Operations | Monitoring | ITSM | DevOps | Cloud

AI is transforming how infrastructure and platform teams design, deploy, and operate systems. As organizations move from experimentation to production, a clear pattern is emerging. AI can decide what should change, but it cannot safely control how those changes are executed. This creates a gap in modern architectures. That gap is filled by a control plane. That control plane already exists in Puppet Enterprise Advanced.

On June 9, 2026, the OpenSSL project released patches covering 18 vulnerabilities across its supported releases. The headline flaw, CVE-2026-45447, is rated high severity and has the potential for remote code execution. Not too long ago, a security advisory with 18 vulnerabilities would have been routine. Microsoft’s Patch Tuesday provided a predictable cycle, and organizations operated with the expectation of a meaningful remediation window. That model is under pressure.

You’re scaling your IT infrastructure so you can do more — deploying across clouds and data center, adding servers, coding like crazy. Great! But how do you keep it all from falling apart? Policy as code is an approach to managing IT that strategically leverages infrastructure as code (IaC) and compliance as code to manage consistent policies across complex IT environments. Sounds perfect, right?

Most teams first adopt policy as code (PaC) in their delivery pipelines. If something breaks a rule, the system stops it before it goes live. That is useful as it helps catch problems early but in real world environments, the hardest issues to resolve do not come from changes that fail validation. They come from changes that happen later, elsewhere, or outside the pipeline entirely.

Claude Mythos may be wrapped in hype, but the core signal is real: AI is making vulnerability discovery much faster, which means defenders have less time than ever to patch and enforce secure configurations. The real risk isn’t just smarter models, it’s that security teams will face a flood of new findings while the window between disclosure and exploitation keeps shrinking.

In early 2026, two back-to-back Linux kernel exploits, Copy Fail (CVE-2026-31431) and Dirty Frag (CVE-2026-43284 & CVE-2026-43500), shattered assumptions about how quickly attackers can weaponize disclosed CVEs. Dirty Frag, a zero-day Linux vulnerability that affected most major distributions, had PoC exploits published within hours of its disclosure. It’s a stark reminder: the timeline between vulnerability disclosure and active exploitation has shrunk from weeks to hours.

I’ve been doing this for over thirty years. Sysadmin, ops lead, global teams, and more data centre migrations than I’d like to admit. Site to site, P2V, V2V, cloud, hybrid, all of it. Every migration gets sold as a clean, well-planned transition. None of them are. They go wrong in very predictable ways. Not because moving infrastructure is especially difficult, but because nobody ever has a clear, current view of what’s actually running, what’s changed, and what still matters.

Poland’s implementation of the EU’s NIS2 Directive marks a decisive shift in how organisations think about cybersecurity, resilience, and operational risk. With amendments to the Act on the National Cybersecurity System (KSC Act) entering into force on 3 April 2026, enforcement expectations are now real, national, and significantly stricter than many organisations anticipated – including obligations for security controls, incident response, and supply‑chain governance.

The April 2026 update to UK Cyber Essentials marks an important shift. Not because it introduces radically new security concepts, but because it removes tolerance for inconsistency. With the effective date quickly approaching, many UK organizations are focused on meeting the immediate requirements. That matters. But the more durable story is what these changes reveal about how security and compliance are now expected to operate in real world environments.

Over the past few months, Puppet has partnered with Bryxx to host a series of leadership lunches across Europe, bringing together infrastructure, operations, and security leaders for candid, peer‑to‑peer conversations. These sessions weren’t marketing briefings. They were grounded discussions about what teams are facing right now: tighter regulation, rising security pressure, shifting cloud strategies, and the practical realities of automation and AI.