March 2026 Summaries

Greg Qualls outlines a strategy for migrating to reproducible environments without rewriting existing infrastructure-as-code (IaC) configurations, emphasizing a configuration-first approach that captures application intent rather than rebuilding applications. The guide proposes an incremental migration path that maintains production-identical environments by starting small with a single feature branch and leveraging tools like Upsun for configuration management. It highlights the importance of addressing environmental "drift" across runtime engines, operating systems, and service topologies, and suggests automated solutions for data context gaps, such as sanitized production clones and automated PII-scrubbing scripts. The approach aims to minimize workflow disruptions by ensuring seamless integration with existing tools and emphasizes the benefits of faster triage times and reduced "Ops work" for developers, ultimately leading to a more stable and consistent development environment across all stages.

In response to the EU's Digital Operational Resilience Act (DORA), financial institutions must now demonstrate their ability to operate independently of any single cloud provider by maintaining documented and tested exit strategies. Many modern cloud deployments face challenges due to deep dependencies on specific providers like AWS, Azure, and Google Cloud, which complicates potential transitions and heightens concentration risks. Upsun offers a solution by standardizing application deployment with a provider-agnostic configuration file, allowing applications to be recreated on different infrastructures without a complete redesign, thus facilitating DORA compliance. This approach emphasizes the need for a planned migration process focusing on operational steps rather than re-architecting infrastructure, providing a solid starting point for institutions aiming to meet regulatory requirements without being trapped by vendor lock-in.

Financial institutions can avoid the risks and stagnation associated with "Big Bang" migrations by adopting Upsun's approach, which utilizes production-like preview environments to facilitate gradual modernization without halting feature development. Traditional migrations typically involve a lengthy feature freeze, posing significant risks such as stalled innovation, increased compliance pressure, and compounded migration risks. Upsun's method allows for continuous testing of modernization changes in isolated environments that mirror the production stack, enabling teams to maintain compliance and manage regulatory requirements like DORA while still advancing product offerings. This approach negates the need for a full freeze period, supporting financial institutions in achieving both modernization and ongoing innovation, as Upsun provides a validated foundation for compliance and security across various cloud platforms, including AWS, Azure, IBM Cloud, and GCP.

Financial technology companies are increasingly moving towards automated compliance through infrastructure automation and inherited controls to streamline their operations and reduce the burden of manual compliance work, which hinders delivery speed. Traditional compliance approaches, which require managing every infrastructure layer and extensive documentation, consume valuable engineering time that could be better spent on product development. By deploying applications on platforms like Upsun, which come with certifications such as PCI DSS Level 1, SOC 2 Type 2, ISO 27001, and HIPAA, fintechs can offload a significant portion of infrastructure controls to the provider. Upsun manages these controls at the platform level, offering features like OS-level security, network isolation, and access control, which are crucial for maintaining compliance without interrupting service. This shift to automated controls and infrastructure as code, supported by tools like Git, ensures that configurations are consistent, documented, and auditable in real-time. This not only reduces the scope of compliance assessments but also simplifies third-party risk management and audit processes, allowing compliance teams to focus on strategic oversight rather than manual evidence collection.

Automated traffic has surpassed human web activity, with AI agents now accounting for over 51% of all interactions online, fundamentally shifting user behavior and creating an architectural crisis for legacy cloud infrastructures. Traditional web models, built for human interaction, are being overwhelmed by AI agents like OpenAI's Operator, which demand real-time, personalized data and can trigger thousands of simultaneous API calls. Legacy systems struggle with high concurrency, context bloat, and low tolerance for latency, necessitating a shift to flexible, on-demand scaling solutions like Upsun, which decouples resource allocation to ensure responsiveness. To address these challenges, modern infrastructures must adapt by testing agent flows in production-identical preview environments, validating AI interactions without risking live operations. This transformation not only caters to AI agents but also enhances accessibility and SEO, raising the question of whether infrastructure will leverage these agents as a new revenue stream or face them as a system failure.

The University of Tennessee at Chattanooga (UTC) overcame the complexities and risks of managing a fragmented web estate by consolidating its hybrid environment, which included Drupal, WordPress, and custom PHP applications, onto the cloud application platform Upsun. This strategic move unified their operational model, reduced maintenance burdens, and enhanced reliability, especially during high-visibility events. Previously, UTC's web estate was split between vendor-hosted Drupal and on-premises WordPress and PHP, which complicated workflows and increased downtime risks. The decision to migrate was driven by the need for a consistent deployment model that could handle multiple application types and integrate with Git-based workflows for safer testing. Evaluated through a rigorous committee process, Upsun was chosen for its ability to provide a comprehensive hosting solution beyond Drupal, offering improved value by expanding hosting coverage without increasing costs. Post-migration, UTC experienced reduced infrastructure toil, improved confidence during traffic spikes, and a more streamlined, scalable web estate, with the added benefit of collaborative support from Upsun that aligned with the university's priorities and needs.

As engineering teams grow from 10 to over 50 developers, the complexity of infrastructure changes, database schemas, and networking rules increases exponentially, leading to a breakdown in manual governance processes that once sufficed for smaller teams. This scaling inflection point creates bottlenecks, as human-centric governance becomes an obstacle to continuous delivery, prompting developers to find workarounds and diminishing centralized control. The solution lies in embedding governance directly into infrastructure through "Governance as Code," where built-in guardrails replace manual gates and Git-driven workflows provide traceable paths for infrastructure changes. By shifting compliance to earlier stages in the development process, IT teams can maintain control without slowing down developer velocity, adopting a system that allows for high-speed delivery within clear boundaries and moving from reactive oversight to structural control.

Governance crises in IT and platform engineering often begin with minor, localized issues that are overlooked until they evolve into costly structural failures. Key warning signs include environment drift, where pre-production environments diverge from production due to untracked changes, and undefined ownership, resulting in delayed responses during failures. Critical knowledge silos, where undocumented information is concentrated among a few individuals, pose invisible risks, while manual compliance processes slow development by turning audits into disruptive events. Governance that is reactive, rather than proactive, becomes evident with the rise of AI tools, as it struggles to adapt to rapid changes, leading to potential gaps only visible post-failure. Shadow IT emerges when approved processes are too slow, indicating governance as a bottleneck, and misleading dashboards that focus on uptime rather than comprehensive oversight reveal assumptions rather than evidence. Collectively, these signs suggest a need for governance to evolve from reactive management to proactive structural control, involving standardization, automated audit trails, and enforced environment parity to maintain pace with delivery and ensure compliance.

In the realm of enterprise software delivery, the proliferation of specialized development tools and cloud services has led to a phenomenon known as developer workflow fragmentation, which paradoxically slows innovation despite its intention to enhance agility. This fragmentation creates a "hidden factory" within engineering teams, where developers lose significant time managing defects and disparate systems, leading to increased mean time to recovery (MTTR) and operational inefficiencies that aren't captured in typical management metrics. While teams initially adopt bespoke workflows to gain autonomy and speed, these practices result in a coordination collapse as they scale, transforming agility into a maintenance burden, with up to 40% of automation budgets spent on maintaining legacy systems. Standardizing workflows through frameworks like Upsun, which offers "Golden Paths" for seamless code-to-production transitions, can mitigate these issues by reducing context-switching costs and enabling teams to focus more on innovation rather than infrastructure maintenance. By treating delivery workflows as a product, organizations can dismantle the hidden factory, streamline operations, and reclaim productivity lost to fragmentation and context-switching.

In 2026, the success of AI agents in production environments hinges on overcoming the "Data Context Gap," which occurs when agents lack access to the exact data state and service topology where bugs manifest. To address this, modern infrastructure must enable rapid, production-identical clones through metadata-level cloning based on a Copy-on-Write foundation, allowing agents to interact with the real-world data state without lengthy provisioning times. This approach facilitates the creation of "Production Sandboxes," enabling agents to test and adapt without impacting live systems. The integration of automated sanitization and compliance guardrails within cloning operations ensures data privacy while maintaining the integrity necessary for bug reproduction. Additionally, performance validation requires production-identical resources in isolated environments to conduct realistic load tests without risking live operations. This infrastructure-as-context strategy reduces cloud-related friction, allowing senior talent to focus on developing AI logic rather than managing fragile staging environments, thereby positioning metadata-level cloning as a critical foundation for AI deployment.

In the evolving IT landscape for mid-market organizations, there's a pressing need to balance rapid digital transformation with stringent cost management. This shift is driving IT leaders to move away from traditional "gate-based" governance models to automated "guardrails" that facilitate faster, more efficient workflows without compromising control. The focus is on maximizing tech value and ROI, particularly by centralizing the Configuration-as-Code (CaC) layer, which offers a non-intrusive governance solution that aligns security and cost-caps automatically. Implementing a "Golden Path" and embedding governance into desirable features like production-perfect preview environments encourages voluntary adoption without imposing rigid tool mandates. This approach preserves developer autonomy while ensuring organizational consistency, reducing operational friction, and enhancing recovery speed. By measuring governance success through metrics like Lead Time for Changes and Mean Time to Recovery, IT teams can transform from being perceived as bottlenecks to enablers of innovation and efficiency.

Shadow IT, often arising from developers circumventing slow central IT processes, leads to the creation of an "invisible architecture" that consumes company resources without adding value. This results in fragmented IT management, with orphaned resources and manual adjustments, dubbed the "Hidden Factory." Modern platform engineering, like Upsun, addresses this by making compliance the default through "Policy as Code," which automates governance and reduces manual errors. By centralizing the data layer and automating service provisioning via YAML configurations, platforms like Upsun eliminate shadow databases and improve security by ensuring consistent policies across environments. These platforms also facilitate quicker onboarding and reduce cognitive load through standardized "Golden Paths," allowing developers to self-service infrastructure needs without increasing risk. Upsun's approach, compared to DIY internal developer platforms, offers automated security updates and compliance, enhancing scalability and reducing maintenance burdens, ultimately dismantling the Hidden Factory and improving developer productivity.

Modern IT management faces challenges with Shadow IT, where teams bypass standard governance due to slow and cumbersome security measures, signaling a need for a shift from a "rules-based" to a "rails-based" architecture. This approach involves creating a unified platform like Upsun, where standardization occurs at the platform and runtime layers, allowing developers freedom in application code while maintaining controlled, predictable infrastructure management through Infrastructure-as-Code (IaC). Automated guardrails replace traditional manual approval gates, ensuring compliance and security checks are built into the deployment process, reducing latency and preventing resource misuse. The blueprint also addresses multi-cloud challenges by abstracting specific provider complexities through a unified configuration layer, enabling scalable and efficient operations across multiple cloud environments without a large DevOps team. This architecture not only mitigates Shadow IT but also balances standardization with innovation, providing pathways for exceptions through governed extensibility, ensuring both compliance and agility in IT operations.

In the context of traditional IT organizations, governance often becomes a procedural burden that leads to Shadow IT, driven by the delays and inefficiencies of manual processes such as security reviews and change advisory boards. Upsun automates policy enforcement by integrating governance directly within the developer workflow, eliminating the friction of manual gates and reducing the "governance tax" that consumes developer time. This is achieved through three core mechanisms: versioned configuration files that act as the source of truth, automated build hooks that serve as quality guardrails, and environment rules with resource caps that prevent budget leakage. By shifting governance from procedural to technical, developers experience fewer interruptions and clearer expectations, allowing them to work faster and with more confidence. This transformation also redefines the role of IT managers from gatekeepers to platform owners, who provide a high-velocity, governed path for engineering teams, thus enhancing compliance and efficiency across the organization.

Migrating from fragmented workflows to a unified platform is a complex process that, if not executed carefully, can lead to operational risks such as hidden dependencies and inconsistent environments. The challenge lies not in the decision to consolidate but in ensuring a smooth transition without disrupting daily operations. A phased approach is recommended, starting with low-risk projects and gradually moving to more critical ones, to contain potential failures. Clear communication and change management are essential to avoid resistance from teams who may feel a loss of control with new systems. Successful migration involves thorough preparation, sequencing, and validation to ensure consistency and trust in the new platform. Upsun, a tool that integrates application and infrastructure configuration with Git, is highlighted as a solution to facilitate this process by creating a repeatable alignment of teams, thereby mitigating the risks associated with shadow IT and fragmented workflows.

In the context of rapidly evolving AI technologies and regulations, the concept of "sovereignty" is being applied to both nation-states and organizations to ensure control over AI systems and reduce reliance on external vendors. The European Union is particularly focused on achieving AI sovereignty, emphasizing data protection, transparency, and jurisdictional control, especially as it anticipates a significant increase in AI-augmented business decisions by 2027. The EU's regulatory landscape, including recent drafts like the Digital Omnibus, aims to streamline interactions between various regulations while addressing high-risk AI applications with stringent measures. Businesses are advised to use open-source technologies, ensure interoperability, and choose diverse cloud service providers to maintain resilience and compliance, while strategies such as leveraging platforms like Upsun can assist in creating region-specific environments and automating compliance documentation. As AI continues to advance, maintaining an updated application portfolio and modernizing legacy systems are crucial to sustaining sovereignty and avoiding future legal complications.

Lemberg Solutions addresses the challenges digital platforms face in adopting AI by utilizing Upsun to create a pipeline that emphasizes business value over technical complexities. The company found that many clients were hesitant to integrate AI due to concerns about model accuracy, reputation risk, and data privacy, leading to analysis paralysis. Lemberg's approach with Upsun involves building a functional Proof of Concept quickly, allowing AI logic to be tested in isolated preview environments before live deployment. This method not only accelerates development cycles and reduces costs but also helps meet legal and compliance requirements through Upsun's secure infrastructure. By offering multi-stack flexibility and human-in-the-loop validation, Lemberg enables clients to safely experiment with AI features, ensuring a smooth transition from experimentation to production without compromising existing systems. Through these strategies, Lemberg assists clients in overcoming their fears of AI implementation, ultimately facilitating faster project kickoffs and reliable AI integration in a centralized and predictable environment.

State-funded higher education institutions in the U.S. are facing a significant shift in digital accessibility requirements due to the new ADA Title II rule, which mandates compliance with the Web Content Accessibility Guidelines (WCAG) 2.1, Level AA by April 24, 2026. This change eliminates the previous "meaningful progress" defense, requiring universities to ensure all digital content, including that from third-party vendors, meets these standards. To address this, institutions must transition from reactive, piecemeal solutions to an automated and standardized approach to accessibility throughout the development lifecycle. Companies like Upsun offer platforms that enable universities to manage these changes by standardizing infrastructure and tech stacks, providing automated preview environments for safe testing, and integrating accessibility checks into the continuous integration/continuous deployment (CI/CD) workflow. This approach not only aids in compliance but also alleviates the burden on developers, allowing them to focus on enhancing accessibility across all platforms, thus helping institutions prepare for future standards like WCAG 3.0.

Ana Cidre's journey to becoming the Director of Developer Advocacy at Upsun exemplifies the power of a non-linear career path, as her diverse background in Fine Arts, international business, and software engineering equips her with a unique blend of creativity, strategy, and technical expertise. Leading a small advocacy team, Ana works closely with marketing, engineering, and product teams at Upsun to enhance the developer experience (DX) and documentation, ensuring they cater to both human developers and AI agents. Her commitment to diversity and inclusion in the tech community is evident in her initiatives like founding ngSpain and GalsTech to support underrepresented groups. Ana's experience as a female speaker in technical spaces highlights challenges and opportunities for women in tech, motivating her to create inclusive communities where diverse voices are heard. As she looks to the future, Ana is focused on redefining developer advocacy in an AI-native world by balancing the needs of both in-person developer communities and AI agents, leveraging her ability to translate across different contexts.

For engineering leaders, PCI DSS audits often halt development as teams gather evidence to prove compliance, highlighting the challenges of managing raw infrastructure. Upsun advocates for "Inherited Compliance" by leveraging a secure-by-default cloud application platform that reduces the burden of manual maintenance through automated patch deployment and traceability, allowing teams to focus on securing their own code. Through a shared responsibility model, Upsun manages the infrastructure, including project isolation and audit trails, while customers handle application-level security. To prevent compliance drift, Upsun treats infrastructure as version-controlled code, ensuring consistent environments and auditable histories, and offers multi-cloud portability without security compromises. Companies are encouraged to use third-party processors for cardholder data and can rely on Upsun's PCI-certified clusters, though some regions are excluded. Transitioning to a managed platform helps streamline compliance workflows, with tools like the .upsun/config.yaml file facilitating secure and standardized deployments across cloud providers.