In this episode, Andy Nicholson not only covers the pricing on the S1112, and a Q3 refresh for Java and ACS, but also dives into security in the AI Era, and, with the launch of the IBM i Marketplace Survey, we find out why you should contribute.

Keeping the IBM i secure in the AI era

One story that caught my attention for this month’s update was an article by Alex Woodie in IT Jungle, with the headline: “It’s D-Day for Cybersecurity.”

Now, the article highlighted a joint warning from companies including IBM, Google, OpenAI and Anthropic.

And that warning was that AI-enabled cyberattacks are expected to become more widespread and sophisticated.

But wait, I hear you say, our system is inherently secure by design. Surely this is for the WinTel audience, not us IBM i-ers?

Well, not quite so. Indeed, artificial intelligence takes away the, “security through obscurity” benefits that may have offered some protection in the past.

Ok, so you’d be right in assuming that IBM i enjoys a long-standing reputation for security and resilience.

But that reputation can create a dangerous assumption.

Yes, IBM i can be an extremely secure platform, but like any critical system, it still needs the right locks, keys and monitoring in place.

So, the strength of the platform does not remove the need for good security governance as AI can exploit weaknesses… weaknesses that were previously shaded by obscurity.

These may include excessive authority, shared accounts, uncontrolled exit points, exposed IFS data, unencrypted information and audit activity that is collected but never reviewed.

The issue is rarely the platform itself. It is how the platform has been configured, governed and monitored.

One particular example in the article was particularly revealing.

Anthropic reported that, during security testing, its models accessed real organisations’ systems after internet access was mistakenly available in the test environment.

The techniques included exploiting weak passwords and services without authentication. Familiar security weaknesses were enough to gain access to the system.

Why IBM i security matters

This brings me nicely to an article I recently wrote, titled Why IBM i Security Matters, with the central point being that IBM i has strong security capabilities, but the protection you actually get depends on how those capabilities are configured, maintained and monitored.

You see, AI adds urgency because it can help attackers understand unfamiliar platforms and investigate weaknesses more quickly.

As a result, we should be increasingly cautious about assuming that IBM i’s specialist nature makes it an unlikely target.

And these systems rarely operate in isolation.

They exchange information with web applications, reporting tools, cloud services and other business systems.

Those connections deserve the same scrutiny as the applications themselves.

So, where should organisations start?

First, review access, – who has powerful authorities, and do they still need them? Are old or shared accounts creating unnecessary exposure? Are password and authentication controls appropriate?

Second, examine the routes into the system – review network services, integrations and file shares, including access to the Integrated File System. Establish what is needed and where controls need strengthening.

Third, make monitoring useful – collecting audit information is only the beginning. Someone needs to review it, recognise suspicious activity and know what action to take.

IBM provides the tools to capture that information, but organisations still need clear ownership, regular review and a defined response process.

There is a positive side to the AI story, too.

The joint warning also highlights how AI can help defenders find and fix weaknesses. Organisations should explore that opportunity alongside the fundamentals.

For businesses that depend on IBM i every day, this is about protecting the operation: the orders, stock, financial information and services that keep things moving.

So, a useful question to take away would be, “When did we last check that our IBM i security is working as intended?”

If that piques your interest and you’d like to explore this further, my article looks at the risks and the controls in more detail. You can find the post here

ACS security release – fixing 3 vulnerabilities

IBM has released ACS 1.1.9.16, addressing three newly disclosed vulnerabilities.

IBM says all previous ACS releases are affected, with the potential for commands to be executed through functions including STRPCCMD, 5250 macros and multiple-session files.

The new release adds explicit confirmation before those actions can run, so if you use ACS, it’s worth checking that you’re running 1.1.9.16 or later.

The 13th Annual Fortra Marketplace Survey is now open

In the middle of September, Fortra launched the 2027 IBM i Marketplace survey, their 13th annual release to the IBM i community.

This years survey is open until November 20th, and I took some time to speak with fellow IBM champion and Fortra stalwart, Mike Davison and first asked why it is important that you the reader (or viewer) adds their voice?

The annual IBM i Marketplace Survey has been running for more than a decade and has become one of the community’s most useful indicators of the health and direction of the platform.

Following the launch of the 2027 survey, I spoke with fellow IBM Champion Mike Davison from Fortra about why people should participate, what Fortra hopes to learn this year and how organisations across the IBM i ecosystem use the results.

Andy Nicholson: Mike, the IBM i Marketplace Survey has been running for more than a decade. Why is it important for someone who has never participated before to add their voice to the 2027 survey?

Mike Davison: It is important because it helps all of us who use the operating system to shape the future of the platform.

As an individual, you may not have an opportunity to make your views known directly to the IBM i Advisory Council. The survey gives you a way to have your say. The more responses we receive, the stronger the data becomes and the more accurately we can identify the trends affecting the industry.

This year, the survey is also available in French, German, Italian and Spanish. We want to extend its reach across Europe and Latin America and create a much more global picture of the IBM i community.

Understanding trends and directions for the IBM i platform

Andy Nicholson: We have seen some significant changes in the results over the years. Last year, for example, IBM i skills overtook cybersecurity as the community’s biggest concern. How important are those year on year changes, and what do they tell us about where the market is heading?

Mike Davison: The changes are vitally important because they show the trends and direction of the platform.

Previous surveys have highlighted movement towards the cloud and then back towards hybrid environments. They have also shown growing concerns around the loss of IBM i skills, the increasing importance of security and the relatively slow movement between operating system releases and generations of Power servers.

Artificial intelligence is now another major area. Even in last year’s results, we saw a noticeable increase in the number of organisations exploring AI use cases.

Taken together, the answers help us understand the community’s commitment to IBM i and identify the strong and weak points within the businesses using the platform.

Topic highlights for this years IBM i Marketplace Survey

Andy Nicholson: There is an enormous amount happening around IBM i at the moment, including Power11, IBM i 7.6, artificial intelligence, application modernisation and tools such as IBM Bob. Are there any areas of this year’s survey that you are especially interested in?

Mike Davison: I am particularly interested in whether organisations plan to expand their use of IBM i, maintain their current position or move away from the platform.

It is also important to understand how many smaller IBM i shops are out there. The community is not only made up of large organisations with hundreds of logical partitions. There are many businesses operating one or two partitions or running a single Power server, and those organisations count too.

I am always interested in the adoption of open source technologies and the security features that organisations are using.

This year, however, I am especially interested in the IBM i skills challenge. As experienced professionals retire, we need reliable information that will help the industry understand how it can better support platform users.

Using the Marketplace Survey results to shape plans and make decisions

Andy Nicholson: Once Fortra publishes the results, who pays attention to them? Do IBM, software vendors, business partners and organisations running IBM i use this information to shape their plans?

Mike Davison: The industry quotes the results extensively. At almost every physical IBM i event I have attended this year, I have seen information from the Marketplace Survey included in a presentation.

That includes IBM events, business partner events and user group meetings. Managed service providers also use the findings to demonstrate the direction of the market and discuss the trends that matter to their customers.

The results provide valuable evidence about the state of the platform. IBM, independent software vendors and service providers can use that evidence when developing their plans, services and product roadmaps.

Why should people complete the IBM i Marketplace Survey?

Andy Nicholson: Finally, what would you say to someone who thinks their individual response will not make much difference?

Mike Davison: I would tell them that it does make a difference.

The results help IBM shape the future of its products and services. Independent software vendors use the findings when developing their roadmaps, and IBM has said many times that the survey results are considered at the highest levels of the organisation.

If you do not use your voice, you will not be heard.

We would love to increase participation from around the world. Historically, the results have sometimes been heavily weighted towards North America, so responses from the UK, Europe and other international markets are extremely valuable.

The survey takes less than five minutes to complete. You can find it through the Fortra website, LinkedIn and IBM i community publications such as the IBM i Update and Power Sockets.

Complete the 2027 IBM i Marketplace Survey

The survey remains open until the end of November, but there is no reason to wait. Please follow the link below and take a few minutes to add your voice to the 2027 IBM i Marketplace Survey.

• English: https://www.surveymonkey.com/r/Power-Fortra-Survey
• French: https://www.surveymonkey.com/r/Power-Fortra-Survey?lang=fr
• German: https://www.surveymonkey.com/r/Power-Fortra-Survey?lang=de
• Italian: https://www.surveymonkey.com/r/Power-Fortra-Survey?lang=it
• Spanish: https://www.surveymonkey.com/r/Power-Fortra-Survey?lang=es

Pricing for Power S1112 – The new Power11 entry level server

Great news as there’s now a clearer picture of what IBM’s new entry-level Power11 server, the Power S1112, might cost, and for some, these costs may be a surprise.

Yes, earlier this month, IT Jungle published pricing examples supplied by US reseller Data Tech Computer Services.

For example, A four-core rack configuration, with 64 gigabytes of memory and 1.6 terabytes of flash storage, is quoted at 41,950 US dollars.

A similarly specified tower comes in at 42,300 dollars. While a larger rack example with 128 gigabytes of memory, 12.8 terabytes of installed flash and a tape adapter reaches 88,000 dollars.

And, these are useful reference points for budgeting. It’s worth bearing in mind that any IBM i subscription charges are additional. Also, these are US prices, and local prices may vary

So, the published figures give us a useful starting point.

The next step is establishing what a properly sized, fully costed replacement would mean for your business.

Java on IBM i gets a Q3 refresh

And finally, we have the recently announced Q3 refresh for Java on IBM i, cementing IBM’s long-running commitment to the language.

In this Q3 refresh, IBM brings the supported runtimes up to their latest maintenance levels, including updates for Java 21, 17, 11 and 8. The versions available depend on which IBM i release you are running, as shown here.

This refresh focuses on security fixes, stability improvements and defect corrections rather than major new Java features, helping organisations keep their Java workloads current and properly supported.

And that’s it for your IBM i Update.

I’m Andrew Nicholson, and we’re Proximity, your application support, maintenance and development partners who are in your corner.

If you missed it, you can check out my previous update here, or access all the IBM i Updates in one place.

Alternatively, if you’d like to receive the latest IBM i Update hot off the press to your inbox, subscribe to the IBM i Update on LinkedIn.

The post IBM i Update #39 – Security in the AI era, plus Fortra’s IBM i Marketplace Survey 2027 appeared first on Proximity.

The tools and hosting arrangements that IBM i teams assume are covering them often stop short of the platform itself.

You can watch the full 30-minute recording at Fresche Talks: IBM i Cloud Security

However, in this article we look at five of the questions the session answered directly, with the practical implications for IBM i decision-makers and the technical teams who have to act on them.

Do CrowdStrike and Arctic Wolf cover IBM i security?

CrowdStrike runs agents on Windows and Linux, not IBM i, there is no native endpoint, so IBM i coverage must be explicitly configured and verified with external monitoring put in place.

Arctic Wolf doesn’t have native IBM i coverage either, though it can ingest events through SIEM integration if the IBM i is set up to send them.

For a technical lead, this means the mission-critical server is invisible to tools the rest of the security stack depends on.

For a business leader, it means the platform running core operations, the one enterprise-wide monitoring was supposed to cover, is sitting outside it.

If your enterprise security review assumed IBM i was included because “everything” reports to the SOC, that assumption is the gap.

Why does IBM i security matter if we don’t store card or personal data?

A common reason teams deprioritise IBM i security is that card data sits in a separate payment platform and personal data sits in HR systems, so the IBM i itself looks low-risk. 

The session addressed this directly: ransomware doesn’t need sensitive data to cause damage, it needs availability.

If the IFS gets encrypted, then this can disrupt applications and halt business processes, disrupting operations.

The cost of monitoring the platform is small next to the cost of it going down.

That’s a business continuity argument, not a data protection one, and it applies even to organisations confident they’re out of scope for PCI or GDPR on IBM i specifically.

How do you Get IBM i security events into a corporate SOC?

IBM i doesn’t forward events to a SOC by default. Getting there means building or buying a way to send SIEM events, typically in Syslog format, from the platform to wherever the SOC team is watching.

The detail that matters here is quality, not just connectivity.

IBM i journals can carry a very large number of data columns, and a SOC team is rarely staffed with IBM i specialists.

Sending raw, unclassified event data creates the same problem security teams have run into elsewhere: real signals buried in noise, discovered too late.

The practical requirement is events that are pre-classified and escalated by severity, in language a generalist SOC analyst can act on without needing to be an IBM i expert first.

This is a large part of what Fresche Security’s SIEM integration is built to do: incorporate IBM i logs into existing enterprise monitoring, with pre-built reports rather than raw journal dumps landing on a SOC analyst’s desk.

Does Hosting IBM i in the Cloud Make It Secure?

Hosting infrastructure and LPAR security are two different things, and cloud providers only cover the first by default.

A SOC-compliant cloud environment secures the physical and network layer.

What happens inside the LPAR, user privileges, library permissions, IFS access, system value configuration, is a separate layer that needs its own setup.

MFA at login is a good example of where the gap shows up. Once a user authenticates for the day, most environments don’t re-authenticate them.

If that user’s device is compromised through a phishing link during that window, the attacker is now operating with an authenticated session, and infrastructure-level cloud security has nothing to say about it.

Compliance regulations bear this out. PCI, SOX, HIPAA and GLBA all include IBM i-specific technical controls, session timeout after inactivity, encryption of sensitive fields, documented access control, that a cloud provider’s infrastructure certification doesn’t automatically satisfy.

This is precisely the layer Fresche Security’s access management (inactivity and timeout session lockdown), MFA and field-level encryption features are built to close.

What are early warning signs of a ransomware attack on IBM i?

Three signals came up repeatedly in the session:

• Strange or altered data appearing in IFS files, particularly if it’s spreading across more files over time rather than isolated to one or two. That progressive pattern is consistent with staged ransomware encryption rather than a one-off error.
• Unexplained CPU usage from an unrecognised job. The session’s advice was to treat this as suspicious by default rather than assuming it’s a vendor process, and to trace it back to the source before deciding it’s benign.
• A spike in invalid sign-on attempts, especially repeated attempts against the same account or one with elevated privileges. Tony described a real case where a client’s invalid sign-on attempts, once traced by IP address, turned out to originate from an attack based in China.

The response recommendation was consistent across all three: assume compromise rather than dismiss the anomaly, investigate the source, and restrict accounts so they can only perform the specific activities they need, which limits what a hijacked or impersonated account can actually do.

The session also flagged that recovery depends on backups that haven’t themselves been compromised. 

One case discussed involved backups being affected alongside the live system, which meant reconstructing around six months of data by hand rather than restoring it.

What this means for IBM i teams

Put together, the session’s answers point to the same conclusion from different angles: enterprise security tooling and cloud hosting cover real ground, but neither one reaches into the LPAR by default. 

Closing that gap means exit point monitoring, SIEM-ready event classification, MFA, field-level encryption and documented access control configured specifically for IBM i, not assumed as a side effect of everything else.

If you want a clear picture of where your own environment stands, Proximity offers Fresche Security, the same IBM i security suite referenced in this session, including a free audit covering 47 key security points with a pass/fail report you can act on. 

Get in touch to arrange an audit or talk to our team about where your IBM i currently sits.

You can catch up on other Fresche Talks here.

The post IBM i Cloud Security: Where Your Cloud Provider Stops Covering You appeared first on Proximity.

More recently, those pressure points have been expanded to include a growing expectation that AI should be able to modernise those applications, develop new functionality and maintain the application.

All at pace and at scale.

A recent Fresche Talks panel discussion featuring Marcel Sarassin (General Manager, IBM i Practice Services & Transformation), Chris Koppe (SVP Modernization, Strategic Advisor Services) and Mark Hunter (VP, Product Innovation), three practitioners working on IBM i modernisation projects at scale, went into detail on where AI genuinely helps with RPG, COBOL and CL modernisation, and where it needs firm boundaries. 

As a company that supports, maintains and modernises IBM i applications for a living and Fresche Solutions partner, we found the conversation worth unpacking, as it lines up closely with what we see with our own customers. 

You can watch the full recording via Fresche’s event page, Strategic IBM i Modernization:

Using AI at Scale.

Below are the three questions we think matter most.

What does “AI-ready” actually mean for an IBM i codebase?

The challenge. 

Using AI to help convert an individual program to Java, PHP or .NET is one thing. Applying it across an established IBM i application with shared data, interdependent programs and decades of business logic is a much larger challenge.

The panel highlighted program size as a major part of that challenge with conventional AI conversions only working for small, self-contained programs. 

It stops working once you’re dealing with the codebase most IBM i shops actually run: monolithic applications that can easily reach in excess of 75,000 lines, built up over decades, with business logic packed into every part of the application.  

Even when the output appears to work, it can still contain significant omissions.

The solution. 

The panel’s approach is to work at scale rather than program by program, and to be deliberate about scale. Their guidance: keep individual conversion targets under roughly 3,000 lines where possible, and break larger applications into smaller chunks before conversion.

The reasoning is direct: the larger the context an AI model has to process in one pass, the more likely it is to skip business logic without any obvious sign that something has been missed.

They also stressed a discrete, deliberate database step: the majority of IBM i shops (the panel put it above 90%) are still running DDS-defined files rather than DDL, often with short field names, no foreign key constraints, and dates stored in inconsistent formats. Modernising the code without also moving the database to DDL, with long, descriptive names and proper data integrity structures, means the new code can’t take full advantage of the languages it’s been rewritten in.

The result. 

Combining program segmentation with a database modernisation step is what let the panel’s team put close to 10 million lines of code through AI-assisted conversion in the past year, a scale that simply isn’t reachable with a manual, program-by-program approach.

How do you stop AI from quietly dropping business logic at scale?

The challenge. 

This is the risk the panel spent the most time on. AI coding tools are very good at producing something that runs and looks finished on screen: every field present, every button clickable. The panel described a real project where an AI agent was set loose on an application with 11 distinct business functions. The resulting program worked. It was only when the team audited it against the original functionality that they found just three of the eleven functions had actually been implemented. The other eight were missing, without any error or obvious gap to flag it.

The solution. 

Two things came up repeatedly as the fix. First, a documented test strategy for every project: the panel noted AI is genuinely useful for generating test data and unit tests around business rules, but functional, end-to-end testing still needs to be planned and owned by the team, not assumed to happen automatically. Second, and just as important: giving the AI a documented set of house rules for how to handle recurring IBM i constructs, rather than letting it solve the same problem differently every time it encounters it.

The panel gave some excellent examples:

• String and input validation, which AI will reinvent correctly roughly 95% of the time, but differently each time; Date handling, where one system was found to have up to 25 different date formats that all needed converting and standardising in a consistent way
• Application security built on IBM i-specific constructs such as local data areas, which have no direct equivalent in Java and need a deliberate decision about where security logic lives in the new architecture.

Documenting these patterns in advance, and making sure the AI and the surrounding tooling are consistently pointed at that documentation, is what the panel described as the first and second lines of defence against inconsistent output.

The result. 

The bar the panel set for “done” is blunt: if the original program had 63 business rules, the modernised version needs all 63, not 42 that happen to be the ones the AI noticed. That’s the table stakes for treating AI-modernised code as production-ready rather than a working demo.

How do you keep legacy and modernised applications running side by side during the project?

The challenge. 

No IBM i shop can modernise 20, 200 or 2,000 programs overnight, and nobody wants to hold onto old code just for the sake of it. Business users need to keep working through the transition, often without noticing much has changed day to day, while different parts of the system (some still in RPG on a green screen, some newly converted to Java) need to call each other reliably. The panel described the IBM i environment as a web of interdependencies: programs calling programs, screens calling screens, data shared through mechanisms like local data areas and data queues that don’t have an obvious modern equivalent.

The solution. 

The panel’s team has built what they call a “coexistence fabric”: a framework, built up over many projects, for handling the common integration patterns that come up when legacy and modernised components need to talk to each other during a phased rollout. Rather than solving each integration case from scratch, they apply a known pattern for each type of interdependency identified in a project’s strategy phase.

The result. 

New functionality and UI can go live in phases, with the previous system available alongside it, and the switch made as unobtrusive as possible for the people using it day to day, rather than requiring a single, high-risk cutover.

A quick note on build vs. buy

One more point from the panel is worth including for anyone weighing a package replacement against modernising existing code: they argued that a 10-year total cost of ownership comparison, not just the upfront licence and implementation cost, is the right way to judge that decision. 

In their experience, replacing a homegrown IBM i system with a third-party package typically delivers around 20% of existing functionality out of the box, with the rest requiring customisation or a change to established business processes. Those costs compound over a decade in a way the initial quote doesn’t show.

Where this leaves IBM i decision-makers

The panel was clear that AI is ready to use now, and that it will speed up any project. The point they kept returning to is that speed on its own isn’t the goal. A program that runs is not the same as a program that’s done. 

Getting from a convincing first pass to something you can put into production means program segmentation, a documented approach to recurring patterns, a real test strategy, a database modernisation plan, and a way to keep the business running while the work is in progress.

If you’re weighing up an IBM i modernisation project and want to talk through what an AI-assisted, at-scale approach would look like for your applications, get in touch with Proximity. 

We work with IBM i teams across many sectors including logistics, manufacturing, finance and retail on exactly this kind of IBM i modernisation project.

The post What Does “AI-Ready” Actually Mean for IBM i Modernisation? Three Questions Every Decision-Maker Should Ask appeared first on Proximity.

AI is a subject that’s created a great deal of buzz in the IBM i community over the past 12-months. 

We’ve covered the expansion of AI in our community regularly, including the news that IBM themselves have released applications such IBM i Bob to assist developers for instance.

However, news from IBM last month presents another angle on AI with one in four malicious breaches were AI-enabled according to data released by IBM in 12-months preceding July 2026. 

That’s a 56% increase from the year before.

IBM estimates that those breaches cost businesses an average of $6 million each. To make matters worse, those costs are about $1 million more than the global average.

How does the growth in AI-enabled breaches impact enterprises operating IBM i?

Moving from assumed security to managed, measurable protection in the age of AI

IBM i has a long standing reputation as one of the most secure and resilient enterprises platforms available. 

For many organisations, it continues to run the applications that matter most: 

• ERP systems
• Warehouse management software
• Finance and billing systems
• Manufacturing software
• Transport management and distribution applications
• Pricing and stock management
• And, a whole host of other business-critical operational workflows.

However, that cyber security reputation can also create a dangerous assumption.

IBM i can be an extremely secure platform. But, like any system, it still needs the right locks, keys and monitoring in place to safeguard that level of security.

Its inherent security credentials, however, does not remove the need for good security governance. 

As with any application, security governance is more effective when the right controls are properly configured, actively managed and regularly reviewed.

In other words IBM i is secureable, but it is not automatically secure.

That distinction matters now more than ever because of AI. In the past, IBM i may have benefited from a degree of obscurity. Considered by some as a legacy platform, many attackers lacked the knowledge of IBM i architecture itself. 

They didn’t understand the commands, exit points, the Integrated File System, how user profiles are set-up, object authority or the special authorities needed to target it effectively.

AI weakens that obscurity advantage.

Attackers can now use AI tools to understand unfamiliar platforms faster, interpret configuration weaknesses, automate research and accelerate the process of looking for poor controls.

IBM’s 2026 X Force Threat Intelligence Index reported that attackers are exploiting basic security gaps at higher rates, accelerated by AI tools that help identify weaknesses faster. IBM also reported a 44% increase in attacks that began with exploitation of public facing applications, and a 49% year on year increase in active ransomware and extortion groups.

This does not mean IBM i has become an insecure platform. 

What it does mean is that businesses running IBM i applications can no longer rely on reputation, obscurity or historical confidence. 

IBM i security now needs to be visible, tested, monitored and evidenced.

The IBM i Threat Landscape Has Changed

AI has meant that the wider threat landscape has changed. IBM i estates now sit inside a much faster and noisier security environment.

Firstly, the rise in attacks exploiting public facing applications. IBM’s X-Force Threat Intelligence Index reported a 44 percent increase in attacks exploiting public facing applications. 

That matters because modern IBM i estates are often connected to web portals, APIs, cloud platforms, reporting tools and integration layers.

Ransomware too is on the rise with IBM reporting a 49 percent increase in active ransomware and extortion groups. Ransomware is no longer something organisations can think of only as a desktop or Windows problem. 

IBM i can still be exposed through file shares, the IFS, compromised credentials, excessive authority and connected systems.

And then there’s software vulnerabilities. 

Verizon’s Data Breach Investigation Report stated that 31 percent of breaches now start with software vulnerabilities. That reinforces the need to understand where systems are exposed, how access is controlled and whether security settings are being actively reviewed.

Finally, Verizon reported that 48 percent of breaches now involve ransomware. That’s why monitoring, alerting, access control and data protection are vitally important for your IBM i security strategy.

The IBM i security misconception

IBM i is often described as secure by design. That is fair, but not entirely complete.

A better description is that IBM i is highly secureable. 

It has strong native security capabilities, but those capabilities need to be configured, maintained and continually reviewed.

A business may have IBM i applications that power much of their operation, with exceptional reliability and years of uninterrupted uptime, but still carry avoidable security risks. 

Common issues include:

1. Over privileged user profiles
2. Excessive use of special authorities
3. Shared or generic accounts
4. Weak control over FTP, ODBC, Telnet and other exit points
5. Limited visibility of Integrated File System activity
6. Sensitive data held in clear text
7. Audit journals that are collected but not actively reviewed
8. Security reporting that is manual, infrequent or dependent on one specialist
9. Limited integration between IBM i activity and enterprise SIEM tools
10. Lack of real time alerting when suspicious activity occurs.

The result?

A gap between the security IBM i can provide and the security the organisation can prove it has in place.

That gap is becoming more dangerous because AI reduces the effort needed to understand enterprise systems. What once required niche knowledge can now be researched, summarised and partially automated much more quickly.

The AI factor: why obscurity is no longer enough

For many years, IBM i has worked in its favour. It is not as widely understood as mainstream Windows, Linux or cloud platforms. You only need to look at the ageing IBM i developer talent pool and see why so many IT leaders view the skills gap as their number one concern. 

Attackers looking for easy opportunities focused elsewhere, but that’s no longer the case. AI changes the risk equation:

1. Platform knowledge is easier to access

An attacker no longer needs to be an experienced IBM i administrator to begin learning the basics of the platform. AI tools can explain IBM i concepts, commands, object authorities, user profiles, exit points, the IFS and common configuration issues to the wannabe cyber criminal.  This does not give an attacker instant expertise, but it significantly lowers the barrier to entry.

2. Reconnaissance can be accelerated

AI can help attackers organise research, generate checklists, interpret technical information and suggest areas of vulnerability to investigate. For IBM i, that could include exposed services, weak password policies, mapped file shares, overly powerful user profiles, unsecured exit points or poor monitoring.

Again, AI does not create weakness, but it does make weaknesses easier to find and understand.

3. Attacks can become faster and more repeatable

The wider threat landscape is already moving in this direction. As mentioned earlier Verizon’s Data Breach Investigations Report states that 31% of breaches now start with software vulnerabilities and 48% involve ransomware. It also notes that generative AI is helping attackers work faster across techniques such as spotting security gaps and writing malware.

For IBM i environments, the lesson is clear: security through obscurity is no longer a credible strategy. 

Organisations should assume that platform knowledge is increasingly available, and that weak configuration can be discovered faster than before. The correct response is not panic. It is discipline.

IBM i security should be assessed, hardened, monitored and reported in a way that reflects the modern threat landscape.

Why native controls alone may not be enough

IBM i includes strong native security features, including user profiles, object level authority, special authorities, system values, auditing and journaling. These are valuable and should remain part of any IBM i security strategy.

However, native capability is not the same as operational security.

The challenge is not simply whether IBM i has security controls. It is whether those controls are correctly configured, consistently applied, monitored in real time and understood by the people responsible for risk.

For example, an organisation may technically have audit journals enabled, but if nobody reviews the activity, the business may still miss suspicious behaviour. 

A user may have high authority levels for historical reasons, but if that authority is never reviewed, it becomes a standing risk. A file share may have been created for a valid reason years ago, but if it remains open today, it can increase exposure.

AI increases the importance of this issue because attackers are becoming faster at identifying weak points. The more quickly an attacker can understand a system, the more important it becomes for defenders to remove unnecessary exposure before it is exploited.

In many IBM i estates, the challenge is not a lack of security commands, it is the need to make security visible, consistent, repeatable and reportable.

Understanding the modern IBM i risk landscape

There are several reasons why IBM i security needs more active management in the face of AI threats.

1. IBM i systems are more connected

Many IBM i applications now exchange data with web portals, BI tools, cloud systems, integration platforms, warehouse systems, third party software, managed service providers and desktop tools. Connections such as FTP, Telnet, ODBC, API and web services are critical to business success, but they also create routes into the system.

2. Ransomware has changed the conversation

Ransomware is no longer just a Windows problem. IBM i may not be attacked in exactly the same way as a desktop estate, but it can still be exposed through file shares, the IFS, compromised credentials, excessive authority and connected systems.

3. AI is reducing the attacker’s learning curve

IBM i used to require specialist knowledge to understand it, however, AI makes the first stage of learning much easier.

An attacker can use AI to understand IBM i terminology, identify likely weak points, generate questions, structure a reconnaissance plan and interpret results. That means poor configuration, excessive authority and exposed access routes are less likely to remain hidden simply because the platform is unfamiliar.

4. Auditors expect evidence

For many organisations, especially those operating under GDPR, PCI, SOX, HIPAA or internal governance standards, it is not enough to say that IBM i is secure. Auditors need evidence.

They need to know who has access, what users can do, what has changed, what sensitive data exists, how access is controlled and whether exceptions are being reviewed.

5. IBM i skills are becoming more concentrated

Many IBM i environments rely on a small number of experienced people who understand the platform, the applications and the security model. That knowledge is valuable, but it can also create operational risk.

Security tools helps reduce dependency on individual knowledge by providing dashboards, reports, alerts and repeatable processes that can be understood by IBM i specialists, security teams, auditors and business stakeholders.

This is especially important in the AI era. If attackers can use automation to move faster, defenders also need better tooling, better visibility and better operational discipline.

The business case for IBM i security products

The case for IBM i security products should not be framed only as technology improvement. It is a business risk decision. Dedicated security tooling helps organisations:

1. Reduce the risk of unauthorised access
2. Limit the impact of compromised accounts
3. Improve control over powerful users
4. Protect sensitive data
5. Monitor network and exit point activity
6. Detect suspicious behaviour more quickly
7. Produce clearer audit evidence
8. Support compliance obligations
9. Improve resilience against ransomware and data theft
10. Reduce reliance on security through obscurity
11. Improve readiness for AI accelerated threats
12. Give both IT and business leaders confidence in the security posture of critical systems

An effective IBM i security approach should cover more than one area. It should provide layered protection across users, data, access points, activity, audit and response. 

The best IBM i security software tools should help organisations answer these questions:

1. Who has access to the IBM i system?
2. Which users have powerful authorities?
3. Are those authorities still justified?
4. Which connections are coming into the system?
5. Are FTP, ODBC, Telnet and other exit points controlled?
6. Is the IFS exposed through unnecessary shares or excessive authority?
7. What sensitive data exists and how is it protected?
8. Can suspicious activity be detected quickly?
9. Can IBM i security events be passed to the wider security team?
10. Can audit and compliance reports be produced easily?
11. Can the business prove that controls are operating effectively?
12. Can the organisation respond quickly if AI assisted attackers find a weakness?

These questions are difficult to answer consistently with manual checks alone. They require dedicated visibility, automation and governance.

The Fresche Security Suite is designed specifically for IBM i environments, with a suite of tools for IBM i security, which addresses IBM i security as a joined up operational challenge rather than a set of separate technical tasks. It includes:

• Compliance and auditing
• Intrusion detection
• Ransomware protection
• Exit point security
• Data encryption
• SIEM integration
• Multi factor authentication.

Centralised management

Fresche Central provides a single web based console for:

• Monitoring security in complex environments
• Configuring privilege escalation and network security
• Dashboard views
• Access to 360 plus built-in compliance reports.

The module provides visibility for security and IBM i development teams as well as auditors with clear reporting and tools that do not slow down daily operations.

Security management and access controls

Fresche Secure safeguards business critical assets on IBM i by addressing one of the biggest IBM i risks: users or service accounts having more authority than they need, for longer than they need it:

• User profile management
• Access escalation management
• Inactive session lockdown
• Network and exit point security
• Object and IFS and privileged access management.

Auditing and compliance

Fresche Audit supports internal and external audit requirements by simplifying data collection, reporting and regulatory compliance evidence. This is particularly valuable where IBM i underpins regulated business processes, financial systems, supply chain operations or customer data.

Threat detection and alerting

Fresche Detect provides real-time alerts for suspicious system activity, with SIEM integration, email notifications, history log monitoring and command monitoring. This closes the gap between event collection and response and provides instant response.

Data protection

Fresche Encrypt provides field level encryption, masking and scrambling, as well as sensitive field identification assistance and field level change reporting. For many organisations, this is an important step toward protecting the data itself, rather than relying only on perimeter or user access controls.

Multi factor authentication

Fresche MFA adds another layer of authentication for users signing into IBM i, including QR codes, OTP app generated codes and email or text token authentication. This is increasingly important as attackers target credentials and as IBM i systems become more connected to wider business workflows.

Securing your IBM i applications

IBM i remains a strong, resilient and highly capable platform. But no platform should be protected by reputation alone. 

The security question for IBM i estates is not simply: “Is IBM i secure?” 

A better question is: “Can we prove that our IBM i environment is properly controlled, monitored and protected today?”

That question has become more urgent in the age of AI.

AI does not make IBM i weak. But it does make weak IBM i security easier to understand, easier to probe and easier to exploit. 

Platform obscurity is no longer enough. Organisations should assume that attackers can access IBM i knowledge more easily and that poor controls may be discovered faster than they expect.

For many organisations, the answer requires more than native capability and periodic manual review. It requires active monitoring, controlled access, real time alerting, sensitive data protection, audit ready reporting and integration with wider security operations.

The Fresche Security Suite delivers a practical way to strengthen IBM i security across these areas. By combining centralised management, access control, auditing, detection, encryption and MFA, it helps organisations move from assumed security to managed, measurable protection.

For businesses that rely on IBM i to run core operations, that shift is no longer optional. It is part of responsible IT governance.

Learn more about IBM i Security from Fresche and request your demo today to mitigate risk.

Interested in learning more about IBM i security?

Read these articles…

The post Why IBM i Security Matters appeared first on Proximity.

Especially when you consider the widening skills gap for experienced IBM i developers.

Without proper IBM i code analysis and documentation, developers are more hesitant to make changes as they don’t know the risks those code changes may introduce to what are often business-critical applications.

Enter X-Analysis from Fresche Solutions, an advanced IBM i code analysis tool that unlocks hidden business rules, data flows, and program dependencies.

X-Analysis gives IT teams full transparency into their IBM i applications code base.

In this article, we’ll explore:

• Why legacy IBM i applications can be difficult to maintain.
• How X-Analysis transforms RPG and COBOL code into structured insights.
• The benefits of automated IBM i application documentation and impact analysis.
• How AI is bringing smarter IBM i modernisation.

The Challenge: IBM i Applications as a “Black Box”

Many IBM i (AS/400, iSeries) applications have evolved over decades, accumulating technical debt and undocumented code. 

This exact scenario was evident when we started to provide support, maintenance and development services to Schenker Finland’s TMS Software. You can read more about how we coupled X-Analysis with TD/OMS, a market leading IBM i change management tool, to understand their CIEL & Opera systems (all of which are in Finnish!).

Just like Schenker, businesses often struggle with:

• Lack of visibility: developers don’t fully understand RPG and COBOL programs.
• Risk of unintended changes: Modifying one program may break dependencies.
• Slow IBM i modernisation: Without a clear view of the application, digital transformation efforts stall.
• Lack of agility and integration: Development projects are either slow or non-existent as there is an IBM i skills gap or inability to develop applications without understanding the code base
• Developer dependency: Only senior IBM i developers understand system logic, making knowledge transfer difficult.

Without automated IBM i code analysis, organizations are left guessing how their applications truly function.

X-Analysis: The Key to IBM i Code Insights

X-Analysis offers a comprehensive suite of tools designed to tackle the challenges of documenting and analysing IBM i systems. 

X-Analysis is equipped with features that make it indispensable for IT developers including:

• Automated Code Analysis: It scans and analyses the entire IBM i codebase, identifying dependencies, dead code, and potential optimisation opportunities.
• Graphical Representations: Complex code structures are broken down into understandable diagrams, aiding in visualisation and comprehension.
• Impact Analysis: Before making changes, X-Analysis assesses the potential impact, ensuring that modifications do not inadvertently disrupt operations.

AI-Powered IBM i Application Intelligence 

With the integration of AI and a new web-based UI, X-Analysis transforms code analysis into an intuitive experience and is a major enhancement to the toolset.

It allows non-technical stakeholders, including Project Managers, Business Analysts, and C-level executives, to query code in plain English (e.g., “What programs use this file?”) and receive actionable insights. 

This AI-powered capability has been shown to improve response speeds by over 10x in some cases compared to legacy methods, making advanced application intelligence accessible to the entire team.

Organisations across various sectors are using X-Analysis to drive results:

• A major financial institution used X-Analysis to document its COBOL applications, significantly cutting the time required for system audits and upgrades.
• A large manufacturing company used the tool to update RPG applications to a modern framework, resulting in lower operational costs and improved performance.

If you’re interested in learning more? Free proof of concept available so you can experience the power of AI for IBM i application modernization. 

What’s the business impact of using X-Analysis?

• Reduce maintenance costs: Improve code visibility and documentation.
• Accelerate modernisation: Use automated business rule extraction.
• Lower development risks: Identify potential issues before changes are made.
• Enable faster onboarding: Help new developers understand the system quickly.

By using X-Analysis for IBM i application analysis, businesses can:

• Reduce IBM i maintenance costs by improving code transparency.
• Speed up IBM i modernization efforts with clear business rule extraction.
• Improve developer efficiency by eliminating guesswork in legacy applications.
• Lower the risk of software changes with precise IBM i impact analysis.
• Accelerate IBM i cloud migration by understanding legacy system architectures.

IBM i code analysis delivers visibility

IBM i applications don’t have to be thought as that impenetrable black box. 

With X-Analysis, IBM i-based enterprises can gain full visibility into their RPG and COBOL code base. 

Analysis, testing and automated documentation of those applications improves application maintenance, the speed of development projects and ensures modernisation and transformation strategies are successful.

Ready to unlock your IBM i applications with X-Analysis? Learn more about X-Analysis here.

You may also like:

• IBM i Update #39 – Security in the AI era, plus Fortra’s IBM i Marketplace Survey 2027
• IBM i Cloud Security: Where Your Cloud Provider Stops Covering You
• What Does “AI-Ready” Actually Mean for IBM i Modernisation? Three Questions Every Decision-Maker Should Ask
• Why IBM i Security Matters
• From Black Box to Clarity: How X-Analysis Unlocks IBM i Code Insights

The post From Black Box to Clarity: How X-Analysis Unlocks IBM i Code Insights appeared first on Proximity.

Developers increasingly expect to work through modern tools such as Visual Studio Code and browser-based applications. 

Businesses want their IBM i applications to connect and integrate more easily with wider enterprise platforms. And artificial intelligence (AI) is beginning to influence how IBM i development teams work.

The challenge for IBM i leaders is adopting these changes without losing the governance and control that protect production systems. 

That challenge is what the latest release of Remain Software’s IBM i change management tool TD/OMS addresses.

Watch the full presentation on TD/OMS V18.1 with Andy Nicholson below.

What’s new in TD/OMS V18.1?

TD/OMS V18.1 is built around four connected components:

• TD/OMS continues to provide lifecycle control, approval, and deployment governance.
• Octo gives developers a modern browser and Visual Studio Code experience.
• APIs allow the platform to connect with other systems and automated processes.
• Octo AI Studio provides a governed route into artificial intelligence.

Together, these four elements turn TD/OMS into a broader, more open DevOps platform for IBM i, rather than a standalone change management tool.

What challenge does TD/OMS V18.1 address for IBM i developers?

IBM i teams are under pressure from two directions at once. 

Developers want to work in the tools they already use elsewhere. 

The business wants IBM i systems tied into its wider enterprise tool set. Often that requirement is complicated with the desire to start using AI within the business. 

The risk is that adopting modern development tools and AI capability comes at the cost of the approval, testing, and deployment control that keeps production IBM i systems stable. 

For an IT leader responsible for that system, that’s a trade-off not to take lightly.

Remain’s Octo tool makes TD/OMS capabilities available through the browser and Visual Studio Code, so developers can work through familiar, modern tools while staying inside the same controlled TD/OMS lifecycle used today.

Version 18.1 also improves the day-to-day development experience within that lifecycle:

• Component dependencies are now grouped and easier to filter, so developers can see what a change will affect more quickly.
• Task solutions can be narrowed by object type and environment, cutting down on unnecessary searching.
• Branches can be stashed with a recorded reason instead of being permanently deleted, so in-progress work is retained safely rather than lost.

These changes reduce unnecessary searching, improve awareness of the impact of a change before it is made, and help developers manage change more safely. 

None of the changes introduced as part of the new release alters the approval and deployment controls TD/OMS already enforces.

Put together, TD/OMS provides the control, Octo provides the modern experience, APIs provide openness and integration, and Octo AI Studio provides governed intelligence. 

For an IBM i organisation, that combination means the ability to modernise the development experience and start using AI, while keeping the traceability and deployment controls the business already depends on.

For a technical lead, that means a familiar, modern working environment connected to the wider enterprise tool set. 

For a business leader weighing risk against reward, it means that IBM i modernisation and AI adoption do not have to come at the expense of control over a system the business runs on.

Explore TD/OMS with Proximity

Proximity resells and supports TD/OMS as part of a wider set of IBM i application services and development tools.

If your organisation is running IBM i and weighing up how to modernise and manage development processes, contact Proximity to arrange a demonstration of TD/OMS.

The post TD/OMS V18.1: Modern Development Tools and Governed AI for IBM i appeared first on Proximity.

In this episode, we’re still in Lyon, but for this second part, we look at a couple of the technical announcements, including Mapepire [pronounced MAH-pup-ee], the second technology refresh for 7.6 and the announcement of a new Power11.

Mapepire – The new way to access DB2 for the IBM i?

So, while at COMMON Europe, I joined a session on Mapepire, the new way to access DB2, which dramatically improves upon conventional technologies.

This technology presentation was completed by IBM’s very own inimitable Jesse Gorzinski, MBA.

So, what is Mapepire? Well, this technology is a cloud-friendly, database access layer technology that runs on IBM i and communicates with clients through secure WebSockets and is built with simplicity and performance in mind. It consists of a server component on IBM i and a set of SDKs for languages including Java, Python and TypeScript with more languages planned in the future.

And why the name Mapepire [pronounced MAH-pup-ee]? Well, Jessie explained that we have programming languages such as Cobra, Viper and (of course, the ever popular) Python, so when Jesse was thinking about creating a venom fast database connector, the South American pit snake seemed apt.

Now, traditionally, JDBC and ODBC connections can involve several different services and network flows before the first database operation takes place. Mapepire simplifies this by using a single port and a single server entry point. Jesse explained that it’s four main design principles involved:

• Portability – It can be used from environments where traditional IBM i drivers may be difficult or impossible to deploy
• Encryption – Connections are encrypted, with TLS providing both encryption and server authentication. Mapepire is intended to simplify certificate configuration considerably compared with traditional database connectivity.
• Performance – The performance demonstrations in the presentation show Mapepire completing queries more quickly and consistently than the Node.js ODBC driver in the examples tested. Connection pooling can further reduce overhead by reusing database jobs.
• Consistency – The SDKs are intended to behave similarly across languages, using consistent class names, methods, configuration options, parameters and error handling too.

This sounds like a utopian data connection layer!

Mapepire runs locally on IBM i, which can help reduce uncontrolled JDBC and ODBC connection sprawl.

Existing IBM i security controls still apply, including:

• Object authority
• Database server exit points
• User-profile controls
• Workload and subsystem management

A new configuration file also allows administrators to permit or deny connections based on user profiles and IP addresses.

Or in other words, it’s secure by design.

Ok, but JDBC and ODBC already do most of the work, right?

Well, when you compare Mapepire with traditional JDBC and ODBC connectivity, the biggest difference is simplicity.

Mapepire uses a single port and encrypts data by default, which immediately reduces some of the complexity normally associated with securing database connections. It still works with familiar IBM i controls, including system exit points, so organisations are not losing the security and governance mechanisms they already rely on.

It also offers enhanced CCSID support and is designed to work in more modern environments. Another important advantage is direct support for multiple client languages, making it easier for developers to access Db2 for i from a wider range of applications and platforms.

So the real appeal of Mapepire is that it keeps the IBM i controls customers already understand, while making secure, portable Db2 access much simpler for modern development.

And, while we’re still officially in a technology preview, plans are afoot for further enhancements. The near-term plans include Kerberos support, improved handling of large objects, a PHP client, a full JDBC client and more complete API documentation.

Beyond that, there are longer-term possibilities such as C# support, an improved Go client and data compression.

As always with roadmap items, these plans are forward-looking and may change, but they do show the direction of travel.

But, now confirmed – within OS7.6 TR2, Mapepire will be delivered as part of the IBM i operating system itself, which will be a significant step towards standardising it as a key component within the platform.

I’m excited, and IBM clearly sees Mapepire as a broader, more secure and portable access layer for Db2 for i across a growing range of languages and development environments.

Clearly, this is a technology to watch!

Technology refresh 2 for IBM i 7.6

Mid July saw the release of OS 7.6 TR2, and this version enjoys some useful additions…

This release is a broad update focused on security, resilience, modern development, system administration and support for the latest Power hardware. There is no single headline feature dominating the release.

Instead, IBM has delivered a substantial collection of practical enhancements aimed at making IBM i easier to secure, manage, develop on and modernise.

One of the strongest themes is external key management.

IBM i Cryptographic Services can now integrate natively with IBM Key Protect for IBM Cloud, allowing organisations to export, store, wrap and use encryption keys through an external key management service.

IBM has also strengthened protection for IBM i master keys.

The Save/Restore key can now be removed from the partition load source, meaning encrypted master keys remain unavailable until the appropriate key is supplied during or after the IPL.

When combined with system ASP encryption, this can prevent the partition from completing an IPL without the required key. Keys can be retrieved from a Platform Keystore or supplied manually through a Remote Key Agent.

*RPG continues to gain useful new capabilities for building more robust and maintainable applications.

ASSERT-F and ASSERT-T allow developers to validate conditions and take an appropriate action, such as raising an exception, recording a warning or calling a test procedure.

Generic message IDs simplify ON-EXCP handling by allowing related groups of messages to be monitored together. LIKE(EXT) can now define an individual field directly from an externally described file, reducing duplicate definitions.

And the new %LOOKUPNE and %TLOOKUPNE functions make it easier to find the first array or table entry that does not match a specified value.

Navigator for i receives another sizeable update. It can now use Java 21 where available and includes improvements across performance monitoring, networking, security, work management and file system administration.

Notable additions include a multi-system CVE overview, support for performance notebooks, new Performance Data Investigator charts, improved TLS configuration tools and the ability to configure SMTP OAuth authentication.

The open source Code for IBM i ecosystem continues to move quickly.

The main extension now includes MFA support for IBM i 7.6, password expiry checking, password changes, SSH key passphrase authentication and a new Environment view for managing actions, profiles and variables.

And, as highlighted in the previous article, TR2 has also moved to Mapepire as its SQL runner, with IBM reporting improved performance.

A number of security improvements have been introduced, including component signature checking, safer temporary directories and checks on home directory permissions.

Other extension updates improve RPG and CL language support, SQL development, automated testing and debugging.

A new IBM i FileSystem extension provides more detailed access to QSYS objects, authorities, locks, usage information and object-specific actions directly from VS Code.

Db2 for i receives several functional and security enhancements, including a new SQL error log, trigger pseudo columns, URL encoding and functions for converting values to and from system timestamps.

IBM has also expanded its range of SQL based IBM i Services. Particularly useful additions include services for:

• Identifying relevant CVEs
• Checking local Group PTF currency
• Examining audit journal entries
• Reading data journal information
• Viewing geographic mirroring status
• Managing Service Tools Server configuration
• Checking CL command syntax
• Reporting on external key management
• Examining job names, users and numbers

The growing number of IBM i Services continues IBM’s strategy of making operating system information and administration functions accessible through SQL.

Power11 S1112 entry-level server release

Also in July, we saw the OFFICIAL announcement of the S1112 Server.

This is IBM’s new entry-level, one-socket Power11 server, designed for smaller environments, and is available in both rack-mounted and deskside configurations.

The biggest point for IBM i customers is that the S1112 sits within the P05 software tier. IBM i partitions can use up to four cores and 64 GB of memory, which makes it quite the flexible powerhouse for the SME’s.

This could genuinely be a game changer – Enterprise-grade technology no longer needs an enterprise-sized footprint… or cost.

And that’s it for your two-part, IBM i Update report from COMMON Europe.

I’m Andrew Nicholson, and we’re Proximity, your application support, maintenance and development partners that are in your corner.

If you missed it, you can check out Part 1 of July’s upate here, or access all the IBM i Updates in one place.

Alternatively, if you’d like to receive the latest IBM i Update hot off the press to your inbox, subscribe to the IBM i Update on LinkedIn.

The post IBM i Update #38 – Mapepire, Technology Refresh 2 for 7.6 and the release of a new entry-level Power11 appeared first on Proximity.

This month, Andy Nicholson visits COMMON Europe and catches up with a raft of IBM Champions, discusses the latest technology and enjoys a ‘thank you and farewell’ with retiring Chief Architect and CTO, Steve Will.

Overview of Common Europe 2026 in Lyon

Now, during the heatwave in June, I visited COMMON Europe in Lyon.

The event was 3 ½ days of latest education, technology and trends delivered by top IBM and industry-leading speakers.

So, let’s take a look at some of the key announcements, ideas and conversations to come out of the event.

First, the venue was situated on the banks of the Rhone River in the City International Conference Space, and honestly, it was baking hot.

Thankfully, the amphitheatre enjoyed air conditioning, and that’s where we enjoyed the keynote by Katarina Gospic, a member of the global advisory board for WatsonX.

In this, and to a packed auditorium, she provided pertinent insight into how you can use AI to better effect and what tools… and skills are needed for maximum results.

The auditorium was just one part of the event space, and just outside the doors was the main expo area, otherwise known as the greenhouse.

Yes, here delegates baked themselves while quaffing quite excellent coffee and delectable French pastries.

The Expo area also housed many of the exhibitors, of which there were a healthy number, all of whom were eager to provide insight and help where needed.

The next generation of IBM i developers

There were plenty of talks and round table discussions too. One particular roundtable involved COMMON Board Member and IBM i NextGen stalwart, Zouhair Oulli and fellow IBM Champion, Tom Wellmann.

It was wonderful to see so many young people getting engaged with the platform.

NextGen positions IBM i as a gateway to exciting opportunities for burgeoning developers, with support for modern tools and practices.

And, newcomers will enjoy the backing of a community that will support the building of their knowledge through education, networking and real world examples and that’s what Zouhair discussed through his own experience.

He spoke on the opportunities, discussed ideas for how Common can support the the next generation of talent and initiatives for the IBM i community.

And, with IBM i skills in short supply and modernisation and AI booming, developers who master the platform can gain valuable cross platform experience and strong career opportunities.

Later in the day, I caught up with Zouhair and Tom and asked what NextGen was and what the roundtable discussion involved…

Zouhair: “First, let me introduce NextGen. It is part of COMMON Europe and aims to support young people who have recently joined the IBM i community, or who are considering a career in it, by providing useful resources, guidance and mentoring. During yesterday’s roundtable, we gathered ideas from the young people attending the event. Their feedback will help us improve NextGen and the ways in which we support people entering the IBM i community.”

Andy: “Fantastic. Tom, you are very much part of this next generation. What has inspired you most about attending this event?

Tom: “Hearing about other people’s experiences, I would say. I’ve heard and read a great deal about these events, and I have attended the German equivalents, but I had never been able to come to this one before. Now I am finally here, and I’m very happy to be part of it. It has been great so far.”

Andy: “Fabulous. It is great to see you, Tom, and you too, Zouhair. Zouhair, to finish, which IBM i technology inspires you most at the moment?”

Zouhair: “At the moment, I would say VS Code, because you can do so much with it. You can create your own extensions, it is open source, and it enables a large community of people to collaborate. That is what I like most about it.”

My thanks to Zouhair and Tom for their time and efforts with NextGen.

Networking at Common Europe

For me, the most valuable part of COMMON Europe was the networking.

The sessions and presentations provided plenty of insight, but it was the conversations between them that really brought the event to life.

Meeting IBM i professionals from across Europe created opportunities to exchange ideas, compare experiences and discuss the challenges organisations are facing in the real world.

Those informal conversations often lead to the most useful insights, new partnerships and future opportunities. COMMON Europe is not simply about learning what is happening across the IBM i ecosystem.

It is about building relationships with the people who are shaping its future.

Alan Seidan discusses VS Code and modern languages for IBM i

First, I met with Alan Seiden and asked him about the two sessions he delivered at the event…

Alan: “The first was “Securing Your Open Source”. It covered areas we do not hear about as often on IBM i, such as securing Node.js, Visual Studio Code extensions, PHP, Python, web applications and APIs. We all need to be mindful of security. The second was “RPG Unit Testing Made Easy with Visual Studio Code”. Unit testing is so important for any modernisation or transformation project, and for putting guardrails around AI. With these extensions, it is now much easier than before.”

Andy: “Absolutely. Visual Studio Code has really come to the fore over the past few years. Do you see it becoming the mainstay moving forward, or could it eventually be replaced by Bob?”

Alan: “Bob is really based on Visual Studio Code, so I think they work hand in hand. The extensions you can run in VS Code can also run in Bob, and IBM sees it that way too. IBM continues to contribute to Visual Studio Code, and all those extensions gain extra mileage, or kilometres, because they can also be used in Bob. I see that moving forward at an even faster pace than before.”

IBM Champions Charles Guarino and Koen Decorte explain their favourite part of the event

I also caught up with IBM Champions, Charles Guarino and Koen Decorte, at the Gala Dinner and asked what the best part of the event was…

Koen: “AI, I would definitely promote it. Definitely go and learn all about it.”

Charles: “There’s a very high level of interest in AI for sure. But back to the best part, it’s the people, of course. It’s like coming home.”

Mike Davison explains what he’s looking forward to at Common Europe

I also had the good fortune to meet my fellow retro gaming enthusiast, Mike Davison. He was in the main expo ‘hot house’ on the Fortra stand.

Mike: “The event has been fantastic, Fantastic. We have had a lot of traffic to the Fortress stand. We have got a Millennium Falcon prize to give away, which is generating lots of footfall for us. So really, really good start to Common Europe in Lyon this year. As for sessions I’m looking forward to? I’m looking forward to catching up with my old boss Ash Giddins who is presenting Administration Runtime Expert (ARE) – one of IBM i’s most powerful, yet overlooked, tools.”

Roberto De Pedrini on the AI coding journey

I also had the pleasure of meeting Roberto De Pedrini again. Now, for those long time subscribers to the IBM i Update, you may remember that one of the first articles I covered some years back was Roberto using ChatGPT 3.2 to develop RPG.

Roberto: “Yes, we started by trying ChatGPT with RPG. It was good because it could create RPG code, and we were beginning to use this kind of assistant, but that was only the start. Now we have much more. We do not only have ChatGPT; there are many large language models we can use. We also have IBM Bob, which can help us change RPG code, create documentation and much more. Today, we can do more than simply create or change code. We can compile it and test it directly on IBM i. That is fantastic because we can use an LLM to understand the code, make the changes we need, and connect the whole process to IBM i. It is very interesting and represents a real change in how we develop in RPG, as well as COBOL and every other language we can run on IBM i. That is very cool.”

Gala Dinner Summary

Now, in the evening of Tuesday 16th June, a 20 minute wander through the glorious park saw us reach the Gala Dinner. Delegates and guest flooded the venue to enjoy an evening of great food, maybe a little too much drink and good company too.

My thanks for Common Europe and to Common France for hosting such a super soiree.

IBM i Chief Architect Steve Will’s parting advice

At the end of July, one of the most familiar and respected figures in the IBM i community will bring an extraordinary career to a close.

Steve Will is retiring after more than 41 years with IBM.

His career reaches back to the original development of the AS/400, and since 2007 he has served as IBM i Chief Architect, helping to shape the strategy and direction of the operating system.

Kris Whitney has been appointed as his successor as IBM i Chief Architect and he joined Steve on the stage to make the announcement.

For many people, Steve has become one of the most recognisable public faces of IBM i.

He has explained its strategy, defended its relevance and helped customers understand where the platform is heading.

However, for his final IBM i Guided Tour, Steve chose not to talk about technology, roadmaps or future releases.

Instead, he offered something much more personal: the lessons he has learned about building a fulfilling career. The presentation was titled Steve’s Advice for… Well, You’ll See.

That unfinished title was deliberate because, as the presentation developed, so did its meaning. Steve’s central concern was not simply of success, status or even happiness, but fulfilment through the development of character.

Or as Aristotle put it, to be eudaimonian in nature.

Now, I’m not going to dissect the entire presentation… you should really check it out yourself. But his message eventually came down to three wonderfully simple points for fulfilment: Learn, bring yourself, and be a good person.

So, while Steve was ostensibly talking about a career in technology, the qualities he described extend far beyond IT.

Curiosity, empathy, collaboration, supporting your people and contributing to something meaningful. These are all qualities that can bring fulfilment to life as well as work.

After 41 years at IBM, this advice may be one of Steve Will’s most valuable contributions of all.

Later that day, I had the opportunity to interview Steve – perhaps his LAST interview as CTO?

I asked him what he thought his greatest achievement was in IBM i over the years…

Steve: “You know, difficult question, and you warned me I was gonna have to talk about it. Putting together the team that I’ve got with so many technologists who can also take what they have built and explain it to the community, that team is extremely competent, extremely visionary, and cultivating them and growing them has probably been the most important thing that I’ve done. I’ve kept the platform alive in a lot of ways, but they’ve been my team, and so the team is probably the biggest thing.”

A great leader and human, thank you Steve…

Now, episode #38 will be following soon, with another Update from Lyon featuring a couple of technical presentations.

But for now, that’s it for episode #37 of your IBM i Update.

I’m Andrew Nicholson, and we’re Proximity, your application support, maintenance and development partners that are in your corner.

If you missed it, catch up on our previous IBM i Update, or access all the IBM i Updates in one place.

Alternatively, if you’d like to receive the latest IBM i Update hot off the press to your inbox, subscribe to the IBM i Update on LinkedIn.

The post IBM i Update #37 – Common Europe Lyon July 2026 Review appeared first on Proximity.

For an IBM i shop, that phrase needs a bit of a translation. 

A recent Fresche Talks session, “IBM i Data to AI-Ready Analytics: Where Your Growth Comes Next”, brought together Fresche’s analytics and data leads to answer the question directly.

It’s a useful reference point for anyone running RPG, COBOL or Synon applications on IBM i and wondering what to do next with AI.

We work with IBM i teams every day on support, development, modernisation and integration projects and the conversation in that session mirrors what we hear from clients: the interest in AI is real, but so is the caution. 

Nobody wants to put decades of business-critical code and data at risk just to chase a trend. 

Below, we’ve pulled out the four questions IBM i leaders ask most often, answered using what was actually said in the session.

What does AI-ready data actually mean for IBM i?

Db2 for i holds decades of accumulated business data. The vast majority of that business data was never designed with AI in mind. 

Traditional IBM i system object and column names were often limited to ten characters, resulting in abbreviated names that can be difficult to interpret outside the original application. 

That combination means raw Db2 for i data may not be sufficiently documented, contextualised, integrated or governed to be used directly by an AI application.

Making data AI-ready means addressing that gap on three fronts: cleaning and organising the data, making it readily and securely accessible to external analytics and AI platforms.  

In practice, that context takes the form of longer, descriptive field and table names and column descriptions layered on top of the existing database, plus governance so the data can be trusted once it’s in use. It also usually means bringing in data from outside IBM i, such as CRM systems, and combining it with the IBM i data in one place.

How do you modernise IBM i data access without risking what already works?

The instinct with any modernisation conversation is to assume it means migrating off IBM i.

That has the potential to be an expensive project with real business risk attached. 

That’s not the starting point the Fresche Talk session described. 

The approach discussed is augmentation rather than migration: adding or mapping descriptive SQL table and column names, aliases, views and column descriptions without altering the underlying data or core application logic that already runs the business.

From there, journal-based replication captures inserts, updates and deletes from the IBM i journal and applies those changes to a connected data platform.  

That’s where the metadata, additional data sources and AI access controls get added. The production system carries on exactly as it did before. Several vendors already run a replication tool for disaster recovery or high availability, and the session made the point that AI-focused replication adds no more overhead, and no more risk, than that existing tooling.

How does an MCP server actually expose IBM i data and code to AI tools?

Model Context Protocol (MCP) servers came up repeatedly in the session as the practical mechanism for connecting IBM i data and code to AI agents, whether that’s a GPT-based agent, Copilot, Claude, or something else. 

Once IBM i data is replicated into a governed data warehouse with metadata attached, an MCP server reads that structure and exposes it to chat agents directly, which is what lets a business move from producing static reports to letting people ask direct questions of governed, authoritative data.

The productised MCP server described in the session is read-only by design. 

Write-back is possible, but it requires more than the standard product: it needs its own governance layer, and in most cases it has to pass through the existing application logic that already validates the data, rather than writing to Db2 for i directly. 

That matters on IBM i specifically, because validation rules are often built into the RPG, COBOL or Java program layer rather than the database itself, so bypassing that layer on a write-back path would bypass the checks that keep the data reliable in the first place.

MCP capability also now extends to code and job data. 

X-Analysis, Fresche’s application analysis and documentation tool for IBM i, has added MCP capability, exposing program structure, logic and business rules so they’re consumable in tools like VS Code. 

Presto, Fresche’s browser-based UI modernisation tool, can add a chat or reporting layer on top of green-screen applications using the same approach.

At Proximity, we deliver both X-Analysis and Presto to IBM i clients across many managed services and modernisation projects, so this shift toward AI-connected tooling builds directly on capability many teams already have in place.

How do you protect personal and sensitive data once IBM i data is exposed to AI??

Governance was treated as a first-order requirement, not an afterthought. 

This includes personal and special category data under UK GDPR, as well as PII and PHI in jurisdictions where those terms apply too. 

Two controls came up specifically: logging every tool call made against an MCP server, so there’s a full record of who accessed what data, and assigning clear ownership of governance, whether that’s a dedicated chief data officer in a larger organisation or a shared finance function in a smaller one.

The alternative, without a governed access layer, is what the session called out directly: users export data to Excel and share or analyse it outside any oversight, or turn to publicly hosted AI tools because no approved option exists, feeding company data into models with no control over where it ends up. 

US healthcare organisations subject to HIPAA were highlighted as being particularly exposed to this risk.. Building the governed access layer first, before AI tools are rolled out more broadly, is what prevents that shadow IT problem rather than reacting to it after the fact.

What the result looks like in practice

Put together, this doesn’t require replacing the production IBM i applications. 

RPG and COBOL programs, and the validation logic inside them, stay exactly as they are. 

Replication overhead sits in line with disaster recovery tooling most businesses are already running. And the outcome for the business is a move away from static, IT-produced reports toward direct question-and-answer access to trusted data, delivered through a governed MCP layer with a full audit trail behind it.

That’s a meaningfully different starting point from “replace the platform” or “just plug an AI model into the database,” and it’s why the session is worth watching in full if you’re weighing up where to start.

Watch the full session:

If your team is looking at what it would take to make your own IBM i data AI-ready, without a migration project and without exposing personal or sensitive data in the process, get in touch with Proximity. 

We support, develop, modernise and integrate IBM i applications for UK businesses through a team of 40+ IBM i application specialists.

As a Fresche Solutions partner, we can also talk you through where X-Analysis, Presto or a governed data layer would fit your IBM i estate specifically.

Learn more about Fresche Solutions

The post What “AI-Ready” Actually Means for IBM i Data appeared first on Proximity.

For organisations relying on the IBM i platform to run business-critical applications, however, the question has always been different: how can AI be adopted without compromising the stability, security and reliability that IBM i is justifiably known for?

At the recent i-UG i-Power Conference, that question was answered with absolute confidence. 

AI has not only arrived on IBM i, but it has matured into a practical tool that can help solve real business challenges.

With solutions such as IBM Bob, a specialist implementation of IBM watsonx Orchestrate, organisations can bring the benefits of generative AI directly into existing green-screen applications, database structures and business processes. 

Rather than replacing established systems, AI is enhancing them.

Tackling the IBM i skills gap through AI modernisation

One of the biggest challenges facing IBM i users is not the platform itself. 

IBM i continues to be recognised for its reliability, resilience and long-term value. 

The real challenge is maintaining decades of bespoke applications as experienced IBM i developers retire, move company, or are redeployed onto other projects, and valuable knowledge leaves with them.

Many businesses depend on complex RPG, COBOL and CL applications that have evolved over many years, and in some cases, decades. 

These systems are often poorly documented, making it difficult for new developers to understand how they work or where to begin when making changes.

This is where IBM i AI modernisation can deliver immediate value.

Rather than embarking on expensive and high-risk IBM i migration or replatforming projects, businesses can use AI as an assistant that helps interpret existing applications and preserve valuable knowledge.

And assistant is the operative word there. It is not a complete replacement for IBM i expertise. 

During hands-on demonstrations at i-Power, attendees saw IBM Bob analyse legacy code in real time. 

Using a simple natural language interface, developers could ask questions such as:

• “Summarise what this SAMCO programme does.”
• “What is the purpose of this application?”
• “Explain how this section of code works.”

Within seconds, the AI analysed the source code and returned a clear, easy-to-understand explanation.

By dramatically reducing the time required to understand legacy applications, AI helps shorten the learning curve for new IBM i developers while making experienced teams significantly more productive.

Moving IBM i AI modernisation beyond development

The benefits of IBM watsonx Orchestrate extend well beyond software development.

System administrators can use AI to explore database schemas, identify system anomalies, locate relevant documentation and support modernisation projects with greater confidence. 

AI becomes an additional member of the team, helping experienced IBM i developers complete routine tasks more efficiently while reducing the risks associated with changes to critical systems.

This demonstrates an important point about IBM i AI modernisation: modernising your IBM i environment does not mean replacing it. 

It means giving your existing teams better tools to work more effectively and efficiently.

Building a smarter future for your IBM i

We can’t stress enough the importance of having reliable IBM i developer resources on hand to determine whether the actions an AI model is taking are actually correct. 

Whether your objective is to accelerate development, document decades of legacy code or improve operational support, combining AI with experienced IBM i expertise offers a practical and sustainable path forward.

At Proximity, we help organisations modernise their IBM i applications through development, ongoing support, maintenance and strategic modernisation services. 

If you’re ready to begin your IBM i AI modernisation journey and future-proof your IBM i applications, get in touch with our expert team to discuss your requirements and arrange a comprehensive systems assessment.

In partnership with Fresche Solutions, we are also offering a free, no obligation IBM i Modernisation Proof of Concept (POC). The POC provides an opportunity for IBM i shops to validate the return on investment for transforming RPG code to Java.

As well as taking advantage of Proximity’s team of IBM i specialists, the POC also uses X-Modernize AI from Fresche Solutions.

The post IBM i AI Modernisation: How watsonx Orchestrate is Bridging the Skills Gap appeared first on Proximity.