How to choose an APM platform without vendor lock-in
Vendor neutral criteria to evaluate an APM platform: coverage, OpenTelemetry support, cost, root cause, access control, data residency and ITSM integration, without getting locked into one tool.
Insights
Technical perspective on how to run, automate and protect technology in regulated organizations.
Observability
Edge observability: branches, ATMs and devices
Branches, ATMs and devices generate telemetry far from the cloud, over links that fail. How to design the local collector, buffer, sampling, time, identity and inventory so you keep visibility.
Observability from the code: a practical OpenTelemetry guide
Structured logs with trace_id, context propagated across services and queues, custom spans and business metrics: how to instrument your code with OpenTelemetry and what to avoid.
From NOC to command center: operating services, not devices
A network-centric NOC sees healthy devices while customers cannot get anything done. A 24×7 command center watches services end to end and takes ownership of them.
Business observability: measuring the banking customer journey
Instrumenting login, transfers, card payments and onboarding as business transactions reveals partial degradation before customers call, without putting personal data in your telemetry.
An observable platform is not an observable application
An APM platform sees infrastructure, dependencies and most calls. It cannot see what your business means. Finding root cause fast requires software written to be observable.
Logs, metrics and traces: what each signal answers
Each telemetry signal answers a different question at a different cost. Understanding what each one provides and how they correlate is what turns scattered data into diagnosis.
AIOps without the hype: the data it needs and the first year
AIOps is not a magic box: it correlates events, reduces noise and detects anomalies when it gets clean data. What data to prepare first and what results to expect quarter by quarter in year one.
Root cause in minutes: a method for distributed systems
A five-step triage method to find the root cause in distributed systems: scope the impact, follow the trace, correlate with changes, check saturation and validate hypotheses.
Alerts without fatigue: SLOs and error budgets in practice
How to define SLIs, SLOs and error budgets, alert on symptoms, and use multiwindow burn rate alerts so you only page people when customers are actually at risk.
Automation
From runbook to playbook: automating auditable procedures
How to turn a manual procedure into an auditable playbook: choose the candidate with clear criteria, translate each step into validated tasks, handle failures and keep human approval where it adds control.
Automated remediation: from event to playbook with Event-Driven Ansible
Event-Driven Ansible connects alerts and webhooks to playbooks. With clear limits it resolves repetitive incidents in minutes; without them, it multiplies errors. How to design rules, guardrails, approvals and ticket closure.
How to measure the value of an automation before building it
Hours saved are only part of the value. A rubric to score effort, risk, customer impact and compliance from 1 to 5 before investing in building.
Ansible in regulated environments: idempotency, inventories and change control
How to use Ansible in regulated organizations so every run is repeatable and traceable: idempotency as evidence, per-environment inventories, secrets kept out of the repository and changes tied to their record.
Ansible at scale: roles, collections, testing and pipelines
When automation grows from a few playbooks to several teams, it needs software discipline: an organized repository, roles and collections, testing with ansible-lint and Molecule, and controlled promotion between environments.
Governing the automation backlog: roles, cadence and metrics
Prioritizing once is not enough. An intake sheet, three clear roles, quarterly re-scoring and four metrics keep the automation backlog in order and accountable.
Real complexity: the factors that sink an automation
Automations rarely fail because of the tool. They fail because of exceptions, access and dependencies nobody measured. A rubric to score complexity and how to redesign what should not be automated yet.
Value × Complexity: how we prioritize what to automate
An automation backlog ordered by whoever pushes hardest wastes capacity. Here is how our Value × Complexity framework works: define, classify and prioritize with two axes and four quadrants.
Agentic AI
Human in the loop: autonomy levels for agents in production
A four-level scale for deciding how much autonomy to give an AI agent in operations, with criteria for moving up a level, least privilege, a kill switch and an audit trail.
Living documentation: agents that keep the CMDB and diagrams current
The CMDB and architecture diagrams start aging the day they are published. How to use agents that detect drift and propose updates for a person to review and approve.
Integration first: agents are only as good as their APIs
An AI agent can only do what its tools allow. What makes an API ready for agents, and how to prioritize which integrations to build first.
Monitoring agents: from fixed thresholds to context-aware detection
Why fixed thresholds fall short, how to use baselines, signal correlation and change context, and how an agent can summarize an anomaly without multiplying false positives.
Governing MCP agents: identity, permissions and logging
MCP standardizes how an agent uses tools, but it does not decide who can use what. How to govern identity, per-tool permissions, consent, logging and the inventory of MCP servers.
Continuous rightsizing: why cloud savings evaporate
Rightsizing resources once saves money for a short while. Why savings decay and how an agent proposes changes backed by evidence, an approval flow and a rollback plan.
Security guardrails for AI agents, layer by layer
Defense in depth for AI agents: guardrails at the input, the model, the tools and the output, with monitoring, against prompt injection, tool misuse and data leakage.
Incident triage with agents: design, controls and traceability
A reference flow for an AI agent that supports incident triage: start read only, log every decision, measure its accuracy against analysts and keep invented causes under control.
AI agents in IT operations: where they work today
What an AI agent is, which operations tasks it adds value to today, where it is still risky, and what you need in place before putting it to work.
Data and AI
AI training by role, not one course for everyone
A single AI course for the whole organization leaves gaps exactly where the risk is. How to design role-based training, with its own content, depth, format and measurement for each profile.
AI-ready data before the first pilot
Before the first AI pilot, put four foundations in place: a catalog, measured quality, lineage and clear permissions. A practical approach for regulated organizations, with a checklist to decide whether you are ready.
Data observability: freshness, volume, schema and lineage
A data pipeline fails silently: the table exists, but it arrives late, incomplete or with a different schema. How to measure freshness, volume, schema, distribution and lineage, and manage them as a service with SLOs.
Cloud
FinOps for AI: the cost of models and agents in production
What makes up the cost of an AI agent, how to measure it per conversation or per resolved ticket, how to allocate it and which levers reduce it without sacrificing quality.
Cloud repatriation: when it pays and when it doesn't
A neutral way to decide whether a workload should move back to your own infrastructure: predictability, dependence on managed services, total cost, latency, sovereignty and execution risk.
Cloud resilience beyond high availability
Deploying across zones is not enough. How to cover regional failures and hidden dependencies, set RTO and RPO per service, choose a recovery pattern and actually test it.
Cloud governance in financial services: responsibilities and minimum controls
What a financial institution delegates and what it keeps under each cloud service model, and the minimum set of controls it should have in place before moving its first workload.
Service management
Modernizing the service desk: requests, knowledge and agents
How to modernize the service desk beyond incidents: a request catalog, knowledge with KCS, self-service, automated fulfillment and AI agents that escalate with context, plus metrics to know whether it works.
Change enablement without bureaucracy: standard change models
A board that reviews everything the same way slows operations without reducing failures. How to use standard, normal and emergency changes, approve by risk and automate so repetitive work is pre-approved.
Problem management: the practice that actually reduces incidents
Restoring service is not enough if the same incident returns every week. How to run reactive and proactive problem management, known errors, root cause techniques and metrics, supported by observability.
PMO and VMO as a service: governing projects and vendors with metrics
What a PMO and a VMO do, when it makes sense to run them as a service, and which metrics, SLAs and governance cadence you need to control your portfolio and your vendors.
SLAs that measure what the business cares about
Green indicators and frustrated users: the watermelon effect. How to tell SLAs, OLAs and SLOs apart, define measures from the user journey and add experience metrics to availability.
The five ITIL 4 practices to start with
ITIL 4 describes 34 practices, but a solid operation starts with five and a service desk. The purpose, minimum viable process, key metric and common mistake of each, plus a suggested sequence.
Operating model
The CIO and AI: from managing technology to orchestrating capabilities
With AI, the CIO's role shifts from managing infrastructure and projects to orchestrating data, platforms, integrations, agents, vendors and talent. Responsibilities, decisions that stay with the CIO, board reporting and metrics.
Platform engineering: internal platforms that let teams operate on their own
An internal platform run as a product, with golden paths and self-service, lightens the load on development teams. Minimum capabilities, the platform team, adoption metrics and common mistakes.
The product operating model: budget, teams and metrics
Moving from temporary projects to products with stable teams changes how IT is funded, how teams are organized and what gets measured. What changes and how it coexists with ITIL and the PMO.
From administrators to SRE: a staged transition
How to move from a systems administration team to an SRE model without breaking operations: measure toil, set SLOs, fix on-call, automate and build new roles.
Cybersecurity and governance
The CISO and AI: new risks, familiar controls
Which generative AI risks are genuinely new and how to place them in the six functions of NIST CSF 2.0, using controls your security program already runs.
DORA and ICT providers: what changes for those operating in Spain
DORA has applied to EU financial entities since January 2025. What they will ask of their IT providers, and how to prepare if you deliver services in Spain.
ISO/IEC 42001 in practice: governing AI before scaling it
ISO/IEC 42001 defines a management system for AI. Why it matters if you deploy agents, how it fits with ISO/IEC 27001 and the NIST AI RMF, and a roadmap to get started.
Organizing cybersecurity: centralized, federated or product-aligned
Three models for organizing the cybersecurity function, with their strengths, risks and when each one fits, what always stays central, and how security champions and NIST CSF 2.0 roles fit in.
NIST CSF 2.0: the Govern function explained for the board
Govern is the main addition in NIST CSF 2.0. What it covers, how to present cyber risk to the board, and how to use profiles and tiers to make decisions.
Burnout in security teams: a manageable operational risk
Burnout in a security team is not just a personal matter: it degrades detection and puts knowledge at risk. Operational causes, workload indicators and controls to manage it.