Fueling the future of digital transformation

In the rapidly evolving landscape of digital innovation, staying adaptable isn’t just a strategy—it’s a survival skill. “Everybody has a plan until they get punched in the face,” says Luis Niño, digital manager for technology ventures and innovation at Chevron, quoting Mike Tyson.

Drawing from a career that spans IT, HR, and infrastructure operations across the globe, Niño offers a unique perspective on innovation and how organizational microcultures within Chevron shape how digital transformation evolves. 

Centralized functions prioritize efficiency, relying on tools like AI, data analytics, and scalable system architectures. Meanwhile, business units focus on simplicity and effectiveness, deploying robotics and edge computing to meet site-specific needs and ensure safety.

“From a digital transformation standpoint, what I have learned is that you have to tie your technology to what outcomes drive results for both areas, but you have to allow yourself to be flexible, to be nimble, and to understand that change is constant,” he says.

Central to this transformation is the rise of industrial AI. Unlike consumer applications, industrial AI operates in high-stakes environments where the cost of errors can be severe. 

“The wealth of potential information needs to be contextualized, modeled, and governed because of the safety of those underlying processes,” says Niño. “If a machine reacts in ways you don’t expect, people could get hurt, and so there’s an extra level of care that needs to happen and that we need to think about as we deploy these technologies.”

Niño highlights Chevron’s efforts to use AI for predictive maintenance, subsurface analytics, and process automation, noting that “AI sits on top of that foundation of strong data management and robust telecommunications capabilities.” As such, AI is not just a tool but a transformation catalyst redefining how talent is managed, procurement is optimized, and safety is ensured.

Looking ahead, Niño emphasizes the importance of adaptability and collaboration: “Transformation is as much about technology as it is about people.” With initiatives like the Citizen Developer Program and Learn Digital, Chevron is empowering its workforce to bridge the gap between emerging technologies and everyday operations using an iterative mindset. 

Niño is also keeping watch over the convergence of technologies like AI, quantum computing, Internet of Things, and robotics, which hold the potential to transform how we produce and manage energy.

“My job is to keep an eye on those developments,” says Niño, “to make sure that we’re managing these things responsibly and the things that we test and trial and the things that we deploy, that we maintain a strict sense of responsibility to make sure that we keep everyone safe, our employees, our customers, and also our stakeholders from a broader perspective.”

This episode of Business Lab is produced in association with Infosys Cobalt.

Full Transcript 

Megan Tatum: From MIT Technology Review, I’m Megan Tatum and this is Business Lab, the show that helps business leaders make sense of new technologies coming out of the lab and into the marketplace. 

Our topic today is digital transformation, from back office operations to infrastructure in the field like oil rigs, companies continue to look for ways to increase profit, meet sustainability goals, and invest in the latest and greatest technology. 

Two words for you: enabling innovation. 

My guest is Luis Niño, who is the digital manager of technology ventures, and innovation at Chevron. This podcast is produced in association with Infosys Cobalt. 

Welcome, Luis. 

Luis Niño: Thank you, Megan. Thank you for having me. 

Megan: Thank you so much for joining us. Just to set some context, Luis, you’ve had a really diverse career at Chevron, spanning IT, HR, and infrastructure operations. I wonder, how have those different roles shaped your approach to innovation and digital strategy? 

Luis: Thank you for the question. And you’re right, my career has spanned many different areas and geographies in the company. It really feels like I’ve worked for different companies every time I change roles. Like I said, different functions, organizations, locations I’ve had since here in Houston and in Bakersfield, California and in Buenos Aires, Argentina. From an organizational standpoint, I’ve seen central teams international service centers, as you mentioned, field infrastructure and operation organizations in our business units, and I’ve also had corporate function roles. 

And the reason why I mentioned that diversity is that each one of those looks at digital transformation and innovation through its own lens. From the priority to scale and streamline in central organizations to the need to optimize and simplify out in business units and what I like to call the periphery, you really learn about the concept first off of microcultures and how different these organizations can be even within our own walls, but also how those come together in organizations like Chevron. 

Over time, I would highlight two things. In central organizations, whether that’s functions like IT, HR, or our technical center, we have a central technical center, where we continuously look for efficiencies in scaling, for system architectures that allow for economies of scale. As you can imagine, the name of the game is efficiency. We have also looked to improve employee experience. We want to orchestrate ecosystems of large technology vendors that give us an edge and move the massive organization forward. In areas like this, in central areas like this, I would say that it is data analytics, data science, and artificial intelligence that has become the sort of the fundamental tools to achieve those objectives. 

Now, if you allow that pendulum to swing out to the business units and to the periphery, the name of the game is effectiveness and simplicity. The priority for the business units is to find and execute technologies that help us achieve the local objectives and keep our people safe. Especially when we are talking about our manufacturing environments where there’s risk for our folks. In these areas, technologies like robotics, the Internet of Things, and obviously edge computing are currently the enablers of information. 

I wouldn’t want to miss the opportunity to say that both of those, let’s call it, areas of the company, rely on the same foundation and that is a foundation of strong data management, of strong network and telecommunications capabilities because those are the veins through which the data flows and everything relies on data. 

In my experience, this pendulum also drives our technology priorities and our technology strategy. From a digital transformation standpoint, what I have learned is that you have to tie your technology to what outcomes drive results for both areas, but you have to allow yourself to be flexible, to be nimble, and to understand that change is constant. If you are deploying something in the center and you suddenly realize that some business unit already has a solution, you cannot just say, let’s shut it down and go with what I said. You have to adapt, you have to understand behavioral change management and you really have to make sure that change and adjustments are your bread and butter. 

I don’t know if you know this, Megan, but there’s a popular fight happening this weekend with Mike Tyson and he has a saying, and that is everybody has a plan until they get punched in the face. And what he’s trying to say is you have to be adaptable. The plan is good, but you have to make sure that you remain agile. 

Megan: Yeah, absolutely. 

Luis: And then I guess the last lesson really quick is about risk management or maybe risk appetite. Each group has its own risk appetite depending on the lens or where they’re sitting, and this may create some conflict between organizations that want to move really, really fast and have urgency and others that want to take a step back and make sure that we’re doing things right at the balance. I think that at the end, I think that’s a question for leadership to make sure that they have a pulse on our ability to change. 

Megan: Absolutely, and you’ve mentioned a few different elements and technologies I’d love to dig into a bit more detail on. One of which is artificial intelligence because I know Chevron has been exploring AI for several years now. I wonder if you could tell us about some of the AI use cases it’s working on and what frameworks you’ve developed for effective adoption as well. 

Luis: Yeah, absolutely. This is the big one, isn’t it? Everybody’s talking about AI. As you can imagine, the focus in our company is what is now being branded as industrial AI. That’s really a simple term to explain that AI is being applied to industrial and manufacturing settings. And like other AI, and as I mentioned before, the foundation remains data. I want to stress the importance of data here. 

One of the differences however is that in the case of industrial AI, data comes from a variety of sources. Some of them are very critical. Some of them are non-critical. Sources like operating technologies, process control networks, and SCADA, all the way to Internet of Things sensors or industrial Internet of Things sensors, and unstructured data like engineering documentation and IT data. These are massive amounts of information coming from different places and also from different security structures. The complexity of industrial AI is considerably higher than what I would call consumer or productivity AI. 

Megan: Right. 

Luis: The wealth of potential information needs to be contextualized, modeled, and governed because of the safety of those underlying processes. When you’re in an industrial setting, if a machine reacts in ways you don’t expect, people could get hurt, and so there’s an extra level of care that needs to happen and that we need to think about as we deploy these technologies. 

AI sits on top of that foundation and it takes different shapes. It can show up as a copilot like the ones that have been popularized recently, or it can show up as agentic AI, which is something that we’re looking at closely now. And agentic AI is just a term to mean that AI can operate autonomously and can use complex reasoning to solve multistep problems in an industrial setting. 

So with that in mind, going back to your question, we use both kinds of AI for multiple use cases, including predictive maintenance, subsurface analytics, process automation, and workflow optimization, and also end-user productivity. Each one of those use cases obviously needs specific objectives that the business is looking at in each area of the value chain. 

In predictive maintenance, for example, we monitor and we analyze equipment health, we prevent failures, and we allow for preventive maintenance and reduced downtime. The AI helps us understand when machinery needs to be maintained in order to prevent failure instead of just waiting for it to happen. In subsurface analysis, we’re exploring AI to develop better models of hydrocarbon reservoirs. We are exploring AI to forecast geomechanical models and to capture and understand data from fiber optic sensing. Fiber optic sensing is a capability that has proven very valuable to us, and AI is helping us make sense of the wealth of information that comes out of the whole, as we like to say. Of course, we don’t do this alone. We partner with many third-party organizations, with vendors, and with people inside subject matter experts inside of Chevron to move the projects forward. 

There are several other areas beyond industrial AI that we are looking at. AI really is a transformation catalyst, and so areas like finance and law and procurement and HR, we’re also doing testing in those corporate areas. I can tell you that I’ve been part of projects in procurement, in HR. When I was in HR we ran a pretty amazing effort in partnership with a third-party company, and what they do is they seek to transform the way we understand talent, and the way they do that is they are trying to provide data-driven frameworks to make talent decisions. 

And so they redefine talent by framing data in the form of skills, and as they do this, they help de-bias processes that are usually or can be usually prone to unconscious biases and perspectives. It really is fascinating to think of your talent-based skills and to start decoupling them from what we know since the industrial era began, which is people fit in jobs. Now the question is more the other way around. How can jobs adapt to people’s skills? And then in procurement, AI is basically helping us open the aperture to a wider array of vendors in an automated fashion that makes us better partners. It’s more cost-effective. It’s really helpful. 

Before I close here, you did reference frameworks, so the framework of industrial AI versus what I call productivity AI, the understanding of the use cases. All of this sits on top of our responsible AI frameworks. We have set up a central enterprise AI organization and they have really done a great job in developing key areas of responsible AI as well as training and adoption frameworks. This includes how to use AI, how not to use AI, what data we can share with the different GPTs that are available to us. 

We are now members of organizations like the Responsible AI Institute. This is an organization that fosters the safe use of AI and trustworthy AI. But our own responsible AI framework, it involves four pillars. The first one is the principles, and this is how we make sure we continue to stay aligned with the values that drive this company, which we call The Chevron Way. It includes assessment, making sure that we evaluate these solutions in proportion to impact and risk. As I mentioned, when you’re talking about industrial processes, people’s lives are at stake. And so we take a very close look at what we are putting out there and how we ensure that it keeps our people safe. It includes education, I mentioned training our people to augment their capabilities and reinforcing responsible principles, and the last of the four is governance oversight and accountability through control structures that we are putting in place. 

Megan: Fantastic. Thank you so much for those really fascinating specific examples as well. It’s great to hear about. And digital transformation, which you did touch on briefly, has become critical of course to enable business growth and innovation. I wonder what has Chevron’s digital transformation looked like and how has the shift affected overall operations and the way employees engage with technology as well? 

Luis: Yeah, yeah. That’s a really good question. The term digital transformation is interpreted in many different ways. For me, it really is about leveraging technology to drive business results and to drive business transformation. We usually tend to specify emerging technology as the catalyst for transformation. I think that is okay, but I also think that there are ways that you can drive digital transformation with technology that’s not necessarily emerging but is being optimized, and so under this umbrella, we include everything from our Citizen Developer Program to complex industry partnerships that help us maximize the value of data. 

The Citizen Developer Program has been very successful in helping bridge the gap between our technical software engineer and software development practices and people who are out there doing the work, getting familiar, and demystifying the way to build solutions. 

I do believe that transformation is as much about technology as it is about people. And so to go back to the responsible AI framework, we are actively training and upskilling the workforce. We created a program called Learn Digital that helps employees embrace the technologies. I mentioned the concept of demystifying. It’s really important that people don’t fall into the trap of getting scared by the potential of the technology or the fact that it is new and we help them and we give them the tools to bridge the change management gap so they can get to use them and get the most out of them. 

At a high level, our transformation has followed the cyclical nature that pretty much any transformation does. We have identified the data foundations that we need to have. We have understood the impact of the processes that we are trying to digitize. We organize that information, then we streamline and automate processes, we learn, and now machines learn and then we do it all over again. And so this cyclical mindset, this iterative mindset has really taken hold in our culture and it has made us a little bit better at accepting the technologies that are driving the change. 

Megan: And to look at one of those technologies in a bit more detail, cloud computing has revolutionized infrastructure across industries. But there’s also a pendulum ship now toward hybrid and edge computing models. How is Chevron balancing cloud, hybrid, and edge strategies for optimal performance as well? 

Luis: Yeah, that’s a great question and I think you could argue that was the genesis of the digital transformation effort. It’s been a journey for us and it’s a journey that I think we’re not the only ones that may have started it as a cost savings and storage play, but then we got to this ever-increasing need for multiple things like scaling compute power to support large language models and maximize how we run complex models. There’s an increasing need to store vast amounts of data for training and inference models while we improve data management and, while we predict future needs. 

There’s a need for the opportunity to eliminate hardware constraints. One of the promises of cloud was that you would be able to ramp up and down depending on your compute needs as projects demanded. And that hasn’t stopped, that has only increased. And then there’s a need to be able to do this at a global level. For a company like ours that is distributed across the globe, we want to do this everywhere while actively managing those resources without the weight of the infrastructure that we used to carry on our books. Cloud has really helped us change the way we think about the digital assets that we have. 

It’s important also that it has created this symbiotic need to grow between AI and the cloud. So you don’t have the AI without the cloud, but now you don’t have the cloud without AI. In reality, we work on balancing the benefits of cloud and hybrid and edge computing, and we keep operational efficiency as our North Star. We have key partnerships in cloud, that’s something that I want to make sure I talk about. Microsoft is probably the most strategic of our partnerships because they’ve helped us set our foundation for cloud. But we also think of the convenience of hybrid through the lens of leveraging a convenient, scalable public cloud and a very secure private cloud that helps us meet our operational and safety needs. 

Edge computing fills the gap or the need for low latency and real-time data processing, which are critical constraints for decision-making in most of the locations where we operate. You can think of an offshore rig, a refinery, an oil rig out in the field, and maybe even not-so-remote areas like here in our corporate offices. Putting that compute power close to the data source is critical. So we work and we partner with vendors to enable lighter compute that we can set at the edge and, I mentioned the foundation earlier, faster communication protocols at the edge that also solve the need for speed. 

But it is important to remember that you don’t want to think about edge computing and cloud as separate things. Cloud supports edge by providing centralized management by providing advanced analytics among others. You can train models in the cloud and then deploy them to edge devices, keeping real-time priorities in mind. I would say that edge computing also supports our cybersecurity strategy because it allows us to control and secure sensitive environments and information while we embed machine learning and AI capabilities out there. 

So I have mentioned use cases like predictive maintenance and safety, those are good examples of areas where we want to make sure our cybersecurity strategy is front and center. When I was talking about my experience I talked about the center and the edge. Our strategy to balance that pendulum relies on flexibility and on effective asset management. And so making sure that our cloud reflects those strategic realities gives us a good footing to achieve our corporate objectives. 

Megan: As you say, safety is a top priority. How do technologies like the Internet of Things and AI help enhance safety protocols specifically too, especially in the context of emissions tracking and leak detection? 

Luis: Yeah, thank you for the question. Safety is the most important thing that we think and talk about here at Chevron. There is nothing more important than ensuring that our people are safe and healthy, so I would break safety down into two. Before I jump to emissions tracking and leak detection, I just want to make a quick point on personal safety and how we leverage IoT and AI to that end. 

We use sensing capabilities that help us keep workers out of harm’s way, and so things like computer vision to identify and alert people who are coming into safety areas. We also use computer vision, for example, to identify PPE requirements—personal protective equipment requirements—and so if there are areas that require a certain type of clothing, a certain type of identification, or a hard hat, we are using technologies that can help us make sure people have that before they go into a particular area. 

We’re also using wearables. Wearables help us in one of the use cases is they help us track exhaustion and dehydration in locations where that creates inherent risk, and so locations that are very hot, whether it’s because of the weather or because they are enclosed, we can use wearables that tell us how fast the person’s getting dehydrated, what are the levels of liquid or sodium that they need to make sure that they’re safe or if they need to take a break. We have those capabilities now. 

Going back to emissions tracking and leak detection, I think it’s actually the combination of IoT and AI that can transform how we prevent and react to those. In this case, we also deploy sensing capabilities. We use things like computer vision, like infrared capabilities, and we use others that deliver data to the AI models, which then alert and enable rapid response. 

The way I would explain how we use IoT and AI for safety, whether it’s personnel safety or emissions tracking and leak detection, is to think about sensors as the extension of human ability to sense. In some cases, you could argue it’s super abilities. And so if you think of sight normally you would’ve had supervisors or people out there that would be looking at the field and identifying issues. Well, now we can use computer vision with traditional RGB vision, we can use them with infrared, we can use multi-angle to identify patterns, and have AI tell us what’s going on. 

If you keep thinking about the human senses, that’s sight, but you can also use sound through ultrasonic sensors or microphone sensors. You can use touch through vibration recognition and heat recognition. And even more recently, this is something that we are testing more recently, you can use smell. There are companies that are starting to digitize smell. Pretty exciting, also a little bit crazy. But it is happening. And so these are all tools that any human would use to identify risk. Well, so now we can do it as an extension of our human abilities to do so. This way we can react much faster and better to the anomalies. 

A specific example with methane. We have a simple goal with methane, we want to keep methane in the pipe. Once it’s out, it’s really hard or almost impossible to take it back. Over the last six to seven years, we have reduced our methane intensity by over 60% and we’re leveraging technology to achieve that. We have deployed a methane detection program. We have trialed over 10 to 15 advanced methane detection technologies. 

A technology that I have been looking at recently is called Aquanta Vision. This is a company supported by an incubator program we have called Chevron Studio. We did this in partnership with the National Renewable Energy Laboratory, and what they do is they leverage optical gas imaging to detect methane effectively and to allow us to prevent it from escaping the pipe. So that’s just an example of the technologies that we’re leveraging in this space. 

Megan: Wow, that’s fascinating stuff. And on emissions as well, Chevron has made significant investments in new energy technologies like hydrogen, carbon capture, and renewables. How do these technologies fit into Chevron’s broader goal of reducing its carbon footprint? 

Luis: This is obviously a fascinating space for us, one that is ever-changing. It is honestly not my area of expertise. But what I can say is we truly believe we can achieve high returns and lower carbon, and that’s something that we communicate broadly. A few years ago, I believe it was 2021, we established our Chevron New Energies company and they actively explore lower carbon alternatives including hydrogen, renewables, and carbon capture offsets. 

My area, the digital area, and the convergence between digital technologies and the technical sciences will enable the techno-commercial viability of those business lines. Thinking about carbon capture, is something that we’ve done for a long time. We have decades of experience in carbon capture technologies across the world. 

One of our larger projects, the Gorgon Project in Australia, I think they’ve captured something between 5 and 10 million tons of CO2 emissions in the past few years, and so we have good expertise in that space. But we also actively partner in carbon capture. We have joined hubs of carbon capture here in Houston, for example, where we investing in companies like there’s a company called Carbon Clean, a company called Carbon Engineering, and one called Svante. I’m familiar with these names because the corporate VC team is close to me. These companies provide technologies for direct air capture. They provide solutions for hard-to-abate industries. And so we want to keep an eye on these emerging capabilities and make use of them to continuously lower our carbon footprint. 

There are two areas here that I would like to talk about. Hydrogen first. This is another area that we’re familiar with. Our plan is to build on our existing assets and capabilities to deliver a large-scale hydrogen business. Since 2005, I think we’ve been doing retail hydrogen, and we also have several partnerships there. In renewables, we are creating a range of fuels for different transportation types. We use diesel, bio-based diesel, we use renewable natural gas, we use sustainable aviation fuel. Yeah, so these are all areas of importance to us. They’re emerging business lines that are young in comparison to the rest of our company. We’ve been a company for 140 years plus, and this started in 2021, so you can imagine how steep that learning curve is. 

I mentioned how we leverage our corporate venture capital team to learn and to keep an eye out on what are these emerging trends and technologies that we want to learn about. They leverage two things. They leverage a core fund, which is focused on areas that can seek innovation for our core business for the title. And we have a separate future energy fund that explores areas that are emerging. Not only do they invest in places like hydrogen, carbon capture, and renewables, but they also may invest in other areas like wind and geothermal and nuclear capability. So we constantly keep our eyes open for these emerging technologies. 

Megan: I see. And I wonder if you could share a bit more actually about Chevron’s role in driving sustainable business innovation. I’m thinking of initiatives like converting used cooking oil into biodiesel, for example. I wonder how those contribute to that overall goal of creating a circular economy. 

Luis: Yeah, this is fascinating and I was so happy to learn a little bit more about this year when I had the chance to visit our offices in Iowa. I’ll get into that in a second. But happy to talk about this, again with the caveat that it’s not my area of expertise. 

Megan: Of course. 

Luis: In the case of biodiesel, we acquired a company called REG in 2022. They were one of the founders of the renewable fuels industry, and they honestly do incredible work to create energy through a process, I forget the name of the process to be honest. But at the most basic level what they do is they prepare feedstocks that come from different types of biomass, you mentioned cooking oils, there’s also soybeans, there’s animal fats. And through various chemical reactions, what they do is convert components of the feedstock into biodiesel and glycerin. After that process, what they do is they separate un-reactive methanol, which is recovered and recycled into the process, and the biodiesel goes through a final processing to make sure that it meets the standards necessary to be commercialized. 

What REG has done is it has boosted our knowledge as a broader organization on how to do this better. They continuously look for bio-feedstocks that can help us deliver new types of energy. I had mentioned bio-based diesel. One of the areas that we’re very focused on right now is sustainable aviation fuel. I find that fascinating. The reason why this is working and the reason why this is exciting is because they brought this great expertise and capability into Chevron. And in turn, as a larger organization, we’re able to leverage our manufacturing and distribution capabilities to continue to provide that value to our customers. 

I mentioned that I learned a little bit more about this this year. I was lucky earlier in the year I was able to visit our REG offices in Ames, Iowa. That’s where they’re located. And I will tell you that the passion and commitment that those people have for the work that they do was incredibly energizing. These are folks who have helped us believe, really, that our promise of lower carbon is attainable. 

Megan: Wow. Sounds like there’s some fascinating work going on. Which brings me to my final question. Which is sort of looking ahead, what emerging technologies are you most excited about and how do you see them impacting both Chevron’s core business and the energy sector as a whole as well? 

Luis: Yeah, that’s a great question. I have no doubt that the energy business is changing and will continue to change only faster, both our core business as well as the future energy, or the way it’s going to look in the future. Honestly, in my line of work, I come across exciting technology every day. The obvious answers are AI and industrial AI. These are things that are already changing the way we live without a doubt. You can see it in people’s productivity. You can see it in how we optimize and transform workflows. AI is changing everything. I am actually very, very interested in IoT, in the Internet of Things, and robotics, the ability to protect humans in high-risk environments, like I mentioned, is critical to us, the opportunity to prevent high-risk events and predict when they’re likely to happen. 

This is pretty massive, both for our productivity objectives as well as for our lower carbon objectives. If we can predict when we are at risk of particular events, we could avoid them altogether. As I mentioned before, this ubiquitous ability to sense our surroundings is a capability that our industry and I’m going to say humankind, is only beginning to explore. 

There’s another area that I didn’t talk too much about, which I think is coming, and that is quantum computing. Quantum computing promises to change the way we think of compute power and it will unlock our ability to simulate chemistry, to simulate molecular dynamics in ways we have not been able to do before. We’re working really hard in this space. When I say molecular dynamics, think of the way that we produce energy today. It is all about the molecule and understanding the interactions between hydrocarbon molecules and the environment. The ability to do that in multi-variable systems is something that quantum, we believe, can provide an edge on, and so we’re working really hard in this space. 

Yeah, there are so many, and having talked about all of them, AI, IoT, robotics, quantum, the most interesting thing to me is the convergence of all of them. If you think about the opportunity to leverage robotics, but also do it as the machines continue to control limited processes and understand what it is they need to do in a preventive and predictive way, this is such an incredible potential to transform our lives, to make an impact in the world for the better. We see that potential. 

My job is to keep an eye on those developments, to make sure that we’re managing these things responsibly and the things that we test and trial and the things that we deploy, that we maintain a strict sense of responsibility to make sure that we keep everyone safe, our employees, our customers, and also our stakeholders from a broader perspective. 

Megan: Absolutely. Such an important point to finish on. And unfortunately, that is all the time we have for today, but what a fascinating conversation. Thank you so much for joining us on the Business Lab, Luis. 

Luis: Great to talk to you. 

Megan:  Thank you so much. That was Luis Niño, who is the digital manager of technology ventures and innovation at Chevron, who I spoke with today from Brighton, England. 

That’s it for this episode of Business Lab. I’m Megan Tatum, I’m your host and a contributing editor at Insights, the custom publishing division of MIT Technology Review. We were founded in 1899 at the Massachusetts Institute of Technology, and you can find us in print on the web and at events each year around the world. For more information about us and the show, please check out our website at technologyreview.com. 

This show is available wherever you get your podcasts, and if you enjoyed this episode, we really hope you’ll take a moment to rate and review us. Business Lab is a production of MIT Technology Review, and this episode was produced by Giro Studios. Thank you so much for listening. 

Why materials science is key to unlocking the next frontier of AI development

The Intel 4004, the first commercial microprocessor, was released in 1971. With 2,300 transistors packed into 12mm2, it heralded a revolution in computing. A little over 50 years later, Apple’s M2 Ultra contains 134 billion transistors.

The scale of progress is difficult to comprehend, but the evolution of semiconductors, driven for decades by Moore’s Law, has paved a path from the emergence of personal computing and the internet to today’s AI revolution.

But this pace of innovation is not guaranteed, and the next frontier of technological advances—from the future of AI to new computing paradigms—will only happen if we think differently.

Atomic challenges

The modern microchip stretches both the limits of physics and credulity. Such is the atomic precision, that a few atoms can decide the function of an entire chip. This marvel of engineering is the result of over 50 years of exponential scaling creating faster, smaller transistors.

But we are reaching the physical limits of how small we can go, costs are increasing exponentially with complexity, and efficient power consumption is becoming increasingly difficult. In parallel, AI is demanding ever-more computing power. Data from Epoch AI indicates the amount of computing needed to develop AI is quickly outstripping Moore’s Law, doubling every six months in the “deep learning era” since 2010.

These interlinked trends present challenges not just for the industry, but society as a whole. Without new semiconductor innovation, today’s AI models and research will be starved of computational resources and struggle to scale and evolve. Key sectors like AI, autonomous vehicles, and advanced robotics will hit bottlenecks, and energy use from high-performance computing and AI will continue to soar.

Materials intelligence

At this inflection point, a complex, global ecosystem—from foundries and designers to highly specialized equipment manufacturers and materials solutions providers like Merck—is working together more closely than ever before to find the answers. All have a role to play, and the role of materials extends far, far beyond the silicon that makes up the wafer.

Instead, materials intelligence is present in almost every stage of the chip production process—whether in chemical reactions to carve circuits at molecular scale (etching) or adding incredibly thin layers to a wafer (deposition) with atomic precision: a human hair is 25,000 times thicker than layers in leading edge nodes.

Yes, materials provide a chip’s physical foundation and the substance of more powerful and compact components. But they are also integral to the advanced fabrication methods and novel chip designs that underpin the industry’s rapid progress in recent decades.

For this reason, materials science is taking on a heightened importance as we grapple with the limits of miniaturization. Advanced materials are needed more than ever for the industry to unlock the new designs and technologies capable of increasing chip efficiency, speed, and power. We are seeing novel chip architectures that embrace the third dimension and stack layers to optimize surface area usage while lowering energy consumption. The industry is harnessing advanced packaging techniques, where separate “chiplets” are fused with varying functions into a more efficient, powerful single chip. This is called heterogeneous integration.

Materials are also allowing the industry to look beyond traditional compositions. Photonic chips, for example, harness light rather than electricity to transmit data. In all cases, our partners rely on us to discover materials never previously used in chips and guide their use at the atomic level. This, in turn, is fostering the necessary conditions for AI to flourish in the immediate future.

New frontiers

The next big leap will involve thinking differently. The future of technological progress will be defined by our ability to look beyond traditional computing.

Answers to mounting concerns over energy efficiency, costs, and scalability will be found in ambitious new approaches inspired by biological processes or grounded in the principles of quantum mechanics.

While still in its infancy, quantum computing promises processing power and efficiencies well beyond the capabilities of classical computers. Even if practical, scalable quantum systems remain a long way off, their development is dependent on the discovery and application of state-of-the-art materials.

Similarly, emerging paradigms like neuromorphic computing, modelled on the human brain with architectures mimicking our own neural networks, could provide the firepower and energy-efficiency to unlock the next phase of AI development. Composed of a deeply complex web of artificial synapses and neurons, these chips would avoid traditional scalability roadblocks and the limitations of today’s Von Neumann computers that separate memory and processing.

Our biology consists of super complex, intertwined systems that have evolved by natural selection, but it can be inefficient; the human brain is capable of extraordinary feats of computational power, but it also requires sleep and careful upkeep. The most exciting step will be using advanced compute—AI and quantum—to finally understand and design systems inspired by biology. This combination will drive the power and ubiquity of next-generation computing and associated advances to human well-being.

Until then, the insatiable demand for more computing power to drive AI’s development poses difficult questions for an industry grappling with the fading of Moore’s Law and the constraints of physics. The race is on to produce more powerful, more efficient, and faster chips to progress AI’s transformative potential in every area of our lives.

Materials are playing a hidden, but increasingly crucial role in keeping pace, producing next-generation semiconductors and enabling the new computing paradigms that will deliver tomorrow’s technology.

But materials science’s most important role is yet to come. Its true potential will be to take us—and AI—beyond silicon into new frontiers and the realms of science fiction by harnessing the building blocks of biology.

This content was produced by EMD Electronics. It was not written by MIT Technology Review’s editorial staff.

Accelerating generative AI deployment with microservices

In this exclusive webcast, we delve into the transformative potential of portable microservices for the deployment of generative AI models. We explore how startups and large organizations are leveraging this technology to streamline generative AI deployment, enhance customer service, and drive innovation across domains, including chatbots, document analysis, and video generation.

Our discussion focuses on overcoming key challenges such as deployment complexity, security, and cost management. We also discuss how microservices can help executives realize business value with generative AI while maintaining control over data and intellectual property.

Cloud transformation clears businesses for digital takeoff

In an age where customer experience can make or break a business, Cathay Pacific is embracing cloud transformation to enhance service delivery and revolutionize operations from the inside out. It’s not just technology companies that are facing pressure to deliver better customer service, do more with data, and improve agility. An almost 80-year-old airline, Cathay Pacific embarked on its digital transformation journey in 2014, spurred by a critical IT disruption that became the catalyst for revamping their technology.

By embracing the cloud, the airline has not only streamlined operations but also paved the way for innovative solutions like DevSecOps and AI integration. This shift has enabled Cathay to deliver faster, more reliable services to both passengers and staff, while maintaining a robust security framework in an increasingly digital world. 

According to Rajeev Nair, general manager of IT infrastructure and security at Cathay Pacific, becoming a digital-first airline was met with early resistance from both business and technical teams. The early stages required a lot of heavy lifting as they shifted legacy apps first from their server room to a dedicated data center and then to the cloud. From there began the process of modernization that Cathay Pacific, now in its final stages of this transformation, continues to fine tune.

The cloud migration also helped Cathay align with their ESG goals. “Two years ago, if you asked me what IT could do for sustainability, we would’ve been clueless,” says Nair. However, through cloud-first strategies and green IT practices, the airline has made notable strides in reducing its carbon footprint. Currently, the business is in the process of moving to a smaller data center, reducing physical infrastructure and its carbon emissions significantly by 2025.

The broader benefits of this cloud transformation for Cathay Pacific go beyond sustainability. Agility, time-to-market, and operational efficiency have improved drastically. “If you ask many of the enterprises, they would probably say that shifting to the cloud is all about cost-saving,” says Nair. “But for me, those are secondary aspects and the key is about how to enable the business to be more agile and nimble so that the business capability could be delivered much faster by IT and the technology team.”

By 2025, Cathay Pacific aims to have 100% of their business applications running on the cloud, significantly enhancing their agility, customer service, and cost efficiency, says Nair.

As Cathay Pacific continues its digital evolution, Nair remains focused on future-proofing the airline through emerging technologies. Looking ahead, he is particularly excited about the potential of AI, generative AI, and virtual reality to further enhance both customer experience and internal operations. From more immersive VR-based training for cabin crew to enabling passengers to preview in-flight products before boarding, these innovations are set to redefine how the airline engages with its customers and staff. 

“We have been exploring that for quite some time, but we believe that it will continue to be a mainstream technology that can change the way we serve the customer,” says Nair.

This episode of Business Lab is produced in association with Infosys Cobalt.

Full Transcript 

Megan Tatum: From MIT Technology Review, I’m Megan Tatum, and this is Business Lab, the show that helps business leaders make sense of new technologies coming out of the lab and into the marketplace. 

Our topic today is cloud transformation to meet business goals and customer needs. It’s not just tech companies that have to stay one step ahead. Airlines too are under pressure to deliver better customer service, do more with data, and improve agility. 

Two words for you: going further. 

My guest is Rajeev Nair, who is the general manager of IT infrastructure and security at Cathay Pacific. This podcast is produced in association with Infosys Cobalt. Welcome, Rajeev. 

Rajeev Nair: Thank you. Thank you, Megan. Thank you for having me. 

Megan: Thank you ever so much for joining us. Now to get some context for our conversation today, could you first describe how Cathay Pacific’s digital transformation journey began, and explain, I guess, what stage of this transformation this almost 80-year-old airline is currently in, too? 

Rajeev: Sure, definitely Megan. So for Cathay, we started this transformation journey probably a decade back, way back in 2014. It all started with facing some major service disruption within Cathay IT where it had a massive impact on the business operation. That prompted us to trigger and initiate this transformation journey. So the first thing is we started looking at many of our legacy applications. Back in those days we still had mainframe systems that provided so many of our critical services. We started looking at migrating those legacy apps first, moving them outside of that legacy software and moving them into a proper data center. Back in those days, our data center used to be our corporate headquarters. We didn’t have a dedicated data center and it used to be in a server room. So those were the initial stages of our transformation journey, just a basic building block. So we started moving into a proper data center so that resilience and availability could be improved. 

And as a second phase, we started looking at the cloud. Those days, cloud was just about to kick off in this part of the world. We started looking at migrating to the cloud and it has been a huge challenge or resistance even from the business as well as from the technology team. Once we started moving, shifting apps to the cloud, we had multiple transformation programs to do that modernization activities. Once that is done, then the third phase of the journey is more about your network. Once your applications are moved to the cloud, your network design needs to be completely changed. Then we started looking at how we could modernize our network because Cathay operates in about 180 regions across the world. So our network is very crucial for us. We started looking at redesigning our network. 

And then, it comes to your security aspects. Things moving to the cloud, your network design is getting changed, your cybersecurity needs heavy lifting to accommodate the modern world. We started focusing on cybersecurity initiatives where our security posture has been improved a lot over the last few years. And with those basic building blocks done on the hardware and on the technology side, then comes your IT operations. Because one is your hardware and software piece, but how do you sustain your processes to ensure that it can support those changing technology landscapes? We started investing a lot around the IT operations side, but things like ITIL processes have been revisited. We started adopting many of the DevOps and the DevSecOps practices. So a lot of emphasis around processes and practices to help the team move forward, right? 

And those operations initiatives are in phase. As we stand today, we are at the final stage of our cloud journey where we are looking at how we can optimize it better. So we shifted things to the cloud and that has been a heavy lifting that has been done in the early phases. Now we are focusing around how we can rewrite or refactor your application so that it can better liberate your cloud technologies where we could optimize the performance, thereby optimizing your usage and the cloud resources wherein you could save on the cost as well as on the sustainability aspect. That is where we stand. By 2025, we are looking at moving 100% of our business applications to the cloud and also reducing our physical footprint in our data centers as well. 

Megan: Fantastic. And you mentioned sustainability there. I wonder how does the focus on environmental, social, and governance goals or ESG tie into your wider technology strategy? 

Rajeev: Sure. And to be very honest, Megan, if you asked me this question two years back, we would’ve been clueless on what IT could do from a sustainability aspect. But over the last two years, there has been a lot of focus around ESG components within the technology space where we have done a lot of initiatives since last year to improve and be efficient on the sustainability front. So a couple of key areas that we have done. One is definitely the cloud-first strategy where adopting the cloud-first policy reduces your carbon footprint and it also helps us in migrating away from our data center. So as we speak, we are doing a major project to further reduce our data center size by relocating to a much smaller data center, which will be completed by the end of next year. That will definitely help us to reduce our footprint. 

The second is around adopting the various green IT practices, things like energy efficient devices, be it your PCs or the laptop or virtualizations, and e-based management policies and management aspects. Some of the things are very basic and fundamental in nature. Stuff like we moved away from a dual monitor to a single monitor wherein we could reduce your energy consumption by half, or changing some of your software policies like screen timeouts and putting a monitor in standby. Those kinds of basic things really helped us to optimize and manage. And the last one is around FinOps. So FinOps is a process in the practice that is being heavily adopted in the cloud organization, but it is just not about optimizing your course because by adopting the FinOps practices and tying in with the GreenOps processes, we are able to focus a lot around reducing our CO2 footprint and optimizing sustainability. Those are some of the practices that we have been doing with Cathay. 

Megan: Yeah. fantastic benefits from relatively small changes there. Other than ESG, what are the other benefits for an enterprise like Cathay Pacific in terms of shifting from those legacy systems to the cloud that you found? 

Rajeev: For me, the key is about agility and time-to-market capability. If you ask many of the enterprises, they would probably say that shifting to the cloud is all about cost-saving. But for me, those are secondary aspects. The key is about how to enable the business to be more agile and nimble so that the business capability can be delivered much faster by IT and the technology team. So as an example, gone are the days when we take about a few months before we provision hardware and have the platform and the applications ready. Now the platforms are being delivered to the developers within an hour’s time so that the developers can quickly build their development environment and be ready for development and testing activities. Right? So agility is a key and the number one factor. 

The second is by shifting to the cloud, you’re also liberating many of the latest technologies that the cloud comes up with and the provider has to offer. Things like capacity and the ability to scale up and down your resources and services according to your business needs and fluctuations are a huge help from a technology aspect. That way you can deliver customer-centered solutions faster and more efficiently than many of our airline customers and competitors. 

And the last one is, of course, your cost saving aspect and the operational efficiency. By moving away from the legacy systems, we can reduce a lot of capex [capital expenditure]. Like, say for example, I don’t need to spend money on investing in hardware and spend resources to manage those hardware and data center operations, especially in Hong Kong where human resources are pretty expensive and scarce to find. It is very important that I rely on these sorts of technologies to manage those optimally. Those are some of the key aspects that we see from a cloud adoption perspective. 

Megan: Fantastic. And it sounds like it’s been a several year process so far. So after what sounds like pretty heavy investment when it comes to moving legacy hardware on-prem systems to the cloud. What’s your approach now to adapting your IT operations off the back of that? 

Rajeev: Exactly. That is, sort of, just based early in my transformation journey, but yeah, absolutely. By moving to the cloud, it is just not about the hardware, but it’s also about how your operations and your processes align with this changing technology and new capabilities. And, for example, by adopting more agile and scalable approach to managing IT infrastructures and applications as well. Also leveraging the data and insights that the cloud enables. To achieve this, the fundamental aspect of this is how you can revisit and fine tune your IT service management processes, and that is where your core of IT operations have been built in the past. And to manage that properly we recently, I think, over the last three years we were looking at implementing a new IT service management solution, which is built on a product called ServiceNow. So they are built on the core ITIL processes framework to help us manage the service management, the operations management, and asset management. 

Those are some of the capabilities which we rolled out with the help of our partners like Infosys so that it could provide a framework to fine tune and optimize IT processes. And we also adopted things like DevOps and DevSecOps because what we have also noticed is the processes like ITIL, which was very heavy over the last few years around support activities is also shifting. So we wanted to adopt some of these development practices into the support and operations functions to be more agile by shifting left some of these capabilities. And in this journey, Infosys has been our key partner, not only on the cloud transformation side, but also on implementation of ServiceNow, which is our key service management tool where they provided us end-to-end support starting from the planning phase or the initial conceptual phase and also into the design and development and also to the deployment and maintenance. We haven’t completed this journey and it’s still a project that is currently ongoing, and by 2025 we should be able to complete this successfully across the enterprise. 

Megan: Fascinating. It’s an awful lot of change going on. I mean, there must be an internal shift, therefore, that comes with cloud transformation too, I imagine. I wonder, what’s your approach been to up skilling your team to help it excel in this new way of working? 

Rajeev: Yeah, absolutely. And that is always the hardest part. You can change your technology and processes is but changing your people, that’s always toughest and the hardest bit. And essentially this is all about change management, and that has been one of our struggles in our early part of the cloud transformation journey. What we did is we invested a lot in terms of uplifting our traditional infrastructure team. All the traditional technology teams have to go through that learning curve in adopting cloud technology early in our project. And we also provided a lot of training programs, including some of our cloud partners were able to up skill and train these resources. 

But the key differences that we are seeing is even after providing all those training and upskilling programs, we could see that there was a lot of resistance and a lot of doubts in people’s mind about how cloud is going to help the organization. And the best part is what we did is we included these team members into our project so that they get the hands-on experience. And once they start seeing the benefits around these technologies, there was no looking back. And the team was able to completely embrace the cloud technologies to the point that we still have a traditional technology team who’s supporting the remaining hardware and the servers of the world, but they’re also very keen to shift across the line and adopt and embrace the cloud technology. But it’s been quite a journey for us. 

Megan: That’s great to hear that you’ve managed to bring them along with you. And I suppose it’d be remiss of me if we’re talking about embracing new technologies not to talk about AI, although still in its early stages in most industries. I wonder how is Cathay Pacific approaching AI adoption as well? 

Rajeev: Sure. I think these days none of these conversations can be complete without talking about AI and gen AI. We started this early exploratory phase early into the game, especially in this part of the world. But for us, the key is approaching this based on the customer’s pain points and business needs and then we work backward to identify what type of AI is best suitable or relevant to us. In Cathay, currently, we focus on three main types of AI. One is of course conversational AI. Essentially, it is a form of an internal and external chatbot. Our chatbot, we call it Vera, serves customers directly and can handle about 50% of the inquiries successfully. And just about two weeks back, we upgraded the LLM with a new model, the chatbot with a new model, which is able to be more efficient and much more responsive in terms of the human work. So that’s one part of the AI that we heavily invested on. 

Second is RPA, or robotic process automation, especially what you’re seeing is during the pandemic and post-Covid era, there is limited resources available, especially in Hong Kong and across our supply chain. So RPA or the robotic processes helps to automate mundane repetitive tasks, which doesn’t only fill the resource gap, but it also directly enhances the employee experience. And so far in Cathay, we have about a hundred bots in production serving various business units, serving approximately 30,000 hours every year of human activity. So that’s the second part. 

The third one is around ML and it’s the gen AI. So like our digital team or the data science team has developed about 70-plus ML models in Cathay that turned the organization data into insights or actionable items. These models help us to make a better decision. For example, what meals to be loaded into the aircraft and specific routes, in terms of what quantity and what kind of product offers we promote to customers, and including the fare loading and the pricing of our passenger as well as a cargo bay space. There is a lot of exploration that is being done in this space as well. And a couple of examples I could relate is if you ever happen to come to Hong Kong, next time at the airport, you could hear the public announcement system and that is also AI-powered recently. In the past, our staff used to manually make those announcements and now it has been moved away and has been moved into AI-powered voice technology so that we could be consistent in our announcement. 

Megan: Oh, fantastic. I’ll have to listen for it next time I’m at Hong Kong airport. And you’ve mentioned this topic a couple of times in the conversation. Look, when we’re talking about cloud modernization, cybersecurity can be a roadblock to agility, I guess, if it’s not managed effectively. So could you also tell us in a little more detail how Cathay Pacific has integrated security into its digital transformation journey, particularly with the adoption of development security operations practices that you’ve mentioned? 

Rajeev: Yeah, this is an interesting one. I look after cybersecurity as well as the infrastructure services. With both of these critical functions around my hand, I need to be mindful of both aspects, right? Yes, it’s an interesting one and it has changed over the period of time, and I fully understand why cybersecurity practices needs to be rigid because there is a lot of compliance and it is a highly regulated function, but if something goes wrong, as a CISO we are held accountable for those faults. I can understand why the team is so rigid in their practices. And I also understand from a business perspective it could be perceived as a road blocker to agility. 

One of the key aspects that we have done in Cathay is we have been following DevOps for quite a number of years, and recently, I think in the last two years, we started implementing DevSecOps into our STLC [software testing life cycle]. And what it essentially means is rather than the core cybersecurity team being responsible for many of the security testing and those sorts of aspects, we want to shift left some of these capabilities into the developers so that the people who develop the code now are held accountable for the testing and the quality of the output. And they’re also enabled in terms of the cybersecurity process. Right? 

Of course, when we started off this journey, there has been a huge resistance on the security team itself because they don’t really trust the developers trying to do the testing or the testing outputs. But over a period of time with the introduction of various tools and automation that is put in place, this is now getting into a matured stage wherein it is now enabling the upfront teams to take care of all the aspects of security, like threat modeling, code scanning, and the vulnerability testing. But at the end, the security teams would be still validating and act as a sort of a gatekeeper, but in a very light and inbuilt processes. And this way we can ensure that our cloud applications are secure by design and by default they can deliver them faster and more reliably to our customers. And in this entire process, right? 

In the past, security has been always perceived as an accountability of the cybersecurity team. And by enabling the developers of the security aspects, now you have a better ownership in the organization when it comes to cybersecurity and it is building a better cybersecurity culture within the organization. And that, to me, is a key because from a security aspect, we always say that people are your first line of defense and often they’re also the last line of defense. I’m glad that by these processes we are able to improve that maturity in the organization. 

Megan: Absolutely. And you mentioned that obviously cybersecurity is something that’s really important to a lot of customers nowadays as well. I wondered if you could offer some other examples too of how your digital transformation has improved that customer experience in other ways? 

Rajeev: Yeah, definitely. Maybe I can quote a few examples, Megan. One is around our pilots. You would’ve seen when you travel through the airport or in the aircraft that pilots usually carry a briefcase when they load the flight, and you are often probably wondering what exactly they carry. Basically, that contains a bunch of papers. It contains your weather charts, your navigation routes, and the flight plans, the crew details. It’s a whole stack of paper that they have to carry on each and every flight. And in Cathay, by digitization, we have automated that in their processes, where now they carry an iPad instead of a bunch of papers or briefing pack. So that iPad includes all these softwares that is required for the captain to operate the flight in a legally and a safe manner. 

Paperless cockpit operation is nothing new. Many airlines have attempted to do that, but I should say that Cathay has been on the forefront in truly establishing a paperless operation, where many of the other airlines have shown great interest in using our software. That is one aspect from a fly crew perspective. Second, from a customer perspective, we have an app called Customer 360, which is a completely in-house developed model, which has all the customer direct transactions, surveys, or how they interact at the various checkpoints with our crew or at the boarding. You have all this data feed of a particular customer where our agents or the cabin crew can understand the customer’s sentiment and their reaction to service recovery action. 

Say for example, the customer calls up a call center and ask for a refund or miles compensation. Based on the historical usage, we could prioritize the best action to improve the customer satisfaction. We are connected to all these models and enable the frontline teams so that they can use this when they engage with the customer. An example at the airport, our agents will be able to see a lot of useful insights about the customers beyond the basic information like the flight itinerary or the online shopping history at the Cathay shop, et cetera, so that they can see the overall satisfaction level and get additional insights on recommended actions to restore or improve the customer satisfaction level. This is basically used by our frontline agents at the airport, our cabin crew as well as all the airport team, and the customer team so that they have great consistency in the service no matter what touchpoint the customers are choosing to contact us. 

Megan: Fantastic. 

Rajeev: So these are a few example looking from a back end as well as from a front line of the team perspective. 

Megan: Yeah, absolutely. I’m sure there’s a few people listening who were wondering what pilots carry in that suitcase. So thank you so much for clearing that up. And finally, Rajeev, I guess looking ahead, what emerging technologies are you excited to explore further going forward to enhance digital capabilities and customer experience in the years to come? 

Rajeev: Yeah, so we will continue to explore AI and gen AI capability, which has been the spotlight for the last 18 months or so, be it for the passenger or even for the staff internally. We will continue to explore that. But apart from AI, one other aspect I believe could go at great ways around the AR and the VR capabilities, basically virtual reality. We have been exploring that for quite some time, but we believe that it will continue to be a mainstream technology that can change the way we serve the customer. Say for example, in Cathay, we already have a VR cave for our cabin crew training, virtual reality capabilities, and in a few months’ time, we are actually launching a learning facility based on VR where we could be able to provide more immersive learning experience for the cabin crew and later for the other employees. 

Basically, before a cabin crew is able to operate a flight, they go through a rigorous training in Cathay City in our headquarters, basically to know how to serve our passengers, how to handle an emergency situation, those sorts of aspects. And in many cases, we travel the crew from various outports or various countries back into Hong Kong to train them and equip them for these training activities. You can imagine that costs us a lot of money and effort to bring all the people back to Hong Kong. And by having VR capabilities, we are able to do that anywhere in the world without having that physical presence. That’s one area where it’ll go mainstream. 

The second is around other business units. Apart from the cabin crew, we are also experimenting the VR on the customer front. For example, we are able to launch a new business class seat product we call the Aria Suite by next year. And VR technology will help the customers to visualize the seat details without them able to get on board. So without them flying, even before that, they’re able to experience a product on the ground. At our physical shop in Hong Kong, customers can now use a virtual reality technology to visualize how our designer furniture and lifestyle products fit in the sitting rooms. The list of VR capabilities goes very long. The list goes on. And this is also a great and important way to engage with our customers in particular. 

Megan: Wow. Sounds like some exciting stuff on the way. Thank you ever so much, Rajeev, for talking us through that. That was Rajeev Nair, the general manager of IT infrastructure and security at Cathay Pacific, who I spoke with from an unexpectedly sunny Brighton, England.

That’s it for this episode of Business Lab. I’m your host, Megan Tatum. I’m a contributing editor and host for Insights, the custom publishing division of MIT Technology Review. We were founded in 1899 at the Massachusetts Institute of Technology, and you can find us in print, on the web, and at events each year around the world. For more information about us and the show, please check out our website at technologyreview.com. 

This show is available wherever you get your podcasts. If you enjoyed this episode, we hope you’ll take a moment to rate and review us. Business Lab is a production of MIT Technology Review, this episode was produced by Giro Studios. Thanks for listening. 

Integrating security from code to cloud

The Human Genome Project, SpaceX’s rocket technology, and Tesla’s Autopilot system may seem worlds apart in form and function, but they all share a common characteristic: the use of open-source software (OSS) to drive innovation.

Offering publicly accessible code that can be viewed, modified, and distributed freely, OSS expedites developer productivity and creates a collaborative space for groundbreaking advancements.

“Open source is critical,” says David Harmon, director of software engineering for AMD. “It provides an environment of collaboration and technical advancements. Savvy users can look at the code themselves; they can evaluate it; they can review it and know that the code that they’re getting is legit and functional for what they’re trying to do.”

But OSS can also compromise an organization’s security posture by introducing hidden vulnerabilities that fall under the radar of busy IT teams, especially as cyberattacks targeting open source are on the rise. OSS may contain weaknesses, for example, that can be exploited to gain unauthorized access to confidential systems or networks. Bad actors can even intentionally introduce into OSS a space for exploits—“backdoors”—that can compromise an organization’s security posture. 

“Open source is an enabler to productivity and collaboration, but it also presents security challenges,” says Vlad Korsunsky, corporate vice president of cloud and enterprise security for Microsoft. Part of the problem is that open source introduces into the organization code that can be hard to verify and difficult to trace. Organizations often don’t know who made changes to open-source code or the intent of those changes, factors that can increase a company’s attack surface.

Complicating matters is that OSS’s increasing popularity coincides with the rise of cloud and its own set of security challenges. Cloud-native applications that run on OSS, such as Linux, deliver significant benefits, including greater flexibility, faster release of new software features, effortless infrastructure management, and increased resiliency. But they also can create blind spots in an organization’s security posture, or worse, burden busy development and security teams with constant threat signals and never-ending to-do lists of security improvements.

“When you move into the cloud, a lot of the threat models completely change,” says Harmon. “The performance aspects of things are still relevant, but the security aspects are way more relevant. No CTO wants to be in the headlines associated with breaches.”

Staying out of the news, however, is becoming increasingly more difficult: According to cloud company Flexera’s State of the Cloud 2024 survey, 89% of enterprises use multi-cloud environments. Cloud spend and security top respondents’ lists of cloud challenges. Security firm Tenable’s 2024 Cloud Security Outlook reported that 95% of its surveyed organizations suffered a cloud breach during the 18 months before their survey.

Code-to-cloud security

Until now, organizations have relied on security testing and analysis to examine an application’s output and identify security issues in need of repair. But these days, addressing a security threat requires more than simply seeing how it is configured in runtime. Rather, organizations must get to the root cause of the problem.

It’s a tall order that presents a balancing act for IT security teams, according to Korsunsky. “Even if you can establish that code-to-cloud connection, a security team may be reluctant to deploy a fix if they’re unsure of its potential impact on the business. For example, a fix could improve security but also derail some functionality of the application itself and negatively impact employee productivity,” he says.

Rather, to properly secure an application, says Korsunsky, IT security teams should collaborate with developers and application security teams to better understand the software they’re working with and to determine the impacts of applying security fixes.

Fortunately, a code-to-cloud security platform with comprehensive cloud-native security can help by identifying and stopping software vulnerabilities at the root. Code-to-cloud creates a pipeline between code repositories and cloud deployment, linking how the application was written to how it performs—“connecting the things that you see in runtime to where they’re developed and how they’re deployed,” says Korsunsky.

The result is a more collaborative and consolidated approach to security that enables security teams to identify a code’s owner and to work with that owner to make an application more secure. This ensures that security is not just an afterthought but a critical aspect of the entire software development lifecycle, from writing code to running it in the cloud.

Better yet, an IT security team can gain complete visibility into the security posture of preproduction application code across multi-pipeline and multi-cloud environments while, at the same time, minimizing cloud misconfigurations from reaching production environments. Together, these proactive strategies not only prevent risks from arising but allow IT security teams to focus on critical emerging threats.

The path to security success

Making the most of a code-to-cloud security platform requires more than innovative tools. Establishing best practices in your organization can ensure a stronger, long-term security posture.

Create a comprehensive view of assets: Today’s organizations rely on a wide array of security tools to safeguard their digital assets. But these solutions must be consolidated into a single pane of glass to manage exposure of the various applications and resources that operate across an entire enterprise, including the cloud. “Companies can’t have separate solutions for separate environments, separate cloud, separate platforms,” warns Korsunsky. “At the end of the day, attackers don’t think in silos. They’re after the crown jewels of an enterprise and they’ll do whatever it takes to get those. They’ll move laterally across environments and clouds—that’s why companies need a consolidated approach.”

Take advantage of artificial intelligence (AI): Many IT security teams are overwhelmed with incidents that require immediate attention. That’s all the more reason for organizations to outsource straightforward security tasks to AI. “AI can sift through the noise so that organizations don’t have to deploy their best experts,” says Korsunsky. For instance, by leveraging its capabilities for comparing and distinguishing written texts and images, AI can be used as a copilot to detect phishing emails. After all, adds Korsunsky, “There isn’t much of an advantage for a human being to read long emails and try to determine whether or not they’re credible.” By taking over routine security tasks, AI frees employees to focus on more critical activities.

Find the start line: Every organization has a long list of assets to secure and vulnerabilities to fix. So where should they begin? “Protect your most critical assets by knowing where your most critical data is and what’s effectively exploitable,” recommends Korsunsky. This involves conducting a comprehensive inventory of a company’s assets and determining how their data interconnects and what dependencies they require.

Protect data in use: The Confidential Computing Consortium is a community, part of the Linux Foundation, focused on accelerating the adoption of confidential computing through open collaboration. Confidential computing can protect an organization’s most sensitive data during processing by performing computations in a hardware-based Trusted Execution Environment (TEE), such as Azure confidential virtual machines based on AMD EPYC CPUs. By encrypting data in memory in a TEE, organizations can ensure that their most sensitive data is only processed after a cloud environment has been verified, helping prevent data access by cloud providers, administrators, or unauthorized users.

A solution for the future As Linux, OSS, and cloud-native applications continue to increase in popularity, so will the pressure on organizations to prioritize security. The good news is that a code-to-cloud approach to cloud security can empower organizations to get a head start on security—during the software development process—while providing valuable insight into an organization’s security posture and freeing security teams to focus on business-critical tasks.

Secure your Linux and open source workloads from code to cloud with Microsoft Azure and AMD. Learn more about Linux on Azure  and Microsoft Security.

This content was produced by Insights, the custom content arm of MIT Technology Review. It was not written by MIT Technology Review’s editorial staff.