It can be tempting for CIOs and CTOs to turn on every AI capability available across their tech stacks, but that approach can create vendor sprawl and governance challenges.
In this installment of the IT Leaders Fast-5 — InformationWeek’s column for IT professionals to gain peer insights — Courtney Totten, CTO and CISO at Shutterstock, explains why her team took several months to evaluate AI tools, establish governance models and create guardrails before deploying those technologies. Her team has also been deliberate about “training the trainer” to extend AI knowledge throughout the organization.
Totten oversees Shutterstock’s network, cloud operations, security, engineering and AI infrastructure, and has been in the IT and cybersecurity industries for more than 20 years. She has held leadership roles in both the public and private sectors, including at General Electric, Thomson Reuters, Booz Allen and General Dynamics.
This column has been edited for clarity and space.
Courtney Totten, CTO and CISO, Shutterstock
The Decision That Mattered
What decision — technical or organizational — made the biggest difference recently, and why?
Over the past year, we made a conscious decision to be proactive with AI and not reactive. It took us six months to evaluate two of our [AI] tools, but once we evaluated them and created governance models and a framework with guardrails, we were able to onboard a total of eight tools in 10 months’ time.
It’s now about getting those tools into our team members’ hands, and getting to hear the use cases — not from technologists, but my business users. We’re seeing what they’re able to do to drive efficiencies and gain confidence that these tools are here to help them — with some guardrails. That has been amazing to watch over the last year.
Some of them were tools that we already had in place, but we hadn’t turned on the AI capability. For example, we leveraged Slack, but we hadn’t turned on AI capabilities. We conducted our security reviews, our evaluations and then we were able to turn some things on.
It sounds silly, but notes and summaries were a huge thing for us — we use Slack every day. That’s a great example where we turned something on for our users to make their lives easier.
We also leveraged ChatGPT to help our users. A simple thing was creating a Q&A doc. We had a team who felt like all day long they were just answering questions around our processes. How do you create something where we can take hundreds of pages of processes to simply respond to users’ requests so [our employees] could serve their customers? That was another great example where we were just able to eliminate a lot of that manual administrative work and get that off our team’s plate.
The Hard-Won Lesson
What didn’t go as planned recently — and what did it force you to rethink?
Costs — with cloud and AI growing exponentially, costs can get out of control. We realized this early on and were able to catch it at a healthy point. We created a dedicated team that includes some of our cloud architecture team members. That team is really accountable for monitoring all of our costs with our cloud providers and AI providers.
Now I have a cloud FinOps and governance team to not only monitor costs but drive optimization. In addition, we created a contest that we’ve opened up to [all teams], where we say, “help us identify opportunities to reduce costs, and we have prizes.” It’s a quarterly challenge, and it’s helped everyone realize that these things are turning into costs. How can we cut costs to make room for some of these other cool things that we want to do? It has created a sense of financial discipline for my engineering team, and all of my teams.
The Talent Trade-Off
Where are you investing in talent right now — and what are you consciously not investing in?
It’s not that we’re not investing in areas. If there’s an opportunity to help our team do more to amplify what we’re doing, that’s where I’m investing. I say all the time that resourcefulness is such an important skill.
We need to make sure that people have depth and that they can be resourceful and able to get things done. How do I invest in training my employees up? How do I give them a stronger sense of the different tools they have available to them and what they can leverage? We’re really big on training goals every single year, so we leverage our partners for free training.
We have some strong cloud partnerships where we get offered a lot of trainings through our agreements with them — AWS and Google are huge partners with us, and OpenAI. They’ve all helped through the entire journey from cloud to AI.
Also, making sure that we’re deepening our AI talent across every single position. AI in a couple years, maybe in a year, is going to be in every single team that we have, and that’s really exciting. I really feel like it’s a skill set we all need to have and to practice. Making sure that we have the right talent to drive outcomes is critical for me.
The External Signal
What recent external development is most likely to change how your organization operates, even indirectly?
Changes are happening every day — the [AI] models are changing every day, and every time we see a new model, it’s better than the last one. Preparing my team to be ready to evaluate and onboard new models is important for us.
For example, OpenAI’s launch of Codex recently — that was a great use case. My team’s been able to get their hands on it, and the things are able to produce — they’re all surprising themselves, which is really neat.
We’ve created a mentorship program to “train the trainer.” I have a few people on my team who were really experts in this space, and they took on a team of eight to train up, develop standards and guardrails. Now those eight people are training two to three people each. It will go out to everybody to have the same type of training experiences. Every single day, you’re hearing about new tools that are coming about.
A lot of our vendors are also figuring out how to stay relevant and incorporate AI. Do we need all of these other tools? It’s really important to always be monitoring your vendor landscape to see if we’re starting to develop too many tools that all do the same thing. You don’t want vendor sprawl.
The Perspective Shift
What have you read, watched or listened to recently that changed how you think about leadership or technology — even slightly?
There was recently an article on Martin Fowler’s site called “Humans and Agents in Software Engineering Loops.” This article talks about how engineers can get involved and be part of this change we’re experiencing. He highlights three different ways that engineers can position themselves in the entire engineering loop.
The first way is step outside the loop — let the agentic agents do what they need to do — to code and hope and pray it works out well. The second thing is to be in the loop — looking at every single manual piece of code and almost micromanaging it, which is going to be draining.
The third is focusing on the entire engineering loop itself and focusing on the output. It’s making sure you know how the agent works, making sure it’s doing what it needs to do, and then monitoring to make sure the output is happening. Because at the end of the day, the output is what we care about.
It’s about going back to standards, processes and guardrails — as long as you have those three things in place, you can focus on the output versus being too involved or being too hands off. That article really resonated with me because it’s my responsibility as a leader to help everyone be aware of how they can be involved. I want to give everybody the opportunity to produce the best outputs with the tools that we have.
