By Pierluigi Casale, Professor and Area Chair of AI at OPIT – Open Institute of Technology
 

If you ask a room of professionals what they should do to get ready for AI, the most frequent answer is still: learn to code. Coding is valuable, and it remains a powerful way to understand how software behaves. But the leap from writing code to leading responsibly with AI is far larger than many organisations admit. 
 

AI systems do not fail only because the code is wrong. They fail when objectives are poorly framed, when data reflects yesterday’s biases, when accountability is vague, and when human expectations are managed badly. Those failure modes are as much about people and institutions as they are about algorithms.

Why ‘learning to code’ is not the same as mastering AI

AI is increasingly used as a decision support layer across recruitment, marketing, customer service, credit, and risk. In each of these contexts, the hardest questions are not syntactic but normative: what counts as success, who bears the downside, and what trade-offs are acceptable. 
 

A strong programmer can build a model that predicts, classifies, or generates text. That does not automatically equip them to judge whether the model should be used, whether it is fair in context, or how it will reshape incentives inside an organisation. Treating coding as the main proxy for AI competence narrows the field exactly when AI demands broader, more interdisciplinary leadership.

AI is a socio-technical system, not a coding exercise

Every AI deployment is a socio-technical system: a combination of data, models, workflows, governance, users, and institutional constraints. If any one of those elements is weak, the system fails even if the model scores well in a lab benchmark. 
 

This is why frameworks such as the NIST AI Risk Management Framework and the EU AI Act stress trustworthiness, governance, and lifecycle thinking rather than technical performance alone. That emphasis is not a brake on innovation; it is what keeps experimentation from becoming harm at scale.

A four-intelligence model for the AI era

To work effectively with AI, we need a richer definition of capability than ‘can write code’. A useful way to frame that capability is through four intelligences: emotional, social, creative, and technological. Coding sits inside the technological domain, but it cannot carry the whole burden of responsible AI.

Emotional intelligence: designing for human reactions, not just outputs

AI changes how people feel about their work, their identity, and their agency. If leaders ignore anxiety, scepticism, and over-trust, they will get either quiet resistance or reckless reliance. 
 

Emotional intelligence means understanding when a system should be transparent, when it should defer to a human, and how to communicate uncertainty without eroding confidence. It also means creating psychological safety so teams can report failures early, before they become public incidents.

Social intelligence: building AI that fits real organisations

Most AI programmes stall not because the model is weak, but because the organisation is not ready. Data sits in silos, accountability is diffused, and incentives reward speed over quality. 
 

Social intelligence is the ability to map stakeholders, power dynamics, and decision rights, then design workflows that make responsibility explicit. It is also about understanding how AI will reshape roles, performance measures, and trust between teams, customers, and regulators.

Creative intelligence: using AI to expand imagination rather than outsource it

Generative AI can accelerate drafting, exploration, and ideation, but it can also flatten thinking into the average of the data it was trained on. If teams use AI only to generate more content faster, they may become less original, not more productive. 
 

Creative intelligence means treating AI as a thinking partner: a tool for exploring alternatives, testing hypotheses, and surfacing blind spots. It requires strong problem framing, good questions, and the discipline to keep human judgement in charge of what is new, relevant, and ethically defensible.

Technological intelligence: more than coding, anchored in impact

Technological intelligence includes software engineering, but it also includes data governance, security, evaluation, monitoring, and incident response. It means understanding model limitations, measuring performance in the real world, and designing for robustness as conditions change. 
 

It also demands an operating knowledge of emerging standards and regulatory expectations, because scale without safeguards is simply automated risk.

How organisations build responsible AI without stifling innovation

The fear in many boardrooms is that ‘responsible AI’ translates into slow committees and frozen experimentation. In practice, the opposite is often true: clear rules enable faster delivery because teams know what is acceptable and how to evidence it. 
 

A pragmatic approach is to separate exploration from deployment. Let teams experiment in sandboxes with synthetic or low-risk data, but require stronger assurance before systems touch customers, employees, or high-impact decisions. 
 

Treat governance as an engineering discipline. Define the use case, document the intended benefit, identify likely harms, and agree measurable thresholds for accuracy, bias, and safety. Then monitor drift and user behaviour, because the world will change even if the code does not.

Why ethics must be embedded into education and leadership

Ethics is too often treated as a slide at the end of an AI training course or a last-minute review by legal. That approach fails because the key ethical choices are made much earlier: in problem selection, data selection, and success metrics. 
 

International guidance is converging on the same message. The OECD AI Principles and UNESCO’s Recommendation on the Ethics of AI both stress human rights, transparency, accountability, and the need for human oversight throughout the lifecycle. 
 

Regulation is also beginning to codify expectations. In the EU, the AI Act has entered into force, signalling that AI risk management and governance will be treated as organisational obligations, not optional best practice. 
 

Embedding ethics means teaching leaders how to ask better questions: what could go wrong, who might be excluded, what data rights are involved, and what accountability looks like when the system is wrong. It also means building interdisciplinary teams where ethicists, domain experts, and frontline staff can challenge technical assumptions without being dismissed as ‘non-technical’.

Addressing common fears and misconceptions with clarity

The public debate about AI swings between hype and panic, and both are unhelpful. People are right to worry about privacy, discrimination, and job displacement, but those outcomes are not inevitable; they are design and policy choices. 
 

Leaders should speak plainly about what AI can and cannot do. Explain that models can be confidently wrong, that they can amplify patterns in historical data, and that they require oversight. In the UK, the Information Commissioner’s Office has issued guidance on AI and data protection that is explicitly aimed at supporting innovation whilst protecting people. 
 

Most importantly, position AI as augmentation rather than replacement. When organisations invest in the four intelligences, they can deploy AI to remove low-value work and raise the quality of human decision-making, rather than eroding trust and morale.

What AI literacy looks like in practice

If AI capability is broader than coding, AI education must be broader too. That means building shared literacy across roles: executives need to understand risk, product teams need to understand governance, and technical teams need to understand the human context in which their systems operate. 
 

A useful test is whether a team can answer four basic questions without handwaving. What outcome are we optimising for, and who decides that outcome is legitimate? What evidence will we collect to show the system is safe, fair, and effective after launch, not only before it? 
 

This is where the four intelligences become practical. Emotional intelligence shapes how you communicate uncertainty; social intelligence clarifies accountability; creative intelligence improves problem framing; and technological intelligence turns all of that into measurable controls and resilient systems.

A more realistic definition of AI readiness

Coding will remain part of the AI story, but it should not be the headline. The leaders who succeed will be those who can combine technical competence with emotional insight, social understanding, and creative judgement. 
 

If we want AI that is not merely powerful but legitimate, we have to educate and lead accordingly. The AI era will reward those who build systems that work for people as well as for performance metrics. 

Meeting the demands of the latest zero trust guidelines involves ditching legacy apps and positioning for non-human identities

By Kate O’Flaherty

When former Forrester analyst John Kindervag first created the zero trust cybersecurity model in 2009, the core idea was simple: Don’t trust anything inside the firewall.

But nearly two decades later, the concept of zero trust has evolved as remote working and novel threats such as AI expand the surface for attack. It is with this in mind that the US National Security Agency (NSA) has released Phase One and Phase Two of its Zero Trust Implementation Guidelines.

The guidelines cover what’s needed to achieve the US Department of War’s (formerly Department of Defense) targets for zero trust maturity. This is mandatory for US-based organizations in critical sectors but in the face of modern threats, its principles apply to the UK and beyond too.

So, what do the guidelines say and how can firms ensure their own zero trust model is set up to mitigate today’s evolving threats?

A very modern security model

Nearly 80% of detections in CrowdStrike’s 2025 Global Threat Report were malware-free, demonstrating that attackers increasingly exploit stolen credentials, social engineering and privilege misuse, rather than perimeter vulnerabilities.

As hybrid, multi-cloud and AI-enabled infrastructures expand, every user, device and non-human account represents “a potential entry point”, says Darren Guccione, CEO and co-founder of Keeper Security.

Yet it is the non-human “users” that pose the most pressing threat, according to experts. “AI agents, automated workflows, and machine-to-machine API calls are becoming a significant share of network traffic, and these non-human entities need to be governed under zero trust principles as well,” says Tom Vazdar, professor of cybersecurity and AI at OPIT – Open Institute of Technology. “That is a dimension the original concept never anticipated, and it represents the next major frontier for the framework.”

The most important evolution in the zero trust mindset is happening “right now”, according to Vazdar. In 2026, there is a shift from verifying identity to verifying intent, he says. “Traditional zero trust asks, ‘can you prove who you are?’. That is necessary, but no longer sufficient. Credentials can be stolen, biometrics get deepfaked and devices get compromised.”

But user behavior cannot be easily counterfeited at scale, he says. For example, the way a legitimate user navigates an application, the rhythm of their keystrokes and their decision-making patterns. “Modern zero trust must incorporate continuous behavioural verification throughout entire sessions, rather than just a one-time check at the door.”

The NSA’s guidelines

The NSA’s Zero Trust Implementation guidelines reinforce a structured maturity model built around five pillars: Identity, devices, networks, applications and data. “The emphasis is on measurable progress, continuous monitoring and enforceable access controls,” says Guccione.

Identity governance is positioned as foundational. “Without consistent multi-factor authentication (MFA), strong privileged access management (PAM) and comprehensive audit logging, organizations cannot achieve meaningful zero-trust maturity,” Guccione explains.

The practical guidelines organize 152 distinct zero trust activities into five phases: AaDiscovery phase for establishing baseline visibility, followed by Phase One, consisting of 36 activities supporting 30 capabilities. Phase Two comprises 41 activities supporting 34 capabilities for reaching target-level maturity, while two future advanced phases are yet to be published.

To reach the target level maturity by the fiscal year 2027 deadline, organizations in the report’s scope must successfully shift from “a perimeter-based defense” to “a model of continuous, context-aware verification”, says Mike Driscoll, senior managing director in the cybersecurity practice at FTI Consulting.

This involves moving “beyond simple login checks” to “a state where every access request, whether for a user, device, or application, is authenticated and authorized in real-time, based on data-centric policies and automated threat analytics”, he says.

Zero trust challenges in 2026

While many firms have already moved to zero trust models, for some it may be a leap to reach the level of maturity outlined by the NSA.

The move can present several challenges. Legacy infrastructure is “the most persistent obstacle”, according to Vazdar. “Many critical business systems were designed for implicit trust. They lack modern authentication mechanisms or APIs that integrate with contemporary identity platforms. Retrofitting zero trust onto these systems without breaking operations requires careful phasing and compensating controls.”

Widespread skill gaps compound the problem. Implementing zero trust across the NSA’s seven pillars demands expertise in identity management, network architecture, data classification, application security and increasingly, AI and automation, says Vazdar.

At the same time, firms often underestimate the user friction they will face. “Zero trust inherently means more verification,” adds Vazdar. ”If this creates excessive friction, users find workarounds, which can actively undermine your security posture.”

There can also be logistical issues. Firms cannot simply “pause operations” to “rebuild their entire IT architecture around zero trust”, says Paulo Cardoso do Amaral, author of Business Warfare, strategist and expert in competitive intelligence. “Transformation must occur while systems remain in production. This creates tension between operational continuity and architectural change.”

Benefits to everyone

However, experts say the effort of moving to zero trust will benefit all businesses, regardless of size.

Every organization benefits from verifying explicitly, enforcing least-privilege access and assuming breach, says Vazdar. “These are sound security fundamentals that improve posture, regardless of size or sector.”

However, the implementation depth must match the context. A multinational bank will execute zero trust very differently from a 200-person manufacturer. “The NSA’s 152 activities across five phases are designed for defense and critical infrastructure, and not every organization needs that level of granularity,” Vazdar points out.

Larger organizations typically have the scale and risk exposure that justify full zero trust programs. Meanwhile, smaller organizations may not implement a complete architecture themselves, but can still benefit through cloud and managed service providers that embed zero trust principles into their platforms, says Cardoso do Amaral.

Over time, packaged and simplified solutions will continue to make zero trust more accessible to smaller firms, he predicts.

An online institute founded by a business school graduate is now launching a doctorate in AI.

By Stephanie Mullins-Wiles

The 6D model of disruption describes technological evolution as a systemic sequence of interconnected phases. It analyzes the dynamics between incumbents and new entrants, user behaviors, and the business models that are reshaping value creation in digital markets.

By Francesco Derchi, Professor and Area Chair of Digital Business at OPIT – Open Institute of Technology

Understanding these dynamics is essential for businesses, managers, and public policymakers who want to anticipate the impact of new technologies rather than suffer them. From this perspective, the 6D model of disruption represents a particularly useful tool for interpreting technological evolution as a systemic sequence of interconnected phases.

From Marginality to Diffusion: How Technologies Become Dominant

The model’s premise is simple yet powerful: many innovations don’t become dominant immediately. In the initial stages, they often appear expensive, marginal, and difficult to deploy, accessible only to a minority of players or users.

Over time, thanks to technical advances, the diffusion of skills, and the reduction of costs, these same technologies become progressively more accessible, widespread, and integrated into economic and social life. Disruption, therefore, is not an isolated event but a chain of successive steps, in which each stage enables the next and contributes to redefining the competitive landscape.

Incumbents and New Entrants: Winners and Losers in the Disruption Trajectory

Looking at technological transformation through the 6Ds allows us to connect two dimensions that are often analyzed separately: the evolution of technology and the behavior of market players. When a technology advances along this trajectory, the balance between incumbents and new entrants also changes.

Some companies are able to exploit the emerging phase of innovation to introduce alternative business models, while others, more established, struggle to adapt to change and risk losing ground. In this sense, the model serves not only to describe technological change, but also to understand how it reshapes competitive dynamics between companies.

The Player Map: How to Spot Who’s Leading, Chasing, or Breaking the Rules

A key aspect of the framework is its ability to visualize the map of players along the progression of disruption. Analyzing an industry means first identifying those driving innovation, those trying to follow it, and those attempting to overturn the rules of the game.

The distinction between incumbent and insurgent is not just a theoretical classification: it allows us to understand how strategies evolve when technology becomes more widespread and accessible, changing the relationship between operational efficiency, value proposition and the ability to attract new users.

Users, investments, behaviors: the transformations that accompany technological evolution

The model also suggests carefully observing the transformational dynamics that accompany technological evolution. This isn’t just about technical advances, but also about changes in user behavior, investment flows, and ways of accessing services.

Innovations are often initially adopted by a minority of pioneers and innovators, then gradually spread to broader segments of the population as they become easier to use and less expensive. Understanding this sequence helps businesses and organizations identify the best time to invest, experiment, or reposition.

The case of hospitality: a sector that has gone through all the phases of disruption

A prime example of this evolution is the hospitality and travel industry. Over time, the sector has undergone a recognizable progression: first the rise of digital aggregators that facilitate the search for offers, then the emergence of platforms based on online reputation, and finally the spread of the sharing economy and peer-to-peer models.

Each step has redefined the way value is created and delivered, introducing new players and transforming user expectations of the service.

Beyond Technology: Disruption as a Redesign of the Value Creation System

This perspective highlights an often overlooked strategic point: disruption is not just about the technology itself, but how it redesigns the value creation system.

In digital markets, competitive advantage no longer depends solely on the ownership of assets or infrastructure, but on the ability to orchestrate relationships between different players, build ecosystems, and develop new ways of interacting between users, platforms, and services. Value increasingly emerges from the overall configuration of the business model — that is, the way an organization creates, distributes, and captures value in the market.

Ecosystems, platforms, and co-creation: an integrated understanding of change

For this reason, applying the 6D model doesn’t mean simply observing the advancement of a technology. It means building an integrated understanding that includes business models, partnerships, platform dynamics, and ways of co-creating value between companies and users.

In many cases, in fact, the most disruptive innovations emerge precisely when the way in which value is generated and captured within an economic ecosystem changes, rather than from the simple introduction of a new technological solution.

Anticipating Industrial Trajectories: The 6D Model as a Strategic Tool

From a strategic perspective, the framework’s main contribution is the ability to anticipate industrial trajectories. Recognizing the stage of a technology’s evolution allows for more robust hypotheses about future market developments.

Companies can thus decide when to experiment with new models, when to consolidate their position, or when to radically rethink their offerings. In this sense, the model becomes a tool for analysis as well as for decision-making.

The Role of Public Policy Makers: Managing Disruption Without Suppressing It

At the same time, public policymakers can also use this perspective to design more timely industrial and regulatory policies. Intervening too early can stifle innovation; intervening too late risks creating concentrations of power that are difficult to rebalance.

Understanding the progressive logic of disruption therefore becomes essential even for those who must govern economic transformation processes.

An essential skill: recognizing progressions to navigate change

Ultimately, the 6D model invites a shift in perspective: rather than interpreting innovation as a succession of isolated events, it proposes viewing it as a systemic evolutionary trajectory. This trajectory intertwines technology, business models, user behavior, and competitive dynamics between companies. For organizations operating in increasingly unstable and complex environments, developing the ability to recognize these progressions is not only an analytical advantage, but an essential strategic skill for navigating the industrial transformations that are redefining the digital economy.