Your company can see faster than it can act

August 20, 2026

A vulnerability lands in your queue on a Tuesday in November. Everyone agrees it needs fixing. It gets fixed in March.
Nobody in that chain did anything wrong. The scanner worked. The analyst triaged it correctly. The change board met on schedule. The fix was tested properly, in a window agreed with the business.
Four months. Working as designed.
Now the real version.
On 7 March 2017, Apache published a patch for a Struts vulnerability. Two days later, Equifax's own security team emailed administrators instructing them to apply it. The following day, attackers began exploiting that same vulnerability through the Equifax dispute portal.
The information existed. The guidance existed. The email had already been sent.
The patch wasn't fully applied until 29 July—more than four months after Equifax had told itself what needed to be done. By then, the personal data of 147 million people had been exposed.
Equifax did not have an information problem.

The new bottleneck

For twenty years, the pitch has been the same: data is the new oil. Build the warehouse, then the lake, then the lakehouse. Buy the BI platform, build the governance program, hire the analytics team. Whoever sees the most wins.

That was true when information was scarce and analytical capability was a genuine advantage.

But the advantage has shifted.

Data itself has not become less valuable. Proprietary data is more valuable than ever. What has become commoditized is the ability to analyze information and generate insight. Capabilities that once required years of investment now arrive as products that every competitor can buy.

When everybody can see, seeing stops being the advantage.

Where time is lost

Look at what happens between a signal and a response inside a large organization.

The finding arrives. It waits for triage. Then an owner. Then prioritization. Then a change window. Then an approval from someone waiting on another approval. Very little of that time is work. Most of it is waiting. That gap deserves a name because you cannot manage what you have not named. Call it decision latency: the time between signal and action.

Every approval gate was introduced for a good reason, usually after something went wrong. A production outage led to change reviews. A bad contract meant legal approval. A costly purchase created a committee. A supplier issue added another form. Each of those was a sensible response to a real incident. And every single one of them is still there.

That is the ratchet. Organizations add controls after failures but rarely remove them once the risk has passed. The benefit of deleting an approval is shared by everyone; the risk of deleting it belongs to whoever signed it off. As a result, layers accumulate.

Ten years of incidents becomes ten years of process. Every single delay has a defensible answer. The total does not. That is why decision latency is so difficult to recognize from the inside—and why it has become one of the biggest competitive differentiators.

Nobody designed this. It accumulated.

Measuring the gap

Unlike data maturity, decision latency is measurable with data you already have.

Start with the clock: how long does it take to move from knowing something to doing something?

Then break that time down into four measurements:

  • The signal-to-action clock: Measure the time between the signal and the action that resolved it. Not meeting to meeting—alert to fix. Take your twenty most recent security findings and calculate it. The number is unlikely to match what you tell customers.
  • Hop count: How many people have to approve the decision between those two timestamps? Count them honestly, including the ones who only forward. The number is always higher than anyone in the room guesses.
  • Flow efficiency: Of the total elapsed time, how much was someone actually working on it? In most knowledge work, the answer is a single-digit percentage. The rest is queue.
  • Reversibility: How many of those approvals are guarding a decision that could simply be undone if it turned out wrong?
Engineering teams already measure a version of this. The DevOps research community calls it lead time for changes, and the difference between elite and low-performing organizations is measured in months, not days. Same industry, same tools, same talent, same access to information. The difference is not knowledge.

Now apply that same clock to security findings, customer complaints, pricing decisions and capacity requests.

Almost nobody measures these. Everybody should.

When AI meets the queue

Most AI programmes are aimed almost entirely at the seeing half of the problem.

Better dashboards. Richer insights. More recommendations. More risks identified. More anomalies detected.

Then every recommendation enters the same approval process that took four months last time.

That is not an improvement. It is simply increasing the arrival rate at a queue you never widened.

The organization sees faster. It still acts at the speed of the change board.

There is also a second-order effect that rarely appears in the business case. Every recommendation that goes unactioned teaches people to ignore recommendations. Generate enough of them and you do not improve decision-making—you create alert fatigue for your most valuable staff.

Which brings us to what happens when the warnings stop being read.

Automation isn't the risk

A common objection is: "If systems start making decisions, what could go wrong?" It deserves a better answer than a slogan.

Knight Capital provides one.

In 2012, the firm deployed new trading software to eight servers. One server was accidentally left running an older version of the code. A dormant testing function, never removed from that server, was reactivated when the market opened.

The systems had already detected the problem. Between 8:01 a.m. and the opening bell, they generated 97 warning emails identifying the affected system. Nobody treated them as alerts, so nobody acted.

When trading began, the faulty server executed millions of unintended trades. Forty-five minutes later, Knight had lost $460 million and the company was effectively finished.

Look at what actually failed.

Not automation. Dead code that had never been removed. A deployment that wasn't verified. No kill switch. And 97 warnings that nobody read.

Equifax had four and a half months. Knight had 89 minutes. Same problem. Different clock speed.

 

So no, the answer is not to take the humans out.

 

The answer is to take the waiting out. Those are very different things, and many organizations confuse them.

Regulation requires control, not delay

The objection I hear most from banks, insurers, hospital districts and public sector IT is simple: "We are regulated. We cannot let systems act on their own."

But regulation does not require slow decisions. It requires control. 

Modern regulations such as DORA (Digital Operational Resilience Act, since 17 January 2025) focus on whether organizations can demonstrate what happened, when it happened, which policy governed the decision, and whether the process can be audited afterwards. Nowhere does it require that a human hand performs the action.

So think about which of these two is genuinely easier to evidence.

A policy engine that evaluates decisions against defined rules and records every action. Or a change advisory board that met on Thursday, where the reasoning lives in the memory of whoever chaired it and the permanent record is a ticket comment saying "approved".

One of those is auditable. The other is a story people tell afterwards.

Regulation is not the reason your decisions are slow. It is the reason you were given for why they are slow.

Human judgment, machine execution

Judgment and approval are two things currently sharing the same queue, and they should not.

Judgment is deciding whether a trade-off is acceptable: take the risk, accept the outage, spend the money, disappoint the customer. Humans should own those decisions. They should do it deliberately, in advance, once, and write it down as policy.

Approval is confirming that an existing policy applies to a specific case. It is administration.

Encode the first. Automate the second.

Jeff Bezos, the founder and former CEO of Amazon, described this distinction through the idea of one-way and two-way doors. 

“Some decisions are irreversible and deserve careful consideration. Most are reversible and should move quickly.”

Many organizations have accidentally applied the one-way-door process to everything.

The question is simple: how many of your approvals are protecting decisions that could easily be undone?

A system that acts within clear boundaries, logs its actions and escalates exceptions is not the Knight Capital scenario. The lesson from Knight was not "do not automate." It was: “automate with guardrails, limit the blast radius, verify deployments and make sure warnings reach people who will act on them.

My own number

I will put one number of my own on the table, because it is the most honest way to make this point. I built an agentic operations platform in six days. It connected to real cloud environments, analyzed findings and took action.

When I priced the same scope using traditional delivery models—day rates, project plans and normal organizational processes—the estimate was many times higher and months longer.

The estimate was not wrong about the work. It was correct about the machinery surrounding the work.

That is the gap.

Not skill. Not tooling. Latency.

What to do on Monday

Pick one recurring decision your organization makes and examine the last twenty examples.

Measure:

  • time from signal to action
  • number of approval steps
  • percentage of time spent actually working versus waiting
  • how many approvals are judgment versus simple policy checks.
That last number is your opportunity.
Then do the thing most organizations never do. Put a review date on every remaining gate, and make somebody own the question of whether it still earns its place. It doesn’t require a platform, a vendor or a budget cycle. It requires somebody willing to write down a number that is going to be embarrassing: find your latency.

The measurement that matters

The real metric is not how much data you have collected, how many models you have deployed, or your AI maturity score.

It is how quickly you move from knowing to doing—and how many people need to say yes along the way.

Your competitors are about to see everything you see.

That was never the hard part.

The experience behind this perspective

I work with organizations that run regulated, mission-critical platforms—like I said, banks, insurers, hospital districts, and public sector IT. The pattern described in this article is not a theory I read about. It is what the last twenty years of cloud and SAP migrations, sovereignty programmes, and OT modernization projects look like from the inside.

Fujitsu’s own Uvance work points to the same challenge: helping organizations shorten the distance between data, decisions, and action. Our Data & AI approach is designed to compress decision cycles from days to hours, while our agentic AI model reflects the distinction at the heart of this article: 

“Humans remain accountable for judgment, while systems execute within defined, recorded, and auditable boundaries.” 

The technology to do this already exists. The question is whether your organization knows where its decision time is actually going.

Start with the metrics

Take one recurring decision. Pull the last twenty examples. Measure signal-to-action, hop count, flow efficiency, and how many of those approvals are policy checks rather than judgment.

If you want a second pair of eyes on those numbers, or on what could safely be encoded as policy in your environment, get in touch. Bring the twenty examples. We will start there. From there, we can identify where AI, automation, and better decision design can safely shorten the path from signal to action.

Toni Kuokkanen
Senior Lead Cloud Consultant & AI-artisan 
Toni Kuokkanen is a senior lead cloud consultant at Fujitsu with 30 years in enterprise IT. He designs and builds multi-agent systems that detect, diagnose and remediate cloud infrastructure without predefined runbooks, and leads Fujitsu's autonomous cloud operations work in the Nordics. His background spans multi-cloud architecture, SAP and OT modernization, and sovereign cloud programmes for regulated industries.

Toni Kuokkanen | LinkedIn

Editor's Picks

Beyond supply chain visibility: why organizations still struggle to respond effectively to disruption
Manufacturing supply chains face constant disruption. Yet, traditional supply chain visibility rare…
Big spend or frontline intelligence?
This Article from Fujitsu discusses a paradigm shift in manufacturing known as ‘Frontline Intellige…
June 3, 2026
Autonomous systems force leadership to define accountability, decision limits, and trust now—before governance gaps become visible failures.
Autonomous systems force leaders to grow up
Autonomous systems force leadership to define accountability, decision limits, and trust now - befo…