Free Live WebinarFree Webinar, Nov 4: How Can AI Help You Run Payroll Better?Wed, Nov 4 at 11:30 AM CTRegister Now
IT in Minutes
Issue 21 to 30 September 2026·25 items·about 15 minutes
Boston Scientific Unlikely to Meet Guidance After Cyber Incident. Tenable Counts 672 Vulnerabilities Fixed in Oracle's September Update. Gartner Forecast Puts 2026 AI Spending at $2.7 Trillion.
Boston Scientific now says it is unlikely to meet its sales growth and adjusted earnings per share guidance for the third quarter and full year, after a cybersecurity incident it identified in August.
Oracle's September update fixed 672 vulnerabilities, by Tenable's count. And Accenture says less than one dollar in five of enterprise token spend can be traced to a quantified financial outcome.
🔍
We track thousands of sources. You read one page. Every vendor release note, security advisory, analyst report, and CIO survey across the enterprise IT world, filtered to only what impacts your decisions. 15 minutes. No noise. Just what you need to know.
🔒
Security and resilience
3 items
01
Boston Scientific says it is unlikely to meet its 2026 sales growth and adjusted earnings guidance after the cybersecurity incident it identified in August
We covered the Boston Scientific cyber incident in August. In September the company told the SEC it is unlikely to meet the guidance it gave investors in July.
What changed
Boston Scientific identified the incident on August 25, 2026. Its filing says unauthorized activity on certain of its systems caused a network outage that hit manufacturing, order processing and shipping.
The company now says it is unlikely to meet its guidance for sales growth and adjusted earnings per share for the third quarter and full year 2026, which it set on July 29, 2026. The company's September filing says manufacturing has resumed across most of its facilities.
Why this matters for you
If your board still treats incidents like this as an IT cost line, this filing suggests such an incident can affect the forecast a company gives investors.
What you can do
Take this filing to your next risk committee and ask which numbers in this year's forecast would move first if your ERP and order systems went down for a week.
Watch out for
The filing gives no figure for the loss itself. Treat the guidance warning as the measure of scale until the company reports more.
SAP fixed a flaw scored 10.0, and Oracle's update included a WebLogic Server flaw scored 10.0
SAP fixed a flaw scored 10.0, and Oracle E-Business Suite took the largest share of Oracle's fixes.
What changed
SAP released 19 new security notes on its 8 September 2026 patch day. Onapsis reports that note 3747649 scores 10.0 on the CVSS severity scale and patches a memory corruption flaw in SAP Extended Passport. Counting updated notes as well as new ones, Onapsis reports twenty-two notes, including five HotNews notes and six High Priority notes.
Oracle's September update fixes 672 vulnerabilities across 17 product families, according to Tenable's count. E-Business Suite took the most patches, 159 of them.
Oracle's own advisory rates one flaw in Oracle Applications Framework, part of E-Business Suite, at 9.8 and lists it as exploitable over the network without a login. The same advisory gives a WebLogic Server flaw a base score of 10.0. Since May 2026 Oracle has issued these monthly updates between its larger quarterly ones.
CISA's catalog of known exploited vulnerabilities added Citrix NetScaler on 27 September. CISA added F5 BIG-IP APM to the catalog on 22 September. A Cisco Firewall Management Center flaw was also added to the catalog in September.
Why this matters for you
If Oracle software runs in your estate, Oracle's monthly cadence may mean a patch window each month from now on.
What you can do
Ask your SAP and Oracle teams for the date each of these fixes went in, or the date it is planned. Check your network edge devices against CISA's list at the same meeting.
Watch out for
SAP and Onapsis count the notes differently, so plan your patching by the severity of each note.
SAP and Oracle both shipped severe fixes in September
September patch releases, the headline numbers
SAP's figure counts new notes only. Each score is the published CVSS severity rating.
Microsoft followed its record September update with an out-of-band update for Windows 11, and Salesforce logged a core-service incident lasting over seven hours
Microsoft's record September update introduced several new problems, and Microsoft followed it with an out-of-band update, The Register reports. Salesforce reported severe delays and intermittent errors on some of its services in affected environments.
What changed
Microsoft fixed a record 974 vulnerabilities in its September 2026 Patch Tuesday release, Infosecurity Magazine reports.
The Register reports that the out-of-band update covers Windows 11 24H2 and 25H2. The problems hit Remote Desktop Services, USB Audio Class 1.0 devices and host folders shared with certain Hyper-V-based Linux virtual machines via Plan9.
Microsoft also rolled back a configuration change that stopped some users loading SharePoint Online sites, The Register reports.
Salesforce's own status page records the incident on its core service on 16 September as lasting 7 hours and 36 minutes, on the instances it lists. Salesforce says it will investigate the technical trigger and the underlying cause.
Why this matters for you
If your critical systems take monthly vendor patches, Microsoft's September problems suggest a vendor patch may need planning as a business risk.
What you can do
Ask for the change calendar for your three biggest SaaS and platform vendors next to your own release calendar. Wherever a vendor change lands in your month-end close or a peak trading week, agree now who decides whether to hold it.
Gartner's forecast puts 2026 AI spending at $2.7 trillion, and BCG finds most company AI spend sits outside the IT budget
Gartner's forecast puts worldwide AI spending at $2.7 trillion in 2026, and BCG finds 80% of corporate AI spending now sits outside the IT budget.
What changed
Gartner's forecast puts worldwide AI spending at $2.7 trillion in 2026, a 49.5% increase on the year. Gartner's forecast table puts spending on AI agents and assistants at $16,481 million in 2025, $29,219 million in 2026 and $65,472 million in 2027.
BCG finds corporate AI spending has doubled in a year to 3.3% of revenue, with 80% of it outside the IT budget. Gartner says enterprises are using the simpler AI features built into software from their existing vendors to improve efficiency and automate workflows.
Why this matters for you
If your company looks like BCG's figures, most of its AI spending may sit outside the IT budget.
What you can do
Ask finance for one list of every AI line item across the business, including features added to existing contracts.
Watch out for
Gartner's figures are a forecast. Check BCG's revenue share against your own before you quote it.
Spending on AI agents and assistants more than doubles in Gartner's 2027 forecast
Worldwide spending on AI agents and assistants, Gartner forecast, millions of US dollars
This is one segment of Gartner's $2.7 trillion total for 2026. Gartner's figures are a forecast.
KPMG found only 12 percent consistently assess AI value against cost across the organization
Accenture says less than one dollar in five of enterprise token spend can be traced to a quantified financial outcome.
What changed
A Gartner survey found only 22% of organizations have successfully scaled AI across multiple business units or adopted an AI-first approach. Roughly 11% did not know what their function spent on AI in 2025. Gartner surveyed 1,303 respondents at organizations with enterprisewide annual revenue of at least $50 million in fiscal year 2025, between January and April 2026.
KPMG's AI Pulse survey found only 12 percent consistently assess AI value against cost across the organization.
Why this matters for you
If your CFO asks what the AI budget returned, Accenture's finding suggests most token spend may have no measured answer.
What you can do
Pick your three largest AI initiatives and set one number for each that finance already tracks, such as cost per transaction or hours saved and redeployed. Report those numbers every quarter, starting this one.
Three studies each found a small share passing their test of AI scale or value
Share meeting each study's own test, out of 100%
The three studies measure different things, so compare them side by side. Accenture's bar marks its upper bound of one in five.
Google Cloud will help train up to 1,000 Accenture forward-deployed engineers to work on site with clients, and Gartner predicts 70% of enterprises will abandon agents built that way by 2028
Two September stories pull in opposite directions. Read them together before your next vendor proposal lands.
What changed
The Wall Street Journal reported that Google Cloud will help train up to 1,000 Accenture forward-deployed engineers, who will work with clients on site to plan and build AI applications.
Gartner predicts that by 2028, 70% of enterprises will abandon agentic AI built through vendor forward-deployed engineering, trapped by soaring costs and unable to develop it further on their own. Gartner also predicts that through 2028, less than 20% of these engagements will turn recurring customer needs into capabilities in the vendor's core product.
Why this matters for you
If a vendor offers to build your agents through forward-deployed engineers, Gartner's warning suggests you may face rising costs and need the vendor to develop them further.
What you can do
Write the exit into the contract before you sign. Gartner advises setting contract requirements that include deliverables, knowledge transfer, intellectual property rights and transition or exit responsibilities.
Watch out for
Gartner's 70% is a forecast for 2028. Use it as a warning in contract talks. The WSJ story describes a plan, and the results are still to come.
Nearly half of EY's survey respondents say urgent AI deployments skipped their own governance, and CISA listed a LiteLLM authentication flaw
A Gartner survey of 297 security leaders found fifty-four percent have no defined way to limit what AI agents can access, or rely on human access settings.
What changed
In EY's survey, 47% of respondents said their organization had skipped its own AI governance process for urgent deployments, though 98% have formal policies.
Gartner predicts that by 2028, ungoverned AI agent abuse will drive 25% of enterprise breaches.
CISA added an improper authentication flaw in BerriAI's LiteLLM to its catalog of known exploited vulnerabilities in September. The LiteLLM flaw sits in its MCP endpoint and could let an unauthenticated attacker open an authenticated session.
Why this matters for you
If your teams fast-track AI for urgent work, the EY respondents suggest your written policy may not be what governs them.
What you can do
Ask your security lead for a list of every AI agent with access to a production system, and what each one is allowed to do. If that list takes more than a week to build, that delay is your first finding.
The Register reports heavier Copilot agent work will need usage-based billing on top of the per-user licence
Microsoft introduced a new Copilot in September. Microsoft says it is evolving Copilot pricing as AI capabilities and the ways people use them change.
What changed
The per-user licence covers Copilot in Chat and across Word, Excel, PowerPoint, Outlook and Teams. The Register reports that Copilot customers who want heavier agent work will also need usage-based billing, charged on top of the user subscription.
Why this matters for you
If your Copilot budget is a seat count, the agent work your teams are starting to pilot may now arrive as a variable bill.
What you can do
Before your next Microsoft renewal, ask your account team for a written estimate of usage charges for the agent pilots you already run. Set a monthly cap and an alert before anyone turns on the heavier features.
Gartner figures show memory and some server prices up sharply, with enterprise network equipment projected to cost over 20% more in 2026
Gartner figures cited by CIO.com put memory price rises at 50% to 200%, PC prices up 35% to 45% and some server prices up over 125%.
Gartner says enterprise network equipment is projected to cost over 20% more in 2026. Memory maker Micron reported quarterly revenue of $54.23 billion, against $11.32 billion a year earlier.
If your hardware refresh sits in next year's budget at this year's prices, reprice it before the budget is locked.
Memory leads the hardware price rises
Price increases cited by CIO.com from Gartner
Solid bars are stated ranges. A dot with a dashed line means the source says only "over" that figure.
Reuters reports the European Commission is asking third parties about Oracle's licensing after SAP's settlement
Reuters reported that the European Commission is seeking information from third parties about Oracle's licensing practices, citing a person familiar with the matter.
A Commission spokesperson said there is no formal investigation into any company at this stage.
The questions follow SAP's settlement, in which the Commission accepted SAP's commitments to abolish reinstatement fees and reduce back-maintenance fees.
If an Oracle renewal is coming up, keep a written record of any reinstatement or back-support charges you are quoted.
Gartner predicts 55 percent of enterprises will start proofs of concept for VMware alternatives by 2029
Gartner predicts that by 2029, 55 percent of enterprises will start proofs of concept for alternatives to their VMware deployments, up from 25 percent this year, The Register reports.
If your VMware renewal is due in the next year, go into it with a priced alternative on the table.
Oracle's cloud infrastructure revenue rose 121% in its first quarter, against 10% for its cloud applications
Oracle's cloud infrastructure revenue rose 121% to $7.4 billion in its first quarter. Cloud applications revenue grew 10% to $4.2 billion.
Remaining performance obligations rose $209 billion over the year to $664 billion. Verdict reports free cash flow of negative $5bn for the quarter as Oracle kept investing in cloud infrastructure.
If you run Oracle applications, ask your account team where application investment sits next to that infrastructure build.
EU cyber reporting rules for product makers took effect on 11 September
Since 11 September 2026, manufacturers have had to report actively exploited vulnerabilities and severe incidents in products with digital elements.
What changed
Under the Cyber Resilience Act, for an actively exploited vulnerability or a severe incident that affects the security of their product, manufacturers must send an early warning within 24 hours of becoming aware, and a full notification within 72 hours.
A final report follows within 14 days of a fix being available for an actively exploited vulnerability, or within a month of the 72-hour notice for a severe incident. ENISA, the EU Agency for Cybersecurity, operates the online platform manufacturers use to meet these reporting obligations.
Why this matters for you
If your company makes products with digital elements, these reporting duties may start with your IT and security teams, so they need to know who files.
What you can do
Name the person who can file an early warning on a Saturday night, and test the route with a dry run this quarter.
The reporting clock under the EU Cyber Resilience Act
Deadlines for reporting an actively exploited vulnerability
For a severe incident the final report is due within a month of the 72-hour notification. Steps are not drawn to scale.
Spain's competition authority estimates only about 2 per cent of business customers have switched main cloud provider, and Gartner predicts sovereignty rules will raise costs for some multinationals by 2028
Spain's competition authority found that in some cloud segments Amazon and Microsoft together hold 60 to 70 per cent of the market. The authority estimates only about 2 per cent of business customers have switched main provider. It flagged discounts and data exit fees as practices that can entrench the largest providers.
Forrester predicts more than half of European companies adopting AI will reduce their dependence on the big US cloud providers, often called hyperscalers. Gartner predicts that by 2028, 30% of multinationals will have to restructure their AI setup for national sovereignty rules, raising operating costs by 20%.
If you operate in Europe, price the exit fees in your current cloud contract now, while you are not under pressure to move.
Zeiss drops its greenfield S/4HANA plan and is seeking to move its existing landscape to the new platform
Zeiss has dropped its greenfield S/4HANA plan after years of struggle, The Register reports.
What changed
The Register reports that Zeiss has dropped its plan for a greenfield S/4HANA migration. The company said it is seeking to move its existing landscape to the new platform, a route known as brownfield.
A Zeiss spokesperson told The Register the ERP migration had been realigned to achieve faster progress and better meet the needs of its segments. Zeiss's CIO has said the board recognised the scale of the challenge in moving off R/3 back in 2020. Mainstream support for ECC is set to end in 2027, The Register notes.
Why this matters for you
If you chose a greenfield rebuild, the Zeiss decision is a reason to check that the case for it still holds at your current pace.
What you can do
Ask your programme lead for an honest comparison of both routes from where you stand today, with the sunk cost left out of the sum.
Deloitte found fifty-four percent of finance leaders lead enterprise AI and technology capital allocation decisions
Deloitte found fifty-four percent of finance leaders are leading enterprise AI and technology capital allocation decisions, and 48% oversee AI and technology spending and cost controls.
IBM's study of 1,500 CFOs found 62% of respondents say their role has expanded into enterprise technology or AI strategy leadership, and 56% report greater portfolio-management and capital reallocation authority.
If your CFO is now in the room for technology decisions, bring the business case in the CFO's terms before you bring the architecture.
Directors in PwC's survey report significant gaps in the information they need to oversee AI
In PwC's directors survey, 82% rated the information linking AI outcomes, risks and business performance as fair, poor or not provided.
In a Deloitte and Center for Audit Quality survey on audit committee priorities, seventy-five percent of respondents named AI governance a top three priority, up from 35% last year.
If you report to the board on AI, one page that ties each initiative to its cost and its risk would answer what directors say is missing.
Gartner predicts 30% of staff laid off because AI replaced them will need rehiring by 2029, often at higher cost
Gartner predicts that by 2029, 30% of employees laid off because AI replaced them will need to be rehired, often at a significantly higher cost.
It also predicts that by 2027, 75% of organizations that prioritize capturing AI productivity gains as cost savings will be eclipsed by competitors that aggressively reinvest those gains into innovation, modernization and upskilling.
If you are asked for headcount savings from AI, put the cost of rebuilding that knowledge into the same business case.
Gartner predicts 60% of organizations that fail to address data governance culture will fail to govern AI successfully by 2027
Gartner predicts that by 2027, 60% of organizations that ignore the culture side of data governance will fail to govern AI successfully. Its survey of 223 data leaders found cultural resistance outweighs funding as the main reason governance fails, 60% against 40%.
If you are funding AI governance, put some of it into how your people handle data.
The EU Data Act's access-by-design duty covers connected products newly placed on the market from 12 September
Heuking notes that the Data Act set a further cut-off date of 12 September 2026, a year after most of the law began to apply. Heuking says that from that date the access-by-design duty applies to connected products and related services newly placed on the market.
If you launch connected products in the EU, check each new launch against that duty.
The EU's revised sustainability reporting standards were adopted and published in the Official Journal
The EU's revised sustainability reporting standards were adopted and published in the Official Journal, EFRAG reports. The new standards are set to become mandatory from financial year 2027, and companies may use them voluntarily for 2026.
If you report under these rules, check which of your systems holds each data point the new standards ask for.
California's governor signed SB 947 on automated decision systems in employment
California's governor signed SB 947, on automated decision systems in employment. The governor's office also lists a requirement for employers to say if a mass layoff, relocation or termination is caused by an AI system.
If you run HR systems for California staff, check what your automated workflows decide on their own.
Oracle released 25 agent applications it says have built-in governance and security controls, and SAP plans to bring its AI platform together with the OpenShell agent runtime
Oracle made 25 Claw-powered Fusion agentic applications available, which it says have built-in governance and security controls. SAP and NVIDIA have plans to bring SAP Business AI Platform together with OpenShell, an open-source secure runtime for autonomous AI agents.
SAP's Joule Studio runtime is free for SAP customers and partners through October 2026. Salesforce's AIforce lets outside agents act on data and workflows inside Salesforce.
If you run any of the three, ask your vendor which agent controls are switched on by default.
Deloitte found only 14% of executives hit or beat their 2025 programme savings targets
Deloitte's survey found only 14% of executives achieved or exceeded their programme savings targets in 2025. Even so, 67% of executives expect to meet or exceed their overall transformation targets this year.
Before you promise savings this year, check how last year's programme actually landed.
Microsoft's Project Online was due to retire on 30 September
Project Online was due to retire on 30 September, The Register reported. Microsoft was also due to remove Publisher from Microsoft 365 subscriptions on 1 October 2026.
If any team still ran plans in it, confirm those plans now sit in Planner or another supported tool.
TurboCore AI agents understand every change, predict every risk, show exactly what to test, and connect everything from requirements to fix, delivering risk-free go-lives.