Martin Kuppinger - The new role of the CI(S)O 2020: Enable disruptive innovation

Good afternoon, ladies and gentleman, I hope you enjoyed your lunch. Welcome to our EIC 20 10, 20 16, the number 10 EIC. That's what I wanted to say. I will talk today primarily about the new role of the CIO and CS O 2020 about enabling disruptive innovation. So when we talked, my colleague, York's the main organizer of the talked about what will be the topic of the keynote. We came upon this because we think it's very important to rethink the way our it organizations are structured. But before I start, I just wanna quickly, okay, here we go quickly, have a look at 10 years EIC and more than 10 years, in fact, some 12 years cooking a coal. So back in 2007, we started, we started one year later with our European identity and cloud awards increased our topic to identity and cloud and more information security in between.
We moved our headquarters to we spot, and then the first three or four have been at a other location. Then we moved to Altra here where we, I think are the sixth year, the sixth consecutive year. And so over time we grew, we are right now more than 700 attendees from more than 30 different countries spending from the us to Taiwan and Australia. So really globally when I would say, and I'm happy and I'm proud of my team, which made 10 years EIC such a success. So let's go ahead. I think one of the, the fundamental change as we are currently observing is that it is changing fundamentally. So we had a shift towards some sort of centralization. In fact, some very big players are in the cloud service provider area, et cetera. But right now we see decentralized distributed approaches blockchain. We had a workshop on blockchain yesterday, the internet of things, where we have a broadly distributed range of things and all the other things.
And so we see the world is in fact becoming more complex and sort OFS decentralization. And it's simply that we don't have the one it, which was center handled centrally anymore. We have to understand that all these things are more complex and they are moving closer and closer to all areas of the business. So having said this, I want to start with looking a little bit at the digital transformation. And I have created a picture here. I've called the circles of change. So it starts with external drivers around the digital transformation. So dynamic partnerships, changing competitive landscape, rapid innovation. We have to face what I particularly find particular important is the product to service transition. So formally products have been sort of the most important thing right now. It's more services are the most important thing. The ubiquitous connectivity, everything, and everyone becomes connected, ever changing regulations is one of the challenges ever increasing attacks we are facing here.
The next layer in here is the intrinsic change we are facing. So this intrinsic change is about what do we need to change in our organization? And I think there are three main areas. One is agility. So in a changing competitive landscape, ever changing regulations, dynamic partnerships, etcetera, we have to be at trial. We need to be innovative and we need to have a organizational flexibility, which allows us to adapt to new business demands. From my perspective, these are the three most important intrinsic changes. The next one here, the overarching seems. So the next circle of change I have here are overarching seems. And in these overarching seems we have the three big things I think, which are commonly discussed. At least two of them are very commonly discussed. One is the internet of things and the other is smart manufacturing or industry for it all, as the Germans tend to say, and the third one I would say is know your customer.
So the KYC thing, we need to know our customer. We need to know more about our customer to serve from optimally also because we collect more and more information about the customer and moving forward from there, it means we have some key enabling technologies and these key enabling technologies include things like big data, identity, cognitive and AI blockchain, which I find very important. The ubiquitous sensors, robotics, security, and privacy. So these are from my perspective, the seven most important key enabling technologies in this digital transformation. And this includes things like clearly big data to handle customer data. It includes the identity to manage all the relationships of things and persons and so on. It includes security and privacy, and we have to be capable of handling that change, which that means we have to think about how can we achieve competitive advantage in this digital transformation and this in fact, ever-changing world.
I think the term digital transformation, if your earn is a little bit to narrow, because it's not about transforming your organization once from non-digital to digital, it's about an ongoing adaptation to new challenges, new business models and faster change of business. So clearly customer relations is one of the traditional areas where you can build competitive advantages. It has been important and it remains important. Product innovation becomes more important. I think we are, have faster, more rapid change in the market. So we need to be more innovative. We have areas such as product quality, which I personally fear are less relevant than in earlier days. So we throw away stuff when it's doesn't work anymore. So probably a smartphone has to live only for one or two years anyway. So product quality probably is less relevant than it has been in the times in the days where we used stuff we bought for 10 or more years. That's one of these changes we have then to go ahead here. I, latest clicker is not the best one I've ever had.
So I had here, we have services, services become more important. I've talked about the product to service innovation, business process efficiency. I think it, the hype is a little bit past. So when I was studying in the eighties, we had this hammer Trae business process re-engineering and so it was a hype of the business process efficiency. It looks like it's going a little bit down also because we have more and more standard business processes from the cloud. So we can rely on more proven standardized services, which we can easily purchase from the cloud. We have smart manufacturing with, which is an area which becomes more and more important. We have data obviously, which becomes more and more important, very central to our business. And when we move forward here, we also have some other things to look at such as it technology. And I think that the capability of being better than others in setting up it technology in coding your own applications, et cetera, is of decreasing relevance because we more and more rely on standardized services.
We procure from the cloud. So our own ability to be perfect in it. Technology is less relevant than it has been before. So we have changes in this competitive advantage area. And that also means that we have to think about how we handle all that. And one of the other changes clearly is the, and this is a picture I brought up last year in my keynote. This is this increased connectivity. So everything and everyone become connected. People, organizations, devices, things. This is another area which then affects our competitive advantage. I have to customer relations up on the top of the other slide. And this is an essential part of the customer relation here.
And then going further again, one step, I think when we look at competitive advantage from these two perspectives I brought up before, there are five essential areas we should look at. One is customers at the end, this is what brings the money services. So the shift from service to product, data analytics and cognitive are very important identity because we need to understand the identity of, of persons, of things, of devices and product innovation and manufacturing. So this is where we see still the need to be more innovative, to be also more flexible manufacturing, smart manufacturing, and to build our competitive advantages around these five areas. And I brought up this point that it is, or it com technologies less relevant for the competitive advantage. I already raised the point that the cloud is factory here. And I think this is something I'd like to show with this picture here.
So where does our competitive advantage come from from innovation in services and products, data analytics, cognitive, smarter manufacturing, customer relations identity I talked about, and that in consequence means we also could look at where does sort of a competitive disadvantage come from? Where does it come from? Low elasticity and agility of on-premise it high cost and CapEx of on-premise it compass on processes, which we particularly have an on-premise it, when we try to invent all these processes at our own, instead of relying on standard services. And clearly that's true for everything cloud and on cloud failing and security and privacy. These are the potential competitive disadvantages, but the cloud in fact, today is delivering equal services to everyone at an affordable price. Every medium sized business, every small business can afford a lot of services. It couldn't afford some five, 10 or 15 years ago.
And that means a lot of this competitiveness from it is disappearing. It can become a competitive disadvantage in fact, and what we really have today is that utility computing is becoming reality. So this term, which has been quite popular a few years ago, I think we are far closer to this utility company computing than we have ever been before. So what already is a utility I've had indicated in green and it's more to the bottom. So the network is utility service and endpoint are in business. It more and more utility. We rely a lot on IAS. It's really something which is standardized. We don't think that much about it anymore in the areas of operational it. So the manufacturing and the area of OT, it's slightly different that we still have to make some progress in making it in the utility, but we see more and more industrial clouds.
We see more and more clouds for the IOT. So even there, we have to strength towards making this utility applications, apps, and things. So if you look at applications in the standard business, it, we rely more and more on cloud services. Our E R P our CRM, everything from the cloud process and function bus also are increasingly as standard capability provided. So we have a shift towards more and more utilities. And so the competitive advantage we can build is more around data analytics and cognitive than around trying to do the utility better than others do it. When we look at this from another perspective, it also becomes clear that it is shifting into the business. So what we have here is in factors that traditionally business, it did most of it. So it looked at, and we have the colors here. It looked at it did operations monitoring, configuration adaptation, deployment execution.
Then we had ideally not in the real world, but ideally governance is a separate area. We still don't have it in most organization, but that's a different story. And then we had a little bit of security maybe underneath, maybe not again, a different story, but right now this has changed. And we see a lot of green green indicates here at the cloud service provider where operations and monitoring, where deployment and execution are increasingly done by the cloud. Even a part of the security is done here while business for cloud services doing more and more of configuration and adaptation. So the role of it, the orange color or light red color, it's far less than it has been. And when we look at this from the perspective of op not only business it, but operational it and IOT of consumer IOT, then we see that even more areas are not really it.
So the business does a lot, the production department, the manufacturing departments already do a lot of their own it in the IOT space. Businesses are providing the devices, they are doing the it. So where's the it department. There's not that much room anymore for the traditional it department. It is shifting into the business, which means we have sort of a rise and fall of it departments to observe. So when we look back over the past decades, one thing is clear. The relevance of it has grown continuously and it's even growing is financially because everything is connected. It is ubiquitous. Everything is, has it in. We use it in our manufacturing. We knew we have sensors in manufacturing it's everywhere. So it is becoming more relevant. But when we look at the is relevance of it, departments from an overall perspective of where we do, we do it, then we see some things happen outside of the traditional it department already, when there's shadow it, there's smart manufacturing.
There are other things. So the is relevant there's degrees. And if you're honest, that two B relevance has decreased even more. What does it mean for an it department? We have to rethink the roles of the it department and the roles of the CIO. So rise or fall a CIO. When we look at it from the CIO perspective, what can you do? Or what are the options you have? Do you want to become the chief infrastructure officer, a CIO, or do you want to become the chief innovation officer? I think these are the two paths and CIO can take infrastructure officer or innovation officer. I personally like the term C in the sense of chief innovation officer, more than they're commonly very prominent or popular C B D O chief business development officer or whatever. I think CIO is a very good term because at the end, there's a lot of it in we need to do.
And I think this is what we can do here. So when we look at this rise or fall as CIO, in fact, it means the chief innovation officer is sort of the chief digital business officer. He's fostering the innovation across all areas where it applies business manufacturing, things, he's the transformational leader. Or we end up with the new data center manager where it started from 20, 30, 40 years ago, managing the it facility services internally at externally more manager than a leader role. What does it mean for the chief information security officer? On the other hand, we have sort of these two areas I've trust outlined for the CIO. So the chief in information or innovation officer chief business development officer, and we have the underlying infrastructure, the it management. So these are the two layers. Anyway, we need all of it. I was on the future.
So we need clearly people who manage the services on premise and from the cloud, but we also need to move forward. Integrate have an I integrated view across all areas. The CSO from my perspective has in future to provide the governance. So security, privacy, data protection for business it for operational it, and for IOT it's, from my perspective, absolutely mandatory that the CSO has a clearly defined governance role for all areas where it applies. We can't keep that separate anymore. The data protection officer is part of the CSO department and the CSO in fact, has to work very tightly with corporate audit enterprise risk management. However, this department is named in your organization. This is where the CSO belongs. It's not that he belongs into an it department. He belongs to the audit. So as Sasha already has said, we have the opportunity to do polls. And if you look at your app, the EIC app, we, I wanna trust, run a quick poll. It's the see of your organization already responsible for all three areas of it, EA security and business. It operational it for all those things in it IOT. So if you have IOT, if you have manufacturing, so go to the I, I C app menu poles, click on the item for my keynote, and then you can provide your answer on that.
What does it mean for the organization? That's a picture I brought up, I think, four years ago for the it organization where it's talked about it. Organizations have to change it. Organizations have to change because we procure services from both on-premise it and cloud. And we should manage everything as a service in a consistent way. Everything as a service, we need to manage the services, the information that we need to deliver really business services. It for a long time, talked about business services and meant something like a technical service, which then allows business application to run business services. What the business really wants based on the concrete business demand. And that's one of the reasons why a lot of businesses went to shadow it and procured their stuff from the cloud. I think we have to change it a little, this picture. It's not that different, but basically it's, we have sort of the infrastructure part at the center, which is service procurement production, managing the services security fulfillment, which is an area of the operational part of it, the services, and then delivering it to the business.
And then we have two main areas. One is sort of the CIO. The other is the CIOs O which is innovation and information management. So for all areas of it, data analytics, cognitive AI, that's the chief innovation officer and the C I O it's information, governance, security, and privacy data protection. And also the service governance, which then is a little bit outside of the C S O but which is part of the entire governance part. This is where we should, that's this an approach to rethink our, your it organizations. And I think we need to do it. We need to manage all of it in a consistent way, and we need to adapt the organization so that it's really is capable of dealing with all the changes to shift toward cloud etcetera. So before I come to the end of my keynote, I want to look at some trend topics.
So what are from my perspective, first of all, the, because we are at the end, we are doing all this to, to remain agile, to become more agile, to be ready for the transformation. So what are the top innovations for business agility from an it perspective I've created here, this quadrant, where on the X axis, we have something which helps us more in risk mitigation, or which helps us more in achieving business value. If it's good for both, it's in the middle. And then we have the emerging technologies at the bottom and the more mature technologies at the top. So what are these 15 top innovations cloud identity and access management I think is very important. It helps us better dealing with our customers with all the external parties. It's increasingly mature, big data and cognitive massive best business value. We have to have it still a long way to go.
Particularly when we look at cognitive regarding maturity industry 4.0 and smart manufacturing as well, very obviously something we have to get better in IOT. Again, I think very clear here in this area, identity, relationship management, very important. We need to understand how devices and things and persons map to each other. We need to be capable of handling all that for a lot of use cases and consumer identity management, clearly as well, all cloud I am consumer I am and identity relationship management, title related topics of behavior analytics helps us in risk mitigation, a very hot and increasing mature topic we should look at. So how can we identify fraudulent behavior? How can we identify high checked account, all of this stuff, realtime security intelligence as well, very important. How can we collect all the data analyze at real time data from locks, from events, et cetera, analyze it at at real time, understand changes in the behavior, changes in the use patterns, et cetera, and react on it.
So becoming better in quickly reacting on attacks and other changes, machine learning, deep learning, very interesting area, very important. I think over time for agility, microservices. Yes. Also an important thing more on the technical on the development side device measure. I think it's already here. I think a while ago, we called it to some extent, bring your own device. And it's a little bit more that, that it means we have a lot of devices we need to, or we want to use them in a consistent way. Yes, clearly important privacy and agility by design, not as mature as it should be, but important for both risk mitigation and business value. Have a look at my blog posts. I wrote a lot of posts and the recent amounts around why privacy by design and security by design increase your business agility. And I think this is a very important thing to look at ambient user experience.
So having user experience, which always fits to what a user expects robotics, some other areas. So some top innovations here I see for business agility. I think that have been all the 15 ones. Oh no, there's another one. Distributed lecturers and blockchain last but not least. We had a very interesting workshop on that yesterday. And it's definitely one of the areas which are highly important. So this is, as I've said, one of the other areas as my final flight, I want to quickly in 20 seconds or so, and look at five top innovations from a disruption perspective, direct disruption, the act of interrupting continued tier. It differs from change and not being a gradual shift, but a radical one. So we need to reinvent. We need to look at our end-to-end business relations. This is what really is changing in the digital transformation. A lot of things are changing.
So back to the red centralization here where I started hyper connected and supply demand does not work the same way, the economics as it did when we produced physical goods here. So what are the five top innovations here, distributed electros and blockchain IOT, consumer IM, and identity, relationship management, big data and cognitive and privacy and agility by design. So if we want to cope with this digital transformation and the disruption, we should look at innovation and we should try to do it in a way where more and more it moves into the business departments, because this is the essence here. It becomes part of the business departments with that I'm done with my presentation.
Thank you so much, Martin.
So that was a very broad overview on the strategy of the it in the company, outside of a company of it in general. So I very much appreciate. So now the task of us will be to understand where to put our stakes in that picture. And there's a number of questions. Could you please pick, put up the questions if that very good. This is live by the way. So if you want to add a question just right now, just try it and you will see the first questions that been rated three times. So once and plus two. So to say, what qualification should the C have regarding these challenges?
Oh, a lot of qualifications. I think probably the most important qualification is really a risk management and the governance qualification with AAF understanding at least from breadth, not necessarily that perspective of security. So he needs to be good enough in security, but it's more and more about risk and other stuff.
Okay. Next question, please explain whom the CSO, oh, plus nice. Whom the C should be reporting to.
I think I brought, brought it up already. It's from my perspective, the CSO has to become part of the enterprise risk management of the corporate audit of the enterprise governance structures.
But is it a board member? So be Frank
Usually as of now, the, the, the, the lead of the corporate audit is directly below the board level that might change over time, but the CSO clearly is not a level member from my perspective.
Okay, good. And last question. If information security is key to, I like that one information security is key to ability and since many people see security as a roadblock, how to change the perception of disease adequately.
Yeah. That's, that's an interesting one. I think it's meant key to agility. I think it's up to it itself to not always talk about why we can't do certain things, but to show options for doing things. And I had a talk, I think two years ago in my keynote or so, where I brought up a small metrics saying we have, we should show where is options to the business also indicating the risk mitigation impact and the cost then business can make decisions about how much risk it wants to take. So we have to talk business language or business language is risk. Okay. I think we're running out of time. Anyway.
Thank you so much, Martin.
Thank you.
And before we go to the next presentation, we will just quickly show, try and look up. Whether there have been some results of the poll. Can you please put up the poll of Martin's presentation? There you go. Is CZU already responsible for everything that you need. And 56% say yes and 43% say, no, this is really good, actually, because experience shows that it's pretty hard to convince people that are not in business it to follow governance rules coming from a C. So definitely this is a very good picture. Thank you so much for participating in that poll.