Adopt
- Phishing-resistant authentication for privileged and remote access.
- Regression suites for enterprise AI whenever a model, prompt or knowledge base changes.
- Service dependency and ownership inventories tied to recovery priorities.
- Metrics, logs and traces designed as acceptance criteria rather than incident-time additions.
Pilot
- AI agents with narrowly scoped tools, explicit limits, human confirmation and a tested stop mechanism.
- Compact private models for classification and extraction, measured on the organization’s own documents.
- Platform templates where several teams repeat the same delivery work.
- Passkeys for broader user groups, including recovery and legacy-device scenarios.
Watch
- Post-quantum requirements: build a cryptographic inventory now, but do not replace dependencies blindly.
- Emerging AI profiles for critical infrastructure: separate guidance, contracts and binding law.
Do not scale without conditions
- AI with broad administrative rights and no confirmation for consequential actions.
- A single cloud provider with no data-export and substitution path.
- Centralized logging without classification, retention and access rules.
- Platform migration with a rollback plan that has never been rehearsed.
Use the radar as a decision tool
For every signal, define the problem, accountable owner, measurable benefit and failure consequence. That turns a trend into a bounded hypothesis with clear continue or stop criteria.