Technology, Trends

Six Trends Every IT Leader Must Act on Now

By Clateway Technology Council · 15 March 2026 · 9 min read

TECHNOLOGY TREND REPORT

March 2025 – March 2026

Six Trends Every IT Leader Must Act on Now

A synthesis of 5,000 technology news signals — distilled into the six forces reshaping enterprise IT leadership in 2025–2026.

Over the twelve months from April 2025 to March 2026, Clateway Media tracked more than 5,000 technology news signals across AI, cybersecurity, cloud infrastructure, regulatory compliance, identity management, and geopolitics. The patterns that emerge are not incremental updates — they represent a structural inflection point in how IT organisations operate, defend themselves, and create value.

This report synthesises those signals into six dominant trends. For each, we identify the signal strength from the news feed, translate it into what it means for the IT leadership agenda, and frame it through the lens of the RCEC methodology — Research, Commit, Execute, Control — that anchors the Clateway practice.

The central message: AI has moved from a technology experiment to a structural operating assumption. Security has moved from a cost centre to an existential board concern. And the window for leaders who are still 'evaluating' is closing rapidly.

TREND 01

The Agentic AI Shift: From Copilot to Autonomous Worker

The most significant structural shift in the feed is the transition from AI-as-assistant to AI-as-autonomous-agent. Where 2023–2024 was dominated by chat interfaces and generative tools, 2025–2026 is defined by agents that plan, execute, and iterate without human handholding. AWS's launch of managed AI agent deployment on Lightsail, the rapid growth of multi-agent orchestration frameworks, and the emergence of agentic development patterns — popularised through 'vibe coding' experiments — collectively signal that the architecture of digital work is being redesigned.

The implications for IT leaders are profound. Agentic systems are not plugins — they require governance structures, access control policies, audit trails, and failure recovery protocols. The Clateway news feed surfaced the security exposure directly: a 250,000-star AI agent framework was found to carry a critical remote code execution vulnerability with over 17,500 vulnerable instances exposed publicly, while 20% of third-party agent skill packages were identified as malicious.

Leadership implication: Every IT leader needs an AI agent governance policy before they need an AI agent deployment. The question is not whether autonomous agents will enter your environment — they already are, through shadow IT and vendor platforms. The question is whether you govern them or they govern you.

What to do now

• Establish an AI agent inventory: map every agentic capability already active across SaaS vendors, developer toolchains, and IT operations platforms.

• Define a minimum security baseline for agent deployment: identity, scope limits, logging, and kill-switch protocols.

• Position AI agent governance as a board-level risk item, not an IT architecture decision.

TREND 02

Cybersecurity at the AI Inflection Point

Cybersecurity was the single highest-volume topic in the Clateway feed, accounting for over 1,400 signals across the year. But the nature of the threat landscape shifted materially. The defining change: AI has equalised attacker and defender capabilities in ways that favour well-resourced, fast-moving actors — which means nation-states and organised crime, not underfunded IT teams.

Three patterns dominate. First, exploit-first attacks: Google Cloud threat intelligence found that the majority of cloud environment compromises now begin with vulnerability exploitation rather than credential theft — upending years of security investment focused on identity. Second, state-sponsored collusion: Iran's MOIS was documented actively collaborating with cybercriminal groups, blurring the line between geopolitical espionage and commercial ransomware. Third, AI-accelerated social engineering: phishing attacks now use personalised AI-generated content that bypasses on-device detection with troubling frequency, while fake proof-of-concept exploits for high-profile vulnerabilities are being weaponised to create chaos in patch management processes.

The Stryker cyberattack — attributed to Iranian threat actors — provided the year's most important case study. It exposed how unprepared most business continuity and disaster recovery programmes are for the speed and coordination of modern attacks.

Leadership implication: Security posture can no longer be assessed against last year's threat model. The combination of AI-powered attacks, state-criminal collusion, and exploit-first entry vectors demands a fundamental reassessment of detection, response, and recovery architecture.

What to do now

• Rerun your DR and incident response playbooks against an AI-augmented adversarial scenario — not a compliance checklist.

• Shift investment from identity-only security towards vulnerability management velocity: your patch cycle is now a competitive security advantage.

• Brief your board on the state-criminal convergence risk — this is no longer a theoretical CISO concern.

TREND 03

Cloud Infrastructure Matures — And Gets Complicated

Cloud infrastructure dominated the feed in volume — over 1,400 signals — but the story is no longer about migration. The 2025–2026 theme is operational maturity, power constraints, and the Kubernetes consolidation. AWS marked 20 years of S3, introducing S3 Vectors and S3 Tables as signals of where cloud-native data architecture is heading. KubeCon EU 2026 confirmed Kubernetes as the dominant abstraction layer for enterprise workloads. And the EU's landmark investment of €1.3 billion in cloud, AI, and cybersecurity infrastructure signalled that public sector cloud is entering its second act.

The most underreported cloud story of the year, however, is power. The Clateway feed surfaced a growing number of signals around data centre power constraints in the United States and Europe — where hyperscaler construction programmes are outpacing grid capacity. For enterprise IT leaders, this creates a new dimension of cloud vendor risk: availability SLAs may be limited not by software or network failures, but by energy infrastructure.

Leadership implication: Cloud strategy in 2026 must account for power supply chain risk, not just vendor lock-in or cost. Multi-cloud architecture decisions should now include energy resilience as a selection criterion for critical workloads.

What to do now

• Add energy availability and grid resilience to your cloud vendor assessment criteria for Tier 1 workloads.

• Review your cloud security model against an exploit-first threat scenario — not just access control and misconfiguration.

• Map your Kubernetes estate: most organisations now have more clusters than they can account for.

TREND 04

Identity Is the New Perimeter — And It Is Under Siege

Identity and access management generated close to 250 signals in the feed — a number that understates its importance, since identity underpins nearly every other trend. The defining development: privileged access management (PAM) is being redefined by the emergence of machine identities. Delinea's acquisition of StrongDM — which specialises in ephemeral, real-time credential injection into developer workflows — signals the direction of the market: PAM is no longer primarily about human privileged users. It is about the proliferation of service accounts, API keys, CI/CD pipeline credentials, and AI agent identities that now outnumber human identities in most enterprise environments.

The parallel development is the IAM challenge posed by multi-agent AI architectures. The Clateway feed surfaced analysis showing that a single IAM system cannot effectively govern the dynamic, context-switching identity requirements of autonomous agent networks. This is a structural gap in most enterprise identity architectures — one that vendors are racing to address, but which creates meaningful risk in the interim.

Leadership implication: Your IAM programme almost certainly does not account for machine identity at scale. Before deploying the next AI system or cloud-native service, audit your non-human identity estate. The attack surface you don't know about is the one that will be exploited.

What to do now

• Commission a non-human identity audit: service accounts, API keys, pipeline credentials, and AI agent identities across your estate.

• Evaluate whether your PAM solution is architected for ephemeral, just-in-time access — or designed for a world of standing privileges.

• Integrate Zero Trust progress into your DORA and NIS2 compliance reporting.

TREND 05

Regulation as Architecture: DORA, NIS2, and AI Governance

Regulatory signals in the feed clustered around three vectors: EU digital operational resilience (DORA going live), network and information security expansion (NIS2), and the emerging global AI governance frameworks. Taken together, they represent a structural shift in the relationship between technology leadership and legal obligation. Compliance is no longer a back-office function — it is an architectural constraint that must be embedded into system design, vendor selection, and operational processes from the outset.

DORA is the most consequential near-term obligation for financial services IT leaders in the EU. The feed surfaced consistent signals of organisations underestimating the operational burden of DORA's ICT third-party risk management requirements — particularly the obligation to perform comprehensive risk assessments of all ICT suppliers, including cloud providers and SaaS vendors. The EU's Cloud CISO Perspectives series emphasised digital sovereignty as the integrating concept: the ability of organisations to maintain meaningful control over their data, infrastructure, and AI systems.

Leadership implication: Regulation is now a design input, not a post-deployment audit. IT leaders who treat DORA, NIS2, and AI governance as compliance exercises will build architectures that need to be rebuilt. Those who treat them as design constraints will build durable systems.

What to do now

• Map your DORA ICT third-party risk inventory now — the assessment obligations are more extensive than most organisations have budgeted for.

• Build digital sovereignty requirements into your cloud and SaaS procurement process as a standing selection criterion.

• Develop a cross-framework compliance view (DORA + NIS2 + AI Act) to identify shared control requirements and avoid redundant effort.

TREND 06

Geopolitical Technology Risk Becomes an IT Leadership Issue

Nearly 400 signals in the feed touched the intersection of geopolitics and technology — a category that would have been considered peripheral to IT leadership five years ago. In 2025–2026, it is central. The TikTok divestiture saga, with a $10 billion fee to the Trump administration, exemplified the new reality: technology platforms are geopolitical assets, and governments are willing to intervene directly in corporate technology decisions. For IT leaders at multinationals, this creates a new category of technology risk that sits above the traditional security and compliance stack.

The Iranian cyberattack on Stryker, the documented collusion between the Iranian MOIS and cybercriminal networks, the Chinese APT shift to new target geographies, and the US policy confusion around commercial spyware collectively illustrate a threat environment where IT infrastructure is a theatre of geopolitical competition. For European IT leaders specifically, the US policy environment introduced new unpredictability into transatlantic technology relationships — from tariffs on technology components to shifting stances on international cyber cooperation.

Leadership implication: Geopolitical technology risk belongs on the enterprise risk register alongside operational and financial risk. IT leaders who are not proactively briefing their boards on technology sovereignty, supply chain exposure, and nation-state threat actors are leaving a material gap in enterprise risk governance.

What to do now

• Add geopolitical technology risk as a standing agenda item in your risk committee reporting.

• Review your critical technology supply chain for components or vendors with high exposure to US-China or US-EU regulatory tension.

• Develop a technology sovereignty position — including data residency, vendor nationality, and jurisdictional access policies — as part of your IT strategy.

The Integrated Leadership Agenda

What makes 2025–2026 distinctive is not that any one of these trends is new — it is that all six are accelerating simultaneously, and they are deeply interconnected. Agentic AI creates new identity risks. Cloud maturity creates new power and sovereignty dependencies. Regulatory frameworks are being written in real time as the technology they govern is already being deployed. And geopolitical volatility makes every architectural decision a political one.

For IT leaders operating through the Clateway RCEC framework, this means:

• Research: the intelligence function must now track geopolitical and regulatory signals with the same rigour as technology signals.

• Commit: governance decisions — on AI agents, identity architecture, cloud sovereignty, and regulatory alignment — need to be made at board level, not delegated to operations.

• Execute: delivery programmes must be designed with regulatory and security constraints as first-class requirements, not late-stage additions.

• Control: monitoring and reporting must surface AI, security, identity, and compliance risks in a single integrated view — not as separate domain silos.

The organisations that will lead through this period are not those with the most sophisticated technology. They are those with the clearest governance structures, the most disciplined decision frameworks, and the leaders who can translate technical complexity into strategic clarity.

That is the Clateway proposition. And the market has never needed it more.

About Clateway

Clateway is a fractional executive leadership practice serving IT leaders across regulated industries in Europe. Through the RCEC methodology — Research, Commit, Execute, Control — Clateway helps organisations make better technology decisions, faster. Clateway Insights publishes regular analysis of technology trends for IT leadership audiences. For advisory engagements, executive roundtables, or the Clateway Academy fractional leadership programme, visit www.clateway.com.

Related articles

• Weekly Technology Insights - October 2026 – A comprehensive roundup of this week's most important technology trends and strategic insights for business leaders

How Clateway can help

• Enterprise architecture and application portfolio management – Enterprise architecture management: system registry and application portfolio, integrations, business processes, data sources, principles, diagrams and cost…