Insights hub.
From success stories to strategic insights — explore the ideas shaping what’s next.
Featured resources.
Whitepaper
AI Accelerated Middleware Modernization
7 Strategic Shifts for Reducing Complexity, Accelerating Transformation, and Preparing for Agentic AI.
Blog
Agentic AI Is Becoming the Enterprise’s Connective Tissue. Governance Has to Move Into the Flow.
McKinsey’s 2026 tech report calls agentic AI the ‘connective tissue of the enterprise.’ But agents that act at machine speed need governance at machine speed too. Static controls won’t work for dynamic agents—active, in-flow guardrails must run before the action, not after.
Blog
When AI Meets Enterprise Messaging: Lessons from IBM TechXchange and the Boston AI Summit
Why agentic AI is creating new opportunities for established messaging technologies and making enterprise governance more important than ever.
Blog
IBM MQ Alternatives: When ActiveMQ and Artemis Make Sense
What IBM MQ costs an organisation is a knowable figure. It comes off a renewal statement, an entitlement count or a licensing review, and finance can put a number against it down to the core. What replacing it would save is not knowable in the same way. There is no independent case study in the public record carrying real durations, team sizes and application counts, and every migration timeline in circulation comes from an organisation selling the migration.
Blog
CVE-2025-54539 & CVE-2025-29953: Apache ActiveMQ® .NET Client RCE
Most Apache ActiveMQ® security advice is about the broker. CVE-2025-54539 and CVE-2025-29953 turn that around: the broker attacks the application. A broker that has been compromised, impersonated or simply isn’t yours can send a crafted message to an Apache ActiveMQ® .NET client, and the client runs the attacker’s code while reading it.
Blog
CVE-2026-34197: Apache ActiveMQ® Jolokia RCE (CISA KEV Alert)
CVE-2026-34197 is a Jolokia RCE flaw in Apache ActiveMQ® Classic, reached through the broker’s Jolokia management API. Apache disclosed it on 6 April 2026. Ten days later, CISA added it to its Known Exploited Vulnerabilities (KEV) catalog, with a remediation deadline for US federal agencies of 30 April.
Blog
The Jolokia Problem: Eight CVEs, One Door in Apache ActiveMQ®
The Apache ActiveMQ® Jolokia endpoint has been the route to remote code execution in three separate years. In 2023, it was reflection into the JVM. In 2024, a default configuration left it without a login. In 2026, it was the broker’s own management operations, patched in March, exploited in April, and reopened three more times by summer.
Blog
10 Questions to Ask an Apache ActiveMQ® Support Vendor
Deciding to buy open source support for Apache ActiveMQ® is the easy part. Working out which vendor can actually keep a broker alive at three in the morning is considerably harder, because nearly every vendor in this market is vague in exactly the same places.
Blog
Banks Found AI Agents Inside Customer Accounts. Nobody Approved What They Did.
Major US banks have found AI agents operating inside customer accounts, signed in with credentials customers handed over themselves. Nothing was breached. The agents authenticated correctly, and some of them still did things nobody asked for. That gap between having access and having authority is the agentic AI security problem every enterprise running agents now owns.
Ebook
ActiveMQ® vs Artemis™ Selection Kit
Test the constraints that decide your broker, score both options against your workload, and plan a cutover you can reverse.
Whitepaper
In-Flow vs Gateway – The Agent Governance Architecture Guide
Where does governance belong in your agent stack? A practical guide to in-flow and gateway governance for the people who build and run AI agents.
Ebook
Migration Kit and Lower IBM MQ Costs
Build the cost case, scope which workloads can move, and plan a controlled cutover to Apache ActiveMQ® or Apache Artemis™.
Whitepaper
The Agentic AI Governance Framework
Policies, controls, and evidence for AI agents: a five-part framework, autonomy tiers, and a 90-day plan for governing agents that act.
Blog
Apache ActiveMQ® CVE-2023-46604: DripDropper Exploit Explained
When a CVSS 10.0 vulnerability is published, the expectation is that affected software gets patched within days. When it involves an open-source broker that processes business-critical transactions in enterprise environments, the expectation is that the security teams responsible for those brokers treat it as an emergency. “The attacks exploit a maximum-severity security flaw in Apache