Tesco are moving 40,000 server workloads off of VMware amid “abusive conduct” from Broadcom, recent legal filings claim.

Tesco filed a lawsuit in the UK’s High Court against Broadcom alleging breach of contract last year. According to a September report from The Register, the lawsuit claimed that in January 2021, Tesco bought perpetual licenses for VMware’s vSphere Foundation and Cloud Foundation, a subscription to VMware Tanzu, plus support services until 2026, with the option to extend support for four additional years.

But when Broadcom took over VMware in November 2023, it would not honour the deal and instead tried to get Tesco to pay “excessive and inflated prices for virtualisation software for which Tesco has already paid” and would not allow it to buy support services for its perpetually licensed software without buying “duplicative subscription-based licenses for those same Software products,” the initial complaint read.

Tesco, which reported 73.7 billion pounds (about $98.7 billion) in revenue in its fiscal year 2026, has since started migrating away from VMware and Broadcom’s mainframe products, according to late-May court filings.

In January, Broadcom stopped supporting Tesco’s VMware products, Tesco said, and Tesco has been paying for third-party support since. In its initial filing, Tesco also said that Broadcom refused to upgrade software or provide all security updates to customers without subscriptions.

One of Tesco’s recent filings reads:

New data from SAP Concur has apparently confirmed employees are still ignoring company policies, with three in four UK business travellers using (or would use) unapproved AI tools.

Data from the company’s Global Business Travel Survey shows that, while organisations are investing heavily in AI, they’re not giving workers access to the right tools.

As a result, employees are opting to use other, more suitable alternatives and often prefer publicly available chatbots such as ChatGPT and Gemini.

Two in five (43%) said they use unapproved tools because they prefer different options to what they’re provided, but one-third (32%) say their organisation doesn’t even offer any AI tools to support planning or booking travel, forcing them to look elsewhere.

The data shows that remote workers (81%) are more likely to use shadow AI than office-based employees (71%), as are younger workers like Gen Z (79%) and Millennials (76%) compared with Gen X (62%) and Boomers (49%).

As for what employees are looking for when it comes to AI supporting their travel needs, the biggest use case is planning itineraries (37%). Tracking expenses (30%), assessing travel risks (26%), making changes to their trip (24%) and completing expense reports (21%) are also common use cases for the productivity-boosting technology.

But business leaders already know the scale of the problem – 100% of CFOs are concerned about shadow AI in business travel, the report found.

“Leaders must educate workers on the risks and provide T&E tools that deliver the desired level of AI support,” EMEA VP for Concur Travel Paul Dear noted.

Looking ahead, the fix must come from organisations – workers clearly aren’t too keen on having to navigate to third-party tools, and are doing it out of necessity. More than a third actually want their AI tools integrated into their productivity software (38%), communications platforms (36%) and CRM systems (32%).

Azul deputy CTO Simon Ritter warns that enterprise Java teams are sleepwalking towards a support cliff.

Ritter, who joined Sun Microsystems in 1996 and now works at Azul, says four long-term support versions of Java will reach end-of-support between 2029 and 2032. Java 17 goes first in 2029, followed by Java 8 in 2030, Java 21 in 2031 and Java 11 in 2032.

Writing in Infoworld, Ritter said: “Between 2029 and 2032, every currently supported long-term support (LTS) version of Java will reach end-of-support within a single three-year window.”

On paper, this looks like a neat upgrade cycle, but Ritter says the reality is a nasty collision of timelines that most enterprises have failed to forecast. Organisations still planning to modernise slowly, moving application by application and version by version, are working from a model the calendar has already mugged.

“The primary danger here is the illusion of time,” Ritter said.

Traditional modernisation plans rely on sequential upgrades and controlled pacing. Ritter argues that once every major Java version expires in the same cramped window, sequential planning collapses.

By the time that becomes obvious, companies will be forced into reactive mode. That means rushed decisions, emergency projects and the usual corporate theatre with extra Jira tickets.

For organisations planning the familiar Java 8 to Java 11 to Java 17 to Java 21 slog, a maintenance task becomes a structural problem. Enterprises with large Java estates will need to upgrade multiple applications across multiple versions simultaneously. That is needed to maintain security compliance and business continuity.

“Waiting until the late 2020s to act guarantees a modernisation process under emergency conditions,” Ritter said.

Modern Java versions still have strong backwards compatibility, but Ritter says that will not offset decades of technical debt.

Large Java environments are stuffed with unused libraries, obsolete logic, forgotten dependencies and dormant features. Much of this stuff no longer runs in production, but it still eats developer time and security oversight.

As codebases age, the drag compounds. What looks like a tidy version upgrade on a roadmap turns into a sprawling operational headache.

Ritter says most modernisation strategies assume upgrades can be sequenced and absorbed gradually. That assumption is now dangerous.

“When multiple Java versions reach end-of-support in the same narrow window, enterprises don’t face a single modernisation project; they face parallel modernisation across their entire estate,” Ritter wrote.

That moves the problem away from frameworks and into people. A typical enterprise with 100 developers cannot afford to waste chunks of its capacity maintaining dead code that delivers no business value.

Multiply that across dozens or hundreds of applications, and the bottleneck becomes obvious. Modernisation is limited by people, not magic tools. Parallel modernisation needs parallel capacity, and most organisations have not budgeted for it, he said.

Ritter says tools that analyse code in isolation cannot tell what matters in production. Without that visibility, companies default to caution and turn their timelines into risk.

“The Java modernisation crunch is a crisis of resource allocation, not a technology problem,” Ritter said.

Every hour spent maintaining obsolete code or investigating unused dependencies is an hour stolen from modernisation. When organisations face simultaneous upgrades across multiple applications, human capacity becomes the hard limit. Sequential planning needs time, while parallel modernisation needs people. Most enterprises no longer have enough of either.

Those tackling technical debt now will still have a difficult transition, but at least it will be manageable. Those who do not will face rushed choices and permanent compromises.

“By the time 2029 arrives, the window for gradual modernisation will have closed. The calendar won’t wait for us to be ready,” Ritter said.

Flexera has published research showing that every organisation surveyed uses generative AI public cloud services. It also found that 85% now see managing cloud costs as their main cloud challenge.

The findings point to growing pressure on technology budgets as companies juggle hybrid cloud estates, AI spending and limited visibility over usage. Some 17% of organisations exceeded their public cloud budgets in the past year, while estimated wasted cloud spend rose to 29%, reversing a five-year decline.

Hybrid cloud has become the dominant operating model in the survey. Flexera found that 69% of organisations now use a hybrid cloud approach, rising to 78% among those with more than 5,000 employees.

Spending patterns also point to larger, more complex estates. Among organisations spending more than USD $500,000 a month on cloud, 79% operate hybrid environments.

The report suggests AI is adding a new source of cost volatility. While all respondents said they use generative AI public cloud services in some form, 45% described that use as extensive and 30% said cost unpredictability was one of the biggest challenges in scaling AI workloads.

Chris Andersen, Chief Financial Officer at Flexera, linked those pressures to broader changes in how finance teams track technology spending.

“The conversation around cloud costs has shifted significantly. It has moved from spending more on technology to solve problems to managing increasingly complex environments that have often evolved organically over time.

“Many organisations have not intentionally designed hybrid or multi-cloud strategies. Instead, these environments emerge through acquisitions, new business requirements or teams independently adopting different platforms. As a result, finance leaders are being asked to manage technology estates that are much harder to monitor and optimise.

“The challenge is that complexity itself creates inefficiencies. The more environments organisations operate across, the harder it becomes to maintain visibility into what resources are being used, whether they are delivering value and where opportunities exist to reduce unnecessary spend,” Andersen said.

The survey also points to a more formal approach to cloud oversight. Flexera found that 71% of organisations now have a Cloud Centre of Excellence, while 63% have established dedicated FinOps teams.

HPE is taking advantage of VMware’s expensive licensing changes by offering customers free use of its own VM Essentials product for a year, plus a $1 license for its Zerto data protection product to help ease migrations.

The announcement of the deal came at the Partner Growth Summit staged alongside their HPE Discover event in Las Vegas, and framed them as a migration assistance program intended to arm channel partners who want to help customers reduce their financial risk when migrating virtualisation platforms.

“One of the big things we see is that as customers are going through this journey on transforming their operating model, you end up with double expenses and so we’re really pleased to announce the program around Morpheus and platform migration,” said EVP and CTO Fidelma Russo.

“We are announcing that as a customer goes through this transformation with HPE Morpheus VM Essentials, you don’t pay for the first year of licenses. You will get Zerto migration licenses during that period to help you move, and so what this does is it helps mitigate the double-bubble cost problem that customers see as they are looking to migrate from one platform to another.”

Neither Russo nor HPE mentioned VMware as part of their pitch for this migration assistance program, but it seems pretty clear where it is aimed.

At its last Discover event in Barcelona, HPE talked about customers seeing license fees for virtualisation skyrocketing and claimed that it was able to provide “a fully integrated enterprise-grade alternative” with Morpheus and OpsRamp management tools, plus Zerto disaster recovery software.

A survey recently found that half of VMware users plan to reduce their use of the virtualisation pioneer’s products by 2028. Since being acquired by Broadcom, VMware license costs have increased by 800 to 1,500 percent for some customers. VMware also ended partner programs that many service providers relied on.

HPE says it is introducing VM Essentials for Partner IT to help providers transition their virtualised business applications. This will see it provide VM Essentials software licenses free of charge for three years, with partners paying only support costs, to the 600 partners who gain Private Cloud with Virtualisation competency by the end of the year.

The company is also extending its channel-only model to cover HPE Private Cloud PC3000 (formerly HPE Private Cloud Business Edition), HPE SimpliVity PC1000, and HPE Zerto software from July 1. HPE said this follows the success of selling Morpheus VM Essentials through a channel-only route to market.

Also at the Partner Growth Summit, the IT biz will disclose that it is unifying the HPE and Juniper Networks partner programs under its Partner Ready Vantage umbrella. The aim is to have a single, global program for partners to offer services across networking, cloud, and AI.

This change will take effect from November 1, after which partners will operate under one program with a simplified structure, aligned incentives, and a consistent engagement model, while existing investments are protected, or so HPE claims.

The company also says it will help cloud service providers build and operate differentiated private cloud services with CloudOps Software and the backing of HPE Partner Ready Vantage.

“Partners want a simpler way to engage and a bigger opportunity to grow,” said Simon Ewington, HPE’s SVP for Worldwide Channel and Partner Ecosystem.

As enterprises race to deploy AI across business functions, many CIOs and CTOs are finding themselves responsible for systems they may not fully oversee, creating a new governance challenge for technology leaders.

A new IBM Institute for Business Value survey of 2,000 technology executives found that two-thirds of CIOs and CTOs are being held accountable for AI systems they do not fully control. The survey also found that 70% of respondents said technology is being deployed across the business faster than IT can track it, while 77% said AI adoption is already outpacing governance capabilities.

Surveyed executives expect the number of AI agents deployed within their organisations to increase by 38% by 2027, yet only 11% said they are fully prepared for the scale of AI-agent deployment they expect over the next year. According to IBM, 80% of respondents also reported CEO-driven mandates to accelerate AI transformation efforts.

“For CIOs and CTOs, the challenge now is scaling AI systems that operate continuously and autonomously, often within governance models and architectures designed for a far slower, more predictable environment,” Matt Lyteson, CIO at IBM, said in a statement accompanying the report.

Britain’s National Crime Agency (NCA) has been told to urgently overhaul an IT estate so dysfunctional that officers say they are fighting serious organised crime despite the technology rather than because of it.

A new report by HM Inspectorate of Constabulary and Fire & Rescue Services (HMICFRS) has delivered a bruising verdict on the National Crime Agency’s tech, concluding that the systems underpinning Britain’s fight against organised crime are no longer up to the job.

The criticism lands despite inspectors otherwise finding much to like. The NCA was graded “Good” in several operational areas, including tackling serious and organised crime and working with partners. But throughout the report, inspectors repeatedly return to technology as a fundamental weakness running through the entire organisation.

“The NCA’s IT infrastructure isn’t fit for purpose,” the report states. Inspectors backed that assessment with a long list of examples, from officers manually re-entering data and sharing information by hand to teams relying on spreadsheets and other workarounds due to a lack of confidence in official systems.

According to the report, around 70 percent of critical IT incidents each month are linked to that technical debt, the result of years spent prioritising short-term fixes over long-term modernisation.

Officers told inspectors they did not trust the agency’s systems, while others described technology as a major drag on productivity. One interviewee summed up the mood: “IT is a blocker; we achieve in spite of it.”

Another was even less flattering. “When I started in policing 15 to 20 years ago, I had better technology than I do in the NCA.”

The report paints a picture familiar to anyone who has worked in a large public sector IT environment. Officers told inspectors they routinely enter the same information multiple times, rely on manual processes, and manually transfer data to external partners. Some said the agency lacks even a basic personnel directory, making it difficult to find the right colleague when they need help.

While the NCA operates a corporate system called ATLAS CM, inspectors heard that officers are using as many as 50 different case management methods across the agency, including spreadsheets and other manual workarounds, often due to a lack of confidence in the official platform.

The agency’s security architecture has also produced its own headaches. Because data sits across multiple government security classifications, many officers reportedly require at least two laptops to do their jobs. Inspectors spoke to some staff who were using four separate machines and said they witnessed the resulting inefficiencies first-hand.

In a separate HMICFRS inspection published last year, inspectors found the agency was still relying on around 260 legacy IT systems more than a decade after beginning a project to modernise IT, with technical debt consuming roughly 80 percent of entire IT budget.

Most businesses believe they are well-prepared to face cyberattacks, but the number of successful breaches in the last year alone paints a different picture.

Last week, NordLayer released a new report, called “Why Browser Security Can’t Wait: Web-based Threat Report 2026.” In it, the company states that while 73% of organisations claim to be prepared for web-based attacks and are confident in their solutions, 82% experienced some form of web-based attack.

The paper is based on an analysis of 504 “highest rated and most reviewed work applications”, an analysis of data stolen from various info-stealers, and a survey of 405 US cybersecurity and IT professionals.

NordLayer stresses that coverage is “modest and uneven”, with data loss prevention tools (DLP) leading at just 53%, followed by other security controls. Nearly all IT professionals reported that their organisations are concerned about web-based threats (98%), and most expect escalation. In fact, 81% expect greater sophistication and 73% believe there will be more incidents in the coming years.

“There’s a clear gap between recognising the threat and knowing how to address it,” says Buinovskis. “Concern is high, but awareness of which controls actually solve browser-specific risks is low. Much of the initial confidence most likely comes from having general security controls in place, yet they rarely adequately cover risks in the browser.”

The researchers also stressed that 100% of the tested applications were browser-accessible, and almost four in five (78.8%) were browser-only. At the same time, malware was able to harvest 1.8 million credentials and 68.8 billion cookies last year.

“Hackers don’t hack anymore, they just log in,” says Buinovskis. “Stolen cookies and credentials grant immediate access without raising alarm bells — a login looks legitimate. It’s low risk, high reward, and as reliance on web-based SaaS grows, so does the value of stolen data. Attackers will keep exploiting this until organisations secure the browser as a critical boundary.”

Azul has published a new whitepaper warning organisations that running Oracle Java in production without a paid subscription carries serious financial and compliance risks.

The whitepaper, titled “Oracle Java Uncovered: What Free Java Users Need to Know Now,” comes as 73% of organisations report having been audited in the past three years.

Under Oracle’s Java SE Universal Subscription model, licensing costs are calculated based on total employee count, regardless of actual Java usage across the organisation.

A single unlicensed instance can trigger a demand to license the entire organisation, often accompanied by multi-year back-usage fees charged at list price.

That exposure extends beyond current employees, with audits potentially requiring organisations to license every contractor and part-time worker in addition to full-time staff.

The whitepaper outlines four paths forward for organisations currently running Oracle Java without a paid license, giving decision-makers a structured framework for evaluating their options.

Azul also cautions that switching to unsupported OpenJDK is not a straightforward fix, as it may not protect against back-usage fees tied to historical downloads of Oracle Java.

Unsupported OpenJDK also introduces its own risks, including patch stability concerns and regulatory exposure under compliance frameworks such as PCI-DSS 4.0 and DORA.

For organisations considering migration, Azul notes that OpenJDK is fully interchangeable with Oracle Java and requires no code changes or re-architecture to implement.

Commercially supported OpenJDK providers offer migration methodology, automated tooling, and expertise designed to reduce the time and resources required for transition.

Azul describes itself as the trusted leader in enterprise Java for the AI and cloud-first world, with its platform powering mission-critical systems for 36% of the Fortune 100.

The company also counts 50% of the Forbes Top Ten World’s Most Valuable Brands and the world’s top 10 financial trading companies among its customers.

The full whitepaper is available for download at azul.com/oracle-java-uncovered for organisations seeking to assess their current exposure and evaluate next steps.