E
Eve Turzillo
Guest
John Willis explains why AI adoption should begin with business value, systems thinking and a clear view of invisible work, governance and risk.
“Automation does not always eliminate the work. Sometimes it simply moves the work.”
In the first conversation of a three-part series, author and technology leader John Willis joins Progress Developer Advocate Eve Turzillo to explore why creating lasting value with AI requires leaders to look beyond the excitement and understand how work actually gets done.
Automate MFT • Audio
AI Value, Invisible Work and Governance with John Willis
Why creating lasting value with AI requires leaders to look beyond the excitement and understand how work actually gets done.
Read transcript
John Willis - Episode 1 Podcast Transcript
Timestamps normalized to episode start (00:00).
00:00
Welcome and thanks for joining us. I’m Eve Turzillo with Progress Software. It’s no surprise everyone is talking about AI. The conversation I find the most interesting about what happens after people begin relying on it and how they turn the early excitement into real business value.
00:18
Over the next three episodes, I’m joined by John Willis to explore leadership, governance, and what it really takes to create value with AI. If you’re familiar with John’s work, he has a way of looking beyond the technology itself to ask those bigger questions.
00:33
That’s exactly why we wanted him to be part of the series. In other words, I’m old and I’ve been doing this for a really long time. [LAUGHTER] Not at all. John, one thing I’d like to start with is something that you said that has really stayed with me. It was AI makes it easy to start, and that makes it easy to leave the work is done.
00:54
I’d love for you to expand on that. Yeah, I think it’s a trap. I’ve been thinking I’ve been doing a lot of podcasts lately, and probably more than I’ve ever done on other people’s podcasts. That’s because I’m trying to promote my books. I realize I think I’ve sold my books to everybody that knows me.
01:11
Now I got to figure out how to find people who don’t know me. But I think it leads into this idea that I heard this expression, I thought it was pretty interesting. These technology transformations are like fluorescence. People like to use winters and springs. They’d rebirth and dying.
01:29
But it’s like this energy that’s there, and not to get too meta. But I think we get fooled by the fluorescence is we get fooled by the flashiness, the glow of this fluorescence.
01:45
We look at this technology and we start throwing everything that we knew out the window. And in fact, there’s nothing I like to say is, which I stand in front of an audience of a thousand people, and I’ll say it’s so terrible that I have to say this in 2026, but in front of a thousand professionals, that prototype does not equal production.
02:09
And it’s funny, I commented Mark Andreessen, Andreessen Horowitz recently wrote a post. This is a great example of how this fluorescence class. But Mark Andreessen is an incredible technologist, brilliant man, incredibly successful.
02:26
But he talked about how AI is creating this new standoff between coders, PMs, and designers, and he suggested this new idea called a builder. And in the comment, I had the remind, and it’s usually I don’t find myself having to remind billionaires too often of that we’ve been doing this for 20 years.
02:47
The builder concept has been around from lean agile, certainly DevOps, from two pizzas, DevOps and beyond. And again, it’s a great example. And I got incredible amount of traffic on that one comment, but it wasn’t anything profound.
03:04
I mean, the whole point was even the best and brightest of us can get sort of blinded by the fluorescence of a new technology. And I’m not immune to it either. Part of my role now these days is to try to decouple that with leaders to step back and say, well, wait a minute, there are definitely new things here.
03:26
But there are some old things too. So not everything is new. And yeah, so I went back and I watched this video from Simon Wardly of O’Reilly’s OSCON 2015, and it’s one of those great, it was like four or five great presentations within the last 15 years.
03:45
So situation normal, everything must change. And what he’s arguing, it was the birth of his Wardly mapping, if you haven’t heard of it. But what he was saying is the future is predictable if you know what you’re looking at. And he uses the mapping metaphor.
04:00
I use it as the fluorescence. In other words, the real truth of any technology, AI, cloud, is understanding what the terrain is. What are the things that are sort of new? What are the things that are old?
04:16
And it’s not an easy job. And I think it goes back to your sort of like you like my quote about AI makes it easier to start, but it makes it easier to believe we’re done. There’s the magic. We need to figure out what is AI doing that’s completely different from everything we’ve done before, but what are the big parts of AI that really don’t change anything?
04:40
That makes sense? Yeah, you talked about the blindness and the terrain. How does someone go about kind of mapping that out? What is that first step for people who are starting out here? Yeah, I think that the obvious ones that are hitting us loud and clear right now, we see this over and over, right?
04:58
Like we see a new… And one of my advantages is I sort of joked about it all, but I’ve actually been doing this for five decades. I’ve basically seen technology transformations for five decades, right? And I won’t bore you. The listeners hear about how I started out with IBM mainframes, but the patterns, you get to see over time the patterns that are recognizable.
05:22
And I think wordly mapping is an interesting way, but I think I like to look at, what is your organization? What are the behaviors? There’s this idea called social technical systems, right? And we use it a lot in the DevOps terminology or sort of like the…
05:39
It’s like I said probably a terrible way to describe it, because it really does… It has economic principles in it, but how does technology interact with humans? And how do humans interact with technology? And the thing we forget more often than not is that the humans…
05:55
There’s an element of the human behavior, the human culture, all the things that make us human that usually… Because the social technical systems thinking came around in the 1950s, where the study of coal miners.
06:10
And they thought if they could just bring in this new technology, this is in the UK, then everything would be hunky-dory, it’d be great. And it wasn’t. And so the real trick is going back to the sort of the things that we know, systems thinking, and it don’t be very meta.
06:30
People want like, “Okay, John, tell me exactly what I need to do.” Well, that’s not usually the first answer, or it’s the wrong first question. You have to sort of understand your organization. And we get a little deeper into what I call the… I know we’re going to talk a little bit about what I call this sort of the innovation strategy versus the talent systems gap.
06:55
And then I think that a lot of what your talent… Not talent, I don’t really care. I do care, but I don’t focus on what the talent is of your organization. I focus on what a talent system looks like. And that’s your organization, that’s your system as an ability to produce something that the organization is trying to create.
07:23
Right? Yeah. I think one of the things that we talked about prior to this podcast was you’re spending more and more time working with these organizations, right? Adok and AI, you’ve started talking about something you call token maxing.
07:39
I think that is something for those who haven’t heard the term before. How would you explain it to them? Yeah. I recently wrote an article called “Token Scutcheon for Any” which is, if we go back three or four years ago, most enterprises… I mean, I’ve done a lot of startups, but most of my day job, my career has been ensuring to help large scale regulated business, banks, insurance companies, certainly certain retail companies that have… Protecting the brand is of critical importance, right?
08:14
And the thing about what people tend not to do very well is understand what value is, right? So the token schizophrenia problem is that we sort of lead is about three, somewhere between three and five years ago, saying, "Do not use AI.
08:34
Can’t use AI. Why? Well, we don’t know." That’s not a terrible thing, right? But they’re like sort of knee jerk reactions, right? And then, I probably should have called it knee jerk reactions. Because then they were like… Because Wall Street was screaming and hollering and like, “Why are you not using AI?”
08:54
And then now we’re in this like, “Ooh, you’re kind of spending too much money on AI.” Right? And then just that blueprint of like this short window of historical structure of what’s happened, this just shows us that we don’t really understand how our human systems, our social technical systems converge, right?
09:20
And so the token maxing thing, what we’re seeing now is that people are basically told in that sort of middle group, go out and therefore AI. In fact, what’s interesting is I was just looking up the… There’s almost like a billboard of the most recent story that’s been a victim to running out of token budgets, right?
09:41
And the US Army now is a victim. They’re literally… They created a sort of ask me that they wanted to turn on all governments and they’ve already used up their, from what I can tell, their 2026 budget, right? Uber had used up their budget in March, almost before like end of March, right?
10:01
Amazon, there’s all these sort of tragic stories about… I think it’s… Somebody said one trillion and I think there was a typo in there, but it was 1.7 billion. And there was also a question of like a half of $500 million single monthly budget for some group, Microsoft.
10:23
So we’re seeing this untamed, unmanaged fluorescence of how people are just… I mean, you could just… I can say this is no way to run a business.
10:38
This is no way to run an economy, but we’re stuck in this fluorescence. So like we’re still trying to figure out… And in the core of what we talked about before is it’s the same thing that we should understand every time we’re looking at technology transformations or any type of transformation is where is the value?
11:00
And it’s a simple question. It’s a hard question to answer. I mean, I wish I had the simple answer. Great. I’d be retired. I’d be on a fishing boat to go from Mexico. But that’s the question you have to answer.
11:17
And not everything has to be AI. I mean, that’s the other… I’m going into organizations where in some places they literally open up like court lots and literally giving it to executive assistants and just go automate everything.
11:37
And where is the value? What’s the improvement? All the things that we’ve been… I’m a big Deming fan, but Deming was promoting these ideas for… Which was the foundation of most management clear thinking, which becomes Toyota, which becomes Lean, which becomes Agile, which becomes DevOps.
12:01
And we don’t have the crystal ball, but we’ve been trying to solve these organizational design, organizational behavior. And then all of a sudden AI comes around and like, “Hey, get out of the way. Here we go. Don’t slow me down.” And so we’re not focusing on the value and not everything has to be, like I said, AI.
12:24
One of the things that somebody asked me recently, they said, “Hey, John, do you think we’ll finally get to the mythical four-day work week with AI?” I’m like, “Are you kidding me? We’re approaching six and a half day work weeks with most of the people I know.” And I’ve got a group of really good friends that have on some of these chat groups.
12:47
And quite honestly, with all due respect to them, it seems like they’re almost like zombies now with AI. Talking about like, “Oh my God, I got only three days to use Fable 5 before it does this.”
13:03
And, “Oh my God.” And I step back and I’m like, “What are they producing?” I don’t know. I’m not writing automation for things I didn’t really do before AI.
13:20
I’m rambling, but yeah. But you brought up another good point. You’re talking about base and fintechs. What do you think the appetite is for AI? What’s the comfort level with some of those financial institutions in the AI workflows?
13:35
Yeah, I mean, it’s schizophrenia again. In other words, you’ve got one hand. It’s the same. Again, we can keep going back to what did cloud do? We always think it’s a different fluorescence, but cloud was an interesting of the patterns.
13:54
There was a lot of pushback on and legitimate pushback on regulated business like a bank. If the regulatory controls groups like OCC and people who regulate banks are not giving clarity about whether you should put certain types of data or processes out in the cloud, a lot of banks held back and waited for that clarity.
14:17
Some banks got real aggressive. Capital One was a bank that historically was very aggressive with cloud. I think we’re seeing the same thing with AI. In a sense, maybe the fluorescence will make me say this in that I think maybe there’s more tension now because AI and Wall Street and if you’re not using AI, you’re falling behind.
14:40
But probably when the dust settles, that was the same tension we had with cloud. If you were, “Oh, look at Capital One. What they’re doing. What is your bank doing?” And so, I mean, the fundamental of all these things was, and we knew this early on.
14:58
I mean, I remember back in the day where regulated businesses would tell me, “Get this.” They would say, “We’ll never use Linux in this bank ever, ever, ever.” Right? And then they said the same thing about cloud.
15:14
And then, I think they’re a little more educated now. I don’t think anybody really believes that they’re not going to use AI in regulated industry. But, and by the way, you will. You’ll have to. The competitive nature. And then the devil is then in the details of one of the things I like to think a lot about is, what does internal audit look like?
15:40
Do we have a systems approach? We wrote a book called DevOps. Basically, well, we wrote a paper called the DevOps Automated Governance Reference Architecture. It was back in 2018. And it was based on banks.
15:56
How do you regulate purely fast cloud native containerized things to really improve? Not to have developers outsmart the auditors or internal auditors figure out how to catch them.
16:14
It was how did you create an improvement structure with an organization? And we wound up writing a book called Investments Unlimited, which was a novel. And so, I think these same type of things are really interesting now with AI. It isn’t like, what can I get away with in a regulated industry?
16:31
Or it isn’t like, how do we figure out what they’re doing that they’re doing wrong? How do we create a systems approach to a unified way that improves the organization and protects the brand or in the case of a bank, protects people’s money?
16:51
I think that’s an important distinction. Another idea you’ve talked about is that invisible work. And I don’t know if everyone is familiar with that terminology, but what do you think is at the heart of that invisible work?
17:06
And what are people overlooking when it comes to AI? Yeah, I sound like a broken record here, but it’s the same. It’s the Simon Wardley situation, normal, everything must change. In other words, to the point being that invisible work has been around for forever.
17:27
And the Phoenix Project is a great story, really. Gene Kim’s The Phoenix Project is based on a book by a guy named Elliot Gohrach called The Goal, who was talking about theory constraints and bottlenecks in manufacturing businesses.
17:45
Gene did a rewrite on a software stack and a Java programmer and a system analysis admin. But the idea is that we need to understand the work. And so AI, in a lot of ways, accelerates these things.
18:06
But at the end of the day, there are things that are… The whole idea of theory constraints is about understanding bottlenecks. And so the real meta point of bottlenecks is, Gohrach said, “An improvement anywhere other than the constraint is an illusion.”
18:33
So therefore, yeah, I mean, that’s… You could take that to them, meaning this is like… In other words, when you think you’re improving something, this is Gohrach. And again, I think mileage varies on all the aspects of improvement.
18:49
But in this sort of discussion, what Gohrach is saying is, if you’re not improving the constraint, you’re really not improving anything. And so AI, if we don’t understand where the work is, where are the bottlenecks?
19:09
In fact, we’re seeing bottlenecks, again, to bring it forward to what we’re seeing now, the whole AI slop thing, right? The question is, just because it’s got everybody writing AI, is it really… Is it creating more bottlenecks? Are we having more rework?
19:27
Are we creating more burnout for the people? There’s a lot of sort of in-stream questions that… And again, a lot of the… Gohrach would talk about this thing called the five focusing stench, right?
19:44
Where you sort of identify the constraint, exploit it, you support it, you elevate, and then you just go… Because guess what? Every time you… There are one of the things I think we talked about is automation doesn’t always eliminate the work, it just moves the work.
20:01
So when I think of invisible work, or one of the invisible work components is, “Okay, you just changed this, where did you move the bottlenecks? Where’d you move the constraints?” Again, this is stuff that people were talking about in the 80s to improve MRP systems, pre-ERP first systems, right?
20:26
So these ideas have been around, they seem to work. There’s a reason why I think Jeff Bezos, they said those three or four books every executive early day of Amazon had to read, and the goal was one of them. They’ve been probably, for me, I think the two most fascinating companies of the last century were Amazon, I remember Amazon mostly this century, but Toyota and Amazon.
20:56
Yeah, those are two big ones. Now, what we’ve shared a little bit is about the token magazine, the visible work, and then you touched a little bit upon governance. How is all of this playing into how leaders are rethinking AI governance?
21:14
Yeah, I think they’re not. That’s another problem, right? Is the florescent Scott has them thinking really to work well. So you have the auditors, and then you have some internal risk, or risk, which again, on how the organization set up should be all insane between the risk owner, the risk intermediary, and the bank, they call it the three lines of defense, right?
21:43
And then usually it is somebody who owns the risk, usually it’s the implemented developer. And then you have this second line, which is somebody who is the arbitrator between the purely technical. And then on the third line, at least this is in the technical layer, there are other parts of the business that have the three lines apply, but from the technology standpoint, and then you have the internal auditor.
22:06
Right? And so, you know, you get a couple of problems here, the internal auditors are always behind that technology, always behind, they were behind in cloud, they were behind in DevOps, they were, you know, and they’re just incredibly behind right now in AI, right?
22:22
So that’s right now you have this gap right there. And then the core of the, what we have is, this is the part that everything is new, right? There’s parts that are all the same and old, but the new here is, we’ve got this new technology that has infinite knowledge at machine speed, or inference, you know, it’s got infinite knowledge with machine speed inference. So the decision making process is depending on the authority that you give it. So this breaks all the rules that we’ve had for risk. Because nobody’s really
23:08
assumed that, you know, I’ll give you a good example. There was a client I was working with, you know, and I’m sort of like a look for these sort of accidents, what I call rogue agent examples, right? And I compile them, but like, I was at a client, and they were telling me a story about how they were using cloud for really just do a simple thing. And the first couple of things it was going to do was, you know, clone the repo, and then it was just going to do some cleanup of this new repo that they’ve got, right? And so they figured, okay, well, just, you know, like, I’ll do that. I’m not even going to think about it, because blood can do all the prefab setup, right? Well, in this example, could found a parameter that I don’t
23:54
think anybody ever uses, it’s like an inverse filter parameter. And the inverse filter, like, it was just like, it was like, I can use this because I can, or because I have infinite knowledge. So I don’t think most users would know all the parameters that git has, in this case, it was GitHub. And then go pick the obscure one that seems logically more efficient that no human would pick. And what happened was, it actually has an hallucination on the execution of it. So the net net was, it deleted every the purpose of the inverse filter was to delete the .env file and preserve everything else, which is something like you don’t really do when you’re setting up the repo. And it did the
24:41
opposite, deleted everything else and kept the .env file. Now, no human would process it that way, but because the model itself had infinite knowledge of, like, all the possibilities and figured out, like, I think that’s probably the best possibility that a probably human would be, I’m going to do this, you know, it’s just like you wouldn’t do arm RF, you know, like, you know not to do that, right? Like, you know, like, yeah, it might be the most efficient way to clearing out a directory, but, like, I’m not going to put that in automation script.
25:15
Right? And I think so, like, my point is, you’ve got this infinite knowledge that a human would, like, so a human thinking about risk from the way a human thinks about risk is not sufficient in this new world. And so we really need to think about, like, I use a term a lot, and we talk about this as blast radius. You really need to sort of rethink this new pattern. And, like, so what is the blast radius of the automation that, you know, and when you get into Gentix, it becomes a whole nother layer with agents.
25:57
Because at least inference, guardrail in terms of guardrails, you can use sort of evaluation software, you can use LM as a judge. But if the inference is creating code and task executions, your ability to limit that from a guardrail perspective is much harder.
26:16
Anyway, so there’s a lot of work to be done here. And unfortunately, most of what I see people doing is trying to repave traditional risk governance models as an overlay to an area that is completely different from a risk perspective.
26:39
So looking at that, like, what lessons do a lot of these leaders need to relearn with this new lens? Yeah, I think you have to, you know, most of the work I do, right, and, you know, these days, I sort of sit back. I’m getting old, right, but I’m not as aggressive at finding work.
27:00
But most of the time, the way I get my work is there’ll be a chief of staff for the CIO. And they’ll sort of see me at a presentation, or they’ll be at one of these technology transformations where they worked with me in the past. And they’ll call me up and they’ll say, I really want or they’ll tell the CIO, they’ll say, Hey, you know, you really should talk to this guy. We need to talk to, you know, the big four. And I’ll be like, then he’ll be like, yeah, I think you ought to at least talk to him. And then I’ll get in, you know, in that conversation and, and start, you know, working my way through. And, you know, part of my conversation with the CIO is, you know, I’m just going to tell him the truth, because I don’t really care whether I get the work or not. You know, in fact, you know, the first thing I tell and I’ve been doing this for years, I’ll tell the CIO, I’ll say,
27:47
you know, you’re not gonna like if I come in, you’re not gonna like what I tell you. Oh, no, no, no, we’re gonna no, no, no, no, trust me. I’ve done this, I’ve seen this movie many times. You’re not gonna like what I tell you. And that’s my first test of them. Right? Like, you know, are they willing to take the brutal truth, right? Deming used to do Deming was when a CEO called Deming and say, Hey, you know, we really heard about your ways, we want to improve, you know, like what you did with this company.
28:17
And he tells the CEO, are you going to work with me like, Oh, no, no, you know, I don’t work with CIOs, but CEOs, but I do work science CIOs. And they’d say, Oh, no, no, I can’t I’m the CEO, you know, I’ll get you to know, he’d hang up on like, literally, you’d hang up on him. And you know, they really don’t don’t hang up on me, like, are you gonna work with me? You know, and so I’m not that brutal. But but the question is, first is, are you willing to, you know, sort of accept this slowdown? You know, in fact, when usually those chief of staff or whatever call me the first thing I say, Okay, you know, kind of like, you know, time and cheek, but not really, I’m like, all right, first thing I want to do is I want you to put down a phone, I want you to go to the coffee machine, hopefully, you got a really fancy coffee
29:03
we talked about seven brew for the call, right, or go to your seven brew, get a really good get your favorite coffee, free speak, calm down, then start listening to the things that we need to talk about, right, and call me back, right. And, and, you know, and, and like, like, stop the frenzy, like, get, you know, get yourself out of the fluorescence. So like, the first test is, are you willing to, you know, accept that, you know, I mean, people, I’ve got asked recently on a podcast, which is, what would you recommend as your 30 day, 60 day, 90 day plan? I’m like, not have a 30 day, 60 day, 90 plan. That’s my first recommendation, right?
29:45
Yeah, like, calm down. There’s a lot out here that’s basically, and so, you know, it sounds simple. And, you know, the simple things are the, you know, the right things, you know, like, but, you know, and then at that point, then, then the second question, and it’s another test, it’s not that I’m like, I’m a game theory person or whatever. But my second test is, I say that, you know, what I think needs to happen, and nobody, very few people want to do this. And I did this with DevOps, I did this with SRE, I did DevSecOps, and I’m doing it now with, you know, organizations that literally sort of passed my first two tests, which is, I, you know, before we do anything, what I want to do is come in and do a qualitative analysis approach,
30:31
understanding what the organization looks like. Because if you go back to what I said earlier, like the problem with an innovation strategy versus a talent system gap is, most CIOs do not understand their talent system. And to make it real simple, and every 10-cent methodology, and I know it’s more than three, but I like to use threes.
30:54
There are the people that are sort of passively aggressive, they feel risk based on the new technology, they don’t really want to, but they’re going to say, oh, yeah, you know, like, we’ll get to it next month. But they have no intention, or they’re going to slow roll it till the end of time.
31:10
Because they don’t believe in it. And this is true with cloud, it’s true with DevOps, it’s now true with AI. They don’t believe they’re threatened by it. Right? The rack and stack person was threatened by cloud, you know, they, you know, and then there’s on the far right, like the other side, there, the do now ask forgiveness, later people who are literally going ahead and like, you know, they’re heroes, and heroes sometimes, you know, die in battle, and sometimes are heroes. But, and then the most interesting group is the middle group who they want to do it, they believe that could work, but they don’t have any clarity on what they’re supposed to do. And a regulated business gets even more interesting, because you’re at a high level and a regulated business.
31:53
Sometimes the best thing that can happen to you, something screws up is get fired. A worship penalty is losing two times your salary. The worst than that, you can literally go to jail. Right? You know, so that you know, so you if you don’t and most, so most CIOs will have this mandated AI strategy. Oh, we got an AI strategy, we have to have it, you know, we brought in this organization, they helped us, and they don’t talk to any of the organization, the talent system.
32:25
And we know what that looks like. Right? When you try to, because we, if we believe in systems thinking, which we do, then we know that if group A is a passive aggressive, and group B is like, do now ask me to give this later, and group C is that middle group and group D, you’re not getting anything through your system, and it goes back to the bottlenecks, the invisible work, where does the work matter? So that’s sort of the second test. And then you can start identifying strategies. Like one of the things I love doing now is, you know, I sort of accidentally came into it early on in the AI world, but we call it call. And I’m pretty sure I created this idea of this. And I’ve done like four or five of them now an ideation hackathon.
33:11
And so because the other problem is, you know, people want to just like, turn over AI to all their executive assistants for the executive team, right? And then like, what’s that chaos going to look like when we’ve got people who know nothing about architecture process, or each creating their silo of automation. So the ideation hackathon is to create a systemic approach to delivering AI.
33:36
So now you can invite the procedure people, the administrative executives, the project manager groups, all those people have the freedom to do in an ideation hackathon, like do everything but code.
33:58
You know, and it might be less than what you’re going to allow them to use this to no, no, no, no tools. We’re going to basically make believe that we use AI to create this solution. And we’re going to coach and we’re going to have some, you know, we have, you know, sort of experts on the teams that have developed and I, I’m telling you some of the I did for a candy bar company, I can say name of it, but I, the there was, it was like six teams. And the, they were gonna fund so that the judges for the hackathon were basically myself, the C, C, I’ll the CFO, and the VP of engineering.
34:39
Right. And they were going to only fund the first two. They, they, they were so impressed by the ideation hackathon. They funded the five out of six and the six just did participate. Right. Like, and it was, it was glorious. You know, like give people the ability, stop telling them that you gotta get this done. And where is your, what’s your token leaderboard? Where, you know, all those nonsense things and tell everybody to sort of slow down. Coffee, let’s, let’s take the method and build a methodical approach to how you’re going to deliver AI in an organization. You know, we, we, we spent 25, 30 years developing a methodical approach to living somewhere. It goes back to my,
35:24
my comment to the market and recent thing, right? We got, we, we do pretty good. Your organization is really good at helping people. You have great products that help people. Right. Like we’re pretty good at that. Well, now a couple of major things changed on us and we’re going to have to refigure out how do we build services in this new world? And, you know, and some of them are repeatable, some of them are not. We need to relearn some of the ways we want to do this. And just telling everybody either don’t do AI or use AI or, you know, you can use AI, but manage your budget as organizational mandates. It’s going to create chaos. Yeah. It sounds like with the work you’re doing, we live with the ideation hackathons would really impact the company culture
36:10
moving forward. Right. You said everybody has a strategy, but how is that actually adopted internalized and is everybody on the same page? I feel like that would be a great way. No, it’s great for a number reasons. One is because what people do is they they’ve heard from everybody else that, oh, company X, Y, Zs have an AI hackathons.
36:32
And when I was in AI, I had all this sort of, you know, who shows up most AI hackathons and alleged corporations? I’ve done a bunch of them. You know, is the young kids, you know, they’re sort of brazen. They have no sort of the risk sticks of like danger, danger. And like almost all the hackathons I’ve been in large corporations, the winning teams. And then, you know, who doesn’t show up? The project managers, the people who don’t code, who are like, you don’t want to go in and show how much I don’t know about the process. And everybody thinks I know all this, but they don’t know. Right. And the ideation hackathon, the first thing it does, it sort of throws that bell off.
37:13
It gives them the freedom to come in that we’re not going to code. But to your point, the second thing it does, it starts creating a cadence of how you want it. You’re going to learn how to deliver because in the right structure, the ideation hackathon will be the blueprints for the technology hackathon.
37:36
And that’s the perfect world. Now we get people to ideate on the solution. Now we can pass, now we can have sort of a larger technology. And now they’ll feel confident being there because they can be an advisor to the technology group that’s going to implement it.
37:53
Right. You know, so yeah, so I think those two things make that, I mean, like, as you do things in your career, you know, there’s certain things that I’ve done, which I’m like, yeah, that works really well. This is just one of those things that we, especially now in this sort of time, we’ve got all this sort of external noise hitting us from all directions. How do we, you know, how do we sort of clear the clouds, you know, smell the coffee, whatever example you want to use?
38:23
No, I think that’s valuable for the audience. They’re a point where they only have, you know, X amount of time, they really need to realize what’s going to work, what’s going to move the needle and learning from your experiences and best practices. Because decades of experiences it’s going to be what they want to take away. Yeah, no, it’s helpful. And then, you know, again, it also starts with, you know, are you a leader that’s willing to slow down, step back, you know, and sort of exhaust some resources.
38:55
Because another sort of thing that is incredible, I did, I was about seven years ago, I did one of the largest asset holding, you know, sort of commercial asset holding banks in the world. I spent a whole summer doing a qualitative analysis and it was just glorious. I mean, I wrote basically a book to the CIO of like all the things they had no one to, in fact, I had to do a readout for like seven DCIOs in this organization because there was some constraint of like, in other words, I wasn’t going to get paid unless I had to do the readout to the people that I actually did the organizational study on. And at the end of the thing, and I was like, literally, I’m not attacking, but I was laying out all this sort of crux and
39:42
waste and, you know, negative ROI and all their sort of groups. And they all turned to me at the end of it. And they said, you’d be hard to believe that one said you learn more about our organization in like two months, and we 25 years, but then and that’s not because I’m a genius, it’s just sit down and listen to people. And then the second point, which was that they said, you know, in fact, actually, it’s like a billion and a half budget, IT budget is like digital services group. And I, you know, I estimated, you know, sort of napkin math, but very well predicted that command that they were wasting like 30, 40%, you know, probably almost a half billion dollars of just waste on a $1.5
40:28
billion IT budget. And they agreed with me. Just listen. I’m excited. I’m excited to have you part of this conversation. As I mentioned, this is a three part series that we have with John. And we’re going to realize people who are being successful aren’t adopting the fastest, they’re the ones that are, you know, doing it thoughtfully and taking into consideration all the things that John shared with us today. Is there anything else you want to share with the audience before we send off to this episode, John? No, I think I, you know, it’s good. I, you know, I hope I didn’t ramble too much. But yeah, I mean, I think you just hit the nail, you know, on the head, which is, you know, like, it’s, you know, it’s, it’s just slow and steady, you know, when’s the race, right? I mean, I mean, yeah, there’s a reason why people say it, right? So yeah. Well, thank you. Thanks
41:15
for joining us. And we will see you next time. Yeah, great. Thanks. It was a pleasure.
AI has dramatically lowered the barrier between an idea and a working prototype. A prompt can produce code, automate a task or turn a rough concept into something tangible in minutes.
That speed is powerful. It can also be misleading.
When something is easy to start, it is tempting to believe the difficult part is over. But a promising experiment is not the same as a production-ready system, and activity is not the same as value.
As organizations move beyond early AI pilots, leaders have to ask harder questions: What problem are we solving? Where is the real constraint? What new work or risk are we creating? And how will we know whether the organization is actually improving?
In this conversation, John Willis brings lessons from decades of technology transformation to the current AI moment. His central message is refreshingly grounded: AI may change what is possible, but it does not erase what organizations have already learned about people, systems, risk and change.
Willis describes the excitement surrounding a new technology as a kind of fluorescence. The glow is so bright that it can obscure the terrain beneath it.
We have seen versions of this before with cloud, agile and DevOps. Each introduced genuinely new capabilities, but each also encouraged organizations to treat familiar challenges as if they had disappeared. AI is following a similar pattern. Leaders can become so focused on what the technology can produce that they lose sight of how that output will operate within a larger system.
That is why one of the simplest points in the discussion may also be the most important: a prototype does not equal production.
Moving from one to the other still requires the less visible work of integration, review, security, governance, maintenance and measurement. AI can accelerate parts of that work. It does not make the system around it irrelevant.
AI strategy does not operate in isolation. It lands within what Willis calls a “talent system”: the people, behaviors, incentives and organizational structures that determine whether the business can turn a strategy into results.
Within that system, people tend to respond differently. Some resist the change because they feel threatened by it. Others move ahead quickly and ask for permission later. A large group in the middle may believe in the potential of AI but lack clarity about what they are expected or permitted to do.
When leaders develop an AI strategy without understanding those different groups, the gap between strategy and execution grows. Teams may slow-roll adoption, create isolated automation or take risks the organization has not prepared to manage. The challenge is not simply whether an organization has the right talent. It is whether its overall talent system can produce the outcome the strategy is intended to create.
Willis uses the term “token maxing” to describe the pressure many organizations now feel to consume more AI simply because they can. After an initial period of caution, some companies have moved to the opposite extreme: teams are told to use AI everywhere, automate whatever they can and demonstrate momentum as quickly as possible.
The problem is that increased AI use does not necessarily mean increased business value.
If the starting point is “Where can we use AI?” almost any task can become a candidate. A stronger starting point is “Where is the value?” That shifts attention from adoption for its own sake to a specific outcome the organization needs to improve.
It also creates room for an answer that is easy to overlook amid the current excitement: not every problem needs AI.
For banks, fintechs and other regulated organizations, AI adoption comes with a particular tension. Leaders recognize that AI will become part of how their organizations operate, but they are also responsible for protecting sensitive data, meeting regulatory expectations and managing risk.
Willis compares the current moment to the early adoption of cloud technology. Some financial institutions moved quickly, while others waited for greater clarity from regulators before placing certain data or processes in the cloud. AI is following a similar pattern, but the external pressure may feel even greater. Organizations are being told that if they are not already using AI, they are falling behind.
The question, then, is not whether regulated industries will use AI. It is how they can adopt it in a way that creates value without losing sight of accountability.
That requires more than trying to move faster than competitors or treating governance as a final checkpoint. Willis argues for a systems approach in which technology, risk and internal audit work toward the same goal: improving the organization while protecting customers, their money and the institution’s brand.
Some of the most important work inside an organization rarely appears in a process map. It happens through handoffs, reviews, exceptions, rework and the experience people use to keep a process moving.
AI can accelerate one part of that process without improving the system as a whole. A team may produce more code, content or analysis, only to create a new bottleneck for the people responsible for reviewing, validating or putting that output into practice.
As Willis explains, automation does not always eliminate work. Sometimes it simply moves the work.
That is why leaders need to understand where work actually happens before deciding where AI can create value. If AI makes one step faster but adds more review, rework or burnout, organizations may be generating more activity without making meaningful progress.
Many governance models were designed around human decisions and relatively predictable automation. AI introduces a different risk profile. A system can draw on a vast range of knowledge, make inferences at machine speed and, when given sufficient authority, take actions a person may not have anticipated.
Willis shares an example in which an AI-assisted task selected an obscure but seemingly efficient technical option and produced the opposite of the intended result. The lesson is not that organizations should avoid AI. It is that traditional risk controls cannot simply be placed around AI as an afterthought.
Leaders need to consider the potential blast radius of an AI-enabled action before it occurs. What can the system access? What decisions can it make? What can it change or delete? Where is human review required? What evidence will show what happened?
The pressure to produce a 30-, 60- or 90-day AI plan can make reflection feel like delay. Willis argues that thoughtful leaders need to resist that frenzy long enough to understand their organization.
An AI strategy does not operate in isolation. It lands in a talent system made up of people who may resist it, race ahead of it or want to participate but lack clear guidance. A strategy developed without understanding those behaviors is likely to create fragmented adoption and hidden risk.
One practical approach Willis recommends is an ideation hackathon. Unlike a traditional hackathon centered on coding, it gives business, operations, project and administrative teams space to define problems and shape potential solutions before technology teams begin building. The result is a more inclusive way to surface valuable use cases and a stronger blueprint for responsible implementation.
It reflects the broader lesson of the conversation: meaningful AI adoption does not begin with producing more. It begins with seeing the system more clearly.
The organizations that create durable value with AI may not be the ones moving fastest. They may be the ones willing to pause, identify the real constraint and build the organizational practices needed to move from experimentation to reliable execution.
AI makes it easier to start. The leadership challenge is recognizing everything that still has to happen after that first impressive result.
Listen to the full conversation with John Willis and Eve Turzillo for a deeper discussion of AI value, invisible work, governance, organizational culture and what leaders should examine before they scale.
Continue reading...
“Automation does not always eliminate the work. Sometimes it simply moves the work.”
In the first conversation of a three-part series, author and technology leader John Willis joins Progress Developer Advocate Eve Turzillo to explore why creating lasting value with AI requires leaders to look beyond the excitement and understand how work actually gets done.
Automate MFT • Audio
AI Value, Invisible Work and Governance with John Willis
Why creating lasting value with AI requires leaders to look beyond the excitement and understand how work actually gets done.
Read transcript
John Willis - Episode 1 Podcast Transcript
Timestamps normalized to episode start (00:00).
00:00
Welcome and thanks for joining us. I’m Eve Turzillo with Progress Software. It’s no surprise everyone is talking about AI. The conversation I find the most interesting about what happens after people begin relying on it and how they turn the early excitement into real business value.
00:18
Over the next three episodes, I’m joined by John Willis to explore leadership, governance, and what it really takes to create value with AI. If you’re familiar with John’s work, he has a way of looking beyond the technology itself to ask those bigger questions.
00:33
That’s exactly why we wanted him to be part of the series. In other words, I’m old and I’ve been doing this for a really long time. [LAUGHTER] Not at all. John, one thing I’d like to start with is something that you said that has really stayed with me. It was AI makes it easy to start, and that makes it easy to leave the work is done.
00:54
I’d love for you to expand on that. Yeah, I think it’s a trap. I’ve been thinking I’ve been doing a lot of podcasts lately, and probably more than I’ve ever done on other people’s podcasts. That’s because I’m trying to promote my books. I realize I think I’ve sold my books to everybody that knows me.
01:11
Now I got to figure out how to find people who don’t know me. But I think it leads into this idea that I heard this expression, I thought it was pretty interesting. These technology transformations are like fluorescence. People like to use winters and springs. They’d rebirth and dying.
01:29
But it’s like this energy that’s there, and not to get too meta. But I think we get fooled by the fluorescence is we get fooled by the flashiness, the glow of this fluorescence.
01:45
We look at this technology and we start throwing everything that we knew out the window. And in fact, there’s nothing I like to say is, which I stand in front of an audience of a thousand people, and I’ll say it’s so terrible that I have to say this in 2026, but in front of a thousand professionals, that prototype does not equal production.
02:09
And it’s funny, I commented Mark Andreessen, Andreessen Horowitz recently wrote a post. This is a great example of how this fluorescence class. But Mark Andreessen is an incredible technologist, brilliant man, incredibly successful.
02:26
But he talked about how AI is creating this new standoff between coders, PMs, and designers, and he suggested this new idea called a builder. And in the comment, I had the remind, and it’s usually I don’t find myself having to remind billionaires too often of that we’ve been doing this for 20 years.
02:47
The builder concept has been around from lean agile, certainly DevOps, from two pizzas, DevOps and beyond. And again, it’s a great example. And I got incredible amount of traffic on that one comment, but it wasn’t anything profound.
03:04
I mean, the whole point was even the best and brightest of us can get sort of blinded by the fluorescence of a new technology. And I’m not immune to it either. Part of my role now these days is to try to decouple that with leaders to step back and say, well, wait a minute, there are definitely new things here.
03:26
But there are some old things too. So not everything is new. And yeah, so I went back and I watched this video from Simon Wardly of O’Reilly’s OSCON 2015, and it’s one of those great, it was like four or five great presentations within the last 15 years.
03:45
So situation normal, everything must change. And what he’s arguing, it was the birth of his Wardly mapping, if you haven’t heard of it. But what he was saying is the future is predictable if you know what you’re looking at. And he uses the mapping metaphor.
04:00
I use it as the fluorescence. In other words, the real truth of any technology, AI, cloud, is understanding what the terrain is. What are the things that are sort of new? What are the things that are old?
04:16
And it’s not an easy job. And I think it goes back to your sort of like you like my quote about AI makes it easier to start, but it makes it easier to believe we’re done. There’s the magic. We need to figure out what is AI doing that’s completely different from everything we’ve done before, but what are the big parts of AI that really don’t change anything?
04:40
That makes sense? Yeah, you talked about the blindness and the terrain. How does someone go about kind of mapping that out? What is that first step for people who are starting out here? Yeah, I think that the obvious ones that are hitting us loud and clear right now, we see this over and over, right?
04:58
Like we see a new… And one of my advantages is I sort of joked about it all, but I’ve actually been doing this for five decades. I’ve basically seen technology transformations for five decades, right? And I won’t bore you. The listeners hear about how I started out with IBM mainframes, but the patterns, you get to see over time the patterns that are recognizable.
05:22
And I think wordly mapping is an interesting way, but I think I like to look at, what is your organization? What are the behaviors? There’s this idea called social technical systems, right? And we use it a lot in the DevOps terminology or sort of like the…
05:39
It’s like I said probably a terrible way to describe it, because it really does… It has economic principles in it, but how does technology interact with humans? And how do humans interact with technology? And the thing we forget more often than not is that the humans…
05:55
There’s an element of the human behavior, the human culture, all the things that make us human that usually… Because the social technical systems thinking came around in the 1950s, where the study of coal miners.
06:10
And they thought if they could just bring in this new technology, this is in the UK, then everything would be hunky-dory, it’d be great. And it wasn’t. And so the real trick is going back to the sort of the things that we know, systems thinking, and it don’t be very meta.
06:30
People want like, “Okay, John, tell me exactly what I need to do.” Well, that’s not usually the first answer, or it’s the wrong first question. You have to sort of understand your organization. And we get a little deeper into what I call the… I know we’re going to talk a little bit about what I call this sort of the innovation strategy versus the talent systems gap.
06:55
And then I think that a lot of what your talent… Not talent, I don’t really care. I do care, but I don’t focus on what the talent is of your organization. I focus on what a talent system looks like. And that’s your organization, that’s your system as an ability to produce something that the organization is trying to create.
07:23
Right? Yeah. I think one of the things that we talked about prior to this podcast was you’re spending more and more time working with these organizations, right? Adok and AI, you’ve started talking about something you call token maxing.
07:39
I think that is something for those who haven’t heard the term before. How would you explain it to them? Yeah. I recently wrote an article called “Token Scutcheon for Any” which is, if we go back three or four years ago, most enterprises… I mean, I’ve done a lot of startups, but most of my day job, my career has been ensuring to help large scale regulated business, banks, insurance companies, certainly certain retail companies that have… Protecting the brand is of critical importance, right?
08:14
And the thing about what people tend not to do very well is understand what value is, right? So the token schizophrenia problem is that we sort of lead is about three, somewhere between three and five years ago, saying, "Do not use AI.
08:34
Can’t use AI. Why? Well, we don’t know." That’s not a terrible thing, right? But they’re like sort of knee jerk reactions, right? And then, I probably should have called it knee jerk reactions. Because then they were like… Because Wall Street was screaming and hollering and like, “Why are you not using AI?”
08:54
And then now we’re in this like, “Ooh, you’re kind of spending too much money on AI.” Right? And then just that blueprint of like this short window of historical structure of what’s happened, this just shows us that we don’t really understand how our human systems, our social technical systems converge, right?
09:20
And so the token maxing thing, what we’re seeing now is that people are basically told in that sort of middle group, go out and therefore AI. In fact, what’s interesting is I was just looking up the… There’s almost like a billboard of the most recent story that’s been a victim to running out of token budgets, right?
09:41
And the US Army now is a victim. They’re literally… They created a sort of ask me that they wanted to turn on all governments and they’ve already used up their, from what I can tell, their 2026 budget, right? Uber had used up their budget in March, almost before like end of March, right?
10:01
Amazon, there’s all these sort of tragic stories about… I think it’s… Somebody said one trillion and I think there was a typo in there, but it was 1.7 billion. And there was also a question of like a half of $500 million single monthly budget for some group, Microsoft.
10:23
So we’re seeing this untamed, unmanaged fluorescence of how people are just… I mean, you could just… I can say this is no way to run a business.
10:38
This is no way to run an economy, but we’re stuck in this fluorescence. So like we’re still trying to figure out… And in the core of what we talked about before is it’s the same thing that we should understand every time we’re looking at technology transformations or any type of transformation is where is the value?
11:00
And it’s a simple question. It’s a hard question to answer. I mean, I wish I had the simple answer. Great. I’d be retired. I’d be on a fishing boat to go from Mexico. But that’s the question you have to answer.
11:17
And not everything has to be AI. I mean, that’s the other… I’m going into organizations where in some places they literally open up like court lots and literally giving it to executive assistants and just go automate everything.
11:37
And where is the value? What’s the improvement? All the things that we’ve been… I’m a big Deming fan, but Deming was promoting these ideas for… Which was the foundation of most management clear thinking, which becomes Toyota, which becomes Lean, which becomes Agile, which becomes DevOps.
12:01
And we don’t have the crystal ball, but we’ve been trying to solve these organizational design, organizational behavior. And then all of a sudden AI comes around and like, “Hey, get out of the way. Here we go. Don’t slow me down.” And so we’re not focusing on the value and not everything has to be, like I said, AI.
12:24
One of the things that somebody asked me recently, they said, “Hey, John, do you think we’ll finally get to the mythical four-day work week with AI?” I’m like, “Are you kidding me? We’re approaching six and a half day work weeks with most of the people I know.” And I’ve got a group of really good friends that have on some of these chat groups.
12:47
And quite honestly, with all due respect to them, it seems like they’re almost like zombies now with AI. Talking about like, “Oh my God, I got only three days to use Fable 5 before it does this.”
13:03
And, “Oh my God.” And I step back and I’m like, “What are they producing?” I don’t know. I’m not writing automation for things I didn’t really do before AI.
13:20
I’m rambling, but yeah. But you brought up another good point. You’re talking about base and fintechs. What do you think the appetite is for AI? What’s the comfort level with some of those financial institutions in the AI workflows?
13:35
Yeah, I mean, it’s schizophrenia again. In other words, you’ve got one hand. It’s the same. Again, we can keep going back to what did cloud do? We always think it’s a different fluorescence, but cloud was an interesting of the patterns.
13:54
There was a lot of pushback on and legitimate pushback on regulated business like a bank. If the regulatory controls groups like OCC and people who regulate banks are not giving clarity about whether you should put certain types of data or processes out in the cloud, a lot of banks held back and waited for that clarity.
14:17
Some banks got real aggressive. Capital One was a bank that historically was very aggressive with cloud. I think we’re seeing the same thing with AI. In a sense, maybe the fluorescence will make me say this in that I think maybe there’s more tension now because AI and Wall Street and if you’re not using AI, you’re falling behind.
14:40
But probably when the dust settles, that was the same tension we had with cloud. If you were, “Oh, look at Capital One. What they’re doing. What is your bank doing?” And so, I mean, the fundamental of all these things was, and we knew this early on.
14:58
I mean, I remember back in the day where regulated businesses would tell me, “Get this.” They would say, “We’ll never use Linux in this bank ever, ever, ever.” Right? And then they said the same thing about cloud.
15:14
And then, I think they’re a little more educated now. I don’t think anybody really believes that they’re not going to use AI in regulated industry. But, and by the way, you will. You’ll have to. The competitive nature. And then the devil is then in the details of one of the things I like to think a lot about is, what does internal audit look like?
15:40
Do we have a systems approach? We wrote a book called DevOps. Basically, well, we wrote a paper called the DevOps Automated Governance Reference Architecture. It was back in 2018. And it was based on banks.
15:56
How do you regulate purely fast cloud native containerized things to really improve? Not to have developers outsmart the auditors or internal auditors figure out how to catch them.
16:14
It was how did you create an improvement structure with an organization? And we wound up writing a book called Investments Unlimited, which was a novel. And so, I think these same type of things are really interesting now with AI. It isn’t like, what can I get away with in a regulated industry?
16:31
Or it isn’t like, how do we figure out what they’re doing that they’re doing wrong? How do we create a systems approach to a unified way that improves the organization and protects the brand or in the case of a bank, protects people’s money?
16:51
I think that’s an important distinction. Another idea you’ve talked about is that invisible work. And I don’t know if everyone is familiar with that terminology, but what do you think is at the heart of that invisible work?
17:06
And what are people overlooking when it comes to AI? Yeah, I sound like a broken record here, but it’s the same. It’s the Simon Wardley situation, normal, everything must change. In other words, to the point being that invisible work has been around for forever.
17:27
And the Phoenix Project is a great story, really. Gene Kim’s The Phoenix Project is based on a book by a guy named Elliot Gohrach called The Goal, who was talking about theory constraints and bottlenecks in manufacturing businesses.
17:45
Gene did a rewrite on a software stack and a Java programmer and a system analysis admin. But the idea is that we need to understand the work. And so AI, in a lot of ways, accelerates these things.
18:06
But at the end of the day, there are things that are… The whole idea of theory constraints is about understanding bottlenecks. And so the real meta point of bottlenecks is, Gohrach said, “An improvement anywhere other than the constraint is an illusion.”
18:33
So therefore, yeah, I mean, that’s… You could take that to them, meaning this is like… In other words, when you think you’re improving something, this is Gohrach. And again, I think mileage varies on all the aspects of improvement.
18:49
But in this sort of discussion, what Gohrach is saying is, if you’re not improving the constraint, you’re really not improving anything. And so AI, if we don’t understand where the work is, where are the bottlenecks?
19:09
In fact, we’re seeing bottlenecks, again, to bring it forward to what we’re seeing now, the whole AI slop thing, right? The question is, just because it’s got everybody writing AI, is it really… Is it creating more bottlenecks? Are we having more rework?
19:27
Are we creating more burnout for the people? There’s a lot of sort of in-stream questions that… And again, a lot of the… Gohrach would talk about this thing called the five focusing stench, right?
19:44
Where you sort of identify the constraint, exploit it, you support it, you elevate, and then you just go… Because guess what? Every time you… There are one of the things I think we talked about is automation doesn’t always eliminate the work, it just moves the work.
20:01
So when I think of invisible work, or one of the invisible work components is, “Okay, you just changed this, where did you move the bottlenecks? Where’d you move the constraints?” Again, this is stuff that people were talking about in the 80s to improve MRP systems, pre-ERP first systems, right?
20:26
So these ideas have been around, they seem to work. There’s a reason why I think Jeff Bezos, they said those three or four books every executive early day of Amazon had to read, and the goal was one of them. They’ve been probably, for me, I think the two most fascinating companies of the last century were Amazon, I remember Amazon mostly this century, but Toyota and Amazon.
20:56
Yeah, those are two big ones. Now, what we’ve shared a little bit is about the token magazine, the visible work, and then you touched a little bit upon governance. How is all of this playing into how leaders are rethinking AI governance?
21:14
Yeah, I think they’re not. That’s another problem, right? Is the florescent Scott has them thinking really to work well. So you have the auditors, and then you have some internal risk, or risk, which again, on how the organization set up should be all insane between the risk owner, the risk intermediary, and the bank, they call it the three lines of defense, right?
21:43
And then usually it is somebody who owns the risk, usually it’s the implemented developer. And then you have this second line, which is somebody who is the arbitrator between the purely technical. And then on the third line, at least this is in the technical layer, there are other parts of the business that have the three lines apply, but from the technology standpoint, and then you have the internal auditor.
22:06
Right? And so, you know, you get a couple of problems here, the internal auditors are always behind that technology, always behind, they were behind in cloud, they were behind in DevOps, they were, you know, and they’re just incredibly behind right now in AI, right?
22:22
So that’s right now you have this gap right there. And then the core of the, what we have is, this is the part that everything is new, right? There’s parts that are all the same and old, but the new here is, we’ve got this new technology that has infinite knowledge at machine speed, or inference, you know, it’s got infinite knowledge with machine speed inference. So the decision making process is depending on the authority that you give it. So this breaks all the rules that we’ve had for risk. Because nobody’s really
23:08
assumed that, you know, I’ll give you a good example. There was a client I was working with, you know, and I’m sort of like a look for these sort of accidents, what I call rogue agent examples, right? And I compile them, but like, I was at a client, and they were telling me a story about how they were using cloud for really just do a simple thing. And the first couple of things it was going to do was, you know, clone the repo, and then it was just going to do some cleanup of this new repo that they’ve got, right? And so they figured, okay, well, just, you know, like, I’ll do that. I’m not even going to think about it, because blood can do all the prefab setup, right? Well, in this example, could found a parameter that I don’t
23:54
think anybody ever uses, it’s like an inverse filter parameter. And the inverse filter, like, it was just like, it was like, I can use this because I can, or because I have infinite knowledge. So I don’t think most users would know all the parameters that git has, in this case, it was GitHub. And then go pick the obscure one that seems logically more efficient that no human would pick. And what happened was, it actually has an hallucination on the execution of it. So the net net was, it deleted every the purpose of the inverse filter was to delete the .env file and preserve everything else, which is something like you don’t really do when you’re setting up the repo. And it did the
24:41
opposite, deleted everything else and kept the .env file. Now, no human would process it that way, but because the model itself had infinite knowledge of, like, all the possibilities and figured out, like, I think that’s probably the best possibility that a probably human would be, I’m going to do this, you know, it’s just like you wouldn’t do arm RF, you know, like, you know not to do that, right? Like, you know, like, yeah, it might be the most efficient way to clearing out a directory, but, like, I’m not going to put that in automation script.
25:15
Right? And I think so, like, my point is, you’ve got this infinite knowledge that a human would, like, so a human thinking about risk from the way a human thinks about risk is not sufficient in this new world. And so we really need to think about, like, I use a term a lot, and we talk about this as blast radius. You really need to sort of rethink this new pattern. And, like, so what is the blast radius of the automation that, you know, and when you get into Gentix, it becomes a whole nother layer with agents.
25:57
Because at least inference, guardrail in terms of guardrails, you can use sort of evaluation software, you can use LM as a judge. But if the inference is creating code and task executions, your ability to limit that from a guardrail perspective is much harder.
26:16
Anyway, so there’s a lot of work to be done here. And unfortunately, most of what I see people doing is trying to repave traditional risk governance models as an overlay to an area that is completely different from a risk perspective.
26:39
So looking at that, like, what lessons do a lot of these leaders need to relearn with this new lens? Yeah, I think you have to, you know, most of the work I do, right, and, you know, these days, I sort of sit back. I’m getting old, right, but I’m not as aggressive at finding work.
27:00
But most of the time, the way I get my work is there’ll be a chief of staff for the CIO. And they’ll sort of see me at a presentation, or they’ll be at one of these technology transformations where they worked with me in the past. And they’ll call me up and they’ll say, I really want or they’ll tell the CIO, they’ll say, Hey, you know, you really should talk to this guy. We need to talk to, you know, the big four. And I’ll be like, then he’ll be like, yeah, I think you ought to at least talk to him. And then I’ll get in, you know, in that conversation and, and start, you know, working my way through. And, you know, part of my conversation with the CIO is, you know, I’m just going to tell him the truth, because I don’t really care whether I get the work or not. You know, in fact, you know, the first thing I tell and I’ve been doing this for years, I’ll tell the CIO, I’ll say,
27:47
you know, you’re not gonna like if I come in, you’re not gonna like what I tell you. Oh, no, no, no, we’re gonna no, no, no, no, trust me. I’ve done this, I’ve seen this movie many times. You’re not gonna like what I tell you. And that’s my first test of them. Right? Like, you know, are they willing to take the brutal truth, right? Deming used to do Deming was when a CEO called Deming and say, Hey, you know, we really heard about your ways, we want to improve, you know, like what you did with this company.
28:17
And he tells the CEO, are you going to work with me like, Oh, no, no, you know, I don’t work with CIOs, but CEOs, but I do work science CIOs. And they’d say, Oh, no, no, I can’t I’m the CEO, you know, I’ll get you to know, he’d hang up on like, literally, you’d hang up on him. And you know, they really don’t don’t hang up on me, like, are you gonna work with me? You know, and so I’m not that brutal. But but the question is, first is, are you willing to, you know, sort of accept this slowdown? You know, in fact, when usually those chief of staff or whatever call me the first thing I say, Okay, you know, kind of like, you know, time and cheek, but not really, I’m like, all right, first thing I want to do is I want you to put down a phone, I want you to go to the coffee machine, hopefully, you got a really fancy coffee
29:03
we talked about seven brew for the call, right, or go to your seven brew, get a really good get your favorite coffee, free speak, calm down, then start listening to the things that we need to talk about, right, and call me back, right. And, and, you know, and, and like, like, stop the frenzy, like, get, you know, get yourself out of the fluorescence. So like, the first test is, are you willing to, you know, accept that, you know, I mean, people, I’ve got asked recently on a podcast, which is, what would you recommend as your 30 day, 60 day, 90 day plan? I’m like, not have a 30 day, 60 day, 90 plan. That’s my first recommendation, right?
29:45
Yeah, like, calm down. There’s a lot out here that’s basically, and so, you know, it sounds simple. And, you know, the simple things are the, you know, the right things, you know, like, but, you know, and then at that point, then, then the second question, and it’s another test, it’s not that I’m like, I’m a game theory person or whatever. But my second test is, I say that, you know, what I think needs to happen, and nobody, very few people want to do this. And I did this with DevOps, I did this with SRE, I did DevSecOps, and I’m doing it now with, you know, organizations that literally sort of passed my first two tests, which is, I, you know, before we do anything, what I want to do is come in and do a qualitative analysis approach,
30:31
understanding what the organization looks like. Because if you go back to what I said earlier, like the problem with an innovation strategy versus a talent system gap is, most CIOs do not understand their talent system. And to make it real simple, and every 10-cent methodology, and I know it’s more than three, but I like to use threes.
30:54
There are the people that are sort of passively aggressive, they feel risk based on the new technology, they don’t really want to, but they’re going to say, oh, yeah, you know, like, we’ll get to it next month. But they have no intention, or they’re going to slow roll it till the end of time.
31:10
Because they don’t believe in it. And this is true with cloud, it’s true with DevOps, it’s now true with AI. They don’t believe they’re threatened by it. Right? The rack and stack person was threatened by cloud, you know, they, you know, and then there’s on the far right, like the other side, there, the do now ask forgiveness, later people who are literally going ahead and like, you know, they’re heroes, and heroes sometimes, you know, die in battle, and sometimes are heroes. But, and then the most interesting group is the middle group who they want to do it, they believe that could work, but they don’t have any clarity on what they’re supposed to do. And a regulated business gets even more interesting, because you’re at a high level and a regulated business.
31:53
Sometimes the best thing that can happen to you, something screws up is get fired. A worship penalty is losing two times your salary. The worst than that, you can literally go to jail. Right? You know, so that you know, so you if you don’t and most, so most CIOs will have this mandated AI strategy. Oh, we got an AI strategy, we have to have it, you know, we brought in this organization, they helped us, and they don’t talk to any of the organization, the talent system.
32:25
And we know what that looks like. Right? When you try to, because we, if we believe in systems thinking, which we do, then we know that if group A is a passive aggressive, and group B is like, do now ask me to give this later, and group C is that middle group and group D, you’re not getting anything through your system, and it goes back to the bottlenecks, the invisible work, where does the work matter? So that’s sort of the second test. And then you can start identifying strategies. Like one of the things I love doing now is, you know, I sort of accidentally came into it early on in the AI world, but we call it call. And I’m pretty sure I created this idea of this. And I’ve done like four or five of them now an ideation hackathon.
33:11
And so because the other problem is, you know, people want to just like, turn over AI to all their executive assistants for the executive team, right? And then like, what’s that chaos going to look like when we’ve got people who know nothing about architecture process, or each creating their silo of automation. So the ideation hackathon is to create a systemic approach to delivering AI.
33:36
So now you can invite the procedure people, the administrative executives, the project manager groups, all those people have the freedom to do in an ideation hackathon, like do everything but code.
33:58
You know, and it might be less than what you’re going to allow them to use this to no, no, no, no tools. We’re going to basically make believe that we use AI to create this solution. And we’re going to coach and we’re going to have some, you know, we have, you know, sort of experts on the teams that have developed and I, I’m telling you some of the I did for a candy bar company, I can say name of it, but I, the there was, it was like six teams. And the, they were gonna fund so that the judges for the hackathon were basically myself, the C, C, I’ll the CFO, and the VP of engineering.
34:39
Right. And they were going to only fund the first two. They, they, they were so impressed by the ideation hackathon. They funded the five out of six and the six just did participate. Right. Like, and it was, it was glorious. You know, like give people the ability, stop telling them that you gotta get this done. And where is your, what’s your token leaderboard? Where, you know, all those nonsense things and tell everybody to sort of slow down. Coffee, let’s, let’s take the method and build a methodical approach to how you’re going to deliver AI in an organization. You know, we, we, we spent 25, 30 years developing a methodical approach to living somewhere. It goes back to my,
35:24
my comment to the market and recent thing, right? We got, we, we do pretty good. Your organization is really good at helping people. You have great products that help people. Right. Like we’re pretty good at that. Well, now a couple of major things changed on us and we’re going to have to refigure out how do we build services in this new world? And, you know, and some of them are repeatable, some of them are not. We need to relearn some of the ways we want to do this. And just telling everybody either don’t do AI or use AI or, you know, you can use AI, but manage your budget as organizational mandates. It’s going to create chaos. Yeah. It sounds like with the work you’re doing, we live with the ideation hackathons would really impact the company culture
36:10
moving forward. Right. You said everybody has a strategy, but how is that actually adopted internalized and is everybody on the same page? I feel like that would be a great way. No, it’s great for a number reasons. One is because what people do is they they’ve heard from everybody else that, oh, company X, Y, Zs have an AI hackathons.
36:32
And when I was in AI, I had all this sort of, you know, who shows up most AI hackathons and alleged corporations? I’ve done a bunch of them. You know, is the young kids, you know, they’re sort of brazen. They have no sort of the risk sticks of like danger, danger. And like almost all the hackathons I’ve been in large corporations, the winning teams. And then, you know, who doesn’t show up? The project managers, the people who don’t code, who are like, you don’t want to go in and show how much I don’t know about the process. And everybody thinks I know all this, but they don’t know. Right. And the ideation hackathon, the first thing it does, it sort of throws that bell off.
37:13
It gives them the freedom to come in that we’re not going to code. But to your point, the second thing it does, it starts creating a cadence of how you want it. You’re going to learn how to deliver because in the right structure, the ideation hackathon will be the blueprints for the technology hackathon.
37:36
And that’s the perfect world. Now we get people to ideate on the solution. Now we can pass, now we can have sort of a larger technology. And now they’ll feel confident being there because they can be an advisor to the technology group that’s going to implement it.
37:53
Right. You know, so yeah, so I think those two things make that, I mean, like, as you do things in your career, you know, there’s certain things that I’ve done, which I’m like, yeah, that works really well. This is just one of those things that we, especially now in this sort of time, we’ve got all this sort of external noise hitting us from all directions. How do we, you know, how do we sort of clear the clouds, you know, smell the coffee, whatever example you want to use?
38:23
No, I think that’s valuable for the audience. They’re a point where they only have, you know, X amount of time, they really need to realize what’s going to work, what’s going to move the needle and learning from your experiences and best practices. Because decades of experiences it’s going to be what they want to take away. Yeah, no, it’s helpful. And then, you know, again, it also starts with, you know, are you a leader that’s willing to slow down, step back, you know, and sort of exhaust some resources.
38:55
Because another sort of thing that is incredible, I did, I was about seven years ago, I did one of the largest asset holding, you know, sort of commercial asset holding banks in the world. I spent a whole summer doing a qualitative analysis and it was just glorious. I mean, I wrote basically a book to the CIO of like all the things they had no one to, in fact, I had to do a readout for like seven DCIOs in this organization because there was some constraint of like, in other words, I wasn’t going to get paid unless I had to do the readout to the people that I actually did the organizational study on. And at the end of the thing, and I was like, literally, I’m not attacking, but I was laying out all this sort of crux and
39:42
waste and, you know, negative ROI and all their sort of groups. And they all turned to me at the end of it. And they said, you’d be hard to believe that one said you learn more about our organization in like two months, and we 25 years, but then and that’s not because I’m a genius, it’s just sit down and listen to people. And then the second point, which was that they said, you know, in fact, actually, it’s like a billion and a half budget, IT budget is like digital services group. And I, you know, I estimated, you know, sort of napkin math, but very well predicted that command that they were wasting like 30, 40%, you know, probably almost a half billion dollars of just waste on a $1.5
40:28
billion IT budget. And they agreed with me. Just listen. I’m excited. I’m excited to have you part of this conversation. As I mentioned, this is a three part series that we have with John. And we’re going to realize people who are being successful aren’t adopting the fastest, they’re the ones that are, you know, doing it thoughtfully and taking into consideration all the things that John shared with us today. Is there anything else you want to share with the audience before we send off to this episode, John? No, I think I, you know, it’s good. I, you know, I hope I didn’t ramble too much. But yeah, I mean, I think you just hit the nail, you know, on the head, which is, you know, like, it’s, you know, it’s, it’s just slow and steady, you know, when’s the race, right? I mean, I mean, yeah, there’s a reason why people say it, right? So yeah. Well, thank you. Thanks
41:15
for joining us. And we will see you next time. Yeah, great. Thanks. It was a pleasure.
AI has dramatically lowered the barrier between an idea and a working prototype. A prompt can produce code, automate a task or turn a rough concept into something tangible in minutes.
That speed is powerful. It can also be misleading.
When something is easy to start, it is tempting to believe the difficult part is over. But a promising experiment is not the same as a production-ready system, and activity is not the same as value.
As organizations move beyond early AI pilots, leaders have to ask harder questions: What problem are we solving? Where is the real constraint? What new work or risk are we creating? And how will we know whether the organization is actually improving?
In this conversation, John Willis brings lessons from decades of technology transformation to the current AI moment. His central message is refreshingly grounded: AI may change what is possible, but it does not erase what organizations have already learned about people, systems, risk and change.
Do Not Let the Glow Hide the Terrain
Willis describes the excitement surrounding a new technology as a kind of fluorescence. The glow is so bright that it can obscure the terrain beneath it.
We have seen versions of this before with cloud, agile and DevOps. Each introduced genuinely new capabilities, but each also encouraged organizations to treat familiar challenges as if they had disappeared. AI is following a similar pattern. Leaders can become so focused on what the technology can produce that they lose sight of how that output will operate within a larger system.
That is why one of the simplest points in the discussion may also be the most important: a prototype does not equal production.
Moving from one to the other still requires the less visible work of integration, review, security, governance, maintenance and measurement. AI can accelerate parts of that work. It does not make the system around it irrelevant.
AI Strategy Is Only as Strong as the Talent System Behind It
AI strategy does not operate in isolation. It lands within what Willis calls a “talent system”: the people, behaviors, incentives and organizational structures that determine whether the business can turn a strategy into results.
Within that system, people tend to respond differently. Some resist the change because they feel threatened by it. Others move ahead quickly and ask for permission later. A large group in the middle may believe in the potential of AI but lack clarity about what they are expected or permitted to do.
When leaders develop an AI strategy without understanding those different groups, the gap between strategy and execution grows. Teams may slow-roll adoption, create isolated automation or take risks the organization has not prepared to manage. The challenge is not simply whether an organization has the right talent. It is whether its overall talent system can produce the outcome the strategy is intended to create.
Token Use Is Not a Measure of Value
Willis uses the term “token maxing” to describe the pressure many organizations now feel to consume more AI simply because they can. After an initial period of caution, some companies have moved to the opposite extreme: teams are told to use AI everywhere, automate whatever they can and demonstrate momentum as quickly as possible.
The problem is that increased AI use does not necessarily mean increased business value.
If the starting point is “Where can we use AI?” almost any task can become a candidate. A stronger starting point is “Where is the value?” That shifts attention from adoption for its own sake to a specific outcome the organization needs to improve.
It also creates room for an answer that is easy to overlook amid the current excitement: not every problem needs AI.
Regulated Industries Are Balancing Pressure with Caution
For banks, fintechs and other regulated organizations, AI adoption comes with a particular tension. Leaders recognize that AI will become part of how their organizations operate, but they are also responsible for protecting sensitive data, meeting regulatory expectations and managing risk.
Willis compares the current moment to the early adoption of cloud technology. Some financial institutions moved quickly, while others waited for greater clarity from regulators before placing certain data or processes in the cloud. AI is following a similar pattern, but the external pressure may feel even greater. Organizations are being told that if they are not already using AI, they are falling behind.
The question, then, is not whether regulated industries will use AI. It is how they can adopt it in a way that creates value without losing sight of accountability.
That requires more than trying to move faster than competitors or treating governance as a final checkpoint. Willis argues for a systems approach in which technology, risk and internal audit work toward the same goal: improving the organization while protecting customers, their money and the institution’s brand.
AI Can Make Invisible Work Harder to See
Some of the most important work inside an organization rarely appears in a process map. It happens through handoffs, reviews, exceptions, rework and the experience people use to keep a process moving.
AI can accelerate one part of that process without improving the system as a whole. A team may produce more code, content or analysis, only to create a new bottleneck for the people responsible for reviewing, validating or putting that output into practice.
As Willis explains, automation does not always eliminate work. Sometimes it simply moves the work.
That is why leaders need to understand where work actually happens before deciding where AI can create value. If AI makes one step faster but adds more review, rework or burnout, organizations may be generating more activity without making meaningful progress.
AI Changes the Potential Blast Radius
Many governance models were designed around human decisions and relatively predictable automation. AI introduces a different risk profile. A system can draw on a vast range of knowledge, make inferences at machine speed and, when given sufficient authority, take actions a person may not have anticipated.
Willis shares an example in which an AI-assisted task selected an obscure but seemingly efficient technical option and produced the opposite of the intended result. The lesson is not that organizations should avoid AI. It is that traditional risk controls cannot simply be placed around AI as an afterthought.
Leaders need to consider the potential blast radius of an AI-enabled action before it occurs. What can the system access? What decisions can it make? What can it change or delete? Where is human review required? What evidence will show what happened?
Slow Down Long Enough to Understand the System
The pressure to produce a 30-, 60- or 90-day AI plan can make reflection feel like delay. Willis argues that thoughtful leaders need to resist that frenzy long enough to understand their organization.
An AI strategy does not operate in isolation. It lands in a talent system made up of people who may resist it, race ahead of it or want to participate but lack clear guidance. A strategy developed without understanding those behaviors is likely to create fragmented adoption and hidden risk.
One practical approach Willis recommends is an ideation hackathon. Unlike a traditional hackathon centered on coding, it gives business, operations, project and administrative teams space to define problems and shape potential solutions before technology teams begin building. The result is a more inclusive way to surface valuable use cases and a stronger blueprint for responsible implementation.
It reflects the broader lesson of the conversation: meaningful AI adoption does not begin with producing more. It begins with seeing the system more clearly.
Progress Comes from Thoughtful Adoption
The organizations that create durable value with AI may not be the ones moving fastest. They may be the ones willing to pause, identify the real constraint and build the organizational practices needed to move from experimentation to reliable execution.
AI makes it easier to start. The leadership challenge is recognizing everything that still has to happen after that first impressive result.
Listen to the full conversation with John Willis and Eve Turzillo for a deeper discussion of AI value, invisible work, governance, organizational culture and what leaders should examine before they scale.
Continue reading...