I speak with a lot of CTOs, and I consistently find that the biggest issue they face is misalignment between their senior leadership teams executive communications and aspirations and their processes, culture, capabilities, and their pragmatic appetite for investment and risk.
If you do one thing this quarter during planning season - you have to pick a lane.
The frontier is fun
I spend a lot of my time talking with AI pioneers and experimenting with the future of agentic engineering. I’ve personally shipped over 23,000 PRs this year, and it’s important to understand what breaks once you start to automate generation and then verification of code.
If you’re wondering, these days the cool kids are mainly talking about bringing more rigor to verification by abusing compilers and pattern matching against ASTs, property-based testing, formal proofs for tractable subsets of your code using Lean and TLA+, and the potential utility of purely functional languages, which materially simplify verification. These will be mainstream discussions - probably sometime in 2027.
If I were to bet, I would also say that GitHub is going to have a hard 2028, and with a Mythos-level threat environment, unikernels are starting to look like a promising approach to reducing the number of attack vectors for your applications.
I was also lucky enough to interview Rob Witoff from Coinbase and Farhan Thawar from Shopify and they’re doing a really good job of scaling good practices across large, high-agency engineering orgs.
But most of us live elsewhere
Most of the CTOs I speak with in my advisory practice have a handful of fire breathers experimenting with factories for AppMod and loops for performance optimizations, 15%-20% of the team who never want to give up Jetbrains or VS Code and a quiet majority trying to figure out how to use skills with 2-3 Claude Code agents and mostly manual review of agentic PRs.
The lucky ones have moved their agents to governed sandboxes to mitigate some of their internal security risks and are building shared skills libraries and starting to standardize on a subset of better maintained skills owned by their DevEx or Platform teams.
Alignment over maximalism
If you haven’t already, the most important thing you can do in Q4 is take a day to run an offsite with your senior leadership team. You need the CEO, the CISO, the CTO, the CPO. And whoever is responsible for governance, compliance, and risk.
Where are you today?
Before the offsite, start by doing a realistic audit of your capabilities. Within your engineering org, how comprehensive is your test coverage? Do you have CI and CD in place? Are you using feature flags to decouple deployments from releases and to do canary rollouts? How is your observability, monitoring, alerting? How are your DORA or SPACE or DX Core 4 metrics looking - and trending?
How good is your team? We all want to say we have amazing engineers, but not everyone can afford to poach talent away from Netflix or Meta (or Anthropic or OpenAI).
How AI-pilled is your organization? How curious are your engineers? Do you have the psychological safety required to make it safe for engineers to run experiments that are not guaranteed to succeed and to risk replacing some members of their teams with agentic software factories?
How much slack are you willing to provide? Only a small percentage of your engineers are willing to spend evenings and weekends learning how to use agents properly. The rest are going to need a structured training program and enough slack to build the muscles required.
What threats and opportunities are you facing?
The good news is that if you run a chain of ski resorts, we’re unlikely to see AI-native mountains anytime soon! So if you’re a little slow to adopt AI, you might lose some operational alpha, but you’re unlikely to be put out of business.
If you’re a SaaS vendor, you are probably are facing a more immediate business threat from AI-native competition.
It’s also worth thinking about second-order effects. What would change in your industry if decisions were primarily made by agents based on real-time auctions versus humans based upon brand preferences and direct-response call to actions? And what happens to your UI or your moat or business model when nobody wants to log into an app or go to a website any more?
Pick your lane
I was first introduced to the idea of the technology adoption lifecycle curve by Geoffrey Moore’s seminal book, Crossing the Chasm. In fact, it’s much older. As with every previous technology adoption, there are plausible reasons to be an innovator, an early adopter, or part of the early or late majority.
I go into all of the pros and cons in my upcoming O’Reilly book which the kind folks at Antithesis are giving away for free. TL;DR, the earlier in the adoption curve you want to operate, the more alpha is available but the more competence and maturity is required and the more that learning will cost you.
Align your company with your lane
There’s nothing wrong with saying you are going to be the most AI-pilled company in your industry, as long as your CISO doesn’t limit the engineering team to $20 Copilot licenses.
It’s fine to not allow engineers to use AI in your coding interview, and to give them a $50-a-month budget for tokens, but don’t expect to attract the most capable agentic engineers.
The most important thing is that as a company you need to look holistically at all of your processes, policies, and communications to investors, customers, prospects, employees and candidates to make sure they’re all aligned with the same lane and ambition for agentic adoption.
How are you planning on aligning your org on a single, clear lane for agentic adoption? And how are you planning on ensuring that everything your org does and says is consistent with that lane?