Trending Topics
Trending
Rex Young, CIO at Spinnaker Support: “You modernise when you’re ready, not when someone else’s sales cycle says so.”
Enterprise IT modernisation is often presented as an exercise in replacing ageing systems. But for organisations running established Oracle, SAP and VMware environments, the case for change is not always clear-cut. A platform may still be doing exactly what the business needs, even as vendor roadmaps, rising costs and changing support arrangements put pressure on the organisation to move. The challenge for CIOs is deciding where investment will make a genuine difference, rather than embarking on expensive migrations simply because a vendor says it is time.
For Rex Young, CIO of Spinnaker Support, that decision starts with understanding the business rather than drawing up a technology wish list. Having joined the company as its first CIO, Young has been listening to teams across delivery, sales and finance to identify where systems create friction, where processes can be simplified and which changes carry the greatest risk. His priorities are security first, followed by the systems that protect bookings and revenue, with cost and consolidation also in view.
AI is another part of that agenda, but Young is wary of treating automation as an end in itself. At Spinnaker, AI is being used to help engineers work through large volumes of diagnostic data, produce evidence-backed findings and identify security alerts that warrant attention. The aim is to give specialists faster answers without removing human judgement, particularly when unusual problems require the experience of a senior engineer.
That approach also shapes how the company manages AI-related risk. Young describes strict controls around agent identities and permissions, human approval for changes to systems, and a clear boundary between AI tools and customer intellectual property. His previous roles at LogRhythm and SambaSafety, where he led IT and security programmes and developed an AI security operations platform, have informed that cautious approach.
In this interview, Young discusses how Spinnaker is approaching technology modernisation, where AI can make a practical difference to enterprise support, and why organisations should distinguish between systems that genuinely need replacing and those that can continue delivering value with independent support.
You’ve joined Spinnaker at a time when it is expanding globally and seeing increased demand for independent support across Oracle, SAP and VMware. How do you assess which parts of the technology estate need modernising first, while ensuring the systems supporting customers remain stable and reliable?
The honest answer is that I started by listening, because the people here understood this business long before I showed up. Spinnaker continues to grow and as their first CIO, I spent most of my first couple of months asking people in delivery, sales and finance where their day goes sideways. Where are you copying the same thing from one system into another? Where are you stuck waiting on someone? Those conversations told me more than any system inventory would have.
What I heard shaped the order. Security comes first, because our customers trust us with systems that run their businesses. After that I look at what protects bookings and revenue, and then at cost and consolidation. The growth matters too. We support customers in more than 100 countries, and our IT team already runs follow-the-sun coverage across the Americas, South Africa and the Philippines, so anything we change has to work for someone starting their day in Manila, not just for us in Denver.
On stability, I try to be humble about what I don’t know. The tools our engineers use on live tickets get changed slowly, in small pieces, with the people who use them every day involved and a clear way back if something goes wrong. Behind the scenes, where people rekey the same data into several systems, we can afford to move faster. A lot of doing this well is saying not yet to good ideas so we can finish the ones we’ve started.
You’ve said AI should do more than automate tasks — it should strengthen security and give engineers faster answers rather than more noise. What does that look like in practice, and how do you measure whether AI is genuinely improving support outcomes rather than simply making existing processes faster?
I will say up front that most of the credit here belongs to our service delivery teams. They were well into AI adoption before I arrived, honestly further along than a lot of companies I’ve seen.
In practice it looks like this. Some problems come with a mountain of diagnostic output, and an engineer used to spend hours, sometimes days, working through it by hand. Now AI does the first read and produces a findings report covering what it thinks went wrong, the evidence for it, and what’s still missing so the engineer knows where to look next. The engineer still makes the call. They just don’t start from zero.
Security is the same idea. Most alerts are noise, and AI earns its place when it hands a person the few that deserve attention. I’ve seen that work at a previous company and we’re building toward it here.
Measurement is the part I’m still learning, and I don’t think anyone has it fully figured out. Hours saved is where everyone starts. We track it, but it’s an estimate and we say so, and faster isn’t the same as better. So, we compare like with like, tickets from the same period, practice and priority with and without AI, and we describe the result as “associated with” rather than “caused by.” We report it whether it flatters AI or not. The most encouraging signal so far didn’t come from a dashboard. Our support leaders told us fewer customers are disputing our root cause analysis, because the issue and the evidence are laid out clearly. That’s the kind of result I care about, because it’s one a customer actually feels.
Spinnaker is building on tools such as Navigator and Spinnaker Intelligence to speed up issue resolution. How can AI make use of decades of enterprise engineering experience and accumulated support knowledge without producing plausible but incorrect answers or overlooking unusual problems?
Our AI platform was built by our own team over the last couple of years, and I feel lucky to have inherited it. The thing I keep reminding myself is that the model is the easy part. The real value is in what our engineers know: decades of Oracle, SAP and VMware experience, a lot of it sitting in old tickets, runbooks and people’s heads. If that knowledge is stale or messy, the AI will be confidently wrong, and that’s worse than no answer at all.
A few habits help. An answer should come with its evidence, the way those findings reports put the conclusion and the supporting detail side by side, so an engineer can check the reasoning in a minute rather than take it on faith. When the AI isn’t sure, it should say so. And the AI reasons, but it doesn’t decide. The engineer does.
Unusual problems are where I’m most cautious. AI is good at recognizing things it has seen before, which is exactly why it can miss the one it hasn’t. Those cases need to reach a senior engineer quickly instead of being squeezed into a near match. Our most experienced people are the safety net there, and I don’t see AI replacing them. If anything, it should give them more time for exactly those problems.
One more boundary is that the knowledge we build on has to be ours. We don’t take in a customer’s source code or intellectual property, and nothing like that goes into our AI, however helpful it might look in the moment.
AI adoption can create new security risks, particularly when tools have access to sensitive customer data, internal systems or operational workflows. How do you establish the right boundaries for AI, and what controls are necessary to prevent an initiative intended to improve security from expanding the attack surface?
This is the question I spend the most time on. I’ve worn the CISO hat a few times, and I’ve seen how easy it is for a well-meant tool to quietly become the weakest point in the building.
So, every agent gets treated like a new hire: its own identity, access to what the job needs and nothing more, someone accountable for it, and a record of what it did. Our agents work with the permissions of the person using them, and anything that writes back to a system needs a human to confirm it. They can’t post a customer-facing comment on a ticket at all. That’s hard-coded. Our business data stays in its system of record. The AI can query it, but we don’t bulk copy it somewhere new that becomes one more thing to protect.
For anything exposed to the internet, the bar is independent penetration testing, a web application firewall, and agent activity flowing into central monitoring and alerting where someone is actually watching. Prompt injection is real, and if nobody is watching how an agent behaves, you won’t know it’s been turned until the damage is done. I set a rule early on that we don’t build AI for the public internet until the security underneath it is ready. We tie the whole thing to ISO 27001, because governance designed in from the start costs a fraction of governance bolted on later.
Many organizations are under pressure to modernise their enterprise systems, yet replacing established Oracle, SAP or VMware environments can be costly, disruptive, and difficult to justify. How should CIOs decide when to modernise, when to retain existing systems and when independent support can provide a more practical route forward?
I’d be careful about telling other CIOs what to do, since every estate is different. What I can offer is how I’d think about it.
I’d start by asking which problem I’m actually solving. Is the system letting the business down, or is the vendor’s roadmap? Those are different problems and they deserve different answers.
Plenty of Oracle, SAP and VMware estates are stable, do exactly what the business needs, and get replaced anyway because a vendor picked a date. I don’t think that alone is a good enough reason to spend millions and put a business through a major migration. Independent support buys time, and the money saved can fund work that actually changes how you compete. You modernise when you’re ready, not when someone else’s sales cycle says so.
There are good reasons to move, though. If the platform can’t support something the business needs to do, or it’s cut off from data you need, or the risk of running it has become hard to defend, then it’s time. Just do it deliberately.
My suggestion is to look at each system on its own. What does it do for us, what does it cost to run, what risk does it carry, and what would we really get for the money if we replaced it? Most of us end up with a mix, and that’s fine.
You’ve held senior IT and security roles at SambaSafety and LogRhythm, including responsibility for digital transformation and AI enablement. What lessons from those roles are you bringing to Spinnaker, and how do you intend to ensure that technology investments deliver measurable value to customers rather than remaining improvements behind the scenes?
The things I’m proudest of from both companies were team efforts, so I’ll try to tell them that way.
At LogRhythm, where I was CIO for about seven years, our team replaced the customer support platform in 90 days. Most of the company never noticed. Our customers did, because that was the system our support engineers worked their cases in every day. That taught me the most valuable IT work is often the kind only customers notice.
At SambaSafety I was CIO and CISO for four years. We built the security program from very little over about three years, and I built an AI security operations platform that cut investigation time by about 98 percent. That taught me AI is only as useful as the discipline around it. And before either of those, more than ten years at VeriSign running global enterprise IT operations across 15 countries taught me that trust at scale is mostly small, dull things done right every day.
I’ve also learned some things the hard way. Announcing ten initiatives and finishing six costs you more trust than it buys, so I’d rather make three promises and keep all three. And I believe the way we work matters more than the work we do.
On making investment visible, I ask one question before anything gets funded: what will a customer notice? Faster fixes, fewer escalations, better answers from our engineers, stronger protection for their systems. If the honest answer is that only IT will notice, it waits. I won’t always get that right, but it’s the test I hold myself to.
Additional reading
About The Author
