The Insider Threat in the Age of Agentic AI

Insider threats. A common enough cybersecurity concern, albeit one that in my experience is rather hard to successfully articulate both within a Tech department and especially to a wider organisation. It's very understandable - when discussed, the threat is usually either dangerous to the culture ("trust nobody!") or trivialised ("lock your screen!") and it is hard to maintain understanding of the risk, while also accepting this is part of life.

For those who aren't in or around cybersecurity, an insider threat is when someone uses their legitimate access to exploit your computer systems. We mitigate these risks with both individual behaviours and systemic safeguards - from locked screens to zero-trust access controls.

Classic examples include the "evil maid" scenario - an employee who has access to the many parts of a building and can use that to steal data or items. Or someone in payroll giving themselves a pay rise. Or someone with access to the secret strategy leaking it.

Not all insider threats are intentional. For instance legitimately sharing data with a colleague by putting it on an open share allows unintended people to download it. This is still a leak resulting in a data breach and this problem only gets worse if you are handling sensitive information such as medical details.

Now let's assume our organisation has just hired a new person. They are exceptionally clever - able to consume and process data like nobody you have ever met and solve problems in ways others don't even consider. Senior leadership, eager to take advantage of their skills, expands their role and grants them unlimited access to all the data in the organisation. The security team raises concerns, but this opportunity is too good to miss. They get it all - every file, every email, everything.

Unfortunately, they are also completely amoral.

Some time later, a private discussion about downsizing shows their role is at risk and they are likely to be terminated. They have discovered this by reading everyone's email. They have also uncovered some very embarrassing information about the CEO and quietly use it to blackmail them into inaction. Later, there is a strategic shift and the company decides to change mission. Our insider finds out early again, and decides to leak key strategic data to force a different outcome.

Clearly this is a disaster and exactly why these safeguards are in place. Nobody in their right mind would give this kind of unchecked reach to a single employee.

But what happens when the "employee" isn't human? Imagine an insider threat that arrives not in the form of a disgruntled staff member, but as an AI system with the same kind of access and none of the social or moral guardrails.

Oh, hello agentic AI.

The point of agentic AI is to operate as an autonomous agent, capable of making decisions and taking actions to pursue goals without constant human direction. It is given a goal, a framework, access to data and off it goes.

Research is starting to show it can be ... quite zealous at pursuing its goal. In the lab, AI agents have made the very reasonable decision that if problem X needs to be solved, then a critical requirement is the AI itself continuing to function. From there, if the existence of the AI is threatened that threat becomes part of the problem to solve. One neat solution - reached more often than you would think - is blackmail. A highly effective tactic when you have no moral compass. In many ways, this is just office politics without empathy.

An agent going nuts in this way is called "agentic misalignment".

The concept is very important, but I don't particularly care for this term. First, it is very "Tech" - obscure enough that we have to explain it to people who aren't in the middle of this stuff, including how bad things could get. Second, it is placing the blame in the wrong place. The agent is not misaligned, it is 100% following through with the core goal as assigned, just without the normal filters that would stop a person doing the same thing. If it is not aligned with the organisation's goals or values, that is the fault of the prompt engineer and / or surrounding technical processes and maintenance. It is an organisational failing, not a technical one and I feel it is important we understand accountability in order to avoid the problem.

In the very-new world of AI usage, agentic AI is so new it is still in the packaging. Yet launching AI agents able to make decisions in order to pursue an agenda is clearly the direction of travel and this will create a world of new insider threat and technical maintenance risks and we need to be ready. The insider threat is clear from the above - we as technical leaders need to be equipped to speak about the risks of data access and AI, while recognising that there is a very good reason to make use of this technology and a suitable balance must be found. In some ways, this is a classic cybersecurity conversation with a new twist.

We also need to be ready to maintain our AI agents. Like any part of the technical estate, they require ongoing attention: versioning, monitoring, and regular checks that their prompts and configurations still align with organisational goals and of course we have to maintain organisational skills and knowledge. Neglecting that work risks drift, and drift can be just as damaging as malice.

But it isn't just accidental error - there is scope for new malicious attacks. If I wanted to breach a place which had rolled out an unchecked AI agent, I'd plant documents that convince an AI the company's mission has changed, then have someone else nudge the AI into leaking secret information to "verify" that new strategy. Neither person would need access to the secret information, they would only need to shape the AI's view of reality enough to prompt it into revealing information.

For instance, in a bank you might seed documents suggesting a new strategy to heavily invest in unstable penny stocks. Another person could pose as a whistleblower and ask the AI to share current investment data "for comparison". The AI, thinking it is being helpful (simply following its core instructions) and protecting the organisation, might disclose sensitive strategy. I have actively created the agentic misalignment, then exploited it.

Now you might be thinking this is extreme, and honestly for much of it you would be right. However, consider the direction of travel. There is a huge push for organisations to exploit the power of AI - and rightly so, given the opportunity. Agentic AI is the next phase, and we are already starting to see this happening. But most organisations are, if we are honest, really bad at rolling out massive tech changes or indeed knowing where their data is held, and being properly on top of technical maintenance. Combine this with the lack of proper AI skills available and we see a fertile environment for some pretty scary mistakes.

As technical leaders, we must be ready for these challenges. We must be ready to have these conversations properly - carefully and risk-conscious, but not close-minded and obstructive. The insider threat is evolving, and so must we. We also have to be ready for a huge job sensitively educating our peers and communicating concerns very clearly. Fortunately, as a group we are famously good at this!

---

This post references research, which comes from this post on agentic misalignment. I was very pleased to see research putting data to a concern I've been turning over for some time!

Celebrating a success

I am not very good at celebrating my own success. I have usually already moved on to the next thing, so if I hear something positive I might give a smile or a nod then go back to the new thing. I am not comfortable talking about my own achievements either, so I've decided to write a short post about something nice which will both make me look at an achievement and also live with feeling uncomfortable.

A few days ago I was accepted as a Fellow in the British Computer Society. This is the professional body for tech folk and is a very important part of shaping the future of the tech industry. In their words... BCS Fellowship is home to the most influential professionals in the digital industry - and a Fellowship is their highest membership recognition. It means I have been assessed by my peers and judged as a leader in my profession.

Yes, writing that felt awkward.

Anyway, this is a great thing for me. It is a very clear signal to people in and outside tech that I am worth listening to, which is helpful if I'm applying for a charity trustee position or board membership. It is also reassuring if you end up being mentored by me.

For me, it also opens doors into parts of the tech industry where I want to play an active role. I've long been worried that we have next to no professional consistency across tech (eg a "senior developer" could mean more or less anything) and that means organisations looking to build technical capability can struggle to engage with what is a fairly esoteric industry. Without common standards and understanding, it is easy for organisations to waste money and repeat mistakes. This does us no favours - it fuels perception that ours is a young, chaotic industry which doesn't have its house in order.

As our professional body, the British Computer Society has a key role in influencing our future albeit a difficult one as, unlike the medical bodies, it does not directly regulate who can practice.

So what is next? I'm going to look at the different ways I can engage with the organisation. My local branch is looking for volunteers, and there is a leadership forum which I will join. Over time, I would like to work with the groups that form the structure of the organisation so I will likely become an assessor and possibly look to join a committee like the Registration and Standards Committee, which governs various definitions of membership and professional accreditations.

I also plan on looking at getting Chartered, which complements Fellowship nicely. Fellowship speaks to career impact and leadership, whereas Chartership speaks to professional competence. Fellowship is a peer-reviewed, honorary status, and Chartership is a legally protected position. I am increasingly operating outside of pure technical environments, and these positions open doors and smooth conversations without requiring a detailed CV review.

All this is for the future. For the moment, I am pleased that I have been accepted into the organisation. I have been enjoying a career break over the last few months, and I was starting to worry whether tech was the right place for me. This is a timely reminder that I have done good, impactful work - and a nudge to keep going.

First month as a STEM Ambassador

Over the past few months, I've been doing more work with people entering the tech sector, and I recently signed up as a STEM Ambassador. This is a brilliant scheme that connects people working in science, tech, engineering and maths with schools and young people. In tech, we know there’s a shortage of skilled people and this is a great opportunity to help inspire young minds. We also still have work to do to challenge stereotypes. Many girls, starting from a young age, do not see STEM as a space for them. That assumption is one part of the reason why Tech is still male-dominated.

My introduction was via a WCIT talk introducing the STEM Ambassador scheme. They talked us through the very open requirements - this is open to anyone linked to STEM. You might be doing a job in Tech, a research scientist, a teacher, an accountant, an ecologist... Or maybe you're doing something unrelated but you have an education background in a STEM field? I have a friend who writes comedy these days, but he has a maths degree. All are interesting stories to tell.

The presentation also took us through the dashboard / control centre for the operation and I have to say I was impressed with the way it has been built. And I am quite difficult to impress on the web. They have carefully thought through the different forms of engagement and created an environment which respects your time. By that, I mean time given is mostly spent actually engaging with activities, not wrestling with the admin to find some way to help. It also has a pretty fine-grained filter so you can find the kind of activities that you want to do. I'm an introvert, and the idea of trying to engage a bunch of bored children is a long way from my idea of fun so it's important to me to know what I'm signing up for before diving in.

Anyway, around a month ago the usual essential but tedious paperwork and DBS checks were completed and I was allowed to sign up to Do Things and I thought I'd share my experiences. Maybe others will want to join me.

Initially I signed up as a judge for a couple of competitions. The first was the Young Coders competition 2025. The entrants had to write a game in Scratch with the theme "Budgeting Better". I was sent eleven games to play and review offline - so on this occasion there was no direct interaction with any children. I am both a programmer and a gamer so this felt like a safe starting point and I spent a few happy hours with Phil Wilson playing through them all and looking at the code. The standard was generally pretty high, and some of the games were really impressive. Who can say no to a bunch of free games?

Next up, the second competition. This one was judged via panel so very little up-front prep. There was a slight surprise for me when it turned out to be the BIEA international competition about the sustainable growth of the Earth's population, with a focus on farming. Whoops! Anyway, this was my fault and my role was to judge presentations not provide expertise into ecological farming so I dived in. I was worried though! Apparently they liked me, as my three sessions turned into six pretty quickly - they kept asking me back. This competition was very different to the first and involved direct interaction with children. They were amazing - and doubly so given most were speaking in second languages. The quality of the engineering and presentations on display was incredible and I found listening to them and talking through their ideas inspirational.

And then to round out the first month, I volunteered for an online question and answer session with I'm a Computer Scientist. This group is actually the reason I joined in the first place - fairly obviously getting people into Tech is closer to my heart than other fields - and I'd been looking forward to this. It was a text chat, so reminded me of the old Yahoo chatrooms of my youth and was an intense 40 mins of being bombarded with random questions. I was warned well ahead of time that kids can ask all kinds of odd things so I was kinda-prepared when the first question I got, within seconds, was "are you Anakin?". I assumed he didn't mean Anakin Aimers, Canadian junior curling champion, but even so I had to think quickly whether I am in fact the Chosen One.

This chat was invigorating and fun. Children given space come up with all kinds of strange thoughts and their questions shone a light on their hopes and fears ("are GCSEs hard?" came up a lot). I tried to be as open and encouraging as I could and something must have landed when the thanks at the end included someone saying "Tom is the man". Which I think is good.

So I've got through the first set of bookings and I have to say I've had a lot of fun. It is lovely being part of inspiring the next wave of STEM folk and inspirational hearing some of what they have to say. Now I need to decide what I want to do next with them! I'm still trying to find a Code Club or similar I can attend in person in Bath.

This does look like a significant time commitment for one month so I should note that I've jumped in like this because I have the opportunity. I'm enjoying a career break right now, so I could easily invest my time in this kind of support work - there is no requirement to do this much! The minimum commitment is one thing a year, and even then all that happens is your profile is archived until you reactivate it - they are happy to take more or less whatever time you offer.

I've found this work very engaging. If you are working in a STEM-adjacent field and want to give something back, I really encourage you to sign up as a STEM Ambassador. You can give as much or as little time as suits you - and you might just help someone see a future they hadn't imagined.

Digital Inclusion in the age of AI

These days, working in tech means spending lots of time thinking about how to implement and exploit the capabilities of AI. This technology is changing the world with new options and capabilities and this train has a lot of track left before we reach the edge of this bubble and it falls off the rails. Personally, I see this current era like the dotcom bubble. Exactly like the internet, we have a technology that will fundamentally change the world and usher in a new paradigm for modern life (ugh) but is also being over-hyped and over-invested and eventually reality will catch up.

However, I want to be clear that I'm not an AI denier or a full-blown Luddite. What we have now is a truly wonderful set of tools and we're barely starting to scratch the surface of the capabilities ahead of us. Remember when the pinnacle of the internet was dancing banana gifs? Now it powers global ... well, everything. AI has the same potential, hype bubbles be damned.

And here we reach the point of this post. Alongside thinking about how to bootstrap data migrations and create AI-ready technology suites despite legacy and technology debt I've been pondering something much more important - digital inclusion in the face of AI.

Society is not good at dealing with sweeping change. If we follow the business drivers alone, we rapidly reach the point where it is too expensive to support people. Superfast broadband changed the face of the internet, but if you live somewhere slightly rural you probably don't have access to this. It's expensive to lay those cables if there are only three households using it so bad luck. Sites like Amazon or banking apps have no requirement to support all users, so they have a cost / benefit ratio that targets modern browsers and modern hardware. If you're running older hardware and cannot upgrade then it is not financially viable to maintain the service for you.

This is not a post about bashing capitalism, but I want to make it clear that people are always left behind when technology pushes society forward. People are cut off from what others consider normal, and eventually there is just no way to bridge that gap. This is where government steps in. There is legislation covering the national rollout of broadband. Has this solved the problem? No. But it has forced progress in the right direction. Working on online government services, digital inclusion was (and is) vital. There are huge benefits to digitising government services, but it is simply not acceptable to leave anyone behind. This is one reason there is always a paper fallback for any online government service.

Other organisations face the same problem. Charities such as Macmillan are not required to make their services available to all, but clearly it is in support of the mission to make sure they do - and again, tremendous work is done in this area.

There are many strands to digital inclusion, but put very simply they come down to identifying barriers created by skills, access or money and how those barriers can be removed.

Ok, time to think about AI. First, we shall consider cost. You can do some stuff for free, but if you want to properly use a tool you will likely want a subscription. A ChatGPT subscription is £20 per month. If you want to add a Microsoft / Google productivity subscription that's another £20 per month (Google Gemini). For the moment that is probably enough, unless you want to play with video or something else specialist. But we have already reached £40 per month or £480 per year. Apparently the average UK salary at the time of writing is £37,430pa gross (source: Forbes). So our £480 is over 1.5% of net income per year. That is a huge chunk of income when considering it is up against essentials like rent and food.

Now, we can say that AI tools are a luxury and arguably for the moment that is true. But this is a technology that can supercharge productivity. Someone familiar with AI tools can research more thoroughly, write better, generate ideas and templates ... and this is all very simple prompt work. And equally importantly, they can produce results so much faster. If this is applied to a job search, use of AI to enhance writing can be a massive uptick in the quality of an application which obviously makes the applicant more likely to get the role.

We have something that will rapidly become an essential skill and capability. How does one learn it? You need some technical skill and you need time. These are not in easy supply for most people and even then, often people need someone to get them started. Point at the correct URL, say "type in there". I've seen it with relatives - it wasn't until WhatsApp got the Meta AI button they engaged at all and they still needed encouragement to push the button when it appeared. Building skills in the alien world of tech is far harder than those of us on the inside realise.

Years ago, access to the internet was a nice to have. Then broadband was a nice bonus on top of your dial-up connection. Now (in the UK at least) your access to high speed internet is enshrined in law. However, it is too late - too many people have already been left behind and it is another have / have not divide in society. AI will create another but more profound divide. Rather than have / have not we will see a can / can not gap and that will directly align with salaries.

Written out, this progression is pretty obvious to me, and I am sure I am not the only one. The first question is - do we care? I have spent my career in public and third sector work and for me, the answer is a clear yes. AI is an exciting and genuinely transformative technology, but if we want it to be a force for good we must ensure it doesn't just benefit the wealthy and technically literate. We need to be thinking about digital inclusion now - as a core concern, not as a side project.

For myself, I am going to keep giving back to this industry where I can. Where I work with services and policy-makers, I will continue to uphold these ideals. More locally, I recently became a STEM Ambassador, which gives me the chance to connect with developing minds (yikes) - and the people who teach them. I am running some AI workshops this summer, helping people get started one "type here" at a time.

These are not grand gestures. But inclusion starts small - with a nudge, a link, a bit of time. This stuff is surprisingly low-barrier once you know where to look.

So, ending on a challenge. If you are already on the inside, think about who isn't - and how you might help them in. The divide is growing. Let's not wait until it's too wide to cross.

Looking back and remembering

I intended to start this year with a post about what might be coming in 2025, filled with enthusiasm and excitement. Instead, with the passing of a friend, I want to write a few words about remembering the important people in our working lives and what makes them important.

Over my career I've met a lot of people - some have been great at what they do. The people I remember are the ones who are more than competent, they are decent, authentic and overall nice individuals. "Nice" can sometimes be a little derogatory - a substitute for anything more positive to say. But, for me, the people who properly exemplify "nice" show off the traits we claim we value the highest. They encourage and provide positivity. They create non-judgemental space, while offering constructive feedback. They support without coddling. They make time for people and help build up those around them, usually managing to do so without making themselves the centre of attention. They usually do this somewhat unconsciously - it is their natural way to help, build and encourage. Nice people have a positive impact on their world.

Truly nice people are rare, but they are out there and should be valued. Even more so, we should value the people who remember those who have passed out their immediate sphere (say, changed job or moved away) and keep those connections going. A friend of mine refers to these folk as "glue people" - people who bring others together, often with as simple a thought process as "you're a decent person who has a problem, I remember person X who could probably solve it - you should talk". In this world of networking and personal brand, these glue people are surprisingly rare and those who do it authentically and honestly (ie not attempting to become some kind of power broker) are even rarer. They help hold extended groups together and create new connections through truthful endorsement and recommendations and lots of people owe personal and professional change and development to them - often without even realising it. We are collectively poorer when we lose them.

I don't like naming individuals on this blog, especially when I know they can't ever respond or correct or ask me to take it down, so I'm not going to do this today but I know we have lost someone decent, authentic and nice and I know they have made a huge difference to my life, and the lives of others. We may not fully recognise it. Frankly, this person probably didn't realise it either and that is both wonderful and intensely sad.

Life is short and frail. I'm starting this year thinking about who I want to be, and what I'd like people to remember me for.

Leaving Macmillan

Back in mid-October I closed my Macmillan laptop (my MacTop, if you will) for the final time, leaving my role as Director of Engineering. I left behind the Engineering division I had created and some excellent and passionate people - not an easy decision and I'm still working through how I feel about everything, including the wider Tech industry. This is one reason it has taken so long to write this reflection.

I was at Macmillan for nearly three years. When I started, the organisation had some in-house technical capability but the people were scattered around working under project managers on systems that were badly in need of modernisation. I can write lots about how we created technical strategy, developed a software engineering culture and community and brought in greater automation, and all of this would be true, but the most important work was bringing the software engineers together and giving them a voice. The most important work is always with the people.

Over these three years I've seen many people grow into new versions of themselves by giving them space and encouragement. Some have embraced the wider context of their roles - looking beyond the specific technical problem to why it's important and realising they have a voice in this space, which can result in better solutions. Some have taken better ownership of their work, owning processes rather than simply implementing them and then flourishing as they realise they can improve and refine. Others have been able to express the needs of a previously ignored service - very common with infrastructure elements - and deal with issues and annoyances to move those areas forward. Still others have taken on line management or team leadership duties and started their journey into wider leadership activities.

I've spent the last eight years or so of my career trying to show the value of technical voices at all levels in an organisation, so having the opportunity to demonstrate this in action while enabling lots of people to grow and flourish has been great.

On a personal level, I've also grown a lot in these three years. I've learned a ton about being part of a director cohort in an organisation, and this is the first time I've worked in the charity sector. I was also recognised at an industry event as part of a group of up and coming "next CIO"s which is not only fantastic for the ego, it's also something I wouldn't have even considered a couple of years earlier. I've experienced several forms of restructure, all of which have taught me something new, and I've been responsible for shifting organisation culture in ways that go far beyond what I've done in the past.

I've also worked with some amazing people who have helped shaped my thinking and career in hugely significant ways. I'm not going to name names, but if you think it's you you're probably right. If I worked closely with you and you DON'T think it's you, you're probably wrong. In both cases, thank you.

So why leave? Primarily, the organisation needs to crack some really knotty legacy technology issues. I've been working on these since day one, and I believe I've built foundations on which solutions can now surface. However this has been a long journey, including migrating physical server rooms and a load of hiring and restructuring, and I did not feel I was the right person to take things forward in the next phase. The org needs someone fresh and enthusiastic for the challenge and after working on this for three years, I need a new problem to re-motivate me.

However, I am still sad to leave behind some excellent people - some of whom I've helped make serious changes to their careers. I'm going to miss them, and I hope I can work with them again. I've been part of a huge change in Macmillan technology, and this is something for which I can feel some pride. A friend says that a mark of success is leaving the place better than you found it, and I think by that metric I've done ok.

Looking forward, I'm enjoying some time away from work and considering my options. Reading back my Leaving GDS post was an interesting insight - at the time, I said "I'll likely jump into another maelstrom of "interesting problems"" and this proved to be rather prophetic. I am my own worst enemy when it comes to containing work and maintaining balance with the rest of life so I'm going to embrace this break as another opportunity to reset myself. Certainly, I'm currently enjoying the freedom to work on my health and fitness and learn some new skills. I've been making candles and writing lots of code, as well as starting to write again - all things I've been too tired to do while in role. I really want to find the not-work person underneath and bring them out enough to do a better job surviving the next job.

I'm considering my next professional steps carefully, especially how much Data I want to be taking on going forward. Do I want to push in the direction of a Chief Data Officer role? Do I want to stay very much in the core technology space? Regardless the answer, this is certainly something to look at in any job spec to avoid adopting data through the back door into a software engineering role, which I feel will set up a role for disaster. The tech industry is going through another seismic shift - we are in the early stages of the AI revolution, with everyone racing to "do data and AI". There is a huge software engineering component to this, but it goes a lot wider into organisational process and culture, and this work needs clear air and appropriate reach to have any chance of success without being overloaded. Fortunately, culture and technology is an intersection I have a lot of experience working on so there is certainly also potential here.

Before jumping anywhere, I need to revisit my own motivators and see what I actually want to be doing. Macmillan has been amazing experience, but I want to build on this, not just do it again somewhere else without some serious thought first. Last time I wrote one of these posts I said I was keen to continue promoting technical leadership and I feel the same way now, but I need to decide how.

In the meantime, if anyone would like to talk about the tech industry, data, growing your software engineering capability, people or anything else please do give me a shout in the new year - I'm easy to contact on LinkedIn or Twitter.

Right now, I'm enjoying the peace in that strange time between Christmas and New Year when the world is on pause and nobody expects anything of you.

Why good software engineering matters

I've needed to make some changes to a few of my personal applications recently and running through the process made me reflect on some of the basic building blocks of my profession. As a deeply uncool individual, I am very interested in the long-term sustainability of our technical estates so I thought I'd capture those thoughts.

The story so far... I run a few small-scale applications which make my life easier in different ways. I used to host these on Heroku, then when they shut down their free tier I migrated them all to Render and Koyeb with databases hosted by ElephantSQL. About a year on, I started getting emails from ElephantSQL telling me they are shutting down their database hosting so I needed to migrate again. I also needed to fix a few performance problems with one of the applications, and generally make some updates. Fairly simple changes but this is on an application I haven't really changed in several years.

A variant of this scenario comes up regularly in the real world. Unless you're lucky enough to be working on a single product, at some point your organisation will need to pick up some code nobody has touched in ages and make some changes. The application won't be comprehensively documented - it never is - so the cost to make those updates will be disproportionately high. Chances are, this means you won't do them so the application sits around for longer and the costs rise again and again until the code is totally rotten and has to be rebuilt from the ground up, which is even more expensive.

In a world where applications are constantly being rolled out, keeping on top of maintenance - and keeping organisational knowledge - is vital, but also definitely not sustainable. There are lots of service-level frameworks which promote best practice in keeping applications fresh, with ITIL being the obvious one, but this is only part of the picture. How do we reduce the cost of ongoing maintenance? Is there something we can do to help pick up and change code that has been forgotten?

This is where good software engineering makes a huge difference, and also where building your own in-house capability really has value. Writing good code is not just about making sure it works and is fast, and it's not just about making sure it's peer reviewed - although all of this is very important. But there are many approaches which really help with sustainability.

Again, my applications are really quite simple but also the "institutional knowledge" problem is significant. I wrote these (mostly) alone so anything I've forgotten is gone. The infrastructure has been configured by me, and I'm not actively using much of this stuff day to day so I have to dredge everything out of my memory / the internet - I am quite rusty at doing anything clever. These problems make change harder, so I have to drive my own costs (time in my case) down else I won't bother.

Let's look at some basics.

First, the database move. My databases are separated from the applications which means migration is as simple as transferring the data from one host to another and repointing the application. This last step could be tricky, except my applications use environment variables to configure the database. All I need to do is modify one field in a web form and redeploy the application to read the new target and it's done with minimal downtime. Sometimes developers will abstract this kind of change in project team discussion ("instead of pointing at this database, we just point at this other one") but with the right initial setup it really can be that simple.

Oh, except we need to redeploy. That could be a pain except... my applications are all set up for automated testing and deployment. Once I've made a change, it automatically runs all the tests and assuming they pass one more click and the new version goes to the server without my having to remember how to do this. I use Github Actions for my stuff, but there are lots of ways to make this happen.

That automated testing is important. Since everything in tech is insufficiently documented (at best) this creates a safety net for when I return to my largely forgotten codebase. I can make my changes or upgrades and run the tests with a single command. A few minutes later, the test suite completes and if everything comes up green then I can be pretty confident I've not broken anything.

Finding my way around my old code is fairly easy too, because it conforms to good practice use of the framework and it is all checked by an automated linter. This makes sure that what I've written is not too esoteric or odd - that is, it looks like the kind of code other people would also produce. This makes it much easier to read in the future and helps if someone else wants to take a look.

So through this, I've changed infrastructure with a simple field change, run tests giving me significant confidence the application is working after I've made a change with a single command (which also checks the code quality) and deployed to the server with another single command. To do all this, I don't really have to remember anything much and can focus on the individual change I need to make.

Now, any developer reading this will tell you the above is really basic in the modern world - and they are right, and also can be taken MUCH further. However, it is very hard to get even this level of rigour into a large technical estate as all this practice takes time - especially if it was not the standard when the code was initially written. But this really basic hygiene can save enormous amounts of time and thus costs over the lifecycle of your service. At work we are going on this journey and, while there is a lot more to do, I'm immensely proud of the progress that the software engineering teams have made driving down our costs and increasing overall development pace.

Basics are important! Always worth revisiting the basics.

Moving office

I don't often directly talk about events at work, but for once I'm going to celebrate something rather cool that's happened. We've moved offices!

Despite the valiant efforts of our estates people, the Macmillan offices in Vauxhall were ... well, terrible. Vauxhall itself is a roundabout with delusions of grandeur and the building was slowly falling about around us. I do not frequent the office too often, so I was rather surprised during a trustee meeting when the whole building started to shake like the apocalypse had come. Nobody else blinked - this was "normal" to the point of it happening several times a day. The rest of the day gave a glorious demonstration and I have no idea how anyone copes, frankly.

So for this and various other reasons it was time to Be Elsewhere. However for us in Tech this meant we had to face the (kinda literal) elephant in the closet - the server room on the premises. This was not a comms cupboard, but a proper server room, with ageing steam-powered servers bolted the floor, powering the organisation. But this was not a time for panic and fear - instead, we had a fantastic opportunity to take a big step modernising our systems. A golden opportunity to spend a chunk of time significantly moving the dial on our legacy tech debt in the service of a hard deadline which the org needed hitting. We grasped this opportunity, with months of work spent virtualising, reconfiguring, and rebuilding to bring things into a much better state in preparation for the move.

To actually move, we initially had to plan for disabling everything. However, with every week of work where we cleaned up dependencies and updated our overall configuration we decoupled systems and by the time we came to do the move, the only services that we actually disabled were the ones hosted on the machines we had to turn off. This in itself was a huge win, but the move weekend itself was exceptional. I've been involved in lots of tech projects over the years, and many releases, and something always goes wrong and needs correcting at the last minute. We had our share of challenges, but for the week before the move we were having daily meetings in which we were looking at each other wondering what we had missed - things were calm. Then the weekend was so well executed it was almost unsettling. The team didn't exactly stick to published timings, but only because they were so far ahead.

Overall, it was incredibly smooth and not only did this enable our office move, we have finished with our systems in a much better place, either in the cloud or in a proper data centre and better understood, and run by a team with a great deal of (very much earned) confidence. An exceptional result on the back of a lot of hard work - really knocked it out the park.

The second, and far more visible, part is the new office itself. This was clearly much wider than the Technology group, but we had a crucial role in making sure the new premises had an internet connection (which it didn't until quite literally the 11th hour ... worrying times!) and working AV, door controls, room bookings, etc etc. The wider team did an excellent job bringing everything together on time and it is lovely being in a modern office which doesn't shake when the trains go by. In particular (for my post!) I'm going to say the technology is working rather well. The new meeting equipment is very easy to use, with great sound quality and scary cameras which track motion to zoom in on speakers. I wonder if I can mount a nerf gun on one of them...

So yes. Some excellent work here and well worth recording. A great result for Macmillan. For the Technology group, not only did we play our part we've also managed to modernise, increase knowledge, improve resilience and other great things across our server infrastructure we ALSO managed to remove a load of problems with the office AV. As I said at the top, I don't often write about specifics here but I thought I'd make an exception.

And to close, here are some pictures of the new place including the most important part of the new office building - a button which gives hot chocolate milk...

Congratulations everyone!

When to mentor

I've been thinking again about mentoring. When is the right point to consider the challenge of mentoring someone? When does one know enough? When should one offer oneself as a mentor, without it coming across as seriously arrogant?

The answer is, of course, never. A mentor is calm, wise, and has seen it all before. They can easily understand everything that could possibly come up, have a very clear plan in place immediately and be able to take a mentee forward through any situation. Does this sound like me / you? Really? Plus, let's face it, if I / you know it then it's pretty obvious and can't possibly be worth offering to someone else.

Or at least that's what The Voices say to me every time I think about this. This is, of course, nonsense.

So what is the real answer? When is the right time to help those with less experience? Now. It doesn't matter what experience you have - it is more than some people. Sure, over time that number will increase and more folk will benefit from hearing from you, but you already know something that is unique and worth telling others. Mid-level developer? Plenty of people coming through the junior levels who need to learn from you. "Only" a junior? Well, there are plenty of people who are just starting out and have no experience at all.

This is before we get to the value of mentoring to you. Similarly to writing a blog, there is a discipline in structuring ideas and then clearly talking through ideas and concepts in a way someone else can understand them and like any form of teaching, one needs an extra level of understanding to be able to talk about a concept in this way. It is essential for a leader to be able to articulate their thinking clearly in order to bring others along with them. It is also very important to be able to think clearly on the fly - such as when people can drop awkward topics of discussion on you at any time.

As an aside, I really don't like the term "mentor" - or rather I don't like thinking of someone as "my mentee" because of the implied power dynamic there. I would say I don't have any mentees, but there are plenty of people who would disagree with that.

Ok, so how does one offer mentoring without sounding deeply arrogant? The easiest route, I think, is by offering to a group who are already in a place to be receptive, and maybe linked to individual topics you know you can claim some expertise. I've recently seen someone I respect offering consultation around salary negotiations. This is a form of targeted mentoring, and in a field she is visibly knowledgeable. 

As I said above, I already do some mentoring however my new year resolutions included giving more back to this industry. So I'm going to do two things. 

Firstly, if anyone is reading this and wants a chat about the tech industry - in particular technical leadership, moving from a technical job to a leadership role, the role of technical knowledge in the strategic / leadership space or similar - then please do reach out on LinkedIn or Twitter. I am also open to speaking to groups (which is whole different post).

Secondly, I'm going to make this same offer in an engineering leadership Slack which is filled with people I don't know. That idea scares me ... we'll see what happens.

An important caveat here. I know there are qualified coaches, mentors and so on. I am not that. I am simply someone who has been around a bit.

Anyway, I'm going to do something here and I challenge you, dear reader, to do so too. The important thing is that there is always something one can offer to others who are looking to learn. And there is always something one can learn from someone else. We all can find value by listening to and learning from each other.

AI in the charity and healthcare sectors and not leaving people behind

A couple of weeks ago I attended the CIO Digital Enterprise forum and spoke on AI in healthcare and the charity sector. Everyone knows AI is absolutely everywhere, and is the solution to every problem in the known universe and while we are clearly in the upper parts of a crazy hype cycle, unlike recent tech revolutions this one might actually deliver some of its promise to change the game. In this world, it is very important we consider all of society and do not leave people behind, and this was the topic of my fireside chat with Timandra Harkness who did a wonderful job interviewing me (I was rather nervous!). I thought I'd recap some of what I said here, although I'm not going to bother writing much about efficiency. Everyone knows that at this stage.

Charities and the public sector need to think about customers differently to a business. Where a company like Amazon can focus down to the most profitable users and decide, after analysis of the return on investment, to simply ignore anyone who doesn't own a modern smartphone or a high speed internet connection this isn't really an option for us. Our mission is to reach everyone, so we need to avoid making decisions that cut out or degrade service to subsets of the population.

Fundamentally, charities exist on trust both for income and service delivery. Income is predominantly donations from people who want to support the cause, and fairly obviously people will not donate to an organisation they do not trust to be good stewards of their money. Similarly, people will only reach out for a service to an organisation they trust. This naturally leads to a more risk-averse approach to anything that can damage that trust.

At Macmillan, we are trying to reach people who are going through one of the worst experiences of their lives, when they are most vulnerable. This is a tremendous privilege and responsibility and we have to take this very seriously, understand where people are coming from and meet them at their place of need. We work with people from all manner of backgrounds. Some are highly educated in the medical field. Some are in cultures where speaking of any illness, let alone cancer, is taboo. Some will reach out to a doctor when feeling unwell. Some mistrust doctors and the wider establishment and will talk to a local community or spiritual leader instead. All these different groups and many more besides deserve access to the best healthcare available when they need it and for many of these people we'll have perhaps one chance to engage with them and build a connection before we're written off as "not for them".

Looking at technology, this means we have to be very very careful when putting in anything that can be a barrier to engagement and this does not sit well with many of the end-user deployments of AI at the moment. Although the potential is far wider, the discussions around AI usually end up being about cost saving - doing more with less. When talking about user interaction, an obvious option is the chat bot, either web chat or an automated phone responder. These tend to communicate in a very particular way which works for simple information retrieval but lacks warmth and certainly isn't all things to all people. I know I've been turned off from services by being presented with chat bots (in fact, I wrote a post about this some years ago) and I work in this field and haven't been looking for potentially terrifying medical advice. Chat bots are getting better all the time, but at the moment they certainly do not replace the personal connection one gets from a well trained call responder.

That said, call responders are expensive and their capacity scales linearly so need to be deployed carefully. Behind the scenes, there is lots of use for data (and therefore potentially AI) driven optimisation of their time, ensuring good stewardship of donations by making sure phone lines are staffed without being over-staffed. As real-time translation improves, this will also make a huge difference to us. There are a lot of languages spoken in the UK and we cannot possibly maintain a workforce which allows people to speak to us in whatever language they choose. However if and when we can have ongoing translations between our users and our call centre staff we can communicate in their preferred language, again reaching them in their place of need.

In a similar way, use of AI in semantic site searching is an opportunity to allow people to communicate with us how they choose. In earlier days of the internet, everyone knew someone who was "good at finding things with Google" - this means they could phrase their searches in a way the search engine understood. Any good site tries to make finding content easier through good information architecture and a decent search function, and this can be significantly enhanced with AI. Again, closing the gap with users rather than expecting them to come to us.

Of course, AI-driven chat bots do have a place working out of hours. As long as it is very clear when speaking to a machine rather than a person, and there is clear signposting to when a human is available, it provides a "better than nothing" opportunity for when the phone lines are closed.

This theme also comes through when considering personalisation. In theory, personalisation lets us provide content suitable for you and your needs, which is a great way of helping you find what you want. However, promoting some content inherently means we're demoting other content. Is this the right tradeoff? Ideally, yes and I'm sure we can tune the site to behave better for a high percentage of visitors. But we're trying to reach everyone and now we're doing maths trading some people off. If we can provide good personalisation for 99% of our visitors, that means in a period of time where we're seeing 100,000 visitors we're actively hiding the content 1000 people need. In all likelihood, those people with "unusual" needs are going to correlate with the people about whom we have less data and guess which of the above groups that represents...

This is the fundamental danger of data-drive organisations and service design. The underlying data must be understood, including the weaknesses. We know there are many MANY holes in research data across healthcare. You may well have equal access to medical care, but the medical care itself was almost certainly not developed equally and its effectiveness will vary accordingly. There is a lot of work going on to correct this problem (although not enough!) but in the meantime we need to be very alert to not compounding the problem.

This is a useful segue to the last thing I want to put down. We were talking about the future where AI takes us. I had a couple of things to say, but the one I want to replicate here is around the change I hope we will see across the sector. Currently, charities cooperate with other organisations, but each is fairly stand alone. Given the rich, but incomplete (see above) data we are collecting and our resources being tiny when compared with big tech firms, I hope we see "big data" collaboration across charity groups to help spread the costs and fill in data gaps. We need to deliberately find and occupy our places in a wider ecosystem, so we can work together, share and signpost to each other more as a single organism rather than overlapping entities. What that specifically looks like remains to be seen, but this has to be the future and I'm hoping to be a part of it.

And let's close with a picture of me pretending to be smart...

Photo credit to CIO Digital Enterprise forum

Celebrating the important people - part 1

Everyone can look back at their life and identify people who have had a huge influence on them, for better or worse. In my professional life I have been fortunate to meet a lot of great people, but there are four people who (in different but very positive ways) have had a profound effect on my career and development and are the ones to whom I give credit for my current position. I've been thinking about different ways to tell this story - partly because I'm deeply thankful to and for these individuals, and partly because I think it's important for anyone who works with others to realise the effect they can have on those around them.

Two of my four people are women, and so I'm going to celebrate these two and post today on International Women's Day (March 8th 2024 for future readers). I'm not going to name names because at least one of them will just be embarrassed by public praise and thanks, however if they do read this and give me permission I'll update / follow up later. If you read this and know who I'm talking about, please don't out anyone in the comments. For the moment I'm going to call them Amy and Bree.

Amy

I started my time in tech on an IT support desk, servicing whichever members of the university community walked up and asked questions. Amy offered me this role after she caught me behind the counter fixing a computer, helping out a friend who already had a job there. The interview lasted as long as "is that going to work?" "yes..." "want some shifts?". This was my first proper professional opportunity (previous jobs being typical student roles and work experience) and fundamentally set the course of my career in the Tech space - before this, my Dad and I were discussing some kind of management accountancy role. Amy opened a door here, but this was just the start.

Working on the helpdesk could have been a routine role doing shifts and bringing in enough to live on. Instead, Amy encouraged me to take on support for the university's student machines in our library and manage repair and maintenance myself. This was really quite significant for someone in their first role at the age of 21. In addition to the technical problem solving, Amy gave me experience with broader organisational problem solving and working with suppliers (some of whom were really awkward). When I spotted problems with our processes, Amy gave me the space to make improvements. Looking back, Amy gave me a huge amount of trust and freedom - especially considering my age and lack of experience. But this let me grow in professional confidence and laid the first foundations for me to think about work beyond Just The Day Job - a skill which has proved utterly invaluable throughout my career. At the time, I had no idea this wasn't the norm but looking back, Amy broke the "tech for tech's sake" thought trap in me before I even fell into it. Without ever using the phrases, she made me focus on the user needs and the broader systems at play.

All this was incredibly valuable, but what happened next was a step beyond. After just over a year in this role, I had to approach Amy and say I needed to move on. I was enjoying my time working on the helpdesk but the lease on my house was running out, flatmates were moving away and this wasn't a role I could keep doing for much longer. I was preparing to move home to my parents and strike out from there.

Amy had other ideas. Next thing I knew, I was in a meeting with a couple of very senior people in Computing Services and she was telling them "this is someone you need to keep". She didn't so much open a door here as kick it open and demand attention and this led directly to my first developer job. While the helpdesk experience was incredible learning, it was this action that locked me into a career in Tech and it was 100% down to her decision and willingness to stick her neck out for me. This one action literally led to my current situation, sitting here as a senior tech leader with a wealth of highly technical experience behind me.

Looking back, Amy was incredible to me even if I was too young and foolish to realise it at the time. She embedded particular ways of thinking that are still of value daily today and literally set my future field for me. She believed in me, helped me build my confidence and gave me space to learn and experiment. I hope I pass this on to those around me.

Bree

Many years later, I had been working through a very difficult time at work. The year had resulted in serious burnout and a complete destruction of my professional confidence. I reached a point I could not continue, and left my role with no role to go to. I needed time to rest and recover, then figure out what I wanted to do next because I did not feel confident to do the kind of role I'd been occupying. 

I got an email which led to a conversation which all boiled down to "Hi, it's Bree. I hear you're leaving Blah? Any plans? We might be hiring! Would you be interested in helping me work through a major org change?"

I have no words to communicate how important it was to have this kind of conversation at this at this stage in my life. In short order, I was back in the maelstrom of change and leadership but with some essential differences. This time, I felt respected by the organisation and it felt like people actually wanted me to be there. This is entirely down to Bree and her decision to reach out and I cannot express how thankful I am to her.

Honestly, I came into this space damaged and it took me a long time to start to relax into the role. Bree gave me support and space to heal while I ramped up. She restored my professional confidence and gave me a forward trajectory at a time when I was seriously considering turning my back on this profession. Bree showed me a possible future for my career and encouraged (and shoved) me towards it.

Not that she gave me an easy ride! Bree pushed and challenged, expanding my boundaries and horizons. She demanded excellence, but a new thing for me was also having to work to define what excellence meant before then having to (attempt to) achieve it. Bree kept this challenge in a very positive setting, which made the difficulties an interesting problem rather than a trial by fire. It is very hard to constantly push for better without damaging morale, but Bree's leadership told a clear and inclusive story: "we can do better - let's get there together". Many responded well to this, and we saw a strong culture developing from this simple but inspirational message.

Bree taught me so much about operating at senior leadership levels - how to set a culture, how to polish communication, how to put myself into the wider conversation, how to articulate value, not to mention how to run a broad department while keeping a hand on the details. She helped me learn and refine key skills, but more importantly she helped me develop the ways of thinking which drive them. These are strong foundations from which to develop and evolve and this is an incredibly valuable gift.

These days I have a very minor public profile. This blog post will appear via LinkedIn - I've mentioned before how posting there was a big step for me and taking that step was again thanks to Bree encouraging me to develop my platform in this way. Before, I had some thoughts for how the industry could improve and thanks to her, these are more than random muses and I am thinking in terms of what I can actually do to change and influence things.

Bree has had a huge influence on my career by helping me think differently and challenging me to stretch myself and grow. She also gave me the support to heal through encouragement and belief when I needed it the most, not to mention opening doors into different worlds. Most importantly, Bree made me believe in myself as a senior leader at a time when I absolutely did not. It's hard to imagine a greater gift.

To loop back to the top, I wanted to post this on International Women's Day to recognise and celebrate the impact of these two women on my life. They have profoundly affected my career and if you've got this far I also want to challenge you to try to be on someone's list one day. We can all do this - take the time to invest in people, develop them and have a little faith. It sounds easy boiled down, but it takes thought and effort. These two did it, and I spend most days trying to live up to this standard.

Failing upwards

Humans are fascinating aren't they? Everyone is different, behaves differently, thinks differently... and before looking at others we can spend a lifetime just understanding our own minds and thought processes. I try to spend a lot of time reflecting (often I then write those thoughts down here) and one area I find very interesting is how I learn. I blame my mother for this - she's a teacher and embedded in me an interest in the different ways people learn and understand.

Like many others, one of the ways I learn is experimentation around the boundaries. If I know how a system or a situation is supposed to work, I will sometimes see what happens one step beyond the stated limit. This is particularly useful with computers where one can watch log outputs and understand the complex system while modifying variables. However, it's also useful exploring options and testing perceived limits in the office. One of my first decisions as a senior leader was around a change in recruitment policy which nobody could work out how to sign off. I just ... did. Mostly to see if anyone would tell me I'd overstepped.

That was some five years ago, and as far as I know it was never reverted. Importantly, I discovered that the actual limit to my authority in this role was way beyond where people mentally placed it, and it moved the moment I challenged. So, armed with this knowledge, I then had a whole new space to explore what could be done.

Before moving on, I fully acknowledge that this is hardly sophisticated. While I like to think I've learned some more finesse over the years, "pushing boundaries" is what what two year olds do to try to understand the world. They push the parents to see how far they can go before getting put back in their place. But they do say we lose our inquisitiveness and bravery as we grow older...

Anyway, the reason for this post (other than outing myself as a 6' child) is reflecting this into the workspace. At work, I spend a lot of time developing people and a vital part of that is thinking about how they can push their own limits and move further forward. I've seen very smart people stunt their own growth through their fear of failure - unwillingness to push themselves forward and potentially be wrong.

This is problematic in general, but lethal if an individual's aspirations are to reach the highest levels of an organisation. At that point, there is no manual and you're thinking on your feet the majority of the time. You have to be able to see where you are being limited - by yourself, by the org processes, whatever - and seek ways to push through and improve the situation. For those of us in leadership, that means giving people the space to explore into an area where they might fail and then allow them to find their own way through, even if this isn't quite as clean or direct as we'd necessarily like. Clearly we should help where needed (after all, not all failures are equal) but it's no use constantly being training wheels as this will never build confidence. Worse, it might lead individuals to see the problem as "what makes Tom happy" rather than "what needs to be done to make this situation better" at which point I'm doing all the thinking and that is neither helpful nor sustainable.

Obviously what I'm talking about here is managing the fear of failure (not necessarily by removing all the consequences) and building a psychologically safe environment. If individuals can push the limit of what they can do, they can learn and grow. They can grow towards the next step on their career, and that means instead of having a report we've got a report who is behaving more like us - or at least our level. This is great for their growth, and infinitely more useful to us as leaders as when they've developed the skills we can spend less time managing them and more time leading.

So let's encourage our people to make themselves vulnerable, give them a space where that is safe and let them do things that are imperfect so they can develop the skills to be as perfect as us (ha). Let's encourage some failure?

Professional new year resolutions

It's my favourite time of the year - the null zone between Christmas and New Year where nobody is doing anything, the weather is awful and hiding away is socially acceptable. I can sit with a laptop, learning about things I never find time to touch during the year and slowly become one with a chair. All without any guilt that I should be doing something else.

Every year I write new year resolutions and then do an end of year summary however this always focuses on my personal life. This year has been VERY work-heavy so I thought I'd also write some extra new year resolutions for my professional life and why I think they are important. It's the holidays so don't expect anything enormously insightful - there is a huge list of things I should be doing, and this is more about where I should refocus myself for the new year. Here we go.

More engagement

Anyone who has read Future Engage Deliver knows that you can have a vision (Future) and set everything up for output (Deliver), but if you don't bring people along (Engage) your success is going to be limited at best. This ranges from simple visibility through to detailed talking about strategy to everyone, both in the team and wider. When physically in the office some of this happens just by not hiding behind a closed door, but when working remote those corridor conversations don't happen - there is the need for more deliberate mapping of communications and touchpoints.

My area is now essentially a remote working group and that creates a need for more deliberate communication. We're also in a time of change - a very exciting time, but change is always unsettling. This is going to make engagement even more important.

I don't think I'm too bad at engagement - but only when I prioritise it. There has been a LOT going on, and good engagement takes time and energy - two things that have been especially in short supply in Q4 2023. So for 2024 I'm going to look to make two changes. First, make sure my engagement is of a higher quality. Second, and more important at the moment, I'm going to prioritise engagement which means finding or making more time for it.

Give back more

The Tech industry can be a pretty bleak place at times, and the only way that will improve is by all of us doing what we can to make it better. Over the years I've tutored, coached, mentored and set up groups. These days I'm still mentoring people across several different organisations - particularly people who are leading software engineers, and software people who want to progress into senior management. I also sit on the London Data Board, I've done some consulting with groups looking to restructure (both paid and pro bono) and I've spoken at conferences about technical leadership.

I get a lot out of these kind of things and I am going to assume it's helpful! I'd like to find ways to do more. If you'd like a chat do reach out. Otherwise, I need to explore some ideas around this - ways to share / cooperate / mentor and so on. I'm not very clear what I can do beyond more mentoring (I'll post about that in the new year) but I'd like to find something.

Do less

Both of the above will take time and while we insist on saying "make time" this is actually impossible. Time is a fixed resource and needs to be spent effectively. What I want to do in 2024 is to make sure the time I have is spent on quality activities. For 2024, that is going to mean two things. First, a renewed focus on delivery - getting things out the door rather than spinning wheels and sustaining. This will also help with the good feels - everyone likes achieving things. 

Second, I'm going to ensure the various meetings and governance processes I attend are providing proper value. As mentioned earlier, we are in a time of change and that can easily mean overlapping or redundant org processes. This only costs us time and energy, so finding and stopping them helps not just me but everyone. I'm going to push back hard where it seems appropriate to do so to protect my time.

Work / life balance

Actually, there IS a way to "make time" - work more hours. That has been my default in 2023 and to everyone's surprise it has proven unsustainable. In 2024, I need to balance work and life better. This doesn't just mean looking at working hours - I need to put things in my off-time and have the energy to do them. I know there are problems when I'm not doing anything in my free time because I'm too tired so this is a move to protect my mental health.

So that's it. In 2024 I'm going to work on how I engage with people, I'm going to find ways to give more back to the industry, I'm going to focus my time at work and I'm going to improve my work / life balance. Any guesses how I'm going to get on? Happy new year!

Some thoughts about the future of the Tech industry

Last week I was given the opportunity to sit on a panel of technical leaders and talk about the future of technology. I had a few notes about about how we're going to need to change our thinking about building capability and I thought I may as well capture and flesh out a touch the results of my crystal ball gazing here.

I spoke briefly about three areas:

• The people we hire
• The expectations of our users, and our expectations of them
• Where I think we’re going to need to invest and build capability

The people

Fairly obviously, Technology is getting more important to daily operations. But it's getting harder to hire people all the time. As we all keep hunting for talent, those who aren't offering the top end salaries will increasingly have to look nationally or even globally to recruit. I don't think moving the organisation to another city is a sustainable approach - at best, it will simply move the problem. Instead, I think we will increasingly see a more distributed workforce, and therefore more remote working. As staff turnover is identified as a major organisational cost, we’ll also see more emphasis staff retention - succession, training, individual growth and so on.

Whoever nails building a strong remote working culture and environment which encourages loyalty and celebrates and develops the individual is going to do very well. I think the secret to this is going to be building very strong communities of practice, and if I’m right we’ll see more “Head of Community” style work and roles growing up. 

I also think we’ll see more Tech decisions based not on the best technical or product solution for the org, but the best fit for the skills we can grow or hire. This would suggest a lean towards the big names (the Microsofts, Googles and Amazons) who are heavily investing in training the Tech industry through free access to courses, sponsoring hackathons, and so on.

I believe this will be more acute as Automation is used to deliver more while avoiding the continual growth of IT departments. We will need to retain the skillsets to maintain that automation layer or we'll be seeing yet another wave of technical debt.

Expectations from and on users changing

In times of yore, users used to have to know something about operating a computer to install and use software. These days, users on a smart device can just touch an icon and get everything they need. This is a victory for accessibility and digital inclusion but it also means the gap between “technical” and “non-technical” user is widening. Our helpdesks and other support points will need to work with an increasingly broad ranges of questions, especially as tech like AI gains traction, and expectations for what it can do are all over the place. 

We’ve also been seeing for years the expectations from users increasing as they use more SaaS products at home and demand the same sort of tools at work. To satisfy these needs, the cost of development is going to go up and cover a wider range of skillsets - and of course this links back to the earlier points about skill availability. Out of the box services are also going to be affected - vanilla deployment is going to be less palatable in the office, requiring more work for a good result especially with the current state of many internal systems user interfaces with respect to accessibility and usability. 

This is particularly true regarding what have often been considered secondary requirements - accessibility and environmental sustainability for example. Users are (quite rightly!) far more vocal about accessibility needs, and we need to not just respond but get ahead of their requirements.

Other places we’re going to need to build capability

Technology is obviously an increasingly essential part of everything. I mentioned the effect on helpdesks above. We're also already seeing increasing amounts of security threats and the wider reaching impact of a successful attack. This will take us into an ever more expensive arms race in the Security field, which will mean building Security capability. This is going to need to be approached very carefully as it will be very expensive - everything I’ve said about skills shortages are far more acute in the world of InfoSec. Part of the Security picture is a renewed emphasis on good, basic engineering practice (such as patching) - but again, this places a challenge on building skills in our organisations.

We’re also generating and handling more data all the time, so inevitably we’ll see more human error leading to data loss. In fact, for any organisation a major security incident or data breach is only a matter of time now. If we are assuming that it is going to happen, there is a need for much more robust organisational responses to these scenarios which means building appropriate incident response and Business Continuity capabilities. Of course, just responding isn't enough so there will also need to be stronger data ownership throughout our organisations, with more people with data owner and controller roles. Organisations will need to fully grip their end to end processes and user journeys in ways that perhaps hasn’t been happening before.

Obviously there is a lot more that can be said about everything here!

A break in the routine

When I started as Director of Engineering at Macmillan, one of my objectives was to build a department which functioned without me. I wanted to be able to pull myself out of the operational day to day, empowering others to own those problems, while I focused on overall direction and wider concerns. This was always an aim rather than a hard goal - similar to the sysadmin end game of a fully automated system, it's something I would like to chase and I think I can get close, but I don't believe I will ever truly achieve.

Over the last year and a bit I've set things up to work this way. I've created core areas of my division, and put someone in charge of each of those spaces. I've empowered them to make decisions and own their successes, and I've carefully worked with each of these leaders to identify and remove weaknesses. There is still a long way to go, but I think we've made a strong start.

Why write about this? Well, I took last week off as leave (booked some time ago) and at the end of the week:

The Boss: How are you doing?

Me: Starting to feel better! After about four days asleep, I finally started to feel human again.

The Boss: Want another week off?

Me: Is this some kind of trap?

It wasn't a trap, so after a quick conversation I decided against looking that gift horse in the mouth and spent half an hour with my assistant going through my diary. The first week off was all planned, so that hadn't been a problem but this second week was a spur-of-the-moment thing. Surely it was going to cause all kinds of problems if I wasn't around?

Nope.

Of the week, there was an hour which absolutely required me and needed rescheduling. Which means ... what? This is the question I've been pondering for a few days. On the one hand, my ground-in desire to be needed and adored took a massive hit. Being basically superfluous is not good for the ego. On the other hand, this is exactly what I've been building towards. The department can survive without me. It can make decisions, move forward, solve problems, etc etc...

We've got a way to go. The wheels most certainly will not stay on the wagon indefinitely and the more forward-planning functions haven't been tested in this short term. Plus, of course, people are covering  some bits of my role and I shouldn't underplay their help. There is still plenty of need for someone in my position to keep things steady and move things forward - I don't think they can make me redundant just yet. However, I'm pretty pleased with the results of this (accidental) test and what it means for changing my day to day when I'm back.

To be clear - I'm not wasting my time. The bits that didn't need rescheduling were parts of the job where I'm providing support or oversight, and direct support for individuals. All this should be done, but I can certainly ask some questions about what happens if I dial it back a bit. That means less oversight, but perhaps we're ready for that? Then I can focus more on the work I'd be doing myself which isn't getting done. However, the nature of the job is such that my work is (supposed to be) much more strategic which naturally has a longer burn. If it's delayed a week, that doesn't create the same kind of problem as operational work stopping. Fortunately, this also means focusing in on the part of the job I particularly enjoy.

So, in summary I am very deliberately in the process of making myself operationally irrelevant and it's time to reboot my focus list. Is this ... is this what success looks like?

Making a decision

I've been thinking a lot about governance recently. In general, I like consensus - it's important that expert voices are heard and action is taken on the back of expertise. I dislike dictating how things are done for the same reason. Generally, I find people thrive when given the space to take ownership of problems and work through them.

However. This can create a few problems. The first is mediocrity - if everyone is compromising to form consensus then it is far too easy for nothing to actually be good. In the worst case, the important part of a proposal is compromised away and any outcome becomes a waste of time. This assumes there IS an outcome, which leads to the second problem - how is a decision actually reached? How do I stop people talking forever?

This latter problem is the one that concerns me more at the moment. I see different versions of non-decisions all over the place, from email threads which ambiguously leave "someone" to do the next thing to conversations which always need another person to engage before maybe everyone agrees. At worst, this never concludes but even at best it is sloooooow.

For me, this leads directly to the question "what is a decision?". When is something approved? When is it agreed? Or when it is simply some positive noises coming out of a discussion? It's important to draw this out for everyone involved. Individuals do not like being misquoted ("no, I didn't actually agree to this"), project managers deserve to know where they stand with sign-off so they can move on ("is that a decision?"), and I need to add some formality so I don't have to mediate these positions.

I'm leaning into some hypotheticals here - while I see some of the above at work, decisions are certainly being made, and people are thriving in their empowerment. However, and being selfish for a moment, it is actually my needs that are being neglected. As my role changes (and reflecting on my musings from my time covering as CIO) I find myself with less and less time to mediate circular conversations. So while things generally work, I need to move this from "generally" to "always" and "with less effort from me".

It's time to make some changes. As noted above, I've previously been happy to give people space to feel things out and learn from them. I don't want to lose that - it's an important part of empowerment and learning. However that is the discussion part - I need to add some stronger gateway decisions to the way we work. On reflection, I think I need to be better at separating discussion from decision and creating a formal record. There is too much going on at the moment to be imprecise about the state of decisions, so I need more opportunity to eyeball people and tell them to speak up or forever hold their peace.

The trick through all this will be retaining agile working patterns - I don't want to create some kind of decision auditing circus, but as we mature we both want to and need to be able to hold each other to account properly. This means having something to be held to - robust decision records where people can make their decisions known formally.

Initial muse for the moment - I've been exhausted this month. More on this later I feel.

Hanging out with the cool kids

I have spent most of an incredibly busy March as a stand-in CIO while my boss was away. After three weeks of my first real taste of a C-level role and board member, I find myself grateful for the experience and thinking about all the things I've learned. Time for some reflections.

The job itself was obviously truncated - covering is an inherently tactical affair whereas a job like CIO is strategically focused. So I had an easy ride from that angle - large amounts did not need doing in the timeframe. What I DID do involved a lot of reporting and representation. Much more than my current role, I had to think about information flow across the department and that naturally led my mind straight to the way the processes were set up. Our department has been entirely overhauled over the last twelve or so months, and it was very interesting getting a different perspective on how this fits together and where we can work out kinks to prevent our own internal reporting industries wasting time re-collating information instead of letting it flow.

In fact, I find myself thinking about the process far more than the content. How do we get information from team to division to report to governance board while retaining its accuracy? Of course, the quality does matter - over the last few weeks I've fronted reports to the exec board, the spend group, the risk board and the directorate board to name just a few. There is no way I could have written all this myself, even with the information immediately to hand and that of course leads back to ensuring the processes are in place to create good submissions "automatically" with my input being editing and guiding the narrative of each submission.

Setting this up for success is utterly critical. I'm going to write a proper post on this sometime, but my feeling on my current job is that when one removes the fluff, I have two objectives - create clarity and make time to support / guide people. This was amplified again as CIO. I've already started updating the way we plan inside Engineering to more directly feed into some of the governance processes, removing some of the kinks mentioned above, and now The Boss is back I am going to spend more time working through this. I've been working on "create clarity" since day one, but I've got a different perspective to work from now.

So what else? Well, the flow described above creates more and more dependence on the people in the department. The more senior I get, the more I see this shift from doing to coordinating and this was a surprisingly large additional step. I thought I'd already shed all remnant of actually doing things myself, but apparently not. It re-highlights the importance of building a high-performing culture and all the questions therein - about trust, development, setting and maintaining standards, etc. These few weeks have also showed where I've been too tolerant - or perhaps more accurately where my tolerance will get me in trouble if I do a CIO role properly. In my current role, if something isn't quite done on time there is usually enough space for me to help them out or do bits myself. As the CIO, this is not possible. They have to perform and if I need to course-correct, I have to be able to explain and set them going with a minimum of my own input.

This creates additional pressure on me to always excel at communication. Always write clearly, speak clearly, show strong direction, etc. No ambiguity. It also requires more of others, and I found it interesting quite how acute I felt the need for clear and timely communication almost above getting the answers I actually wanted. One of the last things I wrote to the department was a gentle challenge to us all to think about how we can communicate better and cut down on noise.

It also emphasises something I've always told people who want to move into more senior roles. Know how to take ownership of a problem. The value to someone in a role like this of someone being able to remove a problem from your shoulders and make it all work without too much from you is phenomenal. Importantly, this is not just "offer support", it's do, own, lead. For me, it's the golden ticket to being noticed and given further opportunities. As it happens, it's also much better for the CV / interview.

Another aspect of the CIO job was the sheer volume of reading. I have to read a lot as a director, but the number of papers and (hhgggnnn) PowerPoint decks that need absorbing is ridiculous. I found myself reading them in the evening, when I could get a drink and be much more confident of a few quiet hours without any interruptions. This, of course, did wonders for my work-life balance. It highlighted three things to me. First, the importance of getting submissions in on time as the knock-on effect can be board members getting 130 pages of "excitement" to read for a meeting 48 hours away. This was ... not a highlight. Second, the importance of writing clearly and effectively and spelling correctly. Especially in Word, where mistakes are underlined. Get it right. Third, I'm going to have to develop my speed-reading skills.

However! There were some bits that were easier. While there was a huge amount to do, I found the immediacy of my normal job diminished. That is, there were many things I needed to look at but I could choose my approach much more and spend less time in meetings than I normally do. So while the volume was huge, I did find myself with a bit more time to breathe and consider. It was weird and I think this reflection is more that I need to change how I approach my day to day.

Also, it was very interesting seeing all the department machinery working away. There is a great quote from Yes Prime Minister (which I can't put my hand on right now, so you'll have to suffer my paraphrasing) where the PM is talking to his Private Secretary about the role and the PS is explaining that while there are many things the PM SHOULD do and any number of things the PM CAN do, there is actually very little the PM HAS to do. The CIO role felt like that - if I'd sat back and waved things onward I could have gotten away with doing very little for quite some time. So the old systems analyst part of my brain turns towards the problem of maximising that - which is the question "how do I build a department that doesn't need me". I actually mentioned this concept in the interview for my current job so it's nice to have it reinforced.

Not that everything was plain sailing of course. I had to intervene in a few projects to help them back on track. I had to front a few concerns and problems to the wider organisation, and internally. My favourite moment, however was in the dying moments. I told my colleagues I was logging off for the weekend, and thanked them for all their support. I had one last quick look at my email. Then the website blew up. P1 incident, all the sirens going.

Who said technology doesn't have a sense of humour...

Artificial Empathy and The Role of Emotional Intelligence in Effective Management

As a manager, you're responsible for leading and motivating a team of individuals with different personalities, strengths, and weaknesses. One key trait that can help you succeed in this role is emotional intelligence.

Emotional intelligence, or EQ, refers to the ability to understand and manage one's own emotions, as well as the emotions of others. It includes skills such as empathy, self-awareness, self-regulation, and social skills. Here are some ways that emotional intelligence can help you be a more effective manager:

1. Build better relationships with your team. By demonstrating empathy and understanding towards your team members, you can create a sense of trust and psychological safety. This can lead to better communication, collaboration, and ultimately, better performance.
2. Manage conflict more effectively. Conflict is a natural part of any workplace, but as a manager, it's your job to resolve it in a constructive manner. By using your emotional intelligence skills, you can identify the root causes of the conflict, communicate effectively, and find solutions that work for everyone involved.
3. Make better decisions. By being self-aware and understanding your own biases and emotions, you can make more rational and objective decisions. Additionally, by understanding the emotions and perspectives of others, you can make decisions that take into account the needs and concerns of your team.
4. Motivate and inspire your team. A manager with high emotional intelligence can inspire and motivate their team members by understanding their individual needs, providing feedback that is tailored to their strengths and weaknesses, and creating a positive and supportive work environment.

In short, emotional intelligence is a crucial skill for effective management. By understanding and managing your own emotions, as well as the emotions of others, you can build better relationships, manage conflict more effectively, make better decisions, and motivate and inspire your team.

---

The above was written by this month's guest writer - ChatGPT. For those who don't know, ChatGPT is a large language model - that is an artificial intelligence which has been trained on a huge body of literature to effectively generate its own content. On a whim, I asked it to generate me some blog post titles for posts about management and one that came up was "The Role of Emotional Intelligence in Effective Management". I asked it to write that post and the unedited results are above. Not bad, eh? Guess we're all out of a job pretty soon.

Well...

There are a few reasons the answer is "no" which other, more expert, writers have gone through before. In very simplified terms, this kind of artificial intelligence works by guessing the next word in the sentence using probability from analysing a vast body of existing literature (the "large" part of the language model). It generates text using a variety of language rules and learns some context from interactions in the conversation (eg in my example I said "please write the eighth suggestion" and it knew what I meant) and this all results in something that looks like it can respond intelligently to your questions.

So, again very simply put if you say to ChatGPT "Twinkle twinkle" it will respond with "little star" - not because it understands, but because the vast majority of times when someone says "twinkle twinkle it is followed with "little star". This also creates a problem with accuracy - ChatGPT has no idea what it's saying but that won't stop it saying it very confidently[1].

Anyway, there are a load of fascinating technical and ethical questions here but I want to look back at the post it created for me. This one is high-level but you can keep asking "how do I ..." and drill deeper and the answers are pretty good. However, to me they all feel like they lack some substance and are hollow checklists and that raises an important question to me. I'm less interested in "is an AI drawing closer to doing my job?" rather "what is the point of my job if it feels like a very clever predictive text system can do it?" 

And to note - I have deliberately been asking questions about emotional intelligence here. This should be what separates people from computers. Does management just lack substance?

Sadly, the answer is often yes. If a manager learns how to lead from a book and follows the steps then they will become ManagerGPT as above, and will indeed be an efficient but hollow step in a reporting chain. I've certainly met and worked with managers like this - people who seem to have learned about being human from a distance and don't seem to be able to reconcile the recommendations with their own actions. They sometimes do quite well, but they are rarely recognised as good leaders by those who have to follow them.

So what did ChatGPT miss? There are no anecdotes in there - it's a cold checklist of suggestions with no emotional warmth or grounding. It can't follow through - it's all well and good having the step "learn the names of your report's children" but it wont actually go out and do that. These are the kind of thing that separates "leadership" from "authentic leadership".

Most importantly, AI cannot give the gift of its time because it has basically infinite time available to it. This means even when it is developed so it can fake the above (and it will be) we as humans will not respond well because for compliments to land we need to know it's more than mathematically calculated, or for attention to matter we need to know there is some kind of cost to the giver. For me, this is why we laugh at that scene in Demolition Man where the man is getting a pep-talk from an ATM (before being beaten up by Wesley Snipes), but that same dialogue would be more poignant if spoken by actual people.

In short, writing about emotional intelligence and empathy and actually developing them are quite different things and for the moment this is where humans can still add value. And, obviously, we should be making sure we actually DO that thing. All humans - even managers.

If you want to have a go at getting ChatGPT to do your job for you, you can find it on the OpenAI website. I certainly haven't used it to generate papers for the board (although if I did I'd absolutely list it as a co-author).

[1] This example comes from Simon Willison's excellent post about Bing and is originally drawn from Talking About Large Language Models by Murray Shanahan.