7 MIN READ
The press cycle in tech moves fast, and the distance between a headline trend and a real trend is usually about a year and a half. What the trade press spends the first quarter of the year talking about is, more often than not, the trend enterprises will be actually implementing in the third quarter of the following year. Seven trends look like they are going to matter in 2026, in roughly the order the platform org will have to deal with them. Some sit on top of the hype cycle. Some have been under the radar. All of them are going to cost someone a budget.
1. Agentic coding tools go from demo to production
The agentic coding tools that the demo videos have been showing off in 2024 and 2025 (Claude Code, Cursor’s background agent, the various open source equivalents) are about to land in real engineering organisations with real code bases and real production constraints. Early results from the orgs that have shipped with these tools are mixed: speed wins on the well bounded tasks (boilerplate, tests, the simple refactor), and a long tail of failures on the unbounded ones (anything that requires understanding the system as a whole, anything that touches the security sensitive parts of the codebase, anything the reviewer is not already in a position to evaluate).
The implication for 2026 is not whether to use these tools; it is how to build the review and the guardrails that make them safe to use in production. Engineering leads who get this right treat the agent as a junior engineer, not as a senior one. Those who get it wrong let the agent merge its own pull requests.
2. Post quantum cryptography becomes a real engineering project
NIST published the first three post quantum standards (ML-KEM, ML-DSA, SLH-DSA) in 2024, and the migration clock is now ticking for orgs that handle long lived secrets. The financial services firms, the government contractors, the healthcare systems, the certificate authorities: all of them hold data that needs to stay confidential for the next ten to twenty years, and the “harvest now, decrypt later” threat is no longer theoretical.
The migration amounts to a multi year programme of inventory (what cryptography do we actually use, and where), pilot (which algorithms work in our stack), staged rollout (the certificate authorities, the TLS terminations, the code signing pipelines), and the long tail of legacy systems that cannot be replaced. The orgs that start in 2026 will be done in 2029. The ones that wait will sit in the same place in 2029 that they sat in 2026.
3. The regulatory environment becomes the primary constraint on AI deployment
The EU AI Act is in force. The state level AI laws in California, Colorado, and New York are starting to bite. The sector specific regulators (the FDA for medical AI, the financial regulators for lending and insurance AI, the education regulators for AI in the classroom) are issuing guidance at a pace that legal teams are struggling to keep up with. The result: the bottleneck on AI deployment in 2026 sits with legal and compliance review, not engineering capacity.
AppSec and platform orgs that are getting ahead of this have built the model card, the data lineage, the bias testing, and the human review process into the development workflow. Those still treating the regulatory work as something that happens at the end of the project, after the model has been built, are the ones that are getting behind.
4. Cloud cost optimisation becomes a first class discipline
Cloud cost has been growing faster than cloud revenue for the last three years, and the gap is finally getting the executive attention it deserves. The FinOps movement, which started as a niche community in 2019, has become a board level conversation in any enterprise with a meaningful cloud bill. The new piece in 2026 sits with the AI workload cost: the GPU instances, the inference endpoints, the vector databases, the data egress for the training pipelines. AI workloads are the first workloads in cloud history that carry a bill large enough to be a line item in the financial statements, and the finance teams are asking platform orgs to account for the cost the way they account for the rest of the budget.
The orgs that do this well have built the cost attribution into the platform, so every engineer can see what they are spending in near real time. The ones doing it poorly are still running cost optimisation as a quarterly exercise, after the bill has already been paid.
5. Open source sustainability hits a wall
The xkcd cartoon about the digital infrastructure that depends on the unpaid maintainer is, in 2026, no longer a joke. The funding crisis in the open source supply chain has been building for a decade, and the crisis is now acute. The maintainers of the critical packages (the ones that show up in every dependency tree) are burning out, the companies that depend on the packages are not contributing, and the foundations that are supposed to bridge the gap are running on fumes.
There are real efforts trying to fix this (the OpenSSF’s Alpha Omega project, the Linux Foundation’s Tidelift subscription, the corporate open source funds at Microsoft, Google, and Amazon). The efforts are not yet at the scale of the problem, and the gap is going to widen before it narrows. Engineering orgs that depend on the open source supply chain need to plan for the day a critical maintainer walks away.
6. The post EDR security stack takes shape
The endpoint detection and response category has matured to the point where the question is no longer whether to buy an EDR but which one, and the interesting action has moved up the stack. Cloud detection and response (CDR), identity threat detection and response (ITDR), SaaS security posture management (SSPM), and the various flavours of XDR are the categories where the consolidation is happening now. The vendor landscape is going to look very different in 2027 than it did in 2025, and the buyers in this cycle are the ones who will be living with the consequences.
The buying heuristic for 2026 is straightforward: buy the platform that integrates with the rest of your stack, not the point product with the best detection on the demo. Integration amounts to the long term moat, and integration is what the marketing decks do not talk about.
7. The year of the boring infrastructure
After three years of the AI hype, the enterprises that have shipped AI projects are starting to pay attention to the boring infrastructure those projects depend on. The Kubernetes platform. The observability stack. Identity and access management. Network segmentation. The boring infrastructure is where the operational debt has been accumulating, and the operational debt is starting to bite.
2026 looks like the year a lot of platform orgs are going to stop adding new capabilities and start paying down the debt. Those that get this right have the discipline to say no to the new project in favour of the refactor that makes the existing systems maintainable. Those that get it wrong are still adding AI features to a platform that cannot keep the lights on.
What this means for the engineering org
The year ahead will be a year of execution rather than exploration. The projects are largely known. The tools are largely available. The hard part amounts to the discipline to do the work, in the right order, with the right people, and to keep doing it for the years that the work takes. Those who ship will not be the ones chasing the newest trend; they will be the ones doing the boring work, on the boring infrastructure, in the boring way that compound interest rewards.
The bottom line
Seven trends, one shared pattern. Each one looks like a project, ships like a programme, and punishes the org that budgets it like a tool purchase. Plan for the three to five year arc and the work is manageable. Plan for the quarter and the work eats the budget.
Sources & Further Reading
All claims in this article are sourced from primary documentation, vendor advisories, and reputable security researchers.
Spotted an error? Email the editor. Corrections are issued with a visible correction note.
Editorial standards. Every article on humanrequired.org is reviewed by a human editor before publication. AI may assist with drafting or research; final editorial control is human. Read the full standards.
