Ts. Lukas J. Tan

For many years, I thought about Corporate Social Responsibility in much the same way many SME owners probably do. CSR was important, but it also looked expensive. It seemed to require a dedicated budget, people to organise activities, partnerships to coordinate, events to manage, reports to prepare and enough management attention to keep everything moving. Large corporations may have dedicated sustainability or CSR teams to handle this work. An SME usually does not.

This creates an uncomfortable situation. Many SME owners genuinely want to contribute to society, but the business itself is already consuming most of their resources. There are customers to serve, employees to manage, products to improve, sales targets to meet and cash flow to protect. When CSR is designed as another large project sitting on top of all those responsibilities, it becomes difficult to sustain.

I began wondering whether the problem was not CSR itself, but the way we were designing it.

What if a CSR initiative could consume relatively few additional resources while still creating meaningful impact? What if it could use capabilities that already exist inside the company instead of requiring an entirely new operation? What if we could design it once, improve it through experience and repeat it many times? And what if the impact could continue travelling even after our direct involvement ended?

Over time, through our work in scam-prevention education, I began to see a pattern.

I would describe it today as a lean, repeatable CSR model: start with something close to what you already know, reduce the resources required to deliver it, create a repeatable method, allow the beneficiaries themselves to carry the message further, and eventually build content, intellectual property and partnerships around the model so that impact can grow without resources growing at the same rate.

That sounds like business thinking because, in many ways, it is.

And I believe SMEs should apply more of it to CSR.

CSR Should Not Exhaust the Business Creating the Impact

A social initiative is not sustainable simply because its purpose is good. If every activity requires extraordinary effort, large budgets and constant founder involvement, eventually the organisation will struggle to continue it.

This is something entrepreneurs understand instinctively in business. If every customer requires a completely different process, the business becomes difficult to scale. If every sale depends entirely on the founder, there is a bottleneck. If costs increase at exactly the same rate as growth, there are limits to how far the business can expand.

We respond by building systems. We simplify processes. We create templates. We automate where appropriate. We document what works. We turn individual efforts into repeatable operations.

I began asking myself why CSR should be completely different.

The objective should not be to minimise resources simply for the sake of spending less. The objective should be to improve the ratio between resources consumed and impact created.

If ten hours of preparation are required every time we conduct a one-hour activity, can we redesign it so that the preparation is done once and the same framework can be used repeatedly? If every programme requires new materials, can we create reusable materials? If impact stops the moment we leave the room, can we create something that participants take home and share with others?

These questions gradually shaped the way I approached our scam-prevention initiative.

The Starting Point Was Not CSR

Interestingly, I did not begin by deciding that we needed a CSR programme.

I began with a problem that bothered me.

Scams were becoming increasingly visible in Malaysia. Every few days there seemed to be another story about someone losing money through impersonation, fraudulent investments, phishing, fake jobs, fake purchases or social engineering.

Coming from a technology background, I was naturally interested in the digital side of the problem. But the more I studied scams, the more I realised that technology was only one part of the equation.

The tools change, but the human vulnerabilities remain remarkably consistent.

Scammers exploit urgency. They exploit fear, trust, greed, loneliness, curiosity and love. They convince people to act before thinking. Technology makes the message faster, cheaper and increasingly convincing, but the final target is still a human decision.

That led me to a different question: if judgment is one of our defences against scams, why do we wait until adulthood to teach it?

That question eventually brought us into schools.

Initially, the idea was straightforward. We would share scam awareness with students and help them recognise risky situations. But once we began doing the work, I started applying the same questions I would ask when developing a product or business process.

What is the minimum that a child really needs to remember?

What part of the message creates the greatest effect?

What can be removed?

What can be repeated?

What can be standardised?

What can continue after we leave?

Without intentionally setting out to build a CSR framework, we were beginning to create one.

The First Principle: Start Close to What You Already Know

I believe one reason CSR becomes resource-heavy is that businesses sometimes choose initiatives far removed from their existing capabilities.

The company then has to build almost everything from zero: knowledge, content, processes, networks and sometimes even credibility.

For SMEs, I believe there is another approach.

Start close to your existing strengths.

Our company works in technology, software, digitalisation and education. I spend time speaking, training and explaining technology to different audiences. Scam prevention sits naturally beside those capabilities.

That meant we did not need to create an entirely separate organisation before contributing. We could use knowledge, communication skills, technology experience and resources that already existed.

This is the first part of the model:

Use existing capability before adding new resources.

An accounting company could contribute financial literacy. A technology company could contribute digital awareness. A restaurant could contribute food education. A creative agency could help communities communicate. An engineering business might contribute technical or safety knowledge.

Every company accumulates expertise while doing business.

That expertise has social value too.

If CSR begins with something adjacent to what the organisation already knows, the additional resources required can be dramatically lower.

The Second Principle: Reduce the Message to What Actually Matters

When we started thinking about scam education for children, it would have been easy to create a comprehensive programme covering every known category of scam.

But comprehensive does not always mean effective.

Children do not need to memorise 30 types of scams. Even adults cannot keep up with every new technique. The moment we finish teaching today's list, new variations will emerge.

Instead, I began reducing the message to three behaviours:

Slow down. Ask questions. Tell an adult.

If somebody creates urgency, slow down.

If something feels strange or unusually attractive, ask questions.

If someone asks for secrecy, especially around money or an online interaction, tell a parent, teacher or trusted adult.

These three behaviours require very little technical knowledge. More importantly, they remain useful even when the scam changes.

One technique I share is extremely simple: pause for three seconds when someone is pushing you to act immediately.

That tiny pause introduces friction between emotion and action.

Once there is a pause, there is space for a question: Why is this urgent? Why must I do it now? Why can I not tell my parents? Why am I being offered this?

In a world where technology is designed to remove friction from everything—clicking, purchasing, sharing, transferring and responding—sometimes adding a little friction back into a decision is protective.

This became the second principle of the model:

Simplify the intervention until the important part becomes easy to remember and easy to deliver.

Complexity consumes resources. Simplicity travels.

The Third Principle: Build a Repeatable Unit

The next question was operational.

If we wanted to visit schools, we could not reinvent the programme for every school. That would make the initiative dependent on too much preparation and too many people.

So we began thinking in terms of a repeatable unit.

A school. A session. A defined duration. A consistent core message. Reusable materials. A simple operating process.

Then repeat.

Each school still has its own environment and students, of course, but the underlying model does not need to be rebuilt each time.

This sounds obvious, yet I think it represents an important shift in how SMEs can approach CSR.

Instead of thinking only in terms of campaigns, we can think in terms of systems.

A campaign is designed to happen.

A system is designed to happen again.

The distinction is important because social impact often comes from accumulation rather than one spectacular event.

One school may feel small. Twenty schools are no longer so small. Thousands of students reached through a repeatable process begin to represent something meaningful.

The resources required do not need to increase at the same rate as the impact because much of the thinking, content and preparation has already been done.

That is the third principle:

Design one unit of impact that can be repeated without rebuilding the programme every time.

The Fourth Principle: Let Impact Travel Beyond the Direct Beneficiary

This was probably the most interesting part of the model for me.

When we educate one student, have we reached one person?

Initially, the obvious answer is yes.

But children go home.

They talk.

They repeat interesting things they learned in school. They tell their parents about unusual stories. Sometimes they correct adults.

A child who learns that scammers create artificial urgency may later see a parent responding to a suspicious message and say, "Wait. Let's check first."

Suddenly, the impact of educating one child has travelled beyond the person sitting in front of us.

This changed the way I thought about the initiative.

We normally imagine adults as the guardians. Parents protect children. Teachers protect students. Society protects young people.

But information can move in both directions.

A child can also become a small guardian inside the family.

I am not suggesting that children should carry adult responsibilities. They should not. What we can give them is permission to notice, question and speak up.

If a child sees something suspicious and feels comfortable telling a parent, that itself is protection. If a child brings home a simple scam-prevention principle and the family discusses it over dinner, the classroom has extended into the home.

This became the fourth principle:

Do not only measure the people you directly reach. Design the intervention so that the message can travel through them.

That is leverage.

And leverage is one of the reasons a relatively small CSR activity can produce a larger social footprint.

The Fifth Principle: Turn Repeated Knowledge Into Intellectual Property

There was still a weakness in the model.

A talk ends.

No matter how good the speaker is, everyone eventually leaves the room. Memories fade.

After visiting schools and repeating the programme, however, something valuable begins to accumulate: knowledge.

We learn which examples children understand. We learn what makes them laugh. We learn which questions they ask. We learn which explanations are too complicated. We learn what teachers notice. We learn which messages children remember.

In business, accumulated knowledge like this should not remain only inside one person's head.

It should become intellectual property.

That thinking eventually contributed to ScamAlert Jr.

The idea was not simply to publish another book about scams. The book became a way of capturing what we were learning from the initiative and turning it into something that could travel without us.

Instead of depending entirely on a speaker standing in front of students, stories and characters can carry the message.

A child can take a book home. A sibling can read it. A parent may pick it up. A teacher can return to it later.

The model begins to evolve:

School → Student → Home → Family.

And the role of the organisation changes as well.

At the beginning, impact depends heavily on our time.

Later, content begins doing some of the work.

This is the fifth principle:

Convert repeated experience into reusable content and intellectual property so that impact becomes less dependent on your physical presence.

For an SME, I think this is particularly powerful.

We may not have thousands of employees to deploy into communities. But we can create knowledge, frameworks, books, videos, tools, software or educational materials that continue working after we have left.

The Sixth Principle: Build an Ecosystem, Not a Larger Internal Team

There is another trap when an initiative begins growing.

The instinct is to build a larger internal team.

Sometimes that is necessary. But every additional layer also creates cost and management complexity.

An alternative is to build an ecosystem.

Schools already have students, teachers and communication channels. Corporate partners may have CSR budgets and community networks. Educators understand children. Industry organisations have expertise. Bookstores have distribution. Publishers and content creators understand how ideas travel.

The SME does not necessarily need to own every part of the system.

Our role can be to build the core model and then work with partners who already possess the infrastructure required for the next stage.

This is again very similar to entrepreneurship.

Strong businesses do not necessarily own every component of their value chain. They identify where they create the most value and collaborate elsewhere.

CSR can work the same way.

The sixth principle therefore is:

Scale through partnerships before scaling internal overhead.

This keeps the organisation lighter while allowing the initiative to travel further.

The Model: Less Resource, Greater Impact

Looking back, I can now see the pattern more clearly.

Our approach can be summarised as a simple progression:

Existing Capability → Simple Intervention → Repeatable Process → Beneficiary Multiplier → Intellectual Property → Partner Distribution

Each stage attempts to increase impact without requiring resources to increase at the same rate.

We start with what we already have.

We simplify what we deliver.

We make the delivery repeatable.

We encourage the people we reach to carry the message further.

We convert experience into reusable intellectual property.

Then we work with partners to expand distribution.

This is the model I am increasingly interested in developing.

I do not claim that it is appropriate for every CSR initiative. Some social problems genuinely require significant capital, specialised expertise and large institutions. Nor should "low resource" ever become an excuse for low quality.

The point is different.

Resource efficiency should be part of CSR design.

If two approaches can create comparable social value, but one requires substantially fewer recurring resources, the more efficient model has a better chance of surviving.

And longevity matters.

Impact Per Unit of Resource

Businesses constantly measure efficiency.

Revenue per employee. Cost per acquisition. Output per hour. Return on investment.

Perhaps CSR deserves a similar—but not purely financial—way of thinking.

I have started thinking about something I would call Impact Per Unit of Resource.

The concept is simple.

For every hour, ringgit and person committed to an initiative, how much useful and sustainable impact are we creating?

This should not become an excuse to reduce social contribution to a spreadsheet. Human impact cannot always be quantified accurately. But the question itself is useful because it forces us to examine the design of the programme.

Can one trainer reach several hundred students using a well-designed session?

Can those students carry the message into hundreds of homes?

Can one piece of educational content be reused across many schools?

Can a book continue delivering the message after the original programme ends?

Can corporate partners sponsor distribution rather than requiring us to finance everything ourselves?

Can teachers eventually use parts of the material without our presence?

Each time the answer becomes yes, the impact-to-resource ratio improves.

For an SME, that ratio may determine whether CSR remains an occasional activity or becomes something the company can sustain for years.

The Business Must Be Sustainable Too

There can sometimes be discomfort around discussing efficiency, intellectual property, partnerships or commercial mechanisms in the context of CSR.

I understand why.

We do not want social initiatives to become disguised marketing exercises.

But I also believe we need to be realistic.

Social impact requires resources.

Books need to be written, illustrated, printed and distributed. Programmes require people. Technology requires development. Travel costs money. Content requires time.

If the organisation providing all of this is continually depleted by the initiative, eventually the initiative stops.

Sustainability must therefore work in both directions.

The social mission must be sustainable, but so must the organisation supporting it.

That does not mean every CSR activity must generate revenue. It means we should be willing to design ecosystems in which free education, corporate sponsorship, commercial products, partnerships and intellectual property can coexist where appropriate, provided the economic mechanisms support rather than compromise the mission.

A commercially available book, for example, can extend the reach of an educational initiative. Corporate sponsorship can fund distribution to communities. Paid products can help support free activities elsewhere.

The relevant question is not simply whether money exists somewhere in the system.

The more important question is whether the system allows the impact to continue.

Why Scam Prevention Is Really About Judgment

As the model developed, my understanding of the mission also changed.

I started with scam awareness.

Today, I increasingly think we are teaching judgment.

Scam techniques will continue evolving, especially with artificial intelligence. Synthetic voices will become more convincing. Images and videos will become easier to manipulate. Messages will become increasingly personalised. It will become harder to judge authenticity simply by looking for obvious mistakes.

We cannot prepare children for that world by giving them a static list of today's scams.

We can prepare them by developing habits.

Pause.

Question.

Verify.

Discuss.

Ask who benefits.

Ask why something is urgent.

Ask whether the information can be confirmed through another channel.

These are not only anti-scam skills.

They are skills for navigating an information environment in which increasingly convincing content can be generated cheaply and at scale.

That makes the mission larger than I originally imagined.

The objective is not to create a generation that is frightened of scams.

It is to contribute, in our own small way, to a generation that thinks before reacting.

What Other SMEs Can Take From This

I am sharing this model because I believe many SMEs underestimate what they can contribute.

You do not necessarily need a CSR department.

You do not necessarily need a large annual CSR budget.

And you do not need to copy what multinational corporations are doing.

Start by looking inside your own organisation.

What knowledge have you accumulated?

What problem do you genuinely care about?

Where does that problem overlap with your existing expertise?

What is the smallest useful intervention you could create?

Can you turn it into a repeatable unit?

Can the people you help carry part of the impact forward?

Can repeated experience become reusable content or intellectual property?

Can partners eventually help distribute it?

Those questions can produce a very different type of CSR programme.

Instead of starting with resources and asking how much impact they can buy, start with a model and ask how efficiently impact can travel.

For me, that is the difference between simply conducting CSR activities and designing a CSR engine.

From One School to a Model

Our own model is still developing.

We continue going into schools. We continue learning from students and educators. We continue simplifying the message and improving the process. We are learning how to turn what began as individual awareness sessions into something more structured and more capable of travelling beyond us.

The next step is ScamAlert Jr.

ScamAlert Jr is planned for launch in Q4 2026, with availability targeted at major bookstores in Malaysia. The book is part of our attempt to convert what we have learned through school engagement into stories that children can carry home and families can discuss together.

But I do not see the book as the destination.

It is another component in the model.

A talk reaches the room.

A repeatable programme reaches more rooms.

A child carries the message into a home.

A book allows the message to stay there.

A partner helps it reach another community.

Each layer increases reach without requiring our internal resources to expand at exactly the same rate.

That is the pattern I want to continue exploring.

Perhaps the future of SME CSR is not about doing bigger projects.

Perhaps it is about designing better multipliers.

Use what you already know. Reduce unnecessary complexity. Build something repeatable. Turn experience into intellectual property. Work with people who already have the infrastructure you lack. And continually ask whether the impact is growing faster than the resources required to create it.

That is how I now think about CSR.

Not simply as giving back.

Not as an annual activity.

Not as a large cheque or a photograph in an annual report.

But as a system that can be designed, tested, improved and repeated.

For our scam-prevention initiative, the unit may begin with something as small as one child learning to pause before clicking.

If that child takes the lesson home, reminds a parent, starts a conversation and one day prevents a rushed decision, the impact has already travelled further than the original classroom.

That is the kind of CSR model I want to build:

less resource-intensive, more repeatable, and capable of creating impact far beyond the organisation that started it.

And we are only at the beginning.

By Ts. Lukas J. Tan | 22 September 2026

From a Small File Problem to a Long-Term R&D Journey in Secure Document Processing

When we first started thinking about PDF-X, the idea looked almost too simple.

People have PDF problems.

A file is too large to upload. Someone needs only a few pages from a document. Several PDFs need to become one. A document needs a password before it can be sent.

There are already many PDF tools on the Internet, so at first glance there seems to be very little left to invent.

But that was exactly what made this project interesting.

The more we studied the market, the more we realised that the problem was not simply whether a PDF tool already existed.

The more important questions were:

• Why are people still struggling with these problems if so many tools already exist?
• Why do simple document tasks still require users to understand technical settings?
• What happens behind the scenes when a public website processes a document uploaded by a stranger?
• How much of the existing experience is designed around what the software can do, rather than what the user actually needs?

Those questions changed PDF-X from a small utility project into something much more interesting to us from a research and development perspective.

Today, I see PDF-X not as the end product of an idea, but as the beginning of a much longer exploration into document processing, secure execution, user experience, infrastructure efficiency and eventually the future relationship between people, documents and intelligent software.

It Started With the Market, Not the Technology

Our first step was not to decide which programming language or PDF library to use.

We started by looking at how people currently solve document problems.

There are large international PDF platforms with dozens of tools. There are desktop applications. There are free websites supported by advertising. There are paid subscription products. There are developer APIs.

Technically, the market is already mature.

But mature does not necessarily mean finished.

What we saw was a gap between technical capability and human intention.

For example, a user may be asked whether they want low, medium or high compression.

But that may not be the user's real question.

Their real question may be:

"The government portal says my PDF must be below 2 MB. Can you make it fit?"

That difference looks small, but from a product-design perspective it is significant.

The user should not need to understand DPI, JPEG quality, image recompression, object streams or PDF optimisation algorithms.

The software should understand those things.

The user should simply be able to communicate the outcome.

That became one of the earliest principles behind PDF-X:

Tell us what you need. Let the system handle the technical complexity.

This principle later influenced almost every decision we made.

We Deliberately Reduced the Product Before Expanding It

Early in the research process, it was very easy to imagine a large document platform.

PDF to Word. Word to PDF. Images to PDF. OCR. Signing. Watermarks. Rotation. Extraction. Conversion. Compression. And dozens more.

But we eventually moved in the opposite direction.

Instead of asking, "How many tools can we launch?", we asked:

What are the few problems worth solving first?

The initial public focus became four functions: Reduce PDF Size. Split PDF. Merge PDF. Protect PDF.

That reduction was intentional.

R&D is not only about adding capability. Sometimes R&D is also the process of discovering what not to build yet.

Word-to-PDF is a good example.

Technically, it is possible. But document conversion introduces another class of complexity: fonts, layout fidelity, images, headers, tables, office formats, rendering engines and additional execution risk.

Rather than releasing it simply because we could, we decided that it should wait until we were satisfied with the processing and isolation model.

That decision represents an important philosophy we developed through the project:

A feature is not finished merely because it works. It is finished when we understand how it behaves, fails, scales and affects the rest of the system.

That is a very different way of looking at product development.

"Reduce PDF" Became a Research Problem

Compression initially sounds straightforward. Take a large PDF. Compress it. Return a smaller PDF.

But once we looked more deeply, we realised the user's expectation is different from a generic compression function.

If someone asks for a PDF below 1 MB, reducing a 10 MB file to 3.5 MB is technically successful compression, but it has failed the user's task.

So the engineering problem becomes:

Given a PDF and a target maximum size, can we produce the highest practical quality result that fits within that limit?

That changes the problem. Now we are dealing with optimisation rather than a simple command.

Different PDFs behave differently.

• A text-heavy document is different from a scanned document.
• A document containing photographs is different from one containing vector graphics.
• An already optimised PDF behaves differently from one containing oversized embedded images.
• A document may not be reducible to the requested target without unacceptable quality loss.

Suddenly, a very ordinary button, Reduce PDF Size, becomes a technical research problem involving content analysis, iterative optimisation, quality trade-offs and honest communication with the user.

This is where PDF-X became particularly interesting to me.

The simpler we wanted the user experience to become, the more sophisticated the engineering underneath sometimes needed to be.

That is a pattern I believe will become increasingly important in software.

Complexity should move away from the user and into the system.

Then We Reached the Security Question

The biggest change in our thinking came when we started looking at the processing architecture itself.

A public PDF platform has a fundamental characteristic: it accepts files from people it does not know.

From a security perspective, that changes everything.

An uploaded PDF cannot simply be treated as a document. It must be treated as untrusted input.

PDF parsers and document-processing engines are complex pieces of software. They process compressed data, fonts, images, metadata, object structures and many different variations of the format.

Software can contain vulnerabilities.

So we asked a new question:

If a document-processing engine is ever compromised by a malicious file, what would that process be able to access?

This question became one of the most important R&D directions in the entire PDF-X project.

Normally, a PHP application may start an external document-processing program under the same Unix account as the application.

Without additional isolation, that child process may inherit much more access than it actually needs:

• Application files
• Environment variables
• Other temporary directories
• Network connectivity
• Other resources visible to that account

But a document processor may only need:

/work/input.pdf
/work/output.pdf

Why should it see anything else?

That simple question eventually led us to investigate process isolation on Linux.

From PDF Processing to Sandbox Engineering

We studied how we could create a smaller execution boundary around external document-processing programs.

That led us to Bubblewrap, a Linux sandboxing technology based on namespaces and filesystem isolation.

The design gradually became very clear.

• Each processing job should have its own workspace.
• The external processor should see only the files required for that job.
• It should not inherit the application's full environment.
• Network access should be unavailable unless explicitly required.
• Commands should be invoked as structured argument arrays rather than assembled into shell strings.
• Processing should have time limits and resource controls.

And perhaps most importantly:

If the sandbox cannot be created, the system should fail rather than silently run without it.

That last principle became especially important.

A security feature that disappears without telling you can be more dangerous than having no security feature at all, because it creates false confidence.

So the approach became fail closed. If the containment environment is unavailable, processing stops.

Security Research Also Taught Us to Be More Precise

One of the most valuable lessons from this project was learning what not to claim.

It would be easy to say: "Our PDF processing is secure."

But security does not work as a simple yes-or-no state.

• The sandbox isolates the spawned processing process.
• It does not automatically sandbox the entire PHP application.
• It does not sandbox the queue worker that started it.
• It does not replace operating-system security.
• It does not remove vulnerabilities from Bubblewrap or the Linux kernel.
• It does not make output files trustworthy simply because they were produced inside a sandbox.

Some resource controls also require capabilities outside the library itself.

The deeper we went into security engineering, the more careful our language became.

Instead of saying "This makes document processing safe", the more accurate statement is:

This reduces the attack surface and limits what a compromised child process can reach.

That distinction matters.

And I believe responsible technology companies need to become much more comfortable communicating limitations.

Trust should not come from claiming perfection. Trust should come from explaining the boundaries honestly.

The Internal R&D Became an Open-Source Project

At this stage, something unexpected happened.

The sandboxing work was originally just one part of PDF-X. But we realised that the problem was not actually specific to PDF-X.

Many PHP systems execute external programs against untrusted input: OCR engines, image converters, Office-document processors, media tools, archive utilities, analysis binaries.

They all face a similar architectural question:

What is the minimum this external process needs to access?

So we extracted that work into a separate open-source project: PDF-X Secure Runner.

The package became independent from the private PDF-X application. It is framework-independent PHP. It can be used with Laravel, but Laravel is not required. It does not bundle the PDF-processing engine itself.

Its purpose is narrower: provide a controlled execution boundary around an external process.

That work was released publicly through Composer, Packagist, GitHub documentation and automated Linux containment testing.

And that created another dimension to the project. PDF-X was no longer only producing a user-facing tool. It was producing reusable infrastructure.

Open Source Changed the Nature of the Research

Once something becomes open source, the engineering mindset changes.

Internal code only has to satisfy the team maintaining it. Public infrastructure has to explain itself.

• What does it protect?
• What does it not protect?
• What assumptions does it make?
• What operating systems does it require?
• What happens when dependencies are unavailable?
• How can another developer verify that the containment model is actually functioning?

This led us to build documentation around architecture, security boundaries and integration. It also led to containment tests and a self-check mechanism rather than relying entirely on assumptions.

This is an important part of R&D that is sometimes overlooked.

Research is not complete when something works on the developer's machine. It becomes much more valuable when the assumptions behind the result can be tested and understood by other people.

That is one reason I am increasingly interested in open-source work.

Public review creates pressure for clarity. And clarity improves engineering.

We Also Had to Study the Reality of Infrastructure

Another lesson came from deployment.

Engineering cannot happen in isolation from business reality. It is easy to design the perfect architecture if budget, infrastructure and operating constraints do not exist. In the real world, they always exist.

We studied how much isolation could realistically be achieved on our existing Linux hosting environment.

We looked at process ownership, file permissions, shared server behaviour, queue workers, temporary storage, cleanup, memory, disk availability, request admission, rate limits and operational monitoring.

Some things could be improved through application design. Some things could be isolated through Bubblewrap. Some things ultimately depend on the host architecture itself.

And there is an important lesson here:

Application security has boundaries that application code alone cannot cross.

If strict host-level isolation is required, infrastructure may eventually need to change. Recognising that limitation is part of engineering maturity.

The answer is not always another function or another package. Sometimes the answer is architectural.

Reliability Became Part of Security

Our research also reinforced something I believe strongly: security and reliability are connected.

If a processing system runs out of memory, fills disk space or accumulates thousands of abandoned jobs, that is not only a performance problem. It can become a security and availability problem.

So we introduced controls around processing jobs:

• Temporary job directories and automatic cleanup
• Queue-based processing
• Signed status and download access
• Rate limiting
• Disk and memory admission checks
• Process timeouts
• Maximum file sizes and workspace controls

The goal was to prevent a simple document-processing feature from becoming an uncontrolled resource consumer.

Once again, something that looks like a small utility on the frontend becomes a systems-engineering problem behind the scenes.

The Market Research Changed Our Definition of Innovation

When people hear the word "innovation", they often expect something dramatic. AI. Robotics. Blockchain. A completely new technology.

But working on PDF-X has reminded me that innovation can also come from reframing an existing problem.

PDF compression is not new. Splitting a PDF is not new. Sandboxing is not new. Linux namespaces are not new. PHP is certainly not new.

But innovation can happen in the way those pieces are combined.

• Can an ordinary office worker use a technically sophisticated document-processing pipeline without having to understand any of it?
• Can a free online utility be designed around user outcomes instead of technical settings?
• Can the security work developed for one product become reusable infrastructure for other developers?
• Can a document-processing platform become a laboratory for exploring secure execution, optimisation and intelligent automation?

Those questions are far more interesting to me than simply asking: "Can we build another PDF website?"

PDF-X Is Beginning to Show Us a Larger Opportunity

This is where I think the long-term R&D journey becomes interesting.

A document is one of the most common interfaces between people and organisations. Invoices. Reports. Applications. Contracts. Statements. Certificates. Forms. Purchase orders. School documents. Government submissions. Corporate paperwork.

For decades, we have focused mainly on creating, storing and displaying these documents.

The next stage may be different. Software will increasingly need to understand the user's intention around a document.

Not "Choose compression level 1, 2 or 3." But: "Make this acceptable for my application portal."

Not "Select pages 17-22." But eventually: "Give me only the pages containing the invoice and payment details."

Not "Merge file A, B and C." But: "Prepare these documents in the correct order for submission."

This is where document utilities may eventually meet intelligent systems.

But there is an important condition. AI should not be added merely because AI is fashionable. It should appear only when it reduces the amount of thinking required from the user.

The intelligence should remain underneath. The simplicity should remain on top.

Privacy Will Become More Important, Not Less

There is another future direction we are watching carefully.

As software becomes more intelligent, more user data is likely to be processed. Documents may contain some of the most sensitive information people handle: financial information, personal identification, contracts, business records, internal correspondence.

So future document intelligence cannot be developed independently from privacy engineering.

This may lead to different architectural models. Some processing may remain server-based. Some may eventually move closer to the browser or user device. Some organisations may require private deployments. Some workflows may need isolated workers. The right architecture will depend on the sensitivity of the task.

For us, this means privacy is not simply a legal page at the bottom of the website. It is an R&D topic.

We Are Also Beginning to See PDF-X as an Engineering Platform

The public sees four tools. From an engineering perspective, we now see several deeper research layers underneath them: document optimisation, untrusted-file handling, secure execution, temporary storage, resource governance, asynchronous processing, user intention, privacy, developer infrastructure, and potentially later, intelligent document understanding.

This is why I say PDF-X is only beginning.

The product may remain visually simple. But the technology behind it can continue evolving for years.

Some of that technology will remain part of PDF-X. Some may become standalone open-source components. Some may become services. Some experiments may fail completely.

That is normal R&D. The objective is not to pretend that we already know the final destination. The objective is to continue asking useful questions.

Build, Observe, Learn, Then Build Again

One of the mistakes technology companies can make is to treat launch day as the finish line. For us, launch is closer to the beginning of the experiment.

Now we can observe real behaviour.

• Which file sizes are common?
• Which operations are used most?
• Where do users abandon the process?
• Which PDF types create problems?
• What do people ask for that we did not anticipate?
• What security assumptions change when usage increases?
• What becomes expensive at scale?
• What should remain free?
• Which infrastructure needs to be separated?
• What should never be automated?

Those answers cannot come entirely from planning documents. They require real systems and real usage.

This is why I like building. You discover things by moving.

What I Hope PDF-X Becomes

I do not want to define PDF-X too narrowly today. At the moment, it is a simple online PDF utility. That is what users should see.

Behind it, however, we are building knowledge: how people interact with documents, secure document processing, file optimisation, resource management, infrastructure boundaries, and how much complexity can be hidden from the user without hiding important truth.

Over time, that knowledge may become more valuable than any individual button on the website.

That is often how meaningful technology develops. The first product solves a problem. The process of solving that problem reveals a deeper problem. Solving the deeper problem produces reusable technology. That technology creates the next opportunity. And the cycle continues.

This Is Why I Call It R&D

Research and development is not only something that happens inside a laboratory. For a software company, it can happen while solving very ordinary problems.

You research the market. You observe the user. You study existing technology. You test assumptions. You discover limitations. You redesign. You fail. You isolate the failure. You improve the architecture. You document what you have learned.

Then sometimes you discover that a small component of one product can become something useful on its own.

That is exactly what happened with PDF-X Secure Runner. And I suspect it will not be the last thing to come out of PDF-X.

The Beginning, Not the Conclusion

When we started, we were trying to build a useful PDF website. Today, I see something larger. Not necessarily a larger website. A larger field of exploration.

• How can document processing become simpler for humans while becoming more disciplined underneath?
• How can intelligent automation understand outcomes rather than force users to understand settings?
• How can untrusted document processing be isolated more effectively?
• How can privacy and security remain part of product architecture rather than being added after the product is built?
• And what other reusable technologies will we discover while trying to solve these ordinary problems properly?

I do not know all the answers yet. That is exactly why this is interesting.

PDF-X is live as a product. PDF-X Secure Runner is now open source. But from an R&D perspective, both are still at the beginning.

We built something. Then we looked underneath it. And underneath that simple PDF tool, we found a much larger area worth exploring.

That is where I believe the next chapter starts.

• PDF-X: pdf-x.co
• PDF-X Secure Runner: open-source infrastructure developed from the engineering work behind PDF-X.

And from here, we continue to build, study, test and discover.

Because sometimes innovation does not begin with trying to invent the future. Sometimes it begins by taking one ordinary problem seriously enough to ask:

"Can this be done better?"

Ts. Lukas J. Tan
Founder & CEO, OPERION Ecommerce & Software Sdn Bhd
R&D | Secure Document Processing | AI & Business Systems

By Ts. Lukas J. Tan | 16 September 2026

Why I Am Paying More Attention to Practical AI Governance

Whenever I learn a new technology, I rarely stop at understanding what it is or watching other people demonstrate what it can do. I have always preferred to use technology myself, push it into real work, test its limits, connect it with other tools, and see how far it can actually go. Sometimes this approach creates efficiency. Sometimes it exposes weaknesses. But more importantly, when you use something deeply enough, you begin to notice things that are difficult to see from the outside.

Artificial intelligence has been no different for me. Over the past few years, AI has gradually become part of how I think, write, research, analyse information, develop software, communicate and operate a business. I have watched tasks that once required hours become tasks that can be completed in minutes. Research can be accelerated. Documents can be analysed almost immediately. Software can be developed faster. Ideas can be explored from multiple directions without assembling a large team. An individual equipped with the right AI tools can now perform work that would once have required several different skills or people.

I am excited by that development. I want AI to become more capable, not less. I want businesses to discover how much more productive they can become when AI is used properly.

Yet the deeper I use AI, the more I find myself thinking about something other than productivity.

Everyone talks about how fast AI is becoming. What concerns me is not simply that AI is fast. What concerns me is the possibility that AI is becoming faster than our ability to control what we are doing with it.

This difference matters.

For decades, computing technology has continued to accelerate. Moore’s Law became one of the best-known descriptions of how rapidly computing capability developed over time. Every generation of technology has given us greater processing power, greater connectivity and faster access to information. AI is adding something different to that acceleration because computers are no longer only storing and processing information. Increasingly capable AI systems are now participating directly in knowledge work: interpreting information, generating content, writing software, analysing documents and supporting decisions.

Consider something as ordinary as preparing a business proposal. In the traditional workflow, someone gathers information, thinks about the problem, prepares a draft, reviews it, makes corrections, discusses it with colleagues and eventually sends it to the customer. That process may take several hours or even several days. Today, an employee can provide AI with some information and receive a professionally written proposal within minutes.

That sounds entirely positive until we look at what happened to the control process.

The speed of generation increased dramatically, but did the speed and quality of human review increase at the same rate? The employee can generate faster, copy faster, analyse faster, upload faster and send faster. But management still has to review, approve, protect, verify and take responsibility.

This is what I increasingly see as the governance gap.

The issue is not that AI is doing something wrong simply because it is fast. The issue is that our organisational controls may still have been designed for a much slower world.

There are much larger debates about what happens if increasingly autonomous AI systems eventually exceed meaningful human control. Some people talk about AI controlling humanity or even posing an existential threat. I do not think anyone can state with certainty today how those scenarios will develop. They deserve serious research and discussion, but we do not have to travel that far into the future to understand why governance matters.

There is a much simpler question that every business can ask today:

Can your company control the AI that is already being used inside your company?

That question is no longer theoretical.

The Employee Leaves. What Happens to the AI?

One of the simplest examples is something that almost every business owner understands: employee turnover.

Imagine an employee who uses AI every day for company work. Perhaps the employee works in marketing, sales, administration, software development or management. The company pays the employee’s salary. The employee works with company customers and company information. Over time, AI becomes deeply integrated into that person’s workflow.

The employee may use AI to analyse customers, develop proposals, write reports, create marketing campaigns, solve technical problems, develop software, summarise meetings, research competitors and structure ideas. After one or two years, the AI environment may contain hundreds or thousands of conversations. Inside those conversations may be prompts, templates, customer context, project knowledge, instructions, research, workflows and many small pieces of organisational knowledge accumulated through daily work.

Then the employee resigns.

Most established companies already know what to do next. The laptop is returned. The company email account is disabled. CRM access is removed. Cloud storage permissions are revoked. Internal systems are locked. The employee exit checklist is completed.

But what happens if all that AI work was performed using the employee’s personal AI account?

Who owns the account? Who controls the conversation history? Where are the prompts? Where are the custom instructions and workflows? Can the company retain the knowledge that was created during employment? Can another employee continue the work?

Suddenly, what initially looked like an AI productivity issue becomes an ownership and business continuity issue.

The employee leaves, and potentially part of the company’s working knowledge leaves as well.

This is why I have increasingly returned to one very simple principle:

Keep Personal Personal. Keep Company Company.

This is not an entirely new management idea. Businesses went through similar transitions with email. We learned why company communication should not depend entirely on an employee’s personal Gmail account. We developed company servers, company databases, company cloud storage, company accounting systems and company-managed access because organisations eventually understood that business information needed ownership and continuity.

AI requires us to revisit the same principle in a new environment.

If an AI account is being used substantially for company work, management should at least know whose account it is, who controls it, what happens to access when the employee leaves, and how important organisational knowledge will be retained.

The Question Is Not Only Whose Account. It Is What Goes Inside.

Account ownership is only the beginning.

The more useful AI becomes, the more context we tend to give it. If we want AI to prepare a better proposal, we provide information about the customer. If we want AI to analyse a contract, we upload the contract. If we want it to understand a technical problem, we may provide source code. If we want it to analyse a business situation, we may give it meeting notes, financial information or internal strategy.

This creates an uncomfortable relationship between usefulness and governance.

The more context we give AI, the more useful it can become. But the more information we give AI, the clearer our information boundaries need to become.

What are employees currently putting into AI systems?

Customer information? Contracts? Internal meeting minutes? Financial information? Employee information? Source code? Business plans? Confidential documents? Strategic discussions?

The correct answer is not simply to declare that every AI platform is unsafe, nor is it reasonable to assume that every AI service handles information in exactly the same way. Different tools, subscriptions, enterprise environments and configurations can provide different levels of data control.

For management, however, there is an even more basic question.

Has the company itself decided what employees are allowed to put into AI?

If one employee thinks a customer contract is acceptable, another thinks it is prohibited, and a third has never considered the question, then the problem is not necessarily the AI platform. The organisation itself has not established the boundary.

If employees have to guess the boundary, management has not defined one.

That is a governance issue.

AI Wrote It. But Who Approved It?

There is another side to AI Governance that has less to do with what goes into AI and more to do with what comes out.

Imagine an AI system preparing a sales proposal. The proposal is beautifully written. It sounds professional, confident and complete. Somewhere in the document, however, the AI states that the project can be delivered within 30 days. The company’s actual operational capability requires 60 days.

The salesperson reads the document quickly, trusts the quality of the writing and sends it to the customer.

The customer accepts the proposal.

Now there is a problem.

Who is responsible?

The company cannot realistically resolve the customer dispute simply by saying, “The AI wrote it.”

AI can draft. AI can suggest. AI can analyse. AI can recommend. But the organisation still needs to establish who reviews important outputs, who approves them and who remains accountable for the decisions and commitments that follow.

This does not mean every AI-generated sentence needs to pass through three levels of management. That would defeat much of the productivity AI creates. Governance should be proportional to impact.

A brainstorming idea for an internal discussion may require only a light review. A customer proposal, financial analysis, contractual statement, engineering recommendation or other high-impact output deserves much stronger human verification.

The principle is straightforward:

The greater the potential consequence, the stronger the human review should be.

That is how governance supports speed rather than destroys it.

AI Amplifies What You Already Have

The more I think about these issues, the more they return me to another principle that has shaped my view of AI:

AI amplifies what you already have.

If an organisation already has clear processes, disciplined information management, responsible employees and clear ownership, AI can amplify those strengths. Good people become more productive. Good processes become faster. Knowledge becomes easier to use. Small teams can accomplish significantly more.

But amplification works in both directions.

If access is messy, AI can make messy access operate faster. If information management is poor, employees can move information outside the organisation faster. If accountability is unclear, decisions can be produced and acted upon faster without anyone knowing exactly who owns the consequence. If the underlying process is broken, automating it does not necessarily repair it. Sometimes it simply allows the broken process to operate at greater speed.

This is why I do not see AI Governance as an attempt to stop AI adoption.

Quite the opposite.

I want businesses to use AI aggressively where it creates value. But if we want to accelerate, we also need to improve the steering, the brakes and the rules of the road.

Practical AI Governance, particularly for SMEs, does not have to begin with a hundred-page document. It can begin with a few very practical areas: Account and Access, Data and Privacy, People and AI Usage, Output and Accountability, and Governance and Continuity.

From there, management can begin asking straightforward questions.

Which AI tools are actually being used inside our company? Are employees using company-managed accounts or personal accounts? What information are they putting into those systems? Do employees understand what should not be uploaded? Which AI-generated outputs require human review? Who remains accountable for the final result? Who oversees AI usage? And when an employee leaves, what happens to the company’s AI-related knowledge?

These are not futuristic questions.

They are operational questions that companies can ask today.

Before Governing the Future, Understand the Present

My growing interest in AI Governance does not come from wanting to become pessimistic about AI. It comes from the opposite direction. I have used AI deeply enough to appreciate just how powerful it is becoming.

I still want AI to become faster. I still want businesses to use more of it. I still believe that AI can dramatically amplify what individuals, SMEs and larger organisations are capable of accomplishing.

But the faster technology becomes, the more important it is that our ability to govern its use develops alongside it.

We cannot continuously upgrade the engine while ignoring the steering wheel and the brakes.

For that reason, I think the question business owners should ask is changing.

A few years ago, the question might have been:

“Should our company use AI?”

Then it became:

“How can our company use AI?”

Today, I think there is another question that deserves equal attention:

“Do we actually know how AI is being used inside our company, and are we still in control of it?”

Before we worry about governing some distant future in which AI becomes extraordinarily powerful, perhaps we should first understand what is happening inside our organisations right now.

That is where practical AI Governance begins.

Not with fear.

Not with banning technology.

Not necessarily with complicated regulation.

It begins with visibility.

Know which tools are being used. Know whose accounts they are. Know what information is going inside. Know what important outputs require review. Know who is responsible. Know what happens when people leave.

Once management can answer those questions, governance becomes something practical rather than abstract.

And if management cannot answer them yet, that does not mean the company has failed.

It simply means it is time to start looking.

A Practical Starting Point

At OPERION, we have developed a Practical AI Governance Readiness Assessment to help businesses begin that process. The assessment looks at five practical areas: Account & Access, Data & Privacy, People & AI Usage, Output & Accountability, and Governance & Continuity.

It is not a certification. It is not an audit, and it is not a legal opinion or declaration of regulatory compliance. Its purpose is much simpler: to help management see what is happening today, identify areas that may deserve attention and decide what should be examined next.

Businesses that want to understand their situation more deeply can also invite OPERION to conduct a complimentary preliminary AI Governance assessment with their management team. The objective is not to arrive with a predetermined solution. It is to understand the existing environment first.

I believe strongly in one sequence:

Assessment first. Prescription second.

AI will continue to develop. It will become more capable, more integrated into everyday work and, very likely, much faster.

We should embrace the opportunity.

But as we accelerate, we should make sure our governance can accelerate with it.

Because AI amplifies what you already have.

The question is whether we understand what we are allowing it to amplify.

Ts. Lukas J. Tan
Founder & CEO, OPERION Ecommerce & Software Sdn Bhd
Practical AI Governance | Digitalisation | AI & Business Systems

By Ts. Lukas J. Tan
Written on 6 September 2026 | Penang, Malaysia

Technology has always changed the value of human labour. Machines reduced the need for physical labour, software reduced the need for certain administrative work, and artificial intelligence is now beginning to reduce the amount of human effort required for many forms of knowledge work. I do not believe this means that human beings will become unnecessary. But I do believe that many things we once considered difficult, specialised or expensive will become easier to accomplish with fewer people. When that happens, we should not only ask what AI will do to jobs. We should also ask what it will do to the institutions that were built to prepare people for those jobs.

This brings me to universities.

The Degree Became the Product

For a long time, the role of a university was relatively clear. Universities educated people, developed specialised knowledge and issued recognised qualifications. Students went to university because knowledge was concentrated there, employers valued degrees, and a certificate provided evidence that a person had completed a certain level of education. For many families, particularly in countries such as Malaysia, the degree also represented something larger. It was associated with social mobility, professional status and the hope of a more secure future.

Over time, however, something gradually changed. Education remained important, but the certificate itself became increasingly important. Students did not necessarily enter university only because they wanted knowledge. They needed the qualification because the labour market asked for it. Employers used degrees as filters, parents regarded them as a form of security, and young people naturally followed the pathway society had created for them. A degree became both an educational experience and a ticket into parts of the employment market.

There is nothing inherently wrong with this system. Universities have contributed enormously to human development, and I would never argue that education is unnecessary. But the assumptions supporting this model deserve to be reconsidered because the environment around universities is changing very quickly.

When Industry Becomes the University

One change I have been observing in Malaysia is the growing involvement of industry in education. More companies and industrial groups are establishing their own academies, training centres and education programmes. Some have gone further into colleges and university-level education. I cannot speak for the motivation of every organisation, and there are certainly different reasons behind each institution. But from an industry perspective, one reason is easy to understand. Companies need talent that can actually function in their environment. When graduates do not arrive with the exact capabilities an industry requires, companies naturally begin to train people themselves.

In some ways, this is a sensible development. A manufacturer understands its machinery, processes and workforce requirements better than an outsider. A technology company understands the systems and tools its people need. An industry can therefore design training around actual problems instead of waiting for a general curriculum to catch up.

But when more industries begin becoming education providers themselves, another question appears. How many universities, colleges and academies does a country ultimately need?

Malaysia's Numbers Tell Two Stories at Once

Malaysia already has a substantial higher-education ecosystem. According to the Malaysia Higher Education Blueprint 2026–2035, using 2024 higher-education statistics, Malaysia had 544 higher-education institutions and approximately 1.35 million enrolled students. The private higher-education landscape alone included 64 universities, 36 university colleges, 271 colleges and 11 foreign university branch campuses.

At the same time, Malaysia is moving through an important demographic transition. According to the Department of Statistics Malaysia (DOSM), Malaysia’s total fertility rate stood at 1.6 children per woman in 2024, below the replacement level.

I believe those two developments deserve to be considered together.

If the supply of education continues expanding while future generations become smaller, competition for students will inevitably intensify. AI could add another layer of pressure by changing how young people think about learning itself.

The Competition for Students Is Already Visible

We can already see signs that higher education has become a much more competitive market. Twenty years ago, I do not remember universities competing for attention in quite the same way they do today. Now university advertisements are everywhere. We see them along roads, on social media, through digital advertising, at education fairs and through increasingly sophisticated student recruitment campaigns.

There is nothing wrong with a university advertising. Every institution needs to communicate with its market. But the intensity of recruitment tells us something important. Universities are increasingly competing for student numbers.

That competition may become much more difficult in the coming years, because AI is changing one of the fundamental reasons people historically needed educational institutions: access to knowledge.

What AI Changed for Me

This is where my view is influenced strongly by my own recent experience.

I have managed a technology company for more than a decade. Yet I have never considered myself the strongest technical person in my company. I understand business logic, system architecture, processes, how different components connect and what a system ultimately needs to achieve. But there have always been technical areas where my programmers knew considerably more than I did. That was normal. They spent years developing those skills, while my role required me to focus on a different level of the business.

Then AI changed something for me.

After spending an intensive period working deeply with AI, I found myself understanding areas that had remained outside my practical capability for years. In roughly a month, I was able to explore programming concepts, infrastructure, deployment, automation and technical workflows at a speed I had never experienced before. By September 2026, I found myself able to oversee multiple client projects while using several computers and AI systems to assist different parts of the work.

The Distance Between Not Knowing and Knowing Enough

I want to be careful about what this experience means. One month with AI did not magically give me the depth of an engineer who has spent ten or twenty years mastering a discipline. Experience still matters. Deep technical judgement still matters. Security, architecture, reliability and understanding what happens when things go wrong still require expertise.

But something significant did change.

The distance between “I don’t know how to do this” and “I can understand this well enough to make it work” became dramatically shorter.

That is the part that should interest universities.

For centuries, knowledge was scarce. If you wanted to understand an advanced subject, you needed to find the right books, the right teacher, the right institution or the right expert. Today, a person can begin with almost no knowledge of a subject and have an AI system explain it, simplify it, challenge them, answer questions, generate examples and help them apply what they have learned immediately.

The AI can be wrong, of course. That is precisely why judgement and critical thinking become even more important. But the cost and speed of acquiring practical knowledge have nevertheless changed.

Four Years, Measured in Time, Not Just Money

This leads to a question that I believe students and parents will increasingly ask: if I spend three or four years obtaining a degree, what exactly am I receiving in exchange for those years?

We normally calculate the cost of university in money. Perhaps we should also calculate it in time.

Four years is a significant portion of a young person’s life. Imagine an 18-year-old who enters university and graduates at 22. Now imagine another 18-year-old who spends the same four years intensely studying one field using AI, working with industry, building products, doing research, creating a company, failing, learning from those failures and producing real evidence of what he or she can do.

At 22, who is ahead?

The answer is not automatically the second person. A strong university student may have developed deeper theoretical understanding, powerful friendships, professional networks, exposure to research and intellectual discipline. Certain professions also cannot responsibly be reduced to self-learning. I would certainly not want doctors, civil engineers or other safety-critical professionals qualifying themselves simply because an AI told them they understood the subject.

But for many other areas, the comparison is becoming legitimate.

If one person can show a certificate while another can show four years of actual work, products, research, clients, experiments and results, employers will increasingly have more than one way to judge capability.

The degree is no longer the only signal.

What University Still Gives You

This is why I do not believe the correct conclusion is that university will become useless. My own experience tells me otherwise. University provides things that are difficult to measure on a transcript. It gives people an environment in which to grow. It creates friendships and networks. It exposes young adults to people from different backgrounds. It provides structure, discipline, mentors and intellectual challenges.

Most importantly, good education develops the ability to think.

I can often see the difference between someone who has learned how to analyse a problem and someone who simply knows how to repeat information. The ability to structure an argument, question assumptions, evaluate evidence and make a judgement remains extremely valuable.

People Who Know How to Learn vs. People Waiting to Be Taught

But here again AI creates an interesting challenge.

A person who knows how to use AI properly can also develop these capabilities outside a traditional classroom. AI can challenge an argument. It can present opposing positions. It can become a tutor. It can explain a subject at different levels. It can help someone experiment and immediately turn an idea into something tangible.

The important distinction in the future may therefore not be between people who went to university and people who did not. It may be between people who know how to learn and people who are waiting to be taught.

The Risk of a Higher-Education Bubble

This is why I believe there is a risk of a higher-education bubble.

By “bubble,” I do not mean that universities will suddenly collapse or that degrees will have no value. I mean that we may be creating more educational capacity based on assumptions about student demand and the value of traditional qualifications that could change faster than institutions expect.

Several forces are moving at the same time. Birth rates are declining. Industries are developing their own talent pipelines. Online education continues improving. Alternative credentials are becoming more accepted. People can work and earn money across borders without physically moving. AI is dramatically reducing the friction involved in self-learning and creation. Meanwhile, more institutions are competing for the same young people.

If these trends continue, something eventually has to adjust.

Why Government Still Has a Role

This is also why government has a role to play. Higher education cannot be treated purely as an ordinary commercial market where unlimited supply is always assumed to create healthy competition. When an educational institution fails, the consequences affect more than shareholders. Students may lose years. Parents may lose savings. Staff lose careers. Qualifications can become uncertain. Communities can be affected.

The question for government should therefore not simply be how many universities a country has. The more important questions are what outcomes those universities produce, whether graduates genuinely develop useful capabilities, whether programmes respond to changing economic realities, and whether institutions are financially and academically sustainable.

Access to Knowledge Is Not Access to Opportunity

At the same time, we need to be socially conscious about the alternatives we promote.

It is easy for someone with a laptop, reliable internet access, business experience and confidence to say that everyone can simply learn with AI. Reality is more complicated. Not every young person has the same environment. Some need the structure of university. Some need access to laboratories and equipment. Some need teachers because they have never learned how to teach themselves. Some need university networks because their families have no professional networks of their own.

For these students, university can still be an extraordinary engine of social mobility.

AI may make knowledge more accessible, but access to knowledge is not the same as access to opportunity.

How Universities Could Evolve

That is why the solution cannot simply be to close universities or tell young people not to study. The more constructive question is how universities should evolve.

Perhaps universities should stop seeing themselves primarily as places that deliver information and qualifications. Information is becoming abundant. Instead, universities could become environments that transform information into judgement, experience, relationships and capability.

Students could spend less time reproducing answers in examinations and more time solving real problems. Industry projects could become part of education rather than something students encounter only after graduation. AI could provide personalised tutoring while professors spend more time challenging assumptions, mentoring students and developing deeper thinking. Students could graduate not only with transcripts, but with portfolios demonstrating what they have actually built, researched, solved and contributed.

The university might also become less of a one-time four-year destination and more of a lifelong platform. People could move between employment and education repeatedly, learning what they need when they need it instead of attempting to predict at 18 everything they will need for the next 40 years.

Industry academies could also have an important role, but they should complement rather than simply duplicate universities. Industry understands immediate workforce needs; universities should retain the ability to think beyond the immediate needs of a particular employer. Society needs both.

This balance is important because education has a responsibility beyond employability. Universities also develop researchers, preserve knowledge, challenge society, study problems that have no immediate commercial return and provide spaces where ideas can be explored independently. If education becomes only training for today’s jobs, we may prepare people perfectly for industries that disappear tomorrow.

The Real Question for 2026

The deeper issue, therefore, is not whether AI will kill universities.

I do not think it will.

What AI may destroy is the assumption that universities have a monopoly over advanced learning.

That monopoly is already weakening.

Knowledge can come from almost anywhere. Skills can increasingly be demonstrated directly. Companies can train their own people. A teenager with the right tools can create something that once required an entire technical team. An experienced businessperson can use AI to enter technical areas that previously seemed inaccessible. A person with curiosity, discipline and judgement has access to learning capabilities that previous generations could hardly imagine.

Universities still have enormous value, but increasingly that value must be demonstrated rather than assumed.

Perhaps the most important question for a university in 2026 is therefore no longer, “What courses should we offer?”

The more difficult question is:

“What can a young person become after spending four years with us that he or she could not become after spending four years learning, building and creating with AI?”

If universities can answer that question convincingly, they have a powerful future.

If they cannot, the greatest threat may not be another university opening across the road.

It may be an 18-year-old sitting at home with a laptop, an AI system, four years of time and a very clear idea of what he or she wants to build.

And that is why, writing this in September 2026, I believe the discussion about the future of universities should begin now. Not because education is becoming less important, but because learning is becoming more accessible than at any other point in human history.

The institution that once controlled access to knowledge now has to compete in a world where knowledge is everywhere.

Its future will depend on what it can offer beyond knowledge.

I just shipped my first open-source project — a small thing, an animated row-deletion pattern for web apps. Nothing world-changing. But building it with an AI coding agent sitting next to me the whole time made me want to understand something I’d been taking for granted: where did these tools actually come from? What are they trained on? Who built them, and why? This is my attempt to trace that history — partly for my own understanding, partly because I think more builders should know the story of the tools they now depend on every day.

Before the agents: a foundation laid in 2017

Almost every AI coding tool in use today — Copilot, Codex, Claude, Gemini — traces back to one research paper: “Attention Is All You Need,” published by a team at Google Brain in August 2017. It introduced the Transformer architecture, which replaced the older, slower recurrent neural networks with a mechanism called “attention” — letting a model weigh the relationships between every word (or token) in a sequence simultaneously, rather than processing text one piece at a time.

This sounds abstract, but the practical effect was enormous: Transformers could be trained in parallel, at far larger scale, on far more data, than anything before them. Nearly every large language model since — GPT, BERT, Claude, Codex — is built on this same architectural foundation. The paper wasn’t about code at all; it was about machine translation. But the architecture turned out to generalize to almost any sequence of symbols, including programming languages.

The raw material: where does the “code knowledge” come from?

Before any model can write code, it has to learn from code that already exists. And overwhelmingly, that code comes from one place: public repositories on GitHub, supplemented by GitLab and a handful of other sources.

The most direct example is a dataset called The Stack, built by the BigCode Project (a collaboration between Hugging Face and ServiceNow). The Stack v1 contains over 6TB of permissively-licensed source code across 358 programming languages; The Stack v2 scaled that to over 3 billion files across 600+ languages. It exists specifically to train open, transparent code-generation models — and, notably, it lets developers request their code be removed from it, an acknowledgment of the ongoing debate around consent and public code being used this way.

OpenAI’s own Codex paper (2021) was explicit about its sourcing: the model was trained on 159 gigabytes of Python code pulled from 54 million public GitHub repositories, plus substantial amounts of JavaScript, TypeScript, Go, Ruby, C++, C#, Java, PHP, Swift, and more.

This is the uncomfortable-but-important fact at the center of this whole story: the reason today’s AI can write code fluently is that millions of developers, over nearly two decades, wrote code in public and explained it in READMEs, comments, and commit messages — not knowing, in most cases, that it would eventually become training material for machine intelligence. GitHub, with over 630 million repositories today (395 million of them public), is functionally the largest library of “how humans write and explain software” that has ever existed. GitLab contributes to this too, at meaningfully smaller scale, since GitHub remains the dominant home for public open-source work.

From autocomplete to Codex (2021)

The first real bridge between “a language model” and “a tool a developer actually uses” was OpenAI Codex, published as a research paper in July 2021 and released as an API that August. Codex was essentially GPT-3, fine-tuned specifically on code. It became the engine behind GitHub Copilot, which launched in technical preview in June 2021 and to the public in October 2021 — the first mainstream “AI pair programmer,” living directly inside your editor, suggesting completions as you typed.

This was a genuinely new category of tool. Before Codex/Copilot, code intelligence meant autocomplete based on syntax rules and static analysis — useful, but fundamentally mechanical. Copilot could suggest an entire function based on a comment describing what it should do. It felt, to a lot of developers in 2021 and 2022, like a genuine step-change.

By March 2023, the original Codex model itself was quietly retired — superseded by GPT-3.5 and GPT-4, which had absorbed vastly more code training data at greater scale and no longer needed a separately fine-tuned “code model” to be good at code.

A different lineage: why Anthropic exists at all

Claude comes from a different origin story entirely — one rooted less in “let’s build the best product” and more in a disagreement about how fast and how carefully AI should be developed.

Anthropic was founded on January 26, 2021, by siblings Dario Amodei and Daniela Amodei, along with five other researchers — all of whom had left OpenAI a few months earlier. Dario had been OpenAI’s VP of Research; Daniela had been VP of Safety and Policy. The group’s departure and the founding of Anthropic were driven by a belief that AI capability was scaling faster than the industry’s understanding of how to keep it safe and steerable. Anthropic was built, from day one, as an “AI safety company” — its research agenda (interpretability, alignment, constitutional AI) has always been positioned as core to the product, not an afterthought bolted onto a capabilities race.

Claude, Anthropic’s model family, launched publicly not long after, and the company has since scaled Claude into a full family of models (the naming conventions have shifted over time — Claude 3, Claude 4, and now the Claude 5 family, including the very model that helped write and structure this article).

The agentic turn: from suggesting code to doing the work

For a few years, both lineages — Copilot/Codex and Claude — mostly did the same basic thing: suggest code, complete a line, answer a question in a chat window. The human stayed in the driver’s seat for everything else: running commands, navigating files, testing, committing, deploying.

That changed with what’s now called agentic coding. Claude Code, Anthropic’s terminal-based coding agent, is a useful case study in how fast this shift happened. It reportedly started as one engineer’s side project during his first month at Anthropic, in September 2024. It launched as a limited research preview on February 24, 2025. Less than a year later, it had reportedly passed a $1 billion annualized revenue run rate — one of the fastest revenue ramps in software history.

What changed technically wasn’t just a bigger model — it was giving the model tools: the ability to read a whole codebase, run shell commands, execute tests, edit multiple files, and iterate on failures, all in a loop, with much less moment-to-moment human steering. The AI stopped being an autocomplete engine and started being something closer to a junior engineer you could hand a task to.

OpenAI moved the same direction with Codex — not the 2021 model anymore, but a 2025-era agentic coding product carrying the same name, repositioned entirely around autonomous task completion rather than line-by-line suggestion.

The lines blur: competitors become co-dependents

One detail that surprised me researching this: GitHub — Microsoft’s platform, and historically OpenAI’s closest coding-AI partner — now also ships Claude. Starting in October 2024, GitHub Copilot added Claude 3.5 Sonnet as a selectable model alongside OpenAI’s own, explicitly framed as “developer choice.” By February 2026, GitHub had Claude and Codex both available as coding agents inside Copilot, and in November 2025, Microsoft committed to continued Claude access across its entire Copilot family.

In other words: the platform most associated with OpenAI’s Codex now also distributes its safety-focused rival’s models, because customers wanted the choice. The AI coding landscape in 2026 isn’t really “Team OpenAI vs. Team Anthropic” — it’s a layered stack where the same underlying platforms (GitHub, GitLab) host the training data, the code, and increasingly the AI tools themselves, often from multiple competing labs at once.

Why this history matters to me right now

I didn’t write this because I think anyone’s waiting for another “history of AI” article. I wrote it because I just spent a session shipping a small open-source library with an AI agent doing a large share of the actual work — writing the backend, catching a privacy mistake I made, walking me through GitLab and GitHub settings I’d never touched, even helping me submit a pull request to a 35,000-star community project.

That whole experience only exists because of the chain this article traces: a 2017 research paper about language translation, that turned into an architecture general enough to learn code, trained on the accumulated public work of millions of developers who never expected their GitHub commits to become raw material for a machine’s understanding — built by two different companies with two different philosophies about how fast to move, now converging on the same category of tool: an agent that doesn’t just suggest code, but does the work.

I’m not a machine learning researcher. I’m someone who builds things — in software, and now, apparently, in the open-source world too. But understanding the tools I use, not just using them, feels like the right instinct for whatever comes next in this industry. This is a start.

Sources referenced in this piece

• Attention Is All You Need (Wikipedia)
• OpenAI Codex (language model) — Wikipedia
• GitHub Copilot — Wikipedia
• The Stack dataset — Hugging Face / BigCode Project
• Anthropic — Wikipedia
• Dario Amodei — Wikipedia
• What Is Claude Code? Full History, Timeline & How It Works — Taskade
• Bringing developer choice to Copilot with Anthropic’s Claude 3.5 Sonnet — GitHub Blog
• Microsoft, NVIDIA and Anthropic Announce Strategic Partnerships

By Ts. Lukas J. Tan | 6 September 2026

This morning, 6 September 2026, I came across a social-media post about China’s progress in the global brain-computer interface (BCI) race. It immediately reminded me of a conversation that Elon Musk helped bring into the mainstream through Neuralink: the possibility that the boundary between the human brain and computers may one day become increasingly thin. Not very long ago, putting a chip into the human brain belonged largely to science fiction. Today, brain-computer interfaces are being tested on humans, governments are treating the field strategically, and the conversation is gradually shifting from whether such technology is possible to how far it should go.

Social-media headlines should always be treated carefully, particularly when they declare that one country or company has become the “world’s first”. What matters to me is not whether China, the United States, Neuralink or another organisation can claim technological leadership today. The more important signal is that brain-computer interfaces are moving from imagination towards reality, while some of the world’s most powerful governments, researchers and entrepreneurs now regard human-machine integration as a serious technological frontier.

There is also a governance question hidden inside that technological race. When technology begins interacting directly with the human brain, the discussion can no longer be limited to innovation, investment and national competitiveness. Questions of consent, privacy, neural-data ownership, medical safety, cybersecurity, accessibility and human autonomy become equally important. If a computer can one day interpret signals from our brains, who owns that information? Who may store it? Can it be transferred to another company? What protection should exist against discrimination based on neurological data? And if such technologies eventually enhance human capabilities rather than merely restore lost functions, will access be determined by medical need or by the ability to pay?

These questions may sound premature, but governance is most useful when it develops alongside innovation rather than after society has already become dependent upon it. We have seen this pattern before with social media, personal data and artificial intelligence. Technology often develops faster than the rules, institutions and social norms required to manage its consequences.

Yet strangely, after reading about the brain-chip race, my thoughts travelled somewhere completely different.

I started thinking about the funeral industry.

At first, the connection sounds almost absurd. What does a brain chip have to do with funeral homes, crematoriums, burial grounds or memorial services? But this is precisely what interests me when thinking about the future. When a technology emerges, we naturally concentrate on its immediate market. We ask which companies will win, what products will emerge and which jobs might disappear. The consequences that interest me more are often further away: the second-, third- and fourth-order effects that appear only after technology begins changing human behaviour and social structures.

If technology changes how we work, it changes how we use our time. If it changes how we use our time, it can influence relationships, caregiving and family formation. When families change, demographics change. And when demographics change for several generations, almost every institution and industry eventually feels the effect—including industries that appear to have nothing whatsoever to do with technology.

That was the chain of thought that began with a brain chip.

A Demographic Change Is Also a Social Change

Long before brain chips become commonplace, another enormous transformation is already happening around us: the world is producing fewer children.

The United Nations’ World Population Prospects 2024 estimated that global fertility has fallen substantially over recent generations, from approximately 3.3 births per woman in 1990 to around 2.25 today. More than half of the world’s countries and territories are already below the replacement fertility level of approximately 2.1 births per woman. Low fertility is therefore no longer an isolated demographic problem belonging only to Japan, South Korea or a handful of European economies. It is becoming a structural issue across a growing part of the world.

It would be easy to look at these numbers purely as statistics. I think that would miss the human story behind them.

People do not decide whether to have children according to a demographic chart. They make those decisions within the realities of their lives: whether housing is affordable, whether employment feels secure, whether childcare is available, whether they have time to care for ageing parents, whether a career can coexist with parenthood, and whether raising a family feels economically and emotionally sustainable.

For women especially, the question can involve difficult trade-offs between professional opportunities, caregiving expectations and motherhood. For younger generations generally, delaying marriage or parenthood may not simply represent changing values; it may also reflect the economic environment they have inherited.

Therefore, falling fertility should not automatically be framed as young people “refusing” to have children. It should also prompt governments, employers and communities to ask whether the societies we are building make family life realistically sustainable.

China is particularly important because of its scale, but the issue extends much further. Demographic change moves slowly through society, almost like a wave travelling from one institution to another. Fewer births eventually mean fewer pupils entering schools. Later, universities compete for a smaller student population. Eventually, fewer young people enter the labour market. Housing demand changes, consumption patterns change, healthcare requirements change and a smaller working population may have to support a larger retired population.

A child who is not born today does not change the labour market tomorrow morning. But that missing person will never enter the workforce twenty years from now.

The same delayed effect eventually reaches the funeral industry.

We tend to regard funeral services as one of the few businesses with permanent demand because death itself cannot disappear. Every person alive today will eventually die. From a demographic perspective, however, there is an important distinction between the certainty of death for an individual and the number of deaths occurring within an entire society.

In the near and medium term, ageing populations could actually create greater demand for funeral and memorial services. Therefore, I would not argue that declining fertility means funeral businesses are about to decline tomorrow. The demographic lag could take decades.

My question concerns what happens afterwards.

Imagine a country remaining significantly below replacement fertility for thirty, forty or fifty years. Each generation becomes smaller than the one before it. Eventually, the large older generations pass away. Behind them are smaller middle-aged generations, followed by even smaller younger generations. Unless migration or a meaningful recovery in fertility compensates for that decline, the total population eventually contracts.

At that point, even the business of death encounters demographic mathematics.

Fewer births today can eventually mean fewer deaths decades later.

But this should not be viewed merely as a prediction about market size. A shrinking and ageing society creates much broader responsibilities. There may be fewer working-age adults caring for more elderly people. More people may grow old without children. More people may live alone. Governments may face greater pressure on healthcare, pensions and long-term care, while communities confront questions about loneliness, social isolation and who takes responsibility when family support is no longer available.

The future of the funeral industry is therefore only one small part of a much larger social transformation.

AI May Save Time Without Giving Us More Life

This is where artificial intelligence enters my thinking.

One of AI’s strongest promises is productivity. Work that previously required hours can increasingly be completed in minutes. Research can be accelerated, documents drafted, information analysed, software developed faster and repetitive administrative work automated. As AI agents become more capable, one person may eventually perform an amount of work that previously required several people.

Logically, greater productivity should mean that human beings become less busy.

I am not convinced that this will necessarily happen.

History suggests that when technology increases human capacity, society frequently responds by increasing its expectations. Email made communication faster, yet it did not necessarily reduce the amount of communication expected from us. Smartphones enabled us to work from almost anywhere, but they also made us reachable almost everywhere. Cloud technology made information accessible twenty-four hours a day, while simultaneously allowing work to follow us beyond the office.

AI could take this pattern much further. If someone becomes twice as productive with AI, the economic outcome may not be that the person works half the day and spends the remaining hours with family. The organisation may simply redefine what one employee is expected to accomplish. What once required five people might be assigned to two. What once took a week may be expected tomorrow.

This is not merely a productivity question. It is a governance and leadership question.

If AI creates enormous productivity gains, we will eventually need to ask who receives the benefit. Does it appear only as higher output and lower labour costs, or can some of that productivity be returned to human beings in the form of better work, greater flexibility, more family time, lifelong learning and improved quality of life?

Technology itself cannot answer that question. Leaders, organisations and public policy will.

This matters because decisions about having children are influenced by far more than biology. Housing, financial security, working hours, childcare, education, relationships, career expectations and the distribution of caregiving responsibilities all contribute to the environment in which people decide whether parenthood is possible.

It would therefore be too simplistic to say that AI will reduce fertility. But it is reasonable to ask whether an AI-enabled economy could unintentionally intensify conditions already making family formation difficult.

This creates what I see as one of the great paradoxes of the coming AI era: we may invent machines specifically to save human time, yet create an economic system that immediately consumes every minute those machines save.

The real measure of AI progress should therefore not be productivity alone. A society that produces more but leaves people with less time for family, community, health and human relationships may be technologically efficient without necessarily becoming more human.

When Technology Moves From Our Hands Into Our Bodies

The brain-chip conversation, made globally visible in large part by Elon Musk and Neuralink, introduces an even more fundamental governance challenge. Until recently, most digital technology existed outside us. Computers sat on desks, smartphones moved into our pockets and smartwatches onto our wrists. Brain-computer interfaces represent a much more intimate frontier: technology interacting directly with the human nervous system.

This naturally raises questions about long-term health and biological exposure, but here we should be careful about separating evidence from speculation. Current scientific evidence does not justify stating as fact that AI devices, ordinary wireless technologies or brain-computer interfaces cause declining human fertility. Researchers have investigated radiofrequency electromagnetic fields and reproductive indicators, including sperm motility and oxidative stress, but findings remain mixed and do not establish a simple causal relationship.

For me, however, the absence of a proven answer does not make the question irrelevant. It tells us where further research and governance will be needed.

The technological environment surrounding a human being in 2050 or 2070 could be fundamentally different from today. We may live continuously alongside intelligent environments, autonomous systems, wearable AI, augmented-reality devices and perhaps implanted interfaces. What are the biological, psychological and social consequences of living within such an environment for fifty or seventy years? We cannot yet answer that confidently.

The responsible approach is neither to create fear without evidence nor to assume that every innovation is harmless until proven otherwise. It is to continue research, establish appropriate safeguards and ensure that commercial competition does not move faster than our ability to protect human wellbeing.

Brain-computer interfaces make this particularly important because brain data is unlike ordinary personal data. A password can be changed. A credit card can be cancelled. Neural information may reveal something far more intimate about an individual. As these technologies develop, societies may eventually need concepts such as neural privacy, cognitive liberty and explicit rights over brain-generated data.

The technological race therefore should not simply be about who becomes first.

There is another race that matters just as much: who can build the governance capable of making the technology trustworthy?

From the Funeral Industry to the Question of Human Dignity

Following these trends further changed my original question. Perhaps the future challenge for funeral businesses is not simply whether there will eventually be fewer funerals. A deeper transformation could come from the changing structure of the family itself.

Funeral traditions were developed around families and communities. This is especially visible across Asian cultures. When a person dies, children, grandchildren, siblings, relatives and friends participate in the process. Someone organises the funeral, someone handles burial or cremation, someone maintains the grave or memorial, and someone carries family memories into the next generation.

But what happens after several decades of very low fertility?

A family with five children and fifteen grandchildren has a very different support structure from a family with one child. A couple without children has another structure entirely. As more people grow old alone or without descendants, society will face questions extending far beyond the funeral ceremony itself.

Who supports someone through the final years of life? Who makes decisions when that person loses capacity? Who arranges the funeral? Who maintains the memorial? Who protects their possessions and records? And who makes sure that a person without descendants receives the same dignity at the end of life as someone surrounded by a large family?

These are not simply commercial opportunities. They are social responsibilities.

Governments, healthcare providers, communities and businesses may eventually need new systems for people ageing without traditional family support. Funeral providers could become part of that ecosystem, but their future role may extend beyond handling death towards protecting dignity, memory and legacy.

The digital dimension makes this even more significant. People already leave enormous digital footprints: photographs, videos, emails, social-media accounts, cloud files, messages, voice recordings and years of written communication. AI could eventually organise these materials into detailed personal histories and interactive memorials. People may begin planning their digital legacy before death in much the same way they prepare wills or insurance today.

This could transform part of the funeral industry into something broader: a legacy industry.

Yet this transformation will also require governance. Who owns a deceased person’s data? Should a company be allowed to create an AI representation of someone who never consented to it? Who has the right to deactivate such a representation? Can someone’s voice or likeness continue to be commercially exploited after death? Should an AI simulation of a deceased parent be available indefinitely to a child?

The technology to do some of these things may arrive before society has decided whether they should be done.

That is why innovation and governance cannot be separated.

The future funeral provider may eventually preserve not only physical remains but digital identity and human memory. If that happens, the industry will inherit an enormous responsibility: to protect dignity after death in the same way that other institutions are expected to protect dignity during life.

The Future Is Not Only About What We Can Build

I am deliberately recording these thoughts on 6 September 2026 because observations about the future are easy to make after the future has arrived.

I do not know whether the funeral industry will ultimately shrink. I do not know whether global fertility will remain low for the rest of this century. Governments may develop more effective family policies. Migration may reshape national populations. Medical science could extend healthy lifespan substantially. AI could ultimately give people greater freedom rather than increasing work pressure. Technologies we cannot yet imagine could change every assumption in this article.

Nor am I suggesting a simple relationship of brain chips causing lower fertility and lower fertility causing the funeral industry to collapse. Human society is far too complex for such a straight line.

What interests me is the chain of signals.

Brain-computer interfaces tell us that technology is moving closer to the human body. Artificial intelligence tells us that the relationship between labour and productivity is changing. Falling fertility tells us that family formation and population structures are changing. Ageing societies tell us that responsibility between generations will become increasingly difficult. Digital identity tells us that what a person leaves behind after death is becoming much larger than physical possessions.

Individually, none of these signals tells us exactly what society will look like in 2050 or 2070. Together, however, they encourage us to ask questions earlier.

When Elon Musk helped bring brain chips into mainstream conversation, the obvious question was what a brain-computer interface could enable. As China accelerates its own ambitions, another obvious question is who will lead the technological race.

I increasingly believe there is a more important question: what kind of society are we creating if all of this succeeds?

Technology changes human capability. Capability changes expectations. Expectations influence behaviour. Behaviour affects families. Families shape demographics. Demographics reshape economies and industries. At every stage of that chain, however, there is also a governance decision. We can decide how technology is regulated, how productivity gains are shared, how families are supported, how ageing populations are cared for, how personal data is protected and how dignity is preserved after death.

That is why technological progress should not be measured only by what becomes technically possible.

A country can win a technology race and still face profound social challenges. A company can achieve extraordinary productivity while its people struggle with time and family. An industry can successfully digitise itself while failing to protect the dignity and privacy of the people it serves.

The future I am interested in is therefore not simply a more advanced future.

It is a future in which innovation, society and governance advance together.

Perhaps decades from now, the funeral industry will remain largely as we know it today. Perhaps population decline will eventually reduce its traditional volume. Perhaps it will evolve into an industry centred as much on memory, identity and legacy as on death itself. I cannot know which outcome will prevail.

What I can do is record what I saw from where I was standing.

On 6 September 2026, a story about China and the brain-chip race reminded me of a conversation Elon Musk helped bring into public consciousness years earlier. But instead of making me think only about the future of computers, it made me think about the future of people: how we work, how we build families, how we age, how we care for one another, and eventually how we preserve dignity when a human life comes to an end.

Whenever I encounter a new technology today, I try not to stop at the most immediate question: what can this technology do?

I try to follow it further and ask: if this becomes normal, what else will change—and are our society and governance ready for what follows?

Because perhaps the most important measure of technological progress will not be how closely we can connect humans to machines.

It will be whether, after doing so, we still know how to put human beings first.

We Used to Build. Then AI Changed the Equation

Over the past year, my team and I have built many internal systems to make our business operations smoother, faster and more efficient. Some of these systems were created for email management, message polishing, data scraping, email blasting, proposal writing and other repetitive business tasks that, at the time, genuinely required dedicated tools. We built them because they solved real problems. They reduced manual work, gave us greater control over our processes and allowed us to operate more efficiently. Like many technology companies, we believed that building our own systems was a sign of progress. If there was a business problem, we would design a workflow, write the code and create a solution around it.

Then AI arrived, and the equation changed far more quickly than most of us expected.

Many tasks that previously justified building an entire internal system can now be completed through AI with dramatically less effort. Writing and polishing business messages no longer requires the same kind of dedicated workflow. Proposal writing can be accelerated with AI. Research, content drafting, data processing and even parts of software development can now be handled in ways that would have sounded unrealistic only a few years ago. When the technology around us changes this quickly, the question is no longer simply, “What else should we build?” The harder and more important question becomes, “What should we stop maintaining?”

The Weight of What We Never Deleted

That was the question I found myself confronting this year.

We had several systems and projects sitting on our servers that had not been actively used for a long time. Some were internal tools that had been replaced by better solutions. Others were old client projects, dummy environments or discontinued applications that remained there simply because nobody wanted to delete them. They were not necessarily causing an immediate problem, but they occupied space, consumed attention and represented another layer of complexity inside our technical environment. More importantly, they carried a strange emotional weight. Anyone who has spent time building software will understand this feeling. You remember the effort that went into a project. You remember the nights spent debugging it, the ideas behind it and the moment it finally worked. Even when the system has become irrelevant, deleting it can feel like throwing away part of your own history.

For years, some of these projects remained untouched because of the same familiar thoughts: perhaps we might need them one day; perhaps there was something useful hidden inside; perhaps we should keep a backup just in case; perhaps it was safer not to touch anything. This is how digital clutter accumulates. One inactive project becomes five. Five become twenty. Old databases sit beside new ones. Forgotten backups remain in folders. Temporary files become permanent. Nobody remembers which version is important anymore. Eventually, a server begins to resemble a storeroom that has not been cleaned for ten years.

This Year, I Decided Enough Was Enough

This year, I decided that enough was enough.

Some of those projects had been sitting not only on our servers, but also in my mind, for several years. I knew they were no longer useful, yet I still felt reluctant to remove them. This year, and especially over the past few days, we finally deleted them completely. Not moved into another folder. Not renamed as “OLD”. Not archived somewhere simply to avoid making a decision. Deleted.

The feeling was unexpectedly liberating.

Transformation Is Not Always About Adding

It reminded me that digital transformation is not always about adding something new. Sometimes transformation begins with the courage to remove what no longer belongs. In business, we often celebrate expansion. We talk about adding new platforms, new automation, new software, new AI tools and new systems. Very rarely do we celebrate subtraction. Yet every new digital layer creates another responsibility: another login, another database, another integration, another renewal date, another potential security exposure and another system that somebody eventually has to understand.

AI is making this issue even more important. Because software can now be created faster and more cheaply, companies may end up creating even more digital clutter than before. An employee can use AI to develop a small application. A department can automate a workflow independently. A team can build an AI agent to connect different services. All of this is powerful, but the lower cost of creation does not eliminate the future cost of ownership. Someone still has to know what the system does, where the data is stored, who owns it, whether it is secure, whether it should still be running and what happens when it fails.

In other words, AI makes creation easier, but it makes digital discipline even more important.

Playing “Digital Doctor”

That thought became especially clear to me over the past two days, when I unexpectedly found myself playing a role that I now jokingly describe as a “digital doctor”.

The first situation involved a system that we had developed for a client some time ago. The application had been stable for a long period and therefore had not required much maintenance. Like many business systems, it continued operating quietly in the background until one day something went wrong. When the client contacted us, we had to return to code that we had not looked at seriously for years.

That experience was almost like digital archaeology.

Digital Archaeology

When you are actively developing a system, the logic feels obvious. You remember why each module exists, how different functions are connected and why certain technical decisions were made. Years later, that context disappears. The source code is still there, but the human memory surrounding it is gone. You look at an old function and ask yourself why it was written that way. You trace one module into another. You examine the database structure, follow the application flow and try to reconstruct the thinking of the developer who built it — even when that developer may have been your own team.

We spent almost the entire day doing exactly that. We reviewed the old logic, traced the issue, tested different possibilities, repaired the affected components and made sure that the fix did not create another problem somewhere else in the system. By night, the application was functioning correctly again and had been deployed.

There is a particular kind of satisfaction that comes from solving this type of problem. Building something new is creative. Repairing a legacy system is investigative. You are not starting with a blank page. You are entering an environment filled with previous decisions, forgotten assumptions and technical history. You have to diagnose before you can treat.

The Second Case: A Server That Kept Failing

The second case was significantly larger.

This client had been operating a critical business application on a server environment that had been causing problems for years. The server would become unavailable two or three times a year. Each time it happened, the impact on the business was serious because the company relied heavily on the system for its daily operations. When the server went down, the company’s ability to function was affected. Staff could not access what they needed, work slowed down and everyone waited anxiously for the system to recover.

For almost two years, I had been encouraging the client to move to a more reliable environment.

The answer was always complicated. A new server costs money. Migration takes time. Moving a large system carries risk. There may be downtime. Something may break during the transition. The existing setup, although unreliable, was familiar. This is one of the most common challenges in digital transformation: companies often know that something is risky, but as long as it is still working today, the urgency to change disappears.

Every outage created pain. Once the system came back online, the pain was forgotten.

Eventually, I told the client very directly that if they continued refusing to migrate, there was little more I could do. I had been following the issue for almost two years. At some point, a business has to decide whether the cost of change is greater than the cost of continued risk.

This time, the client finally decided to move.

What We Found Inside

Once we began the migration, it became clear that this was not simply a matter of copying files from one server to another. The environment included multiple applications and around six subdomains, together with a large database. The overall data volume was approximately 40 to 50 gigabytes. Even downloading, transferring and organising that amount of material was already a significant exercise.

But the real problem was not the size. It was what we discovered inside.

There were old application files, unused folders, historical backups, temporary files, unnecessary logs and remnants from previous development work. Over the years, different people had worked on the system. Different things had been added. Very little had been removed. The application had continued running, but the technical environment around it had gradually become more difficult to understand and manage.

This is more common than many business owners realise.

A business system may survive for ten or fifteen years. During that time, developers change, vendors change, employees resign, operating systems are upgraded, hosting providers change and business requirements evolve. Every generation adds something. Very few generations take responsibility for cleaning up what came before. Eventually, the system still works, but nobody has a complete picture of how everything fits together.

Cleaning the Digital House

At that point, a server migration becomes more than a technical exercise. It becomes an opportunity to clean the digital house.

That is exactly what we are doing now. Instead of simply moving all the old files into a new server and carrying years of unnecessary baggage with us, we are reviewing the application, removing what is no longer needed, organising the source code, cleaning the environment and preparing the project to be properly managed through GitLab. Once that process is completed, the cleaned and organised application can be deployed into the new server environment with a much clearer technical structure.

As I write this article, the work is roughly halfway completed.

The Real Cost of Neglect

It has been tiring, messy and at times painfully slow. Moving tens of gigabytes of data is not glamorous work. Searching through old folders is not the kind of technology story that normally appears in marketing material. There are no dramatic AI demonstrations, no shiny dashboards and no impressive product launches.

Yet this kind of work may be far more important to a business than another new AI tool.

When a legacy application fails, the consequences can be immediate. A business may lose access to customer information, inventory records, financial processes, internal workflows or operational data. Employees may be unable to continue their work. Management may suddenly realise that nobody knows where the latest source code is stored. The developer who originally built the system may no longer be available. Passwords may be scattered across different people. Backups may exist, but nobody knows whether they can actually be restored.

Technology problems rarely arrive at a convenient time.

A Digital Housekeeping Problem

This is why I increasingly believe that many companies do not necessarily have a technology problem. They have a digital housekeeping problem.

The first question should not always be, “What new system should we buy?” Sometimes the better questions are much simpler. What systems do we already have? Which of them are critical? Who owns the domains? Where are the databases? Where is the latest source code? Who has access to the server? When was the last backup tested? Which applications are still being used? Which systems are no longer necessary? What would happen if a key server stopped working tomorrow?

These questions may not sound innovative, but they determine how resilient a company really is.

The arrival of AI does not make these fundamentals less important. It makes them more important.

Innovation Needs Discipline, Not Just AI

As AI becomes embedded in more business processes, companies will connect more systems, generate more data and automate more decisions. Without discipline, the technology environment will become increasingly complicated. If companies simply add AI on top of years of technical debt, they may create faster systems without creating healthier systems.

A healthy digital organisation requires both innovation and maintenance. It needs the courage to experiment, but also the discipline to clean. It needs the ability to build new systems, but also the wisdom to retire old ones. It needs AI, but it also needs governance. Most importantly, it needs people who are willing to examine the messy parts of the business that nobody else wants to touch.

Why I Enjoy These Messy Problems

This is where I realised something important about myself.

I enjoy these messy problems.

Give me a straightforward software project and I can work through it. But give me a system that nobody understands anymore, a server that keeps failing, an old database that has grown out of control, an application left behind by a previous vendor or a problem that everyone has been avoiding for years, and I become genuinely interested.

I want to know what happened.

I want to understand how everything is connected.

I want to identify what is unnecessary.

I want to repair what still matters.

I want to organise the environment properly.

And I want to see the business regain control over something that had become a source of frustration or risk.

Becoming an “Enterprise Digital Doctor”

That is when the idea of being an “Enterprise Digital Doctor” suddenly began to make sense to me.

A doctor does not begin treatment by prescribing random medicine. The first responsibility is diagnosis. A patient may describe one symptom, but the real cause may be something completely different. Digital problems are similar.

A company may say its website is slow, but the real issue may be poor server architecture. A business may say it needs a new system, when the real problem is that three existing systems are doing overlapping jobs. Management may say it needs AI, when the company actually needs cleaner data and better processes first. A team may believe it needs a bigger server, when the real problem is years of unmanaged files and inefficient application design.

The visible problem is not always the real problem.

Diagnosis must come before development.

The Right Technology, in the Right Place, for the Right Reason

For many years, companies like ours were mainly expected to build things: websites, ecommerce platforms, internal systems, applications and digital tools. We still do that, and building will remain an important part of our work. But I increasingly believe that the greater value lies in understanding what the business truly needs before another system is created.

Sometimes the correct prescription is a new application. Sometimes it is AI. Sometimes it is migration. Sometimes it is restructuring. Sometimes it is better governance. Sometimes it is simply cleaning up years of technical debt.

And sometimes, the best solution is to delete something.

That may be one of the most important lessons the AI era is teaching me.

Transformation is not always about having more technology. It is about having the right technology, in the right place, for the right reason.

Companies that learn how to let go of unnecessary systems, protect the systems that still matter and introduce new technology with discipline will be in a much stronger position to survive the next wave of change.

As for me, I think I have found one part of my work that I genuinely want to do more of.

When a business has a digital problem that has become too complicated, too old, too messy or too difficult for anyone to understand, I want to be the person who comes in, examines the symptoms, identifies the real cause and helps bring the system back to health.

Perhaps “Enterprise Digital Doctor” sounds unconventional.

But after the past few days, it feels surprisingly accurate.

Beyond AI-Generated Code

Over the past few months, I have worked extensively with Claude, ChatGPT and Codex on real software development projects. The result has been more than a collection of AI-generated code. I have gradually developed a practical method for helping AI understand a software project, follow its rules, execute tasks and improve the system—without allowing the process to drift out of control.

The Question Behind the Work

A large part of my time has been spent trying to answer one deceptively simple question: How do I communicate with AI so that it truly understands what I want?

Easy Answers, Difficult Systems

Chatting with AI is easy. Getting an answer is easy. Generating code is becoming easier every day. Building a dependable system that people can safely use, however, is a completely different challenge.

A Software Engineer's Perspective

Coming from the software industry, I naturally brought my usual concerns into the process. Is the architecture stable? Is the database designed correctly? Who can access each function? What happens when something fails? How is the data protected? These questions remain essential, regardless of whether the code is written by a person or generated by AI.

Control, Quality and Accountability

I also had to consider how the system would preserve a complete history, who would be responsible for checking quality and which decisions could safely be made by AI. Just as importantly, I needed to identify the decisions that still required human judgement and determine whether the entire process could be repeated consistently.

Teaching AI How to Think With Me

The deeper I went, the more I realised that this was no longer simply about using AI to write software. It was about teaching AI how I approach problems, structure systems, evaluate risks and define an acceptable result.

Working Is Not the Same as Reliable

AI can produce a feature remarkably quickly. The screen may look correct, the button may work and the system may even pass a basic test. But none of these things guarantees that the underlying system has been designed properly.

The Problems Beneath the Surface

A working interface does not prove that the database is well structured. A successful test does not guarantee that access controls are secure. A feature that works today may still introduce weaknesses that cause another part of the system to fail later.

The Three-Month Test

The real measure of software is not simply whether it works at launch. It is whether the system remains understandable, maintainable and safe to change months or years later. Something that functions perfectly today can still become a system that nobody dares to touch three months from now.

Confidence Without Understanding

This is one of the greatest dangers of AI-assisted development: AI may not fully understand the requirements, yet it can still complete the task with remarkable confidence. The result can look convincing enough that important design flaws remain unnoticed.

A Challenge Across Every AI Platform

This is not a problem unique to Claude. The same issue appears when working with ChatGPT, Codex and other AI agents. Different tools may have different strengths, but all of them depend on the quality of the context, rules and boundaries they receive.

Code Is No Longer the Main Question

The real challenge is no longer whether AI can write code. It clearly can. The more important question is whether we can provide enough context and guidance for AI to produce work that genuinely meets our technical, operational and business standards.

Building Structure Around AI

To address this, I began placing more structure around the development process. This included requirement records, database rules, access controls, issue tracking, version control, testing checklists, audit logs and clearly defined human approval points.

Creating Organisational Memory

I also needed the project’s knowledge to survive beyond a single conversation, computer or AI session. Important decisions cannot remain trapped inside temporary chat histories or in the memory of one person.

Preparing for the Next AI

If another AI takes over the project later, it should be able to understand what was built, why certain decisions were made and which parts of the system must not be changed without proper review. Continuity becomes essential when multiple people and AI agents contribute to the same system.

Software Engineering Matters More Than Ever

This experience has made me appreciate software engineering even more. AI can accelerate development, but speed does not remove the need for architecture, security, governance, documentation and disciplined decision-making.

The Most Valuable Skill in the AI Era

In the AI era, the most valuable person may not be the one who writes code the fastest or produces the longest prompt. It will be the person who understands the industry, translates real business needs into clear system rules and knows how to judge whether AI has delivered the right outcome.

Industry Knowledge Cannot Be Replaced

AI cannot replace industry understanding. It amplifies it.

AI Amplifies What Already Exists

When you understand your industry well, AI can amplify your experience, judgement and ability to solve problems. But when processes are unclear, data is disorganised and responsibilities are undefined, AI will amplify those weaknesses too.

Turning Knowledge Into Systems

At OPERiON, we help businesses transform their industry knowledge into structured systems and practical AI solutions—supported by the right processes, controls and human judgement.

Moving Beyond Experimentation

If you are ready to move beyond experimenting with AI and begin applying it meaningfully to your business, let’s have a conversation.

Your Business, Amplified

Your knowledge. Your systems. Your business—amplified.

Technology Professionals Know That Some Things Can Be Said—and Some Cannot

Those of us in the technology industry understand how quickly the market is changing. If a software company openly tells every client, “Most of your project was developed using AI,” the client’s first reaction may not be excitement. Instead, the client may ask: “If AI can do it, why should I pay a software company?”

However, even if we choose not to talk about it, the market will eventually discover the truth. AI web coding, vibe coding and automated development tools are already transforming the software industry. They can generate websites, dashboards, system modules and applications faster than ever before.

The real question is no longer whether we should use AI. The more important question is this: when almost anyone can use AI to generate code, what is the real value of a professional programmer or software company?

AI Can Write Code, but It May Not Understand the Business

AI can quickly produce a website, an API, a backend module or even an application that appears complete. However, a system that can run is not necessarily a system that is suitable for the business. It may also be unable to support the organisation over the long term.

A company does not simply need attractive screens and working buttons. It needs a solution capable of handling real business processes, operational exceptions, data accuracy, security risks and future growth.

What are the company’s actual business rules? Which processes should be automated? Which decisions must remain under human control? What happens when the number of customers, transactions or system users increases tenfold? Who should be allowed to view, edit, approve or export sensitive information?

These questions cannot be answered reliably through a single prompt. They require business understanding, technical experience and human judgement.

Foundational Knowledge Determines How Far a System Can Go

As we use AI to perform more programming work, foundational technical knowledge becomes more important—not less.

How should the data be collected? What information should be mandatory? How should the fields be defined? How should the database be structured? What should be used as the primary key? How should foreign keys connect different tables? Which data should be stored separately, and which information should be linked?

AI may suggest an answer, but a human professional must determine whether that answer is appropriate.

If the foundation is wrong, AI will simply help us produce the wrong system faster. A system may appear to work when it contains only a small amount of test data. Problems may emerge later when the data volume grows, multiple users operate the system simultaneously or the application must integrate with other platforms.

AI can accelerate development, but a knowledgeable technical professional must still decide whether the system is moving in the right direction.

The Real Expertise Lies Between Raw Data and the Final Result

Many people assume that once a large amount of data is given to AI, it can automatically generate valuable answers. In reality, there is a long and complicated journey between raw data and a trustworthy result.

The data may need to be cleaned, categorised, verified, linked and interpreted. Duplicate records must be identified. Missing information must be handled properly. Different access levels must be established. Exceptions and unusual cases must be investigated.

Which data can be trusted? Which records are incomplete? Should missing information be removed, corrected or retained? Does the same measurement carry the same meaning across different departments? Is the final result technically accurate but commercially misleading?

Without industry knowledge and domain expertise, a large dataset may produce an answer that looks convincing but is fundamentally incorrect.

The value of a technology professional is not limited to processing data. It also comes from understanding why the data appears in a particular way, recognising what may be missing and determining whether the result can be used responsibly by the business.

Programmer, Where Does Your Value Truly Lie?

Every programmer should now ask a difficult but necessary question: if AI can already generate most basic code, what additional value do I provide?

Knowing how to write code remains useful, but “I can programme” may no longer be enough to create a sustainable competitive advantage.

Your value may come from system architecture, database design, cybersecurity, software integration, performance optimisation or business analysis. It may come from your ability to transform an unclear business request into a structured and practical solution.

Your value may also come from recognising risks before they become expensive problems. It can be found in your ability to communicate with clients, coordinate with a technical team, make responsible architectural decisions and respond calmly when a live system fails.

The most valuable technology professional of the future may not be the person who writes the largest amount of code. It may be the person who understands what should be built, why it should be built that way, what could go wrong and how to recover when something fails.

Ten Programmers Do Not Automatically Create Ten Different Levels of Value

Imagine a company with ten programmers who possess similar knowledge, perform similar tasks and produce similar results. Once the organisation establishes a mature AI development framework, proper governance, reusable components and standard operating procedures, work that previously required ten people may be completed by a much smaller team.

This may be uncomfortable to hear, but avoiding the discussion will not stop the change from happening.

Some positions will be reduced. Some responsibilities will be combined. Some programmers may leave employment and start their own businesses. Others may move into entirely new technical roles.

The future may create greater demand for solution architects, AI workflow specialists, data specialists, system auditors, product owners and technical leaders who can review and govern AI-generated work.

The goal should not be to preserve an old job title forever. The goal is to develop capabilities that remain valuable even as the tools, workflows and size of development teams continue to change.

People Who Have Completed—and Rescued—Real Projects Remain Rare

At OPERiON, we are not only interested in how many websites or systems someone has built. We value people who understand the complete project lifecycle.

This means being involved in gathering requirements, planning the architecture, designing the database, developing the solution, testing it, launching it and maintaining it after deployment. It also means taking responsibility when real users begin using the system and unexpected problems appear.

Even more valuable are professionals who have taken over troubled or failed systems. They know how to investigate an unfamiliar codebase, identify structural weaknesses, repair damaged data, correct business logic and stabilise the system without causing further disruption.

Building a new system requires technical ability. Maintaining a live system requires discipline and responsibility. Rescuing a failing system requires experience, patience, sound judgement and the courage to make difficult decisions.

These capabilities will not disappear because of AI. In an environment where software can be produced faster than ever, the ability to evaluate, govern, maintain and rescue systems may become even more valuable.

Job Loss Is Not the End—It Can Be the Beginning of a New Direction

Whether the future brings a career transition, a smaller development team or an unexpected job loss, technology professionals must continue moving forward with a positive and practical mindset.

OPERiON will be opening new opportunities through an IT Specialist talent initiative. We are looking for experienced professionals who have spent at least seven years in the technology field, managed projects from beginning to completion, and remained involved during the maintenance stage.

We are particularly interested in people who have repaired, recovered or rescued systems that were failing. We want professionals who can do more than generate code—people who can understand business requirements, make sound technical decisions, take ownership and solve difficult problems.

If your career is currently going through a major change, do not immediately conclude that your experience has become irrelevant. The knowledge you accumulated through real projects, system failures, difficult clients and operational challenges may now be your greatest professional asset.

You are not necessarily being replaced by technology. You may simply have arrived at a point where you must redefine your value.

For capable, responsible and experienced technology professionals who are willing to keep learning, OPERiON hopes to offer more than another job opportunity. We want to become a new source of hope—and the beginning of the next chapter in your professional journey.

Synopsis

A company may own several domains, use different hosting providers, purchase SSL certificates separately and manage multiple renewal dates—yet still have no clear picture of how everything connects. This is not merely a technical inconvenience. It is a business continuity, security and governance risk. As AI introduces even more platforms and solutions into the workplace, leaders must resist the temptation to keep adding. The priority should be to simplify, consolidate and regain control.

The Conversation Started With a Website

During a recent client discussion, we began with what appeared to be a straightforward topic: the company’s website.

As the conversation progressed, however, the client explained that one domain had been registered with one provider, while another domain was managed through a different platform. The website was hosted elsewhere, and its SSL certificate came from yet another provider.

The client knew these services existed, but could not clearly explain which domain was connected to which server, where the SSL certificate was managed or which account controlled each component.

Every service also had a different renewal date.

From the client’s perspective, everything was technically operating. From a governance perspective, however, the entire arrangement had become dangerously unclear.

When Digital Assets Become Invisible

Many companies face the same problem. Their websites, domains, email systems, hosting accounts and security services were not necessarily planned as one complete architecture.

Instead, they were accumulated over time.

One provider registered the first domain. Another vendor developed the website. Someone else purchased the hosting package. A former team member created an account for the SSL certificate. Years later, nobody has a complete record of what the company owns, where it is located or who has access to it.

This creates a form of invisible operational risk. The website may be functioning today, but a missed renewal, expired credit card, inaccessible email account or departed team member could suddenly interrupt the business.

The company owns the digital assets, but it may not truly control them.

The First Recommendation Was Consolidation

Our advice to the client was simple: consolidate wherever practical.

If the company does not need two hosting servers, reduce them to one. If there is no strategic reason to manage domains across several registrars, consider transferring them to one trusted provider. If multiple services perform the same function, eliminate the duplication.

Most domain names can be transferred from one registrar to another, subject to the domain extension’s policies, transfer eligibility and security requirements. A domain is not normally locked permanently to the company where it was first registered.

The objective is not to force everything into one platform at any cost. The objective is to reduce unnecessary fragmentation.

Every additional provider creates another account, password, renewal date, invoice, support channel and potential point of failure. Consolidation gives management a clearer view of its digital assets and reduces the effort required to protect them.

We Drew the Architecture on the Spot

During the meeting, I drew a simple diagram for the client.

It showed where the domains were registered, which domain was connected to which server, where the website was hosted, how the SSL certificate was applied and which accounts provided administrative access.

That simple diagram immediately changed the conversation.

What had previously been stored as fragmented information in different people’s memories became visible on one page. The client could finally see the relationship between the domain, DNS, SSL, server, website and account access.

Every company should maintain this type of digital asset record. It should include the provider, account owner, administrator access, renewal date, payment method, responsible team member and recovery information for every critical service.

Documentation is not paperwork for its own sake. It is part of security, continuity and governance.

Not Every Website Needs an Expensive SSL Package

The client then asked whether a separate paid SSL certificate was necessary.

The answer depends on the website, its technical environment and the organisation’s compliance requirements. For a relatively straightforward information-based corporate website, a separately purchased premium SSL certificate may not always be required.

A properly configured Cloudflare setup, for example, can provide SSL/TLS capabilities together with DNS management, content delivery, traffic filtering and protection against certain forms of malicious activity.

This does not mean that Cloudflare automatically solves every security issue. The configuration must still be correct, and the connection between Cloudflare and the origin server must also be protected. However, it can reduce the number of separate products that a company needs to purchase and manage.

Again, the principle is not simply to choose the cheapest service. It is to select an appropriate level of protection without introducing unnecessary complexity.

Cloudflare Can Add a Protective Layer

Without an intermediary layer, a domain may point directly to the web server. Depending on the configuration, this can expose the server’s origin IP address and allow traffic to reach it directly.

With Cloudflare acting as a proxy, visitors first connect through Cloudflare before their requests are forwarded to the origin server. This can help mask the server’s IP address, filter unwanted traffic and provide an initial protective layer.

However, masking the IP address is only effective when the origin server is also configured to prevent unauthorised direct access. Cloudflare should be treated as one layer within the security architecture, not as a replacement for server hardening, access control, patching, backups and monitoring.

Security becomes stronger when each layer is understood and intentionally managed.

Security Must Match the Business Risk

The client then asked how far website security should go.

For an information-based website with no customer accounts, online payments or sensitive personal data, the security architecture does not necessarily need to be excessively complicated. It still requires proper protection, but the solution should be proportionate to the actual risk.

The situation changes when a company handles sensitive information, processes transactions or supplies services to multinational corporations and regulated industries.

I once worked with a client serving an American corporation that required monthly security audits—not only of the website, but also of the company’s email environment, domains, servers and overall external security posture.

It was the first time I had encountered such a demanding monthly requirement.

For that situation, we recommended UpGuard, a security-rating and third-party risk-management platform. It is not a low-cost solution, but some large organisations require their vendors to demonstrate formal, continuous and independently measurable security controls.

The right level of security is therefore determined not only by the website itself, but also by the expectations of the customers, industries and markets that the company serves.

A Working Website Is Not the Same as a Governed Website

Many business owners assume that if a website is online, everything must be under control.

That is not necessarily true.

A website can remain online while its domain is registered under a former vendor’s account. Its hosting subscription may be charged to an unknown credit card. Its DNS could be managed through an account that nobody can recover. Its SSL certificate may expire without anyone receiving the notification.

Technical functionality tells us whether something is working today. Governance tells us whether the company can understand, control, secure and recover it tomorrow.

This is why the real conversation is not only about websites. It is about digital ownership.

AI Must Not Amplify Our Existing Complexity

We are now entering an era in which companies can access more AI platforms, cybersecurity tools, cloud services and digital solutions than ever before.

The temptation will be to keep adding.

One team subscribes to an AI writing platform. Another adopts an automation service. A third connects a new customer system. Every solution appears useful individually, but together they can create an increasingly fragmented and ungovernable environment.

AI will amplify whatever already exists. If our processes are clear, AI can amplify efficiency. If our systems are fragmented, AI can amplify confusion. If our access controls are weak, AI can amplify risk.

We should not allow AI to amplify our complexity.

Before adopting the next solution, companies should ask: Can we consolidate what we already have? Can we eliminate duplication? Can we reduce the number of providers, accounts and renewal dates? Can everyone clearly see who owns and manages each digital asset?

Simplification Is Now a Management Discipline

The most important improvement may not be adding another platform. It may be removing one.

If we are currently managing ten separate components, can we reduce them to five? If we are managing five overlapping services, can we consolidate them into one well-governed environment?

Simplification does not mean sacrificing capability or security. Done correctly, it improves visibility, accountability, continuity and control.

This perspective comes from our years of practical experience helping businesses manage websites, domains, hosting environments, email systems, cybersecurity requirements and digital transformation.

In the AI era, companies will certainly need better technology. But they will also need the discipline to reduce, cut and simplify.

Do not begin by asking what else you can add.

Begin by asking what you no longer need to manage.

Lukas Insight | By Ts. Lukas J. Tan

After completing PDX2026, I decided to go all-in on artificial intelligence.

Nearly three weeks into this journey, I have moved beyond simply using AI tools. I am exploring how AI can learn, build, analyse, automate and operate alongside me.

My biggest discovery is simple: AI enables us to learn independently and create exactly what we need at extraordinary speed.

One person can now research a market, analyse data, prepare a strategy, develop software and automate workflows. This represents a major productivity breakthrough, particularly for small and medium-sized businesses.

But the deeper I go into AI, the more I find myself asking one uncomfortable question:

Do you know whether there is a devil inside your AI?

What Is the “Devil” Inside AI?

The devil is not AI itself. It is the hidden risk created by poor data, excessive access, unclear instructions and uncontrolled automation.

An AI system may generate a convincing answer based on inaccurate information. It may reveal confidential data because it was given the wrong permissions. An AI agent may perform an unintended action because nobody clearly defined its boundaries.

The risk becomes greater when AI moves from answering questions to operating business systems.

A human mistake usually develops at human speed. An automated AI mistake can affect thousands of records, messages or transactions before anyone detects it.

Business leaders must therefore understand three things clearly:

• What AI can access
• What AI can decide
• What AI can execute

Lessons From the Age of Hacking

I come from a generation shaped by computer viruses, hacking, data scraping, software cloning and system vulnerabilities.

That experience trained me to examine technology from two perspectives: what the system is designed to do and how someone could manipulate it.

Convenience can create an entry point. Connectivity can create exposure. Automation can multiply efficiency, but it can also multiply errors.

Traditional cybersecurity focuses on protecting devices, networks, passwords and databases. AI introduces another layer that organisations must protect: the information and context influencing its behaviour.

AI does not merely store information. It interprets information, identifies patterns, generates recommendations and increasingly completes tasks.

Securing the system is no longer enough. We must also secure the decision-making process.

Can Someone Manipulate AI Data?

Yes. AI can be influenced by inaccurate, outdated or deliberately manipulated information.

The internet can be flooded with fabricated articles, fake reviews, synthetic identities, altered images and misleading statistics. Internal databases can also contain duplicate records, incorrect labels and biased historical decisions.

If AI relies on compromised information, it may produce an answer that appears professional and logical but is fundamentally wrong.

This creates a new category of cyber risk.

In the past, attackers mainly attempted to steal information or disrupt systems. In the AI era, they may attempt to influence what an AI system believes, how it reasons and what it recommends.

An attacker may not need to change the final decision directly. Manipulating the information used to reach that decision could be enough.

A company may successfully prevent outsiders from accessing its database and still make poor decisions because the data inside cannot be trusted.

Cybersecurity protects access to data. AI governance protects how that data becomes a decision.

What Is AI Governance?

AI governance is the framework that determines how an organisation selects, uses, monitors and controls artificial intelligence.

It establishes responsibilities for data protection, system access, human approval, output verification and accountability.

Without governance, every team member may create their own rules. Confidential information could be uploaded to unapproved platforms. AI-generated recommendations might be accepted without verification. Automated actions could happen without proper authorisation.

That is not a sustainable AI strategy. It is unmanaged business risk.

AI governance turns individual experimentation into a controlled organisational capability.

What Should an AI Governance Framework Include?

A practical framework should address five core areas.

1. Data. Define what information AI may access, process and retain. Personal, confidential and commercially sensitive information requires stronger protection.
2. Permission. Set boundaries around the systems AI can access and the actions it can perform. Access should be based on necessity—not convenience.
3. Verification. Establish how AI-generated work will be reviewed for accuracy, relevance, bias and potential harm.
4. Human Approval. Identify which decisions must remain under human control. Financial transactions, legal commitments, customer data changes and other high-impact actions require appropriate safeguards.
5. Accountability. Assign clear ownership. Every AI system should have someone responsible for its purpose, performance, monitoring and risks.

The strength of these controls should correspond to the potential impact. Using AI to correct grammar does not require the same governance as allowing an AI agent to modify customer records, approve payments or deploy software.

Does AI Governance Restrict Innovation?

AI governance should not stop innovation. It should enable organisations to innovate with greater confidence.

When the boundaries are clear, the team can experiment without creating unnecessary exposure. Leaders can approve automation while maintaining visibility. Customers and partners can trust that their information is being handled responsibly.

Governance is not about controlling every prompt or slowing every project. It is about creating clear authority, traceability and accountability around AI activities that can materially affect the organisation.

The winners of the AI era will not simply be the companies using the most AI tools. They will be the companies capable of using AI reliably, explaining important decisions, protecting their data and taking responsibility for the outcomes.

The Question Every Leader Must Answer

Your organisation may already be using ChatGPT, Claude, AI agents or automated workflows—even without an official AI strategy.

Members of the team may be uploading documents, analysing customer information, generating business recommendations or using AI-created code inside company systems.

The first leadership question should therefore be:

Do we know where and how AI is being used across our organisation?

An AI Governance Assessment can identify existing tools, data exposure, access permissions, approval gaps and accountability risks. The organisation can then establish a practical governance framework aligned with its operations and level of risk.

I remain strongly positive about AI. Its potential to improve productivity, strengthen decisions and help smaller organisations compete is enormous.

But opportunity without control can quickly become liability.

AI should not be feared. It should be governed with clarity, discipline and confidence.

Do not wait for the devil to appear before creating the rules.

The Era When Computer Viruses Were Everywhere

When I first started using computers, we were still living through the eras of DOS, Windows 95, Windows 98, Windows Millennium, Windows 2000, and eventually Windows XP.

At that time, almost every computer user experienced a virus infection. Computers would suddenly slow down, files would disappear, browsers would be hijacked, and sometimes the entire operating system had to be reinstalled.

The one I remember most clearly was the ILOVEYOU virus, which appeared in 2000. Disguised as an email carrying the subject line “ILOVEYOU,” it persuaded recipients to open an attachment before spreading rapidly through their contact lists.

Technically, it was a computer worm rather than a conventional virus. Within a very short time, it affected millions of computers worldwide and made the world realise something important: the more widely a technology is adopted, the greater the potential damage caused by even a small weakness in its foundation. Source: EBSCO, “ILOVEYOU Virus Attacks Computers.”

How Much Has Microsoft Spent Protecting Windows?

As Windows became one of the world’s most widely used operating systems for individuals and businesses, it naturally became one of the most valuable targets for attackers.

Microsoft does not only have to protect its operating system. It must also consider different computer brands, enterprise systems, legacy software, hardware drivers, third-party applications, and decades of compatibility requirements.

We have all encountered Windows security updates and software patches. Sometimes, just as we are preparing to shut down the computer, Windows begins installing an update and asks us to wait. From a user’s perspective, this can be frustrating. From a security perspective, however, it represents a battle that never truly ends.

Microsoft previously announced a US$20 billion investment over five years to advance cybersecurity. Its published materials also indicated that the company was investing more than US$1 billion annually in security, data protection, and risk management. These figures demonstrate how expensive it is to protect a large, open ecosystem that must continue supporting countless legacy systems. Source: Microsoft’s Cybersecurity Investment; Microsoft Cyber Defense Operations Center.

This does not necessarily mean that Windows was built on a weaker foundation. Windows faces more attacks partly because of its enormous user base, complex operating environments, and obligation to support a vast range of enterprise systems and third-party hardware and software. For cybercriminals, attacking a platform with a larger market share can offer a much greater return.

Why Do Many Mac Users Not Install Antivirus Software?

Many years later, I started using a MacBook. I noticed that many Mac users did not install separate antivirus software, yet their computers continued operating normally. Like many people, I wondered whether Macs simply could not get viruses.

Strictly speaking, that is incorrect.

macOS can still be affected by malware, ransomware, phishing, and system vulnerabilities. The difference is that Apple has integrated many protective mechanisms directly into the operating system, so users may not even notice that these protections are running.

macOS includes technologies such as XProtect, Gatekeeper, and App Notarization. Gatekeeper checks whether software comes from an identified developer, has been notarised by Apple, and has not been altered. XProtect is Apple’s built-in anti-malware technology, designed to detect, block, and remove known threats.

Apple organises its malware defence into three layers: preventing malicious software from launching, blocking it from running, and remediating it if it has already been executed. Source: Apple, “Protecting Against Malware in macOS”; Apple, “Gatekeeper and Runtime Protection.”

Apple has therefore not avoided spending money on security. A more accurate explanation is that Apple has placed much of that investment into its underlying architecture, hardware-software integration, application review process, permission controls, and automatic updates.

The fact that users do not install antivirus software themselves does not mean that there is no major security investment behind the system.

Apple also maintains greater control over its hardware and software ecosystem. It can determine which devices run macOS, how applications access system resources, and which security policies are enabled by default. This controlled environment reduces some complexity.

However, Apple’s approach cannot simply be copied and applied to Windows because the two platforms serve different markets and carry different compatibility responsibilities.

Will AI Cause Computer Viruses to Decline?

As we enter the AI era, I initially had a thought: if AI can automatically detect unusual activity, analyse malicious code, predict attack patterns, and allow firewalls to respond automatically, will traditional computer viruses gradually decline?

Part of this observation is correct.

AI can help security teams identify threats more quickly, detect phishing messages, close detection gaps, and respond at machine speed. Microsoft is already developing AI security systems designed to turn threat signals into real-time protection. Source: Microsoft, “Rethinking Security for the Age of AI.”

However, we cannot conclude that viruses will disappear simply because AI has arrived. Defenders can use AI, but attackers can use it too.

Cybercriminals can use AI to search for vulnerabilities, generate malicious code, create more convincing scam messages, and attack many more targets simultaneously. Microsoft’s security research also warns that AI adoption benefits both defenders and threat actors. Source: Microsoft Digital Defense Report 2025.

What may decline is the visible experience we once described as “my computer has caught a virus.” What may increase instead are less visible threats: identity theft, data theft, ransomware, supply-chain attacks, manipulated AI agents, and scams designed to exploit human behaviour.

Viruses may not disappear. They may simply evolve into different forms.

Was Microsoft’s Past Security Investment Wasted?

If AI can eventually automate a large part of cybersecurity work, does that mean the money, manpower, and time Microsoft invested in the past have all gone to waste?

My answer is no.

Those investments created the vulnerability databases, threat intelligence, authentication systems, security standards, update infrastructure, and defensive experience that we rely on today.

Without that foundation, AI would not have enough reliable information or established rules to distinguish normal behaviour from a genuine threat. AI is not a security expert that suddenly appeared from nowhere. Its capabilities are built upon decades of knowledge accumulated by people and organisations.

What may become obsolete is not the previous investment in security, but some of the repetitive ways security work was performed.

Security professionals may no longer need to inspect every alert manually. However, they will still be needed to design policies, supervise AI, make high-risk decisions, and ensure that the automated security systems themselves are not compromised.

Microsoft’s recent direction is also not limited to using AI to patch vulnerabilities. It has renewed its emphasis on Secure by Design, Secure by Default, and Secure Operations—placing security at the centre of design, default configurations, and everyday operations.

This tells us that even with powerful AI, everything eventually comes back to the quality of the foundation. Source: Microsoft Secure Future Initiative.

What the AI Era Has Truly Taught Me

This article is not written to criticise Microsoft or to prove that Apple is necessarily better.

It is simply a reflection from someone who lived through the eras of DOS, Windows 95, Windows 98, Windows Millennium, Windows 2000, and Windows XP—and who is now observing how computer viruses, security updates, and cyber defence are evolving in the AI era.

Different operating systems carry different historical responsibilities, user bases, levels of ecosystem openness, and security risks. We cannot judge the quality of a technology simply by asking which platform appears to suffer fewer virus infections.

However, this history has given me one important insight:

The foundation is the most important part of any good system.

If the architecture is unclear, permissions are poorly designed, data is disorganised, and responsibilities are not properly assigned, even the most advanced technology will spend its life repairing gaps.

Every time the world changes, the organisation will need more technical people, more knowledge, and more money just to keep compensating for a foundation that was never properly established.

Today, this principle does not apply only to operating systems. It applies to every organisation preparing to implement AI.

AI can help us move faster. But if our foundation and direction are wrong, it will also help us create problems at a much greater speed.

In the AI era, true competitiveness will not be determined by how many tools we own, how many technical people we employ, or how much security software we install. It will depend on whether we have designed the right architecture, governance, permissions, and accountability from the very beginning.

Technology will continue to change. Threats will continue to evolve.

But a strong foundation will never become obsolete.

Why Every Organisation Needs a Governance Strategy Before Scaling AI

Artificial Intelligence has moved beyond experimentation. What began as individual employees using AI to draft emails, summarise documents, or generate ideas has rapidly evolved into organisations embedding AI across customer service, finance, human resources, operations, software development, marketing, and executive decision-making. For many businesses, AI is no longer a future initiative—it is already part of daily operations. Yet while investment in AI continues to accelerate, governance has not kept pace. Most organisations have established policies for finance, cybersecurity, procurement, and data privacy, but relatively few have developed a comprehensive framework that governs how AI should be deployed, managed, monitored, and continuously improved.

This imbalance creates a significant leadership challenge. AI is fundamentally different from traditional enterprise software. Conventional systems execute predefined business rules, whereas AI learns from context, interacts with organisational knowledge, and increasingly influences decisions. As organisations connect AI to customer databases, accounting systems, cloud storage, communication platforms, and operational workflows, they are no longer managing software alone. They are managing a digital workforce capable of accessing, interpreting, and acting upon business information. This requires a new discipline. AI Governance should not be viewed as another compliance exercise. It is a leadership framework that ensures AI remains aligned with organisational objectives, business values, operational controls, and risk management. In many ways, AI Governance will become as essential to modern organisations as financial governance and cybersecurity governance are today.

AI Governance Begins With Visibility, Not Policies

One of the most common questions I receive from business leaders is, “Can you help us write an AI policy?” My answer is usually the same: not yet. Policies are important, but they should not be the starting point. An effective policy can only be written after an organisation understands how AI is currently being used. Surprisingly, many companies cannot answer basic questions. Which AI tools are employees already using? Which departments have connected AI to business systems? What information is being uploaded into external platforms? Which workflows have already been automated? Without visibility, any governance document quickly becomes theoretical rather than practical.

The first objective of AI Governance is therefore awareness. Organisations should begin by creating a comprehensive inventory of AI across the business. This inventory should identify every AI platform, every AI agent, every workflow automation, every system integration, and every business owner responsible for its operation. Once visibility exists, leadership can begin classifying AI according to business impact. Some AI applications may simply generate marketing copy or summarise meeting notes. Others may analyse financial reports, access confidential customer information, recommend purchasing decisions, or interact directly with clients. Different levels of responsibility require different levels of governance. Just as organisations classify financial approvals according to authority limits, AI capabilities should be classified according to operational impact and organisational risk.

Ownership Requires More Than Technology—It Requires Operational Discipline

Many discussions surrounding AI focus on selecting the right platform. While technology selection is important, ownership is ultimately determined by operational discipline rather than software features. Organisations often assume that implementing an AI solution automatically creates capability. In reality, capability emerges from the combination of people, processes, governance, and technology working together. AI should therefore be treated as part of the operating model rather than simply another digital tool.

One practical way to achieve this is by documenting how AI interacts with organisational systems. Every AI capability should have a clearly defined purpose, an identified business owner, and documented permissions. For example, an AI assistant responsible for preparing management reports may require read-only access to operational dashboards but should not be able to modify financial records. A customer service AI may retrieve product information but should not automatically approve refunds above a defined threshold. A marketing AI may generate content but should not publish communications without human review. These governance decisions are not technical limitations; they are management decisions that define accountability.

As organisations deploy multiple AI solutions, documenting these permissions becomes increasingly important. A simple governance register can include which systems each AI can access, whether it has permission to read, create, update, or delete information, which departments approve those permissions, and how often those permissions are reviewed. Such documentation may appear administrative, yet it forms the foundation of responsible AI operations. Governance is built through disciplined documentation, not assumptions.

AI Workforce Requires Governance Just as Human Workforce Does

One concept I believe organisations should begin embracing is the idea of an AI Workforce. Many businesses still think of AI as a collection of software applications. I believe this perspective is becoming outdated. As AI agents become increasingly autonomous, collaborate with one another, and support multiple departments simultaneously, they begin resembling a workforce rather than a toolset. Just as organisations define roles, responsibilities, reporting structures, performance expectations, and codes of conduct for human employees, they will eventually need equivalent governance structures for digital workers.

Imagine an organisation operating twenty specialised AI agents. One supports finance, another assists human resources, another manages customer enquiries, another analyses operational performance, while others contribute to procurement, legal review, project management, and executive reporting. Individually, each agent may perform a specific function. Collectively, however, they form an operational ecosystem. Leadership therefore needs visibility not only into each AI agent individually but also into how information flows between them. Can one agent trigger another? Can sensitive information unintentionally move between workflows? Which human manager ultimately approves decisions generated by AI? Governance should answer these questions before operational complexity makes them difficult to control.

For this reason, I encourage organisations to establish what I describe as an AI Workforce Register. Similar to an employee directory, this register should document every AI agent’s role, purpose, owner, connected systems, permissions, review schedule, and business value. This transforms AI from an invisible collection of technologies into an accountable organisational resource.

From Strategy to Implementation: Building Governance Step by Step

One misconception surrounding AI Governance is that it requires a large transformation programme before meaningful progress can begin. My experience suggests the opposite. The most effective governance frameworks evolve incrementally. Organisations should resist the temptation to produce lengthy policy documents before understanding operational reality. Instead, governance should mature alongside AI adoption.

A practical roadmap begins with six progressive stages. The first stage is establishing an AI Inventory to understand what already exists. The second stage involves classifying business information according to sensitivity and determining which categories of information may be accessed by different AI capabilities. The third stage documents permissions using a simple access matrix that specifies whether AI systems may read, create, update, or delete information within each connected platform. The fourth stage introduces governance policies covering approval processes, acceptable use, human oversight, and accountability. The fifth stage implements periodic governance reviews to verify that AI continues operating within approved boundaries. Finally, the sixth stage integrates AI Governance into broader corporate governance alongside cybersecurity, enterprise architecture, risk management, and strategic planning.

Importantly, governance should remain a living management system rather than a static document. As AI capabilities evolve, governance must evolve with them. New integrations, new regulations, changing business priorities, and emerging risks all require continuous review. Organisations should therefore view AI Governance as an ongoing leadership discipline rather than a one-time compliance exercise.

The Future Belongs to Organisations That Understand Their AI

Every major technological transformation eventually shifts from innovation to discipline. During the early Internet era, organisations focused on getting online. Later they learned the importance of cybersecurity. During the data revolution, businesses concentrated on collecting information before recognising the need for governance and privacy. Artificial Intelligence is following the same pattern. Today’s excitement around AI capabilities will gradually be matched by a greater appreciation for governance, accountability, transparency, and operational maturity.

The organisations that succeed in this next phase will not simply possess the most advanced AI models. They will possess the clearest understanding of how AI operates within their business. They will know which digital workers exist, what they can access, how they support decision-making, and who remains accountable for their performance. They will recognise that governance is not a barrier to innovation but an enabler of sustainable innovation. Responsible governance builds trust, improves operational resilience, strengthens executive confidence, and allows AI to scale safely across the enterprise.

Executive Diagnostic

Before expanding AI across your organisation, ask your leadership team these questions:

• Do we have a complete inventory of every AI tool and AI agent currently operating within the business?
• Have we documented what each AI system is allowed to read, create, update, or delete?
• Is every AI capability assigned to a business owner rather than only an IT administrator?
• Do we understand how information flows between different AI systems?
• Have we established review processes for AI permissions and governance?
• Does our leadership team discuss AI Governance with the same seriousness as financial governance or cybersecurity?

If the answer to several of these questions is “no,” your organisation’s next investment should not necessarily be another AI platform. It should be stronger governance.

Executive Action Plan

Within the next 90 days, every organisation can begin building practical AI Governance.

Create an inventory of all AI tools currently in use. Develop an AI Workforce Register identifying each AI agent’s purpose, owner, permissions, and connected systems. Build a simple access matrix defining which AI capabilities may read, create, update, or delete business information. Establish executive ownership for AI Governance rather than delegating responsibility entirely to technical teams. Finally, review governance quarterly as AI capabilities continue evolving.

Artificial Intelligence will undoubtedly reshape every industry, but governance will determine whether that transformation creates long-term competitive advantage or unmanaged operational complexity. The future belongs not simply to organisations that use AI, but to those that understand it, govern it, and integrate it responsibly into the fabric of their business.

Every Technological Revolution Creates a New Leadership Challenge

Over the past three decades, businesses have experienced several waves of technological transformation. Each wave has fundamentally changed how organisations operate, compete, and create value. During the early Internet era, success depended on connectivity. Companies invested heavily in network infrastructure because simply being connected to the digital world represented progress. As the Internet matured, the focus shifted from connectivity to digitalisation. Businesses began redesigning workflows, introducing enterprise systems, and integrating information across departments. Eventually, the conversation evolved once again. Data became one of the world’s most valuable business assets, forcing organisations to invest in cybersecurity, privacy, governance, and regulatory compliance. Every technological revolution introduced extraordinary opportunities, but it also demanded a new level of leadership responsibility.

Artificial Intelligence represents the next stage of this evolution. Yet many organisations continue to evaluate AI using the same performance metrics that shaped previous technology investments. Boardroom discussions are dominated by productivity, efficiency, automation, and cost reduction. These are undoubtedly important outcomes, but they are no longer the defining question of enterprise AI adoption. The organisations that will lead over the next decade will not necessarily be those that deploy AI first or purchase the largest number of AI tools. Instead, they will be the organisations that understand how AI changes the ownership of organisational knowledge and that build the governance required to manage that knowledge responsibly.

This shift requires executives to rethink AI from a leadership perspective rather than simply a technology perspective. AI is not another software application that automates repetitive tasks. Unlike traditional enterprise systems, AI interacts directly with organisational knowledge. Every prompt, document, meeting transcript, customer conversation, operating procedure, and business decision that enters an AI environment carries context about how an organisation thinks and operates. That context is becoming one of the most valuable corporate assets of the AI era. Productivity remains important, but ownership is rapidly becoming the more strategic question.

Organisations Are Measuring the Wrong Success Indicator

Most AI success stories begin with impressive productivity statistics. Marketing teams generate campaigns in minutes rather than days. Software developers accelerate coding. Customer service departments respond more quickly. Managers summarise lengthy reports within seconds. These improvements are real, measurable, and valuable. However, they represent only one side of the equation.

Every AI interaction consists of two equally important components: output and input. Organisations naturally celebrate the quality of AI-generated outputs because they are immediately visible. Far less attention is given to the organisational knowledge that makes those outputs possible. Every uploaded proposal reveals commercial thinking. Every financial spreadsheet explains business performance. Every internal procedure documents operational experience accumulated over many years. Every prompt teaches AI something about how the organisation approaches decisions, solves problems, and serves customers.

This distinction is critical because knowledge differs fundamentally from data. Data records what has happened. Knowledge explains why it happened, how decisions were made, and what should happen next. Competitive advantage has never existed solely within databases or enterprise systems. It exists inside the experience of leadership teams, the judgement of managers, the expertise of employees, and the operational methods that competitors cannot easily replicate. AI has created the first environment in which organisations voluntarily convert this knowledge into machine-readable context every single day. Consequently, the conversation should extend beyond productivity and begin examining ownership. Business leaders should ask not only whether AI is improving performance, but also how organisational knowledge is being governed, protected, and managed as AI becomes embedded within daily operations.

The New Competitive Advantage Is Organisational Intelligence

For many years, organisations described data as the “new oil.” While data remains important, I believe the next competitive advantage lies elsewhere. The true strategic asset of the AI era is organisational intelligence. Organisational intelligence is the collective understanding of how a business creates value. It includes leadership judgement, operational workflows, customer relationships, pricing philosophy, risk management, quality standards, decision-making processes, and institutional experience accumulated over time. Unlike software or hardware, organisational intelligence cannot simply be purchased. It is developed through years of learning, experimentation, and continuous improvement.

Artificial Intelligence is uniquely capable of interacting with this organisational intelligence. Modern AI systems no longer process only structured information. They interpret meeting discussions, analyse policy documents, summarise technical manuals, assist with strategic planning, and recommend business decisions. This capability creates tremendous opportunities for productivity, but it also raises an important leadership responsibility. Organisations should understand what knowledge is being shared with AI systems, which systems have access to sensitive information, how permissions are managed, and how institutional knowledge is protected throughout its lifecycle. These questions are not expressions of distrust towards technology providers. Rather, they reflect good executive governance. Responsible leadership has always required visibility into the assets that create long-term competitive advantage. AI simply expands the definition of those assets.

Ownership Requires Visibility Before It Requires Technology

Many AI discussions quickly move towards selecting platforms, comparing models, or evaluating new capabilities. While technology selection is important, ownership begins much earlier. It begins with visibility. Before organisations can govern AI effectively, they must first understand how AI is already being used across the business. In many companies, employees independently adopt different AI tools, upload documents, connect cloud services, automate workflows, or integrate external applications without any central visibility. This phenomenon is understandable because AI tools are increasingly accessible and easy to use. However, accessibility should not replace management.

Business leaders do not need to become AI engineers, but they should understand the questions that define responsible adoption. Which AI applications are officially approved? What categories of information may be uploaded? Which systems can AI access? Who authorises those permissions? What governance exists when multiple AI services interact with one another? These questions represent leadership responsibilities rather than technical responsibilities. Organisations have long established governance for finance, cybersecurity, procurement, and legal compliance. AI deserves the same level of executive attention because it increasingly influences knowledge, decisions, and operations rather than simply automating repetitive work.

Building Capability Instead of Depending Entirely on Convenience

One observation has become increasingly clear throughout my own work with organisations exploring AI transformation. Many businesses focus their attention on acquiring AI solutions, yet comparatively few invest in developing internal AI capability. Purchasing AI technology is often the fastest way to improve productivity. Building internal capability, however, provides something equally important: understanding.

This does not imply that organisations should avoid third-party AI platforms. Enterprise AI providers offer significant innovation, robust security investments, and valuable capabilities. The more important consideration is whether the organisation itself understands how AI fits within its operating model. Leadership teams should know how information flows between systems, what permissions exist, who remains accountable for AI-driven processes, and where organisational knowledge resides. Over time, I believe every medium and large organisation will develop some form of internal AI capability—not necessarily to replace external platforms, but to ensure that strategic knowledge, operational processes, and governance remain aligned with business objectives.

This is also why I believe the concept of an AI Workforce will become increasingly important. Rather than viewing AI as a collection of disconnected tools, organisations should begin viewing AI as a managed workforce operating alongside human employees. Just as every employee has defined responsibilities, reporting structures, access rights, and performance expectations, every AI capability should eventually operate within clearly defined governance boundaries.

Leadership Must Move Beyond AI Adoption Towards AI Ownership

Artificial Intelligence will undoubtedly become one of the defining technologies of our generation. Every industry will adopt it. Every profession will be influenced by it. Every organisation will discover new opportunities to automate work, improve decisions, and enhance customer experiences. Yet technology alone has never determined long-term competitive advantage. Leadership has always been the deciding factor.

The next generation of business leaders will therefore need to ask a different set of questions. Instead of asking only how AI can improve productivity, they must also ask how AI affects ownership of organisational intelligence. Instead of measuring only efficiency gains, they should evaluate governance maturity. Instead of celebrating automation alone, they should ensure visibility, accountability, and responsible management accompany every implementation. Organisations that combine innovation with disciplined governance will build greater resilience than those pursuing speed without structure.

Executive Diagnostic

Before introducing AI into more business functions, every executive team should honestly consider the following questions:

• Do we know every AI platform currently being used across our organisation?
• Have we defined what information employees may and may not upload?
• Do we understand which AI systems can access our core business applications?
• Is there a documented approval process for granting AI access to sensitive information?
• Have we identified who is accountable for AI governance at the leadership level?
• Are we treating organisational knowledge as a strategic asset rather than simply another collection of files?

If several of these questions cannot yet be answered confidently, the priority may not be adopting more AI. The priority may be establishing greater visibility into the AI that already exists.

Executive Action Plan

Over the next thirty days, leadership teams can begin strengthening AI ownership without waiting for a major transformation programme.

First, create an inventory of every AI platform currently used within the organisation. Second, classify the types of information each platform is permitted to access. Third, define approval rules for future AI integrations. Fourth, begin documenting AI-related policies and decision-making responsibilities. Finally, appoint a business leader—not only a technical leader—to oversee the organisation’s AI governance journey.

Productivity may be the most visible benefit of Artificial Intelligence, but visibility, governance, and ownership will ultimately determine whether AI becomes a sustainable competitive advantage. The organisations that thrive in the coming decade will not simply use AI more effectively than their competitors. They will understand it more deeply, govern it more responsibly, and retain ownership of the organisational intelligence that truly differentiates them.

Sometimes, we spend years searching for the right answer, only to discover that the answer was never meant to be created. It was meant to reveal itself when the mission became clear.

When people see the PDX mascot in the future, they may simply see an octopus. Some may think it looks friendly. Others may think it represents technology or artificial intelligence. Few will know that behind this little character lies years of conversations, hundreds of meetings, thousands of kilometres travelled, and one simple question that has shaped everything we do: How do we help businesses transform successfully in the digital era?

The story of our mascot did not begin with a design brief. It began with a problem. And like many meaningful discoveries, it appeared only after we stopped searching for it. Looking back today, I realise the octopus was never just a mascot. It became a reflection of what PDX had quietly evolved into—a platform built not around technology, but around people, collaboration, and a connected ecosystem. This is the story behind why an octopus became the face of PDX.

1. Seeing the Problem Beyond Technology

Long before PDX was established, I spent years meeting business owners across different industries. Every meeting sounded familiar. Companies wanted to digitalise. They wanted to embrace AI, automate operations, improve productivity, and remain competitive. Yet despite the growing number of software solutions, government initiatives, grants, and technology providers available in Malaysia, many businesses were still unsure where to begin. The challenge was never a lack of technology. Instead, it was a lack of clarity and coordination. Business owners struggled to translate operational challenges into digital requirements. Technology companies spoke in technical language that many business leaders found difficult to understand. Universities were producing graduates, but employers still complained about talent shortages. Funding opportunities existed, yet many businesses were unaware of them or lacked the confidence to apply. Every stakeholder was working hard within their own area of expertise, but they were rarely connected. The more conversations I had, the more convinced I became that Malaysia did not need another technology exhibition. What we truly needed was an ecosystem where every stakeholder could understand one another, collaborate, and move in the same direction.

2. PDX Was Never Meant to Be Just Another Event

That belief became the foundation of Penang Digitalisation and AI Conference & Exhibition (PDX). From the very beginning, my vision was never to organise the biggest conference or exhibition. Events last for a few days, but ecosystems continue growing long after the exhibition halls become empty. Every decision we made was driven by one question: “How do we create meaningful connections?” We wanted business owners to meet solution providers who genuinely understood their challenges. We wanted universities to hear directly from industries about future workforce requirements. We wanted government agencies to engage businesses beyond policy announcements. We wanted investors to discover innovation before it became mainstream. We wanted students to experience the opportunities waiting for them in the digital economy. Slowly, year after year, more organisations joined the journey. Government agencies, multinational corporations, startups, educational institutions, technology providers, investors, and industry associations all became part of something much larger than a conference. Without realising it, PDX was no longer just an annual event. It was becoming a living ecosystem where different communities could finally come together with a shared purpose.

3. Searching for a Mascot That Didn't Exist

As PDX matured, our team began discussing something many established organisations eventually consider—a mascot. It sounded simple at first. We organised brainstorming sessions, explored different concepts, and experimented with various designs. We sketched futuristic robots, AI-inspired characters, digital avatars, and technology icons. We even tried incorporating Penang's iconic blue, white, and yellow colours into the design. Every concept looked professional. Every illustration was creative. Yet every time we reviewed the proposals, something felt incomplete. None of them represented who we really were. Looking back today, I understand why. We were trying to create an identity before we had fully understood our own story. A mascot is not simply a marketing tool. It should represent a mission, a culture, and a belief that people can immediately recognise. At that stage, we were searching for a character. What we truly needed was a symbol that reflected the ecosystem we had spent years building. The answer could not be found in a design studio because it had not yet revealed itself in our journey.

4. The Conversation That Changed Everything

The breakthrough came in the most unexpected place—not during a branding workshop, but during a yacht networking session organised before PDX2026. There were no keynote speeches, presentation slides, or sales pitches. Instead, everyone simply shared their stories. Around the table were business strategists, AI educators, cybersecurity experts, software developers, infrastructure providers, investors, government representatives, university leaders, and entrepreneurs. Each person spoke passionately about the role they played in helping businesses succeed. As I listened carefully, I stopped seeing individual organisations. I began seeing an interconnected ecosystem. Every participant represented a different capability, yet none could create meaningful digital transformation alone. Strategy required execution. Technology required talent. Talent required education. Innovation required investment. Infrastructure enabled everything else. Government created the environment for progress. One conversation naturally connected to another, and another after that. It was one of those rare moments where the entire vision of PDX became visible—not on a presentation screen, but through the people sitting around the table.

5. The Moment I Looked at the Octopus Differently

As the evening continued, my eyes rested on a small orange octopus sitting quietly on the yacht. Until that moment, it had simply been a decorative toy. Then something unexpected happened. I no longer saw a toy—I saw the ecosystem sitting right in front of me. The brain represented strategy and leadership, providing direction for transformation. Every tentacle represented a specialised capability, from AI and cybersecurity to software development, cloud infrastructure, automation, and digital consulting. The nervous system reminded me of education and talent development, ensuring knowledge reached every part of the ecosystem. The flow of nutrients throughout the octopus symbolised funding and investment, sustaining innovation and growth. Each arm could perform independently, yet every movement remained coordinated because they were connected to the same central purpose. Suddenly everything made sense. We had spent two years searching for a mascot when, in reality, our ecosystem had quietly created one for us. The octopus was not chosen because it looked memorable. It was chosen because it perfectly represented what PDX had become.

6. The Real Meaning Behind the PDX Octopus

Today, the octopus represents far more than branding. It symbolises intelligence, adaptability, collaboration, and resilience—qualities that every organisation needs in an AI-driven economy. More importantly, it reminds us that successful digital transformation is never achieved by one company alone. No software provider can transform an organisation without leadership commitment. No consultant can succeed without technology partners. No AI solution creates value without skilled people. No innovation scales without investment, infrastructure, and policy support. Every stakeholder matters. Every contribution matters. The role of PDX has never been to become the centre of attention. Instead, our mission is to become the platform that connects every stakeholder so they can create greater value together. When businesses stop viewing digital transformation as a technology purchase and start seeing it as an ecosystem, their chances of success increase dramatically. That philosophy is what the octopus now represents.

7. A Mascot That Will Continue to Grow With the Ecosystem

People have asked me what the PDX octopus will look like in the years ahead. My honest answer is that I don't know—and that uncertainty excites me. Perhaps it will evolve into different characters. Perhaps it will inspire educational programmes for students. Perhaps it will become recognised across Malaysia as a symbol of collaboration in the digital economy. Whatever form it takes, one thing will never change. It will always represent the belief that transformation happens when people work together rather than apart. Every exhibitor, every speaker, every student, every policymaker, every investor, and every entrepreneur who joins PDX becomes another connection within this ecosystem. The mascot will continue growing because the community behind it continues growing. Its story is still being written, and every new partnership adds another chapter to that story.

8. Building the Next Chapter Together

When I reflect on the journey of PDX, I realise that the greatest achievement was never organising a successful event or introducing a mascot. The greatest achievement has been bringing together people who genuinely believe Malaysia can build a stronger, smarter, and more connected digital future. The octopus simply reminds us of that responsibility. As AI reshapes industries and digital transformation accelerates, businesses can no longer afford to navigate the journey alone. They need a clear roadmap, trusted partners, practical strategies, and an ecosystem that supports long-term growth. That has always been the mission of PDX, and it continues to be my personal mission as well.

Your Digital Transformation Journey Starts With the Right Roadmap

If your organisation is exploring digital transformation, AI adoption, automation, or long-term technology strategy, don't start by asking “What software should we buy?” Start by asking “What roadmap do we need?”

Technology is only one part of the equation. Success comes from aligning leadership, people, processes, funding, talent, and the right implementation partners into a single, practical strategy.

If you are ready to build a digital roadmap tailored to your organisation, I would be delighted to have that conversation.

Let's build your digital future—together.

Lukas J. Tan
Digital Transformation Strategist | AI Advisor | Founder, PDX
Digital Roadmap Consulting • AI Strategy • Ecosystem Development

This case study is based on an actual digital transformation project undertaken during the COVID-19 Movement Control Order (MCO). To protect the confidentiality of the client, the company's identity and certain operational details have been anonymised. However, the business challenges, transformation approach and outcomes presented in this article accurately reflect the project.

Case Background

Industry: Retail Business
Business Size: 20 retail branches across Malaysia
Workforce: Approximately 200 employees
Project Type: Enterprise Digital Transformation & Business Process Redesign

The client is an established retail business operating approximately 20 branches with a workforce of around 200 employees. As the organisation expanded, managing information across multiple branches became increasingly difficult. Critical business operations still relied heavily on Microsoft Excel and manual processes, resulting in inconsistent data, duplicated work, limited visibility and weak permission control. Although the company had already invested nearly a year developing a custom business system, the project had reached a point where continuous modifications were creating more operational issues than solutions.

This article shares how we approached the project—not by fixing the software first, but by redesigning the organisation behind it. It also explains why I believe Digital Transformation must always come before Artificial Intelligence, because AI is only as good as the business processes and data that support it.

The Wake-Up Call During MCO

The COVID-19 pandemic changed the way businesses operated almost overnight. During the Movement Control Order (MCO), many companies suddenly realised that the systems and processes they had relied on for years were no longer sufficient. One particular client approached us during this challenging period with a problem that, on the surface, sounded very familiar. They were still managing critical business operations using Microsoft Excel. As the company expanded, multiple employees were editing the same files, data was constantly being overwritten, and management had no confidence that the reports they were looking at were accurate. More importantly, there was no proper permission control. Anyone with access could modify information, whether intentionally or accidentally. The management team knew they needed to digitalise, but what they believed they needed was simply a software system. What they actually needed was something much bigger.

A Year Spent Building, But Not Progressing

For various reasons, the company eventually engaged another software developer instead of working with us. Over the next twelve months, the system went through countless revisions. Every few weeks there was another meeting, another change request, another bug to fix, and another feature to modify. Unfortunately, the project slowly entered a cycle that many business owners know all too well. Every time one problem was solved, another appeared somewhere else. New features could not be introduced because the development team was constantly repairing existing functions. Users became frustrated because familiar processes kept changing, while management began losing confidence in the project altogether. After nearly a year of investment, both financially and emotionally, they were still nowhere close to having the stable business system they had originally envisioned. That was when they returned and asked if we could help.

I Didn't Start by Looking at Their System

When I first met the management team again, they expected me to review the software, analyse the database, or identify the technical problems that had accumulated over the previous year. Instead, I did something that surprised everyone in the room. I barely looked at the system at all. After nearly twenty years of building enterprise software, I have learned that software is rarely the real problem. A poorly performing system is often nothing more than a reflection of a poorly structured organisation. If the business itself lacks clarity, no amount of programming can compensate for that confusion. Rather than spending days trying to understand thousands of lines of source code or documenting every existing screen, I decided to start from the very top. Before discussing technology, I wanted to understand the business.

The First Question Was About People, Not Technology

The very first document I asked the CEO to show me was not a system manual or a workflow diagram. It was the organisation chart. I wanted to understand how the company was structured before understanding how the software had been designed. Looking at the organisation chart, I asked three simple questions for every department. How many people work here? Does this department generate revenue, or is it a support function? What is its primary responsibility? These questions may sound basic, but they immediately exposed issues that had never been discussed during software development. Several departments had overlapping responsibilities. Some approval processes existed simply because they had always existed. Certain teams were overloaded while others had unclear ownership. Before redesigning technology, we first needed to redesign organisational clarity.

Understanding the Business Before Designing the System

Once the organisational structure became clear, I asked the management team to explain something even more important. I didn't ask how every individual screen should work, nor did I request every operational detail. Instead, I asked them to walk me through the complete customer journey. How does a customer first hear about your business? What happens after they make an enquiry? How are quotations prepared? How are orders confirmed? What happens during production, delivery, invoicing and after-sales support? By understanding the entire business lifecycle, we could identify how information should naturally flow throughout the organisation. Only after understanding the business model did we begin discussing software. Technology should always support business operations, never dictate them.

Digital Transformation Is Not About Digitising Existing Problems

One of the biggest misconceptions surrounding digital transformation is that businesses believe success comes from converting manual paperwork into digital forms. In reality, that approach simply transforms inefficient manual processes into inefficient digital processes. If an organisation has unnecessary approvals, duplicated work, poor communication between departments and inconsistent ownership, software will only make those weaknesses more visible. Digital transformation is not about replicating yesterday's workflow on a computer. It is about questioning every process, eliminating unnecessary steps, simplifying communication and redesigning how the organisation operates. Only then should technology be introduced to automate and support those newly designed processes. Software should never preserve inefficiency; it should eliminate it.

Building a Business System Instead of Just Another Software Application

One aspect of this project that I truly appreciated was the trust given to our team. After we completed our analysis and proposed a new operational framework, the client allowed us to redesign the system based on business objectives instead of individual preferences. They did not interfere with every button, every screen or every workflow. Instead, they judged us based on one simple expectation: when the system is delivered, it must work. It must be intuitive for employees to use, easy for new staff to learn, and capable of providing management with accurate, real-time information. Every department would have its own permission controls, ensuring that employees only accessed information relevant to their responsibilities. Data would move seamlessly from one department to another without repeated manual entry, while every enquiry, customer case and business transaction could be monitored through dedicated operational dashboards. The goal was never to create beautiful software. The goal was to create a business that operated more effectively.

The Real Transformation Happened Inside the Organisation

When the project was completed, the biggest success was not the software itself. The greatest transformation occurred within the organisation. Departments began communicating more effectively because everyone was following the same workflow. Information no longer disappeared inside spreadsheets stored on individual computers. Management gained complete visibility into every stage of the business instead of relying on fragmented reports prepared manually by different teams. Employees spent less time searching for information and more time serving customers. Permission control reduced unnecessary risks, while structured processes improved accountability across the organisation. The company did not simply receive a new system. They gained an entirely new way of operating, where decisions were based on reliable information rather than assumptions.

Before Artificial Intelligence Comes Digital Transformation

Today, almost every boardroom conversation revolves around Artificial Intelligence. Organisations are eager to adopt AI assistants, intelligent automation and predictive analytics. Yet one important question is often overlooked: is the organisation actually ready for AI? Artificial Intelligence does not magically fix poor business processes, inconsistent data or fragmented operations. AI simply consumes whatever data an organisation provides. If the underlying data is incomplete, duplicated or inaccurate, AI will only produce faster and more convincing mistakes.

This is why I often remind business leaders that Digital Transformation is not an optional step before AI—it is the foundation upon which every successful AI initiative is built.

Digital Transformation creates structured business processes. Structured business processes generate reliable and consistent data. Reliable data empowers trustworthy Artificial Intelligence. Skip the first two steps, and AI simply becomes another expensive technology layered on top of organisational chaos.

Many organisations today are rushing to purchase AI tools before asking whether their own operations are ready. They hope AI will solve problems that actually originated from years of inconsistent processes, disconnected systems and poor operational governance. Unfortunately, AI cannot create operational discipline. It can only amplify whatever already exists. If your business operates with clarity, AI accelerates performance. If your business operates in confusion, AI accelerates confusion.

That is why I always tell business leaders during my keynote presentations that AI is not the starting point of transformation. Digital Transformation is.

A Leadership Lesson Beyond Technology

Looking back, this project reinforced something I have believed throughout my career. Technology has never been the hardest part of Digital Transformation. People often assume software development is about coding, databases and programming languages. In reality, the most difficult challenge is helping organisations rethink the way they operate.

Every company already has a workflow. Every company already has departments. Every company already has reporting structures. The question is whether those structures are still suitable for today's business environment.

Digital Transformation is not an IT initiative. It is a leadership initiative. It requires management to rethink responsibilities, decision-making, accountability and information flow before technology can truly deliver value. When leaders embrace this mindset, software becomes an enabler instead of a burden.

A Message to Business Leaders

If your organisation is constantly modifying its system but never seems to make real progress, perhaps the problem isn't your software vendor. If your employees continue relying on spreadsheets despite having an expensive system, perhaps the issue isn't user adoption. If every department keeps asking for new features while management still cannot obtain accurate information, perhaps the real challenge lies much deeper than technology.

Before introducing AI into your organisation, ask yourself a simple question: is your digital foundation strong enough to support it?

AI is only as intelligent as the data it receives. Data is only as reliable as the processes that generate it. And those processes are only as effective as the leadership that designs them. If the foundation is weak, AI will only make poor decisions faster. If the foundation is strong, AI becomes one of the most powerful business accelerators your organisation will ever adopt.

Over the past two decades, I have worked with organisations not just to build software, but to redesign how businesses operate. Sometimes that means stepping into projects that others could not complete. Sometimes it means rebuilding the architecture from the ground up. Much like an intensive care unit (ICU), our role is to stabilise critical digital transformation projects before they fail completely, allowing organisations to recover, modernise and prepare for the future.

If your organisation is facing endless software revisions, disconnected systems, poor data quality, weak permission controls or operational processes that no longer scale with your business, let's have a conversation. Whether through executive advisory, Digital Transformation consulting or one of my keynote sessions, my mission remains the same: to help organisations build the right digital foundation today, so they are truly ready for the AI-powered future tomorrow.

After using AI intensively over the past few weeks, I realised something interesting. My way of working has completely changed.

In the past, I spent almost the entire day operating my computer—writing, editing, checking, and executing every task myself. Today, my computer is running multiple AI agents at the same time. One is writing, another is researching, another is designing, while another is analysing data. My role is no longer to do everything manually.

Instead, I wait for the first draft. I review it, make adjustments, approve it, and let AI continue improving. My value has shifted from execution to judgment. The keyboard is no longer where I spend most of my time—my thinking is.

What the Waiting Moments Became

What surprised me most was what happened during those waiting moments. Instead of rushing to the next task, I found myself picking up a book, enjoying a coffee, or simply thinking about bigger ideas. It feels like a break, but in reality, it’s becoming some of my most productive time.

The Better Question

People often ask me whether AI will take away our jobs. I think a better question is this: When AI gives us back time, what will we do with it? Will we spend it scrolling through social media, or will we invest it in learning, reading, thinking, and becoming better leaders?

For me, that’s the real promise of AI. It isn’t replacing people—it is giving us the opportunity to focus on the things that only people can do: think deeply, make better decisions, and create a greater impact.

How has AI changed the way you spend your time? Has it made you busier, or has it given you back time to learn and think? I’d love to hear your experience in the comments.

Over the past two weeks, one of the biggest lessons I learned wasn’t about AI itself. It was about myself. For most of my career, I’ve been someone who is very detail-oriented. I like to understand every process, every implementation, and every small step before moving forward. That mindset has helped me build businesses over the years.

But recently, I found myself working differently. Instead of spending hours thinking about every detail, I began focusing on the outcome I wanted to achieve. I realised that AI is often capable of handling the detailed execution faster, more consistently, and sometimes even better than I could. It challenged a habit that I had built over many years.

Details Still Matter — But Who Handles Them Changes

This doesn’t mean details are no longer important. Details still matter. The difference is who should spend more time on them. As leaders, perhaps our greatest value is no longer doing every detail ourselves, but ensuring the direction is correct, the objectives are clear, and the instructions are precise. AI can help execute, but it still depends on us to define the destination.

Leadership Is About the Right Work, Not the Most Work

It reminded me that leadership has never been about doing the most work. Leadership is about helping people—or now, even AI—do the right work. The clearer our thinking, the better the execution becomes. I’ve started spending more time asking “What problem are we trying to solve?” rather than “How do I complete every individual task?”

I’m still learning every day, and I’m sure my thinking will continue to evolve. But this has probably been my biggest personal takeaway so far. AI isn’t replacing our thinking. It is pushing us to think at a higher level, focusing more on strategy, judgment, and leadership than ever before.

I’d love to hear your experience too. Has AI changed the way you work, lead, or make decisions? What’s the biggest mindset shift you’ve experienced? Let’s learn from one another, because I believe we’re all still discovering what leadership looks like in the AI era.

People often ask me why I started the Penang Digitalisation & AI Conference & Exhibition (PDX). Some assume it was because I wanted to organise a conference or create another technology event. The truth is much deeper than that. PDX was never about organising an event—it was about solving a problem that I had observed for many years.

Throughout my journey with OPERiON, I had the opportunity to work with organisations across different industries. I realised that government agencies, businesses, technology providers, universities and talented individuals were all working towards the same goal of driving innovation and economic growth. However, they were often working independently, with limited opportunities to connect, collaborate and create meaningful impact together.

I came to believe that digital transformation is not simply about adopting new technologies. It is about bringing people together, redesigning the way organisations operate, and building stronger partnerships across the entire ecosystem. Technology is only an enabler. Real transformation happens when people share knowledge, trust one another and work towards a common vision.

The Future Belongs to Ecosystems, Not Individuals

As artificial intelligence continues to reshape every industry, the importance of collaboration has become even greater. No single organisation can prepare for the future alone. Governments need industry. Businesses need technology partners. Universities need closer connections with employers. Students need opportunities to learn from real-world experiences. The future belongs to ecosystems, not individuals.

That belief became the foundation of PDX. My vision was to create a platform where government, industry leaders, technology providers, universities, startups and future talent could come together under one roof. A place where ideas become collaborations, collaborations become opportunities, and opportunities become lasting impact for our communities and economy.

Every Obstacle Became Part of the Journey

The journey has not been easy. Building an ecosystem is far more challenging than building a company. There have been countless challenges, financial pressures, setbacks and moments of uncertainty. Yet every obstacle has reinforced one important lesson: if the mission is meaningful and benefits others, every challenge becomes part of the journey rather than the reason to stop.

Today, PDX represents much more than an annual conference and exhibition. It is a growing movement to accelerate digital transformation, encourage responsible AI adoption, develop future-ready talent and strengthen collaboration between the public and private sectors. It is a platform designed to help organisations learn, connect and move forward together.

Looking Ahead

Looking ahead, my vision extends far beyond the next event. I hope to see PDX become a leading AI and digital ecosystem that starts in Penang and creates impact across Malaysia and the region. Through initiatives such as AI Hackathons, leadership forums, talent development programmes and industry collaborations, we can build a stronger future together. If you share this vision, I warmly invite you to join us on this journey by following PDX2027, participating as an exhibitor, partner or delegate, and becoming part of an ecosystem that believes innovation grows stronger when we build it together.

Think Bold. Build Together. Transform the Future.

Follow PDX

🌐 Website: penangdigitalisation.com

📢 Follow the PDX social media channels for the latest updates on exhibitions, conferences, partnerships, AI programmes and exhibitor opportunities.

We look forward to welcoming you to the PDX ecosystem.

By Ts. Lukas J. Tan

For the past two decades, businesses have invested heavily in Search Engine Optimisation (SEO). We optimised keywords, built backlinks, improved page speed, and published articles to rank higher on Google. Those strategies are still important, but while building my own AI workforce recently, I realised something that completely changed my perspective. The next generation of websites won’t compete only for search rankings—they’ll compete to be understood by AI.

One unexpected lesson came from something developers have quietly used for years: Markdown (.md). I wasn’t trying to learn Markdown. I discovered it while building AI-powered systems with Claude. At first, I wondered why almost every document was stored as a Markdown file instead of Microsoft Word or plain text. Then it clicked. Markdown isn’t just a writing format; it’s a structured way of organising knowledge. AI doesn’t care about beautiful layouts or animations. It understands hierarchy, relationships, context, and clearly organised information. The better your knowledge is structured, the easier it is for AI to understand your business.

This made me rethink how we build websites. Traditionally, we start by designing pages—Home, About Us, Services, Contact. Today, I believe we should start by designing knowledge. Most websites, especially traditional CMS platforms, were built primarily for humans to read and search engines to crawl. They can absolutely be made AI-friendly, but many organisations still organise content page by page rather than as a connected body of knowledge. With AI-assisted development, I now find myself creating structured knowledge first, then letting AI generate the website, proposals, profiles, and other business assets from that single source. The website becomes one output—not the starting point.

From SEO to GEO and AEO

I believe we are entering the next phase of digital transformation. In the past, we optimised for SEO. Today, conversations are shifting toward Generative Engine Optimisation (GEO), Answer Engine Optimisation (AEO), and other AI-focused approaches. Whatever terminology eventually becomes the standard, the direction is clear: organisations need websites that communicate expertise in a way AI systems can understand, not just pages that look attractive to people.

One Knowledge Base, Every Output

The organisations that adapt early will gain a significant competitive advantage. Imagine maintaining one trusted knowledge base that powers your website, LinkedIn articles, keynote profiles, proposals, sales materials, training content, and even your internal AI workforce. Instead of rewriting the same information across different platforms, AI understands your knowledge once and helps you publish it consistently everywhere. That changes not only how we build websites, but how we manage knowledge across an entire organisation.

I am still researching and learning in this space, but one thing is becoming increasingly clear. The last 20 years were about building beautiful websites. The next 20 years may be about building websites that AI can understand. The question is no longer, “Does your website rank on Google?” The better question is, “Can AI understand your business well enough to recommend it?” Those who begin restructuring their websites into AI-ready knowledge platforms today may be the ones who remain visible, trusted, and discoverable in tomorrow’s AI-first world.

People often ask me what framework I use or which technology I recommend. The truth is, I have never been someone who learns technology by memorising names or following trends. I learn by solving real business problems. Many years ago, I built a UI component system that made my projects more consistent and easier to maintain. Years later, someone looked at my code and said, “This is basically Bootstrap.” I smiled because, at the time, I had never even thought about Bootstrap. I wasn't trying to use a framework — I was simply trying to solve a problem.

The same thing happened again around 2009. As my projects became larger, I realised I needed a better way to control code quality. I designed my own PHP project structure so developers could only access the folders they were supposed to access. Business logic, presentation, and data were separated to make maintenance easier and reduce mistakes. Years later, I discovered that what I had built followed the same philosophy as the Model-View-Presenter (MVP) pattern. I didn't set out to implement MVP. I was simply designing a better way to build software.

The Problem Comes First, the Name Comes Later

Looking back, I realised this has always been my approach. I rarely start with a technology or a framework. I start with the problem. Once I understand the problem deeply, I build the architecture that solves it. Sometimes the industry already has a name for it. Sometimes it becomes a recognised design pattern. Either way, the name has never been the goal. The solution has always been the goal.

Why the Database Comes First

If there is one area I have always believed deserves the most attention, it is the database. Frameworks change. Programming languages evolve. AI models improve every few months. Cloud platforms come and go. But your data remains. A poorly designed database will create problems for years, no matter how modern the technology stack is. A well-designed database, on the other hand, allows applications, frameworks, and even entire platforms to evolve without disrupting the business. To me, the database is not just another component — it is the foundation of the organisation's digital assets.

That is why, throughout my career, I have invested more time in database architecture than in chasing the latest technology trends. Naming standards, relationships, primary keys, audit trails, migrations, scalability, and future-proof design are not glamorous topics, but they are the reason software survives. If people remember me for one thing, I hope it is this: build the database right, and everything else becomes easier.

If your organisation is facing challenges in database architecture, system design, digital transformation, or AI-ready application architecture, I would be glad to have a conversation. The right database design doesn't just solve today's problems — it creates the foundation for the next decade of growth.

By Ts. Lukas J. Tan — Founder of ScamAlert Junior™ | CEO of OPERiON | AI & Digitalisation Strategist

Over the past few years, I have had the opportunity to work closely with businesses, schools, government agencies, technology professionals, educators, and parents through various digitalisation, artificial intelligence, and cybersecurity initiatives. While every organisation has different priorities, one concern has become increasingly common — the digital world is evolving much faster than our ability to prepare people for it. Cybersecurity is no longer a topic reserved for IT departments or large corporations. It has become a life skill that affects every individual, regardless of age.

As technology becomes more accessible, children are also entering the digital world earlier than any previous generation. They learn through smartphones, communicate through messaging platforms, play games online, and increasingly interact with artificial intelligence without fully understanding the risks that may exist behind every screen. This observation led me to a simple but important question: are we preparing our children early enough to navigate the digital world safely? That question eventually became the starting point of ScamAlert Junior™, an educational intellectual property created to help children develop critical thinking, responsible digital habits, and the confidence to make better decisions before they encounter online threats.

The Digital Childhood Has Changed

Childhood today looks very different from what many parents experienced growing up. Previous generations spent most of their free time outdoors, interacting face-to-face with friends, reading physical books, or learning through direct conversations with teachers and family members. Today's children, however, are growing up in an environment where digital technology is seamlessly integrated into almost every aspect of daily life. Smartphones, tablets, online classrooms, social media platforms, streaming services, artificial intelligence, and multiplayer games have become part of their normal routine from a very young age.

While these technologies provide incredible opportunities for education, creativity, and communication, they also introduce new challenges that many children are not yet equipped to recognise. Fake online identities, phishing attempts, scam advertisements, misleading information, cyberbullying, and AI-generated content are becoming increasingly sophisticated. Children are naturally curious, trusting, and eager to explore new experiences — qualities that make them wonderful learners but can also make them more vulnerable in digital environments.

The digital world itself is not the problem. Technology is one of the greatest tools humanity has ever created, opening doors to knowledge and opportunities that previous generations could only imagine. The real challenge lies in ensuring that children develop the judgement, awareness, and critical thinking needed to use these technologies responsibly. Just as we teach children how to cross a busy road safely, we must also prepare them to navigate the digital world with confidence rather than fear.

Why Traditional Scam Awareness Is No Longer Enough

For many years, scam awareness campaigns were designed primarily for adults. The focus was often on financial fraud, investment scams, phishing emails, or identity theft targeting working professionals and senior citizens. Children were rarely considered part of the conversation because they were perceived as having limited financial resources and relatively little online independence. That assumption is changing rapidly.

Today, children are exposed to online interactions much earlier than before. They receive messages from strangers while gaming, watch influencer content across multiple platforms, click advertisements without understanding their intent, and sometimes unknowingly share personal information through quizzes, apps, or social media. Modern scams are no longer limited to stealing money. They can involve manipulation, deception, emotional exploitation, identity misuse, or attempts to build trust before targeting other members of a family.

This means digital safety education cannot begin only after an incident has occurred. Waiting until a child becomes a victim is similar to teaching road safety only after a traffic accident. Prevention has always been more effective than recovery. Instead of relying solely on warnings such as “don't click suspicious links” or “don't talk to strangers online,” we need to help children understand why certain situations are dangerous and how to think critically before making decisions.

The future of scam awareness should not be built upon fear alone. It should be built upon knowledge, observation, curiosity, communication, and responsible decision-making. These are skills that children can continue applying throughout their lives as technology continues to evolve.

Why Stories Can Teach Better Than Lectures

Throughout history, stories have always been one of the most effective ways to teach values, wisdom, and life lessons. Long before classrooms, textbooks, or digital learning platforms existed, knowledge was passed from one generation to another through stories that people could remember, relate to, and share. While technology has changed dramatically, the way children learn has remained surprisingly consistent. They still remember characters long after they forget instructions. They remember emotions more easily than statistics. They remember meaningful experiences more than lengthy explanations.

This understanding became one of the foundations behind ScamAlert Junior™. Rather than producing another educational handbook filled with warnings and technical terminology, I wanted to create characters that children could genuinely connect with. Characters like Lukas, Leo, Lynn, Turbo, Johan, Lina, and Atuk Hassan each represent different personalities, perspectives, and life experiences. Through their adventures, mistakes, discussions, and teamwork, children are encouraged to observe carefully, ask questions, verify information, and think before acting.

Storytelling transforms learning into an enjoyable experience rather than a compulsory lesson. Instead of telling children what they should or should not do, stories allow them to explore situations alongside familiar characters, developing their own understanding through observation and discussion. When learning becomes emotionally engaging, the lessons often remain with children far beyond the final page of a book.

Building More Than Just a Comic

Many people who first hear about ScamAlert Junior™ naturally assume it is simply another children's comic book. While storytelling remains an important part of the project, the comic itself represents only one component of a much larger educational vision. From the beginning, my objective was never limited to publishing a series of books. I wanted to create an educational intellectual property that could continue supporting children across different learning environments for many years to come.

Behind every official character sits a comprehensive Character Asset Library that defines visual identity, personality, behaviour, educational purpose, communication style, expressions, poses, costumes, colours, and commercial guidelines. This ensures consistency regardless of whether the characters appear in books, classroom activities, animations, mobile applications, educational games, public awareness campaigns, or licensed merchandise. Every future adaptation remains aligned with the same educational philosophy and values.

Beyond the characters themselves, the ecosystem is designed to expand into activity books, teacher resources, parent guides, workshops, digital learning materials, exhibitions, community programmes, and future educational technologies. Each component shares the same mission: helping children become thoughtful, responsible, and confident digital citizens through engaging and practical learning experiences.

Building an educational intellectual property requires thinking beyond today's publication. It requires creating a foundation that remains relevant as new technologies, new challenges, and new generations emerge.

Looking Towards the Future

Artificial intelligence will continue advancing. Digital platforms will become even more sophisticated. Online scams will undoubtedly evolve in ways we cannot yet fully predict. While technology changes rapidly, the qualities that protect people often remain timeless. Critical thinking, empathy, responsibility, curiosity, integrity, and good judgement have always been valuable, regardless of the tools people use.

This is ultimately what ScamAlert Junior™ hopes to contribute. The project is not about creating fear of technology or encouraging children to avoid digital innovation. On the contrary, it is about helping young learners embrace technology with confidence while understanding the importance of thinking before acting, verifying information before believing it, and seeking guidance whenever uncertainty arises.

I also believe protecting children online should never be the responsibility of schools alone. Parents, teachers, communities, government agencies, technology companies, and industry leaders all have an important role to play in shaping the next generation of responsible digital citizens. Education becomes most effective when these groups work together towards a common purpose.

ScamAlert Junior™ was created with that long-term vision in mind. It is more than a comic, more than a collection of characters, and more than an educational campaign. It is a commitment to helping children build the confidence, judgement, and values they will need not only to recognise scams, but to navigate an increasingly digital world with wisdom, responsibility, and hope.

At a PDX2026 speaker briefing last year, a manufacturing CEO told me his company had just rolled out an AI forecasting tool that nobody on the floor was using. The tool wasn’t broken. Nobody had told the planning team which decision it was supposed to change. Six months and a licence fee later, the spreadsheets were still running the floor, and the AI dashboard sat open in a browser tab nobody clicked.

I hear a version of this story at almost every PDX prep call. The technology works. The leadership around it doesn’t move fast enough to point it at anything.

Three Things I Keep Seeing

The tool arrives before the decision does

Someone in IT or ops champions a good tool. It gets bought, piloted, even praised in a town hall. But nobody has decided what will change because of it — which report stops being manually built, which meeting gets shorter, which approval gets skipped. Without that, the tool becomes a second system running next to the old one, not a replacement for it.

Nobody owns the follow-through

A pilot has a project owner. Adoption rarely does. Once the vendor demo is over and the case study photo is taken, the person accountable for whether staff actually change their daily habits is often nobody in particular — which means, in practice, nobody.

Middle management absorbs a leadership problem

When adoption stalls, the story that gets told is usually “our people resisted change.” In my experience it’s rarely resistance. It’s that middle managers were handed a new tool and the same old targets, with no time carved out to actually redesign how the work gets done. They didn’t reject the technology. Nobody gave them room to use it.

A Test Before Your Next AI Pilot

Before signing off on another tool, I ask leadership teams three questions. If they can’t answer all three in one sentence each, the pilot is not ready to launch:

• What specific decision or task does this replace, not just support?
• Who is personally accountable for adoption twelve weeks after go-live?
• What will we stop doing to make room for this?

If the answer to the third question is “nothing”, you’ve just bought a second job for your team, not a productivity gain.

FAQ

Will AI actually take my team’s jobs?

Rarely in one clean step. What I see far more often is a role quietly becoming unnecessary over 12–18 months because leadership never redesigned the workflow around the new tool — the job doesn’t disappear so much as the company falls behind competitors who did the redesign.

What should a leader do differently this quarter?

Pick one AI tool already sitting half-used in your organisation and answer the three-question test above for it. Fix the adoption gap before buying anything new.

Is this really a leadership problem, not an IT problem?

If your IT team can point to a tool that’s live but nobody outside IT can point to a decision it changed, it’s a leadership problem wearing an IT costume.

The Short Version

The real risk was never that AI replaces people. It’s that leaders who can’t make a fast, specific decision about how work should change get quietly outpaced by leaders who can — using the exact same tools.

Running PDX means I get a year-on-year read on what Malaysian business leaders are actually worried about, not what a survey says they should be worried about. Between PDX2025 and PDX2026, the conversations in the delegate lounge changed in a way I didn’t expect.

Three Signals From the Delegate Floor

Signal 1: Fewer people ask “what is AI”

At PDX2025, a good third of conversations were still explaining basic concepts. At PDX2026, almost nobody asked that. The question had shifted to “who else in my industry has already deployed this, and what did it cost them to get it wrong?”

Signal 2: Vendors are being asked harder questions

Exhibition-floor conversations got sharper. Procurement teams showed up with checklists instead of curiosity — asking about integration with legacy ERP systems, not just feature lists. That’s a sign the buying committee has matured past the pilot-project stage.

Signal 3: The window to catch up is visibly shrinking

A supply-chain director told me flatly that two of his competitors had already renegotiated supplier contracts around real-time data sharing. His company hadn’t started. He wasn’t worried about being behind — he was worried about being unable to catch up before contracts renewed.

Where the Smart Companies Are Actually Positioning

The organisations that stood out to me this year weren’t the ones with the biggest AI budget. They were the ones who could describe, specifically, which of their existing workflows would be redesigned in the next two quarters — and who owned that redesign. Everyone else was still in “exploring options” mode, which is a polite way of saying nothing has actually changed yet.

A Question Worth Sitting With

If a competitor called your best customer tomorrow and said “we can already do that, in real time, at lower cost” — would your team know within the hour, or find out at contract renewal?

Where This Goes Next

This is exactly the gap we built PDX2026 around: not another round of AI explainers, but a room where the people already three steps ahead sit next to the people who need to move. If you want to see where Malaysia’s next phase of digital transformation is actually heading, that’s the conversation happening on the PDX floor, not in a webinar.

A few years ago, an OPERiON client — a mid-sized distributor — asked us to help fix a warehouse system their internal team had spent eight months building. It didn’t talk to their accounting software, couldn’t handle their busiest month of the year, and had already cost more than three off-the-shelf platforms combined. The build itself wasn’t incompetent. Nobody on the team had simply been given time to look outside the building before starting.

The Situation

Their internal IT lead was smart and had built useful tools before. But he was solving the problem with the only reference points he had: what the company had done in the past, and what he personally already knew how to build. Three competitors, we later found out, were already running a widely-used regional platform for the exact same workflow — at a fraction of the cost and time.

The Insight

Internal teams aren’t under-skilled. They’re under-exposed. A good engineer who has only ever seen one company’s way of solving a problem will build a solution shaped by that one company’s history, not by what the wider industry has already learned the hard way. That’s not a competence gap. It’s a visibility gap, and no amount of internal effort closes it, because the information simply isn’t inside the building.

What Changed

We didn’t replace their team. We changed the first step: before building anything, spend two weeks mapping what already exists in the market and who in their own supplier or partner network had solved something adjacent. That single habit — look outward before building inward — turned their next three projects from eight-month builds into six-week integrations.

Why This Keeps Happening

Vendor dependency gets a bad reputation, so companies overcorrect into “we’ll build it ourselves to stay independent.” But independence built on outdated information isn’t independence — it’s isolation with extra steps. The companies actually winning right now aren’t the most self-reliant. They’re the ones with the widest, fastest-moving network of outside insight feeding into decisions made inside.

A Question for Your Next Project

Before your team writes a single line of code or signs off on a build, can anyone in the room name two ways competitors or peers have already solved an adjacent problem? If not, you’re not being independent. You’re building blind.

Artificial intelligence is not reducing the importance of humans—it is redefining the value humans are expected to create.

Technology Has Entered a New Era

For almost two decades, I have worked in software development, digital transformation, and technology consulting. During most of that time, technical expertise was one of the strongest competitive advantages a professional could possess. The more programming languages you mastered, the more systems you built, and the more technical problems you solved, the more valuable you became to an organisation. Today, that equation is changing rapidly. Artificial intelligence is transforming the way software is written, analysed, tested, and maintained. Tasks that once demanded years of experience can now be accelerated within minutes using AI-assisted development tools. This is not a temporary trend or another technology cycle. It represents a structural shift in how knowledge work is performed. While many discussions continue to focus on whether AI will replace jobs, I believe the more important question is whether professionals are prepared to redefine the value they bring. Technology is evolving faster than many careers, and those who continue relying only on traditional technical skills may soon discover that technical execution alone is no longer enough.

AI Is Replacing Tasks Before It Replaces Professions

There is a common misconception that artificial intelligence will suddenly replace entire professions. In reality, AI is replacing individual tasks long before it replaces complete roles. Software developers can now generate code, automate documentation, identify programming errors, create user interfaces, and even suggest software architecture within minutes. Accountants can automate reconciliations. Designers can generate visual concepts almost instantly. Lawyers can summarise contracts with remarkable speed. These capabilities do not eliminate professionals overnight, but they significantly reduce the time required to complete routine work. As a result, organisations begin asking a different question. Instead of evaluating employees based on how efficiently they complete repetitive tasks, they increasingly evaluate them based on how well they solve business problems, make decisions, communicate across teams, and improve organisational performance. The value of execution is gradually shifting towards the value of thinking. Those who recognise this transition early will position themselves for future growth, while those who continue competing only on technical execution may find themselves competing directly against AI.

Technical Skills Will Remain Important—but They Are No Longer Enough

Some people interpret discussions about AI as suggesting that technical knowledge is becoming irrelevant. I disagree completely. Programming, engineering, cybersecurity, software architecture, and systems integration remain essential disciplines. However, technical capability is becoming the starting point rather than the destination. Future technology professionals must also understand business operations, organisational behaviour, customer expectations, process optimisation, and strategic objectives. Throughout my career, I have discovered that many software projects fail not because programmers cannot write code, but because business requirements are misunderstood, communication breaks down, or the organisation has never clearly defined the problem it wants to solve. AI may now generate thousands of lines of functional code, but it still depends on humans to ask the right questions, define meaningful outcomes, and evaluate whether the proposed solution actually creates business value. Technical knowledge remains valuable, but business understanding increasingly determines professional relevance.

The Professionals Who Thrive Will Become Translators

One observation has remained remarkably consistent throughout my experience working with clients from different industries. The individuals who create the greatest impact are rarely those with the deepest technical expertise alone. Instead, they are the people capable of translating between business and technology. They understand the language of executives while also appreciating the realities faced by programmers, engineers, and operational teams. They know how to convert a strategic objective into system requirements, and they know how to explain technical limitations in business language that decision-makers understand. Artificial intelligence will only increase the importance of this role. As AI becomes capable of generating technical output, organisations will need more professionals who can provide context, exercise judgement, resolve ambiguity, and align multiple stakeholders towards a common objective. The future belongs not only to builders, but to translators who connect ideas, people, systems, and execution.

Organisations Must Redesign Work, Not Just Buy AI

Many organisations are currently investing heavily in artificial intelligence platforms, hoping that productivity will improve automatically. Unfortunately, technology alone rarely transforms an organisation. I have seen projects where sophisticated systems were successfully deployed, yet employees continued using spreadsheets because workflows were never redesigned. Managers still approved work manually because responsibilities remained unclear. Communication problems persisted because the organisation focused on purchasing technology instead of changing behaviour. Artificial intelligence should never be viewed as an additional tool layered on top of existing inefficiencies. Instead, leaders must rethink how decisions are made, how information flows, and how responsibilities should evolve. AI changes the way work is organised, not merely the software employees use. Without leadership, ownership, communication, and redesigned processes, even the most advanced AI solution will struggle to create sustainable value.

Leadership Will Become More Valuable Than Technical Perfection

One of the biggest changes brought by artificial intelligence is the growing importance of leadership. Technical professionals who aspire to remain valuable must develop capabilities that AI cannot easily replicate. These include critical thinking, ethical judgement, creativity, emotional intelligence, negotiation, stakeholder management, adaptability, and strategic decision-making. Likewise, business leaders must develop sufficient technological understanding to make informed strategic decisions without needing to become programmers themselves. The strongest organisations of the future will not necessarily employ the most technically gifted individuals. They will build teams capable of combining business insight, technical capability, leadership, and continuous learning. In the AI era, leadership is no longer reserved for people with formal management titles. Every professional is increasingly expected to contribute ideas, challenge assumptions, coordinate across departments, and help organisations adapt to continuous change.

Dream It. Execute It. Ground It.

This philosophy has guided my work for many years, long before generative AI became part of everyday business conversations. Dreaming is about recognising opportunities that others have not yet seen. Execution is the discipline required to transform those ideas into practical workflows, systems, and measurable outcomes. Grounding is ensuring that innovation genuinely improves the lives of employees, customers, and organisations instead of becoming another technology experiment with little lasting impact. Artificial intelligence is giving organisations unprecedented capabilities, but capability without execution creates little value. Likewise, execution without grounding often produces systems that look impressive yet fail to solve meaningful problems. Sustainable innovation requires all three elements working together. Technology should serve people, support organisations, and strengthen long-term competitiveness rather than simply demonstrating technical sophistication.

The Real Question Every Professional Should Ask

Perhaps the most important question facing professionals today is not whether AI will replace them. A more meaningful question is whether they are developing capabilities that remain valuable even when AI becomes significantly more capable. If artificial intelligence can perform half of today’s technical tasks tomorrow, what unique contribution will you continue making? Will you become someone who simply executes instructions, or someone who frames problems, guides decisions, builds alignment, and creates lasting organisational value? Throughout history, every major technological revolution has rewarded those willing to evolve alongside it. The AI era will be no different. Traditional technical expertise will remain important, but the professionals who combine technology with strategic thinking, business understanding, communication, leadership, and disciplined execution will become the people organisations rely on most. In the years ahead, human value will be measured less by what we can do manually, and more by how effectively we help others navigate change.

I built my first automation system in 2008 — a customer-relationship tool I called Autobot CRM, inspired by watching Iron Man and wondering if a small business could have its own version of Jarvis. There was no “AI workflow” category back then. There was just a simple realisation: the software mattered less than the sequence of steps it was automating.

The Lesson That Still Holds

Autobot CRM wasn’t powerful because of clever code. It was useful because I’d mapped, in painful manual detail, exactly which follow-up happened after which customer action, and in what order. The automation just executed a workflow that was already clear. Companies rushing to bolt AI onto a messy, undocumented process today are making the same mistake I’d have made if I’d automated a workflow I hadn’t actually understood first.

Two Kinds of Companies in the AI Economy

Companies with a workflow to plug AI into

These organisations can describe, step by step, how a task currently moves from trigger to completion, including who touches it and why. When they adopt an AI tool, it slots into a known gap and the result is immediately measurable, because the “before” state was already documented.

Companies hoping AI will create the workflow for them

These organisations buy the tool first and hope structure emerges afterward. It rarely does. The AI ends up automating confusion faster, surfacing more inconsistent outputs at higher speed, which is a worse position than the manual mess they started with.

How OPERiON Builds Around This

Every system we design leans on independent, microservice architecture on purpose — not as a technical preference, but so that a client’s workflow can keep evolving without the whole system needing to be rebuilt each time a piece changes. Fragile, tightly-coupled systems are exactly where AI adoption stalls, because nobody can safely change one part without breaking three others.

A Practical Starting Point

Before evaluating any AI vendor, write down — on one page — the current manual steps of the process you want to improve. If you can’t fit it on one page, that’s the actual project. The AI tool is the easy part that comes after.

As AI makes software development faster, software architecture becomes more important—not less.

Everyone Is Talking About AI Writing Code. Few Are Talking About What Happens Five Years Later.

Artificial intelligence has transformed software development at an extraordinary pace. Today, developers can generate code, build websites, create mobile applications, design user interfaces, and even produce technical documentation within minutes. Tasks that once required days of programming effort can now be completed through carefully written prompts and AI-assisted development tools. This technological progress is remarkable, and I believe every technology professional should embrace it. However, while AI has dramatically reduced the time required to build software, it has also created a new misconception. Many people now assume that if software can be built faster, then software development itself has become easier. My experience over more than nineteen years tells me otherwise. Building software has indeed become faster. Building software that remains maintainable, scalable, secure, and valuable over many years is an entirely different challenge. That challenge has always been called software architecture, and in the AI era, it has become more important than ever before.

Building Software Is No Longer the Difficult Part

For many years, software projects were constrained by development speed. Businesses waited months for programmers to complete interfaces, databases, reports, and workflow modules. Today, AI has changed that equation completely. Prototypes can be created within hours. Landing pages can be generated within minutes. Developers can solve programming errors with unprecedented speed. Even non-technical users are beginning to create applications using AI-assisted platforms. This democratisation of software development is exciting because it lowers the barrier to innovation. More entrepreneurs can validate ideas, more organisations can experiment, and more people can participate in digital transformation. However, creating a working application should never be confused with creating a sustainable software platform. Speed solves the problem of building version one. It does not automatically solve the challenges of maintaining version fifty. The true complexity of software begins after deployment, not before it.

Architecture Determines Whether Software Can Grow

Every organisation changes. Customers evolve. Regulations are updated. Business models expand. New technologies emerge. As these changes occur, software must also evolve. This is where architecture becomes the foundation of long-term success. A well-designed architecture allows systems to scale without constant rebuilding. It enables modules to be upgraded independently, integrations to be added safely, and new business requirements to be implemented without affecting the entire platform. Poor architecture produces the opposite effect. Small changes create unexpected problems. New features become increasingly expensive. Technical debt accumulates. Eventually, organisations reach a point where replacing the system appears easier than maintaining it. The problem is rarely the programming language or the framework. More often, it is the architectural decisions made at the beginning of the project, when speed was prioritised over sustainability.

AI Understands Code. Architecture Requires Judgement.

Artificial intelligence has become remarkably capable of generating technical solutions. It can recommend database structures, optimise algorithms, suggest APIs, and write clean code based on detailed prompts. These capabilities significantly improve developer productivity. Yet software architecture extends beyond writing code. Architecture requires understanding business strategy, organisational workflows, operational risks, user behaviour, scalability requirements, security considerations, governance, and long-term maintenance. These decisions often involve balancing multiple priorities that cannot be resolved by technical optimisation alone. An architect must ask questions such as: How will this system evolve over the next five years? Which modules should remain independent? How should future integrations be managed? What happens if business priorities change unexpectedly? These questions require judgement, experience, and business understanding. AI can provide recommendations, but humans remain responsible for making architectural decisions that determine the future of an organisation’s technology.

The Most Expensive Software Mistakes Are Usually Invisible at the Beginning

One of the most dangerous characteristics of poor software architecture is that it often appears successful during the early stages of a project. The application launches. Users log in successfully. Reports are generated correctly. Management feels confident because the project has been delivered on time. The real problems emerge months or even years later. New business requirements become difficult to implement. Performance begins to decline as transaction volumes increase. Integrating external platforms requires significant redevelopment. Every enhancement introduces unexpected bugs because components are tightly connected. Technical teams spend more time maintaining old code than creating new value. These issues are rarely caused by poor programmers. They are usually the consequence of architectural decisions that failed to anticipate future organisational growth. By the time these problems become visible, correcting them is often significantly more expensive than building the system correctly from the beginning.

Software Architecture Must Begin with Business Architecture

Throughout my career, I have learned that successful software projects rarely begin with discussions about technology. They begin with conversations about the business itself. How does the organisation create value? Which workflows generate competitive advantage? Which information is most critical for decision-making? Where are operational bottlenecks occurring? Technology should support these answers rather than dictate them. Before writing a single line of code, organisations should first understand how work flows across departments, how responsibilities are assigned, and how customers experience the business. Software architecture should therefore reflect business architecture. When technology follows business strategy, systems remain aligned with organisational objectives even as technology continues evolving. When technology is designed independently from business reality, organisations often find themselves adapting their operations to accommodate software instead of allowing software to support the business.

AI Is Changing the Role of Software Professionals

The AI era is transforming what it means to be a software professional. Future developers will spend less time writing repetitive code and more time solving business problems. Software architects will increasingly evaluate AI-generated solutions rather than producing every technical component manually. Project managers will coordinate intelligent automation instead of supervising routine development tasks. Business analysts will become even more important because defining the right problem is now more valuable than generating another solution. Professionals who combine technical expertise with communication, critical thinking, business understanding, and architectural judgement will become indispensable. Those who focus only on code generation may discover that AI performs many of those activities faster and at lower cost. The future belongs to professionals who can bridge business strategy and technology implementation while ensuring systems remain maintainable long after the excitement of deployment has faded.

Dream It. Execute It. Ground It.

Artificial intelligence has given us extraordinary new capabilities, but technology alone has never guaranteed lasting success. Dreaming allows organisations to imagine new possibilities and innovate beyond traditional limitations. Execution transforms those ideas into working systems that improve productivity and create measurable value. Grounding ensures those systems remain practical, maintainable, scalable, and aligned with the realities of business growth. Software architecture represents this final step. It is the discipline that turns short-term innovation into long-term organisational capability. As AI continues changing how software is built, organisations should remember that technology may accelerate development, but architecture determines sustainability. The companies that succeed over the coming decade will not simply build software faster. They will build systems that continue serving their organisations long after today’s technologies have evolved into tomorrow’s history.

Executive Reflection

Before beginning your next software or AI project, ask yourself:

• Are we designing software, or are we designing a long-term business capability?
• Will this architecture still support our organisation five years from now?
• Does our technology reflect the way our business actually operates?
• Are we prioritising speed at the expense of sustainability?
• If AI can generate code in minutes, where will our long-term competitive advantage come from?

Artificial intelligence has changed how software is built.

It has not changed the importance of designing systems that organisations can trust, maintain, and grow with.

That is why software architecture remains one of the most valuable disciplines in the AI era.

Organising the first PDX conference, I made hundreds of decisions personally — which vendor, which stage layout, which speaker slot. By PDX2026, my job had changed almost entirely. I was no longer making most of those decisions. I was designing the system that let other people make them well, without calling me first.

Decision-Maker vs System Architect

A decision-maker is the person everyone waits on. A system architect is the person whose absence doesn’t stop anything, because the structure already tells people how to decide. Most leaders I meet are still operating as the first, even as their organisation has grown far past the size where that scales.

What a decision-maker optimises for

Being right, quickly, on the specific thing in front of them. It feels responsive. It also means every important choice funnels through one person’s calendar.

What a system architect optimises for

Designing the conditions — the information flow, the escalation rules, the shared context — so that a good decision is the default outcome even when the architect isn’t in the room. It feels slower to set up. It scales without you.

The PDX Test

The clearest sign PDX had become a system rather than a one-man decision engine: during the 2026 event itself, I was mostly moving between stages, not fielding operational questions. The team had the structure to handle what came up. That wasn’t luck. It was eighteen months of deliberately building the structure instead of just making faster decisions.

FAQ

Does this mean leaders shouldn’t make decisions anymore?

No — it means reserving your personal decision-making for the handful of choices that genuinely need it, and designing everything else so your team doesn’t need to ask.

Where should a leader start?

Pick the single decision your team asks you for most often. Instead of answering it again, write down the rule you used to answer it, and hand the rule to the team. That's the first brick of the system.

The best digital tool I’ve ever built won’t stop a single scam on its own. What stops a scam is a grandparent pausing for three seconds before clicking a link, or a teenager remembering to ask “why is this stranger asking me for a one-time password?” That’s not a technology outcome. It’s a thinking habit — and it’s the exact same gap I see inside companies that have spent heavily on digital transformation and still can’t explain what changed.

Two Kinds of “Digital”

Writing Scam-Proof and building the ScamAlert Junior comics taught me something I now see everywhere in corporate transformation projects too: giving someone a tool doesn’t give them the instinct to use it well. You can install the best anti-fraud software in Malaysia on every device in a household, and it won’t matter if nobody in that household has learned to pause before trusting an urgent message. The software was never the missing piece. The habit of questioning was.

Companies make the identical mistake with digital transformation budgets. They buy the platform. They skip building the habit of questioning how work should actually flow through it. Six months later, the platform is “live” and nothing about how people actually work has changed, because the organisation never learned to think differently — it just learned to click a new button in roughly the old way.

What “Thinking Differently” Actually Looks Like

In the scam-awareness talks I give to schools and community groups, the turning point is never the moment I show a slide about phishing techniques. It’s the moment someone in the room says, out loud, “wait, I did exactly that last week.” That’s a mindset shift, and it happens through story and reflection, not through installing anything.

Inside an organisation, the equivalent moment is a manager saying “wait, we’ve been approving this the same way for six years and nobody has asked why.” If your digital transformation programme has never produced that sentence out loud in a meeting, technology has been installed, but thinking hasn’t changed — and the transformation, whatever the dashboard says, hasn’t actually happened yet.

Where to Look First

Before your next platform purchase, sit in on the process you’re trying to fix and count how many times someone says “that’s just how we’ve always done it.” That sentence, not the software gap, is what you’re actually transforming.

Artificial intelligence is not simply changing the tools we use. It is forcing organisations to rethink how work is organised, decisions are made, and value is created.

Technology Is Moving Faster Than Most Organisations Can Adapt

Over the past two decades, organisations have invested billions of dollars in enterprise software, cloud platforms, automation, and, more recently, artificial intelligence. Yet despite this rapid advancement, many businesses continue to struggle with the same operational challenges they faced years ago. Meetings remain unnecessarily long, approval processes are slow, information is scattered across departments, and employees still spend valuable time performing manual tasks that technology should have eliminated long ago. This disconnect highlights an important reality. Digital transformation is no longer constrained by technology. Today’s tools are more capable than ever before. Instead, the limiting factor has become the organisation itself. The greatest challenge is no longer finding better software but redesigning how people collaborate, make decisions, share information, and execute work. Organisations that continue treating digital transformation as an IT project will increasingly find themselves falling behind competitors who understand that transformation begins with organisational redesign rather than technology acquisition.

Technology Alone Does Not Change the Way an Organisation Works

One of the biggest misconceptions surrounding digital transformation is the belief that implementing a new system automatically changes organisational behaviour. In reality, software only provides capability. People determine whether that capability creates value. I have seen organisations invest heavily in ERP platforms, CRM systems, workflow automation, AI assistants, and sophisticated dashboards, only to discover months later that employees still rely on spreadsheets, manual approvals, email chains, and disconnected processes. The technology functions exactly as intended, but daily operations remain largely unchanged. This happens because digital transformation is often approached as a technology deployment instead of an organisational redesign exercise. Installing new software without redefining responsibilities, communication channels, performance measurements, and decision-making processes simply digitises existing inefficiencies. Technology becomes an additional layer rather than a catalyst for meaningful improvement.

Artificial Intelligence Is Redefining Organisational Structures

Artificial intelligence is accelerating a transformation that extends far beyond automation. It is changing how organisations should be structured. Traditional organisations were designed around clearly defined departments, hierarchical approvals, and specialised job functions. AI is making these boundaries increasingly fluid. Employees now have access to tools that allow them to analyse information, create content, automate routine tasks, and solve problems that previously required multiple departments. As a result, organisations must rethink reporting structures, role definitions, decision authority, and collaboration models. The future organisation will rely less on rigid departmental silos and more on cross-functional teams capable of responding quickly to changing business needs. This shift is not about removing people. It is about enabling people to contribute at a higher level while allowing technology to handle repetitive execution. Organisational design must evolve alongside technological capability.

Leaders Must Shift from Managing Work to Designing Systems

Leadership itself is undergoing a significant transformation. For many years, effective managers were expected to supervise work, monitor performance, approve decisions, and solve operational problems. In the AI era, these responsibilities increasingly shift towards designing systems that allow good decisions to happen consistently without constant managerial intervention. Leaders must become architects of organisational capability rather than supervisors of daily activity. They must establish clear workflows, define accountability, simplify communication, and ensure information reaches the right people at the right time. Artificial intelligence can assist with analysis and automation, but it cannot replace thoughtful organisational design. Sustainable transformation depends on leaders who understand both business strategy and operational execution, creating an environment where technology supports people instead of forcing people to adapt to poorly designed systems.

Communication Is Becoming the Most Valuable Organisational Capability

Throughout my career in software development and digital transformation, I have observed that many projects do not fail because of poor technology. They fail because communication breaks down between business leaders, technical teams, operational users, and external stakeholders. Executives often describe business objectives while developers interpret technical requirements, yet somewhere between those conversations the original problem becomes distorted. Artificial intelligence does not eliminate this challenge. In many cases, it amplifies it. AI systems depend heavily on accurate context, clear objectives, and disciplined implementation. The organisations that succeed will therefore invest as much in improving communication as they do in purchasing technology. Employees who can translate business challenges into practical implementation strategies will become increasingly valuable because they bridge the gap between strategic vision and operational reality.

Organisational Agility Will Become the New Competitive Advantage

In the past, organisations often competed through economies of scale, production efficiency, or geographical reach. Today, competitive advantage is increasingly determined by organisational agility. How quickly can leadership recognise change? How rapidly can teams redesign workflows? How efficiently can information move across departments? How confidently can employees adopt new technologies? Artificial intelligence provides faster access to information, but organisations still require people capable of interpreting that information, making informed decisions, and executing consistently. Companies that redesign themselves around adaptability rather than bureaucracy will respond more effectively to market changes, customer expectations, and technological disruption. Agility is no longer simply an operational characteristic. It is becoming a strategic capability that determines long-term competitiveness.

Digital Transformation Requires Courage Before Technology

Every successful transformation I have witnessed began with leadership making difficult decisions rather than purchasing new software. Leaders chose to challenge long-standing assumptions, redesign familiar workflows, redefine responsibilities, and encourage employees to embrace new ways of working. These decisions often created discomfort because organisational redesign requires people to leave familiar routines behind. Technology implementation is usually the easiest phase of transformation. Changing behaviours, aligning stakeholders, and maintaining momentum require significantly greater discipline. Organisations must therefore recognise that transformation is fundamentally a leadership responsibility. Technology provides new possibilities, but courage, communication, and execution determine whether those possibilities become sustainable business outcomes. The future belongs to organisations willing to redesign themselves before competitors force them to do so.

Dream It. Execute It. Ground It.

Every meaningful transformation begins with a vision of what an organisation could become. Dreaming allows leaders to imagine a future beyond today’s limitations. Execution transforms that vision into redesigned workflows, improved communication, stronger leadership, and measurable operational improvements. Grounding ensures that transformation remains practical, sustainable, and aligned with the realities of employees, customers, and long-term organisational success. Artificial intelligence will continue evolving at remarkable speed, but technology alone will never determine which organisations succeed. Those that thrive will be the ones willing to redesign how they work, rethink how they lead, and continuously adapt how they create value. Digital transformation has therefore become much more than a technology initiative. It has become an organisational discipline that connects people, leadership, systems, and innovation into a sustainable competitive advantage.

Executive Reflection

Before launching your next digital transformation initiative, consider these questions:

• If every employee had access to AI tomorrow, would your organisation still operate the same way?
• Which workflows exist today simply because “that is how we have always done it”?
• Are your organisational structures designed for hierarchy, or for speed and collaboration?
• Does technology support your people, or have your people adapted to inefficient technology?
• If you could redesign your organisation from scratch today, what would you do differently?

The organisations that lead the next decade will not necessarily own the most advanced technology. They will be the organisations with the courage to redesign themselves before change forces them to.

Everyone who has organised a large event will tell you the idea is the easy part. Turning “Penang should have its own digitalisation conference” into two days at Setia SPICE Convention Centre with government, MNCs and industry leaders in the same room meant running straight into the same execution failures I now see inside almost every organisation I work with.

Three Failures That Almost Sank PDX

1. Everyone agreed on the goal, nobody agreed on the trigger

Early on, three teams all believed “get sponsors confirmed” was someone else’s next move. Nobody was wrong about the goal. Nobody had been told exactly what event should trigger their part of the work. The fix wasn’t a pep talk about ownership — it was a one-page document naming, for every workstream, the single event that started it.

2. Knowledge lived in one person’s head

For the first PDX, sponsor relationships existed mostly in my own memory and inbox. The moment I was unreachable for two days, decisions stalled, not because the team lacked judgement, but because they lacked the context I hadn’t written down anywhere. We now document context, not just tasks — the “why” behind a relationship or a commitment, not just the “what.”

3. Feedback arrived too late to matter

In year one, we found out what delegates actually wanted from post-event surveys — useful for next year, useless for the event already over. Now we build in short feedback checkpoints during planning, not just after the event, so a bad assumption gets caught in week three instead of month eleven.

The Pattern Behind All Three

None of these were knowledge problems. Every team involved knew, in the abstract, what needed to happen. What was missing was the specific trigger, the written-down context, and the fast feedback loop that turns knowing into doing. That gap — not a lack of smart people or good intentions — is what I’d call the real execution gap.

FAQ

Isn’t this just a project management problem?

Partly — but project management tools don’t fix it if the underlying triggers and context were never defined. The tool organises the gap; it doesn’t close it.

What's the fastest way to check if my team has this problem?

Ask three people on the same project to describe, unprompted, what specifically triggers their next task. If you get three different answers, you've found the gap.

Scammers adopted AI voice cloning and deepfake video call scams faster than most Malaysian banks updated their customer fraud warnings. I’ve tracked this gap closely while researching Scam-Proof, and it isn’t a story about criminals having better technology. It’s a story about who moves fast and who moves slow — and that exact gap shows up inside ordinary companies too, just with less dramatic headlines.

Fast Side, Slow Side

A scam network can test a new script, drop the ones that don’t convert, and scale the ones that do, all within days. A bank updating a customer warning message often needs sign-off from legal, compliance, and brand — a process measured in months. Neither side lacks intelligence. One side has removed the friction between noticing something and acting on it. The other hasn’t.

I see the identical pattern inside companies evaluating AI tools. A competitor tests, fails fast, adjusts, and ships. The slower organisation is still circulating the seventh draft of a risk-assessment memo for a pilot with no customer data in it yet. The technology gap between them is usually small. The decision-speed gap is enormous, and it compounds every quarter.

What Speed Actually Costs You If You Skip It

To be clear, this isn’t an argument for recklessness — a bank should absolutely check its fraud messaging carefully. It’s an argument for shrinking the distance between “we noticed a problem” and “we did something proportionate about it” from months to weeks. Every extra month of deliberation is a month a faster-moving competitor, or a faster-moving scammer, gets to operate unopposed in the same window.

Three Questions That Reveal Your Real Speed

• How long ago did your organisation last change a customer-facing process because of something you noticed last month, not last year?
• Can anyone below senior leadership approve a small, reversible experiment without three layers of sign-off?
• When something goes visibly wrong, does the fix ship in days, or does it wait for the next quarterly planning cycle?

If those answers are uncomfortable, the risk you’re carrying was never really about AI. It was about how long your organisation takes to notice and move — and in both fraud prevention and digital transformation, that number is the only one that actually predicts who gets hurt.