In an exclusive Q&A with VMblog, Chase Doelling, principal strategist at cloud directory platform provider JumpCloud, offers valuable insights into the evolving landscape of IT management for small and medium-sized enterprises (SMEs).

Drawing from JumpCloud's latest SME IT Trends report, Doelling discusses the measured approach companies are taking towards AI adoption, the persistent challenges of shadow IT, and the ongoing priority of security in an increasingly complex device ecosystem. As organizations grapple with budget constraints and the need for expertise across multiple platforms, Doelling shares his perspectives on emerging technologies and strategies that can help IT teams navigate these challenges effectively.

From passwordless authentication to centralized IT operations, this interview explores the key trends and solutions shaping the future of IT management for SMEs. 

VMblog:  Beyond security concerns, what are some of the biggest challenges SMEs face when adopting AI solutions? (e.g., lack of expertise, budget constraints)

Chase Doelling:  JumpCloud's SME IT Trends report suggests SMEs are being incredibly deliberate about how they're approaching AI. They're taking a measured approach even though they're still wary of its impact on security. Only 10% of SMEs have absolutely no plans to implement AI, and those planning to implement AI initiatives within the next six months increased to 35% from 27% just six months ago. A whopping 82% say their organizations should be investing in AI. The interest and the vision are there, no question, but as is always the case with SMEs, budget constraints are probably the biggest challenge. There's also the question of how to integrate AI into existing, complex tech stacks and how to balance AI adoption with all of the other IT priorities that smaller IT teams have to manage. 

VMblog:  Beyond traditional security solutions, what emerging technologies can help IT teams address the growing security landscape? (e.g., zero-trust security models)?  

Doelling:  Using AI to enhance security operations through automation in areas like threat detection is pretty promising and doesn't require deep expertise. Passwordless authentication is another huge area of opportunity. We found that 95% of respondents still use passwords for at least some IT resources. Emerging passwordless technologies like biometrics, hardware tokens, or cryptographic keys can help SMEs adopt zero trust models while reducing the burden for admins and employees. 

VMblog:  What are the biggest risks around shadow IT and what's sparking the rising concerns around it? 

Doelling:  As more productivity applications become available, from software packages to browser extensions, it's no longer a budgetary concern but a security concern. Each of these open up new and unknown threat vectors to the organizations as attacks become more sophisticated at different points in the supply chain. Business users are simply moving too fast for IT to keep up, and this is making IT and their security counterparts increasingly worried. 

VMblog:  How can/should IT teams respond to shadow IT and what are some of the pitfalls they should avoid in approaching it? 

Doelling: Visibility is essential. It's an impossible task to try to reduce the attack surface when you don't have a clear idea of what applications employees are using. IT teams should deploy tools to spot rogue apps to better centralize their IT operations and enforce security and access controls. Improving communication with business partners is also vital to ensure best practices are implemented securely across the software supply chain. JumpCloud's survey results reveal that IT admins are aware of the dangers of shadow IT and their need to address it, but awareness isn't enough. Pitfalls include failing to make shadow IT a priority; failing to balance security needs with user requirements; underestimating shadow IT usage; and implementing overly restrictive policies that drive users to find more workarounds. 

VMblog:  Your recent research seems to suggest that organizations currently support a pretty broad mix of devices and that's going to continue. What does that mean for the IT admins who have to support all of those devices? 

Doelling:  Flexibility around devices is simply the reality for SMEs moving forward. IT teams need to establish (and maintain) consistent security policies in order to stay vigilant against increased security risks. This is forcing IT admins to either develop expertise across multiple operating systems or find solutions that can manage diverse device environments. 

VMblog:  How are IT teams at SMEs approaching AI and what do you expect to see over the next year? 

Doelling:  It's a mixed bag. When asked how their general opinion changed over the last six months about how AI will impact their day-to-day job, 22% of admins say the impact is much lower than they thought it would be; 34% say the potential impact of AI is the same but it is moving slower than they thought it would; and 23% say they feel the impact of AI is even greater than they thought it would be. There are concerns about AI outpacing security capabilities, which I expect will continue. Over the next year, I think we'll see more efforts to balance AI adoption with security concerns, more training initiatives, and greater experimentation with AI across various IT areas.

VMblog:  Security continues to be the #1 concern for IT teams, taking the top spot in nearly every edition of the JumpCloud survey since 2021 - what are the biggest developments you expect to see and how can IT teams get a handle on them?

Doelling:  Given that 84% of admins are worried about shadow IT, I suspect that will be a priority for many. I also think we'll see some advances around strategies to protect against network attacks and software vulnerability exploits, an emphasis on ransomware protection given the uptick in attacks. 

The best way to get a handle on all of the security threats is to make it as easy as possible to manage and protect against them. Centralizing IT operations allows teams to eliminate a lot of the holes created by point solutions while gaining more control over users' identities and access. With a more aggressive push towards passwordless authentication, I think we're finally at the point where security and user experience can be balanced without sacrificing either.

##