TLDR IT 2026-09-29

AI made building software easier, and now more of it is entering the enterprise than IT has ever had to govern. Keeping up takes new thinking on security, access, and oversight, built for software created faster and by more people than ever.

On October 6, join Tines and Forrester for a candid conversation on why decision velocity is becoming IT's new differentiator, and what it means to govern outcomes rather than just oversee systems.

You'll learn how IT accountability is shifting from delivery to outcomes, and practical ways to position your team now for the next five years of AI-driven change.

Save your seat here.

UpGuard identified more than 16,000 Supabase databases exposing readable tables. Analysis of their schemas indicated that more than half could expose personal information, with smaller subsets potentially exposing passwords or authentication tokens. The issue is misconfigured access controls rather than a newly discovered platform vulnerability, reinforcing the need for database authorization, exposure testing, and clear ownership of internally built tools.

Microsoft has paused optional update KB5002907 after reports that it left some Office 2016 and 2019 installations unlicensed or, rarely, removed. Its recovery guidance is to reactivate or reinstall the affected product. Importantly, the update makes no changes where Microsoft 365 Apps updates are managed through Group Policy or Cloud Update. Support teams should check update history before treating unexpected licensing tickets as subscription or account problems.

In this Decoder interview, Mike Cannon-Brookes explains why Atlassian combined internal IT and AI enablement under its people leadership: employee adoption and changes to business systems are tightly connected. He also argues that AI will change SaaS workflows without eliminating the need for structured systems and human judgment. For CIOs, the interesting question is who owns the combined work of employee enablement, system integration, and AI cost management, rather than treating each as a separate rollout.

Promoting a strong technologist does not automatically prepare them to manage people, business relationships, or competing operational priorities. This piece examines unclear expectations, insufficient leadership development, and the tendency to reward technical output without developing management skills. It is a useful operating-model check for CIOs overseeing support, infrastructure, SaaS, and business systems: define what managers own, coach them on business outcomes, and provide advancement paths for specialists who should remain individual contributors.

Workday has announced Total Benefits, combining benefits-provider integrations, administration services, and employee guidance in one offering. Workday Wellness is now available to US customers, while benefits guidance through its Self-Service Agent is expected to become generally available in October. Evaluation should cover provider compatibility, sensitive employee-data sharing, and whether the new workflows can replace existing portals and manual administration rather than simply adding another layer.

Anthropic's marketplace brings together more than 2,000 plugins and connectors, partner-built agents, and services, with eligible partner software purchasable using a portion of committed Anthropic spending. For an internal AI platform team, the significant change is the growing catalog of connections between assistants and business systems, along with another procurement channel to manage. Marketplace availability should not replace reviewing permissions, data access, integration ownership, and how access will be removed when someone leaves.

Disabling BitLocker starts decrypting the drive, while suspending protection leaves the data encrypted but temporarily makes the encryption key accessible. This walkthrough explains the distinction and why short-term firmware maintenance or troubleshooting often calls for suspension rather than removing encryption entirely. The operational takeaway is to make resuming and verifying protection part of the endpoint maintenance runbook, not optional cleanup after the support ticket closes.

Microsoft 365 customers can now use consumption-based billing when users exceed their licensed OneDrive storage instead of purchasing additional capacity upfront. Admins choose which users are eligible and can set budgets and alerts. Additional storage costs $0.20/GB/month. Enterprise SaaS is shifting toward usage-based pricing, giving IT more flexibility but also making cost monitoring part of day-to-day platform management.

Google will begin applying new automatic-note settings on September 29.

Cloudflare says it completed remediation of a cross-tenant storage-reuse flaw affecting Containers and Sandboxes by September 19, found no evidence of malicious exploitation in available telemetry, and requires no customer-side action.