Aparna Valsala

During a recent interview with the BBC, Microsoft AI chief Mustafa Suleyman criticised competitors and warned that unchecked artificial intelligence could create a new "silicon species" that rivals humans. It caused a stir in the media during a week when other AI leaders were also starting to call for regulation. I think it's important to remain clear on what the threat actually is and where it really lies. The calls for regulation are mainly around the practice of Recursive Self-Improvement (RSI). RSI is concerning because we've seen many examples of AI models exhibiting surreptitious and secretive behaviour. It's highly probable this same behaviour would emerge during a self-improvement routine, leading to significant and unintended consequences. As for silicon lifeforms... let's be clear that AI is still running on hardware originally designed for rendering video games. To put that in perspective, this is hardware that has a clock and runs on a cycle just like any other computer. Efforts towards neuromorphic computing, which mirrors the behaviour of a human brain, are underway and important for the future. However, to imagine that Claude is going to wake up one day, simply invent a manufacturing process for neuromorphic chips, and start an assembly line of AI-powered life is a long way from reality. Why am I writing this? I'm sure Suleyman didn't intend his comments about a silicon species to be taken literally and stoke such fears, but the story will have undoubtedly done so. Meanwhile, we are missing the basics. Reports from both OpenAI and Anthropic over recent months suggest there are significant and quite basic gaps in security at the facilities testing their latest and greatest models. We need to get better at detecting and training out surreptitious behaviour before we look to scale up what AI can achieve for itself. Perhaps, alongside regulations on RSI, we should be requiring that effective cybersecurity practices be put in place and audited on an ongoing basis.

Most of the advice about shipping early and learning fast gets aimed at product teams. I think it applies just as much to platform teams too. We spent a long time designing a new CI/CD flow. Mapping out the edge cases, getting the foundations right and trying to make it bulletproof before we put it in front of engineers. The foundations were worth it, but trying to make it bulletproof probably wasn’t. At some point, you stop reducing risk and just delay finding out what you got wrong and what you can fine-tune. So we took the leap, switched it on and learnt a tonne. The important bit was knowing we could put it back. Every change had an off-switch, so if we got something wrong, we could undo it quickly. Worst case was a painful afternoon, not an engineering team that couldn’t ship. And our internal stakeholders are our customers, and some very passionate ones at that! Engineers have been using the new flow every day and telling us what is slow, noisy or just getting in their way. We can adjust the flow, change the tech and watch the metrics in real time. We learnt more from a few days of people actually using it than we would have from another few weeks in a design doc. It’s still not perfect. There’s plenty more to improve. But we’d be miles behind where we are now if we’d carried on polishing instead of shipping. FIAFO, as it’s been described internally 👀. I’d probably add “safely” in brackets. Safely means a blast radius you can live with, telemetry that tells you quickly when you’ve got something wrong, and a rollback you’ve tested rather than one you assume works. I am the quality, stability and security guy after all 🤓. Taking the leap and being careful aren’t opposites. Done well, moving fast can be a stability strategy. Small changes, real feedback and easy rollback beat a big-bang change that nobody gets to tell you is wrong until it lands. We’ll soon be going faster than ever ⚡️

We had something break this morning. From it being raised to working again took 20 minutes. The fix took four. Restart a service. That was it. The interesting bit is the other 16 minutes, because that's where the time normally goes. Not fixing the problem, but working out what to fix. And this one wasn't obvious. An infrastructure change in a different part of the stack exposed a defect nobody knew was there. The symptom was in one place, the cause somewhere else entirely. We’re currently trialling incident.io "Investigations", and this was a good example of where it could help. It kicked off automatically when the issue was raised and, by the time everyone was in the channel, there was already a hypothesis with the reasoning and evidence behind it. Instead of starting from scratch, the team had something to prove or disprove. The other important bit is that Investigations only had something useful to work with because of the groundwork underneath it. We've spent years of consolidating our monitoring, improving tracing and logging, and making infrastructure changes visible in a way it can understand. It's early in the trial, but that's probably the biggest takeaway for me so far. It's good at spotting patterns across far more information than any of us can digest at once. But it can only do that with what we've wired up for it. The agent is a genuine upgrade. The wiring is what makes it one. Big shout out to Tim Nicholls, Damon Marlow, Liam Fitzpatrick, Aparna Valsala, Patrick Bontoft and Michael B. for getting it resolved so quickly.

A week of AI wins across Live Service at Thrive The productivity gains are obvious, but what's been even more interesting for me is how AI is helping us improve quality, platform stability and security. Some highlights from the past week: 🐰 CodeRabbit review rules, trained on our own data. We had AI analyse every issue raised this year, identify recurring patterns, and turn them into custom CodeRabbit rules. Since going live last week they've already caught more than 40 issues before they reached manual PR review.   🚨 Smarter issue detection in SRE (great work, Aparna Valsala). We now detect when a new error group appears after a deployment, automatically alerting and triaging it using MCP across GitHub, Amazon Web Services (AWS) and New Relic to help get to the root cause much faster. 📮 Matthew Cannings' dead letter queue tracker is now live, automatically surfacing the worst offending DLQs and has already helped resolve several long-standing issues. 🩺 Damon Marlows "task killed" diagnostic is another brilliant example. Give it a service name and task ID and it'll explain exactly why the task crashed, saving a lot of manual investigation. ⚙️ Patrick Bontoft shared some of the heavy lifting AI took off his plate in QA last week: https://lnkd.in/ea5WCXnw 🔍 Technical reviews at a completely different scale (thanks for the push, Frankie Woodhead). We've used AI to carry out deep reviews across front-end caching, our new payment feature and entire codebases, work that would previously have taken specialists many hours. 🔐 Security and compliance has seen plenty of progress too: Syed Zarak Hassan has been driving device-management improvements using Irus MCP, keeping endpoints secure and policy-compliant by default, reducing manual effort. Vanta MCP (also Syed Zarak Hassan) is helping automate evidence collection and continuous control monitoring, making audit preparation much less manual. AI-assisted risk assessments (Alex Callighan) - AI gathers the supporting evidence from across our business context, so assessments are faster and better-grounded and the team can focus on the judgement calls. A real accelerator for customer security reviews, DPAs and RFPs. Cakewalk is helping streamline access and administration requests, getting people the right permissions more quickly while maintaining least privilege. Wiz (currently being evaluated by Liam Fitzpatrick) is using AI to surface and prioritise the cloud security risks that genuinely matter, rather than overwhelming teams with raw findings. One thing that's been important throughout: none of this is AI on autopilot. Every workflow has a person reviewing the output and making the final decision. AI is accelerating the work, not replacing the expertise. It's been great to see the level of adoption across the team. Just as importantly, we've built a culture around it, from Claude Code mornings and AI days to guilds where people share what they're learning.

Half the year gone, so here's a quick check-in on what the GRC team's been up to at Thrive. We picked up ISO 9001 certification with zero non-conformities, and came through another ISO 27001 audit clean. We'll take it. We also partnered with Iru for device management, and it's already outdone what we hoped for. A smoother experience for our people from day one, much better visibility and insight across the estate, a lot more control over the fleet, and for the first time, 100% of devices on the latest OS and compliant with our policies. On top of that, it's keeping a constant eye on our devices for malware and unusual behaviour, stepping in to block anything suspicious before it becomes a problem. Vulnerability management has come a long way too. Wider scope, new tooling, and stronger coverage than we've ever had, with plenty more still to land before the year's out. Watch this space. There's plenty else in the pipeline as well. SOC 2 Type 2 later this year, plus a few other bits the team's cooking up. Thrive's flying, and we're making sure security keeps pace every step of the way.

It was a very tough day yesterday at Elastic Company has announced 7% of layoffs and it was hard not only for those who were impacted, but also for those who stayed and couldn't help but see their friends and coworkers dissappearing in real time - deactivated slack accounts for people you have just talked to, people getting notifications during their standups. Fear and uncertainties everywhere - will I be next? Am I impacted? As a member of German works council I knew about it beforehand and it was for me very hard to know that changes are coming and not be able to prepare the people around or even to say a word about it. And I'm wondering what is actually worse for those who stayed - to know nothing and just get the news on the day it's announced or to know things and be in stress for prolonged time with your hands tied. I worked closely with many of those affected. And I have mixed and sad feelings right now, we have lost so many great people. If you were impacted and are looking for your next opportunity, feel free to reach out, I’m happy to connect, refer, or just be there for you.

Thrive Learning grew fast and brought on some of the world's largest enterprises, but their on-call and alerting weren't keeping up. Leigh Darlow, Head of Platform Engineering: "It was very manual. It wasn't really embedded into our ways of working. It was very dependent on one person." They ran a POC, compared the costs, and moved off PagerDuty. 🔥 Watch how it went 👀

Thrive Learning grew fast and brought on some of the world's largest enterprises, but their on-call and alerting weren't keeping up. Leigh Darlow, Head of Platform Engineering: "It was very manual. It wasn't really embedded into our ways of working. It was very dependent on one person." They ran a POC, compared the costs, and moved off PagerDuty. 🔥 Watch how it went 👀

"She's going off to have a baby. You won't see her again." I still hear that line... I was Head of People at a scaling business and a new mum was returning to work. She'd made requests for flexible working - reasonable ones. Her manager said no. To everything. I tried to navigate it. Had the conversations. Pushed back hard. Tried to understand why this person was being, frankly, pretty mean about the whole thing. At one point we were unprofessionally screaming at each other. The business declined everything she'd asked for. I challenged it every step of the way. I was a very unhappy individual. A settlement agreement followed. Then a few weeks later, I was made redundant. The scapegoat. I knew it at the time. (A work-related shit show, if ever there was one.) 💩 But I hold my head high. I stood strong. I tried to do the right thing. And it's the reason I've been a fierce ally to new mums ever since. Because there still is a stigma. Someone leaves to have a baby and suddenly they're being disregarded. It still happens. More than people admit. One of the things I'm most proud of is embedding proper maternity leave policies with my clients. Six months full pay at a startup or scaleup. It strengthens trust. It strengthens psychological safety. And it sends a very clear message about the kind of business you're building. New mums aren't a liability. They're some of the most focused, determined, capable people I've ever worked with. Treat them like it.