CIO · Cybersecurity Leader · Board Member · Author
I help executives turn technology complexity into business clarity.
CIO operator, cybersecurity leader, board member, IDC advisor, author, and business translator. My work focuses on reducing friction, exposing risk, simplifying systems, and turning technology into measurable business leverage.
What I Help Leaders Do
The work is practical: reduce friction, make risk visible, improve decision quality, and align technology investment with business outcomes.
Technology strategy, cybersecurity and identity governance, technical health assessment, AI readiness, and AI agent governance for CEOs, CFOs, boards, and ownership groups.
Explore advisory services →Keynotes, panels, podcasts, and executive roundtables on tech debt, cybersecurity leadership, AI readiness, agent governance, identity and passwordless, and data governance.
View speaking topics →Practical frameworks and field-tested language for turning technical complexity into business conversations leaders can act on.
See the frameworks →AI Readiness
Most AI programs stall for reasons that have nothing to do with the AI. They stall on portfolio clutter, on data nobody owns, and on agents granted authority no person would be given. These questions run in sequence, and skipping one shows up later as cost, delay, or exposure.
The Value Density Index divides the annual business value a system delivers by the annual cost of the complexity it introduces. Decide what to amplify, simplify, consolidate, or retire on evidence instead of politics — and simplify your highest-value systems before you chase retirements.
IDC Research · PublishedTech debt inside infrastructure and data is the most common reason AI pilots never reach production. Sprawl, unclear ownership, and unmanaged data create drag before the first model runs. Readiness is a cleanup sequence, not a purchase.
IDC Research · PublishedLeast privilege and segregation of duties, applied to AI agents. Most organizations have handed a single agent read access, write access, and approval authority — a combination that would fail an audit if a person held it. Security tooling does not catch this.
IDC Research · In reviewTry It · Step 01
Pick one application you already argue about internally. Put a defensible annual dollar figure on the value it delivers, then on the complexity it costs you to keep it running. The ratio is its value density. Treat both sides as estimates with documented assumptions, reviewed with finance and the business owner — the point is comparability across your portfolio, not accounting precision.
VDI = annual business value delivered ($/year) ÷ annual complexity cost ($/year)
Annual business value delivered
Annual complexity cost
Move any slider to score this system.
—
Tickets, incidents, on-call load, manual runbooks, environment sprawl, and the specialist skills required to keep it supported.
Number of integrations, tight versus loose coupling, fragile pipelines, and custom middleware or glue code someone has to maintain.
Lead time for change, deployment constraints, testing burden, change failure rate, and upgrade friction from customization or version lock.
Duplicate sources of truth, reconciliation work, downstream dependency chains, quality remediation, and manual pulls in place of real pipelines.
Patch exceptions, compensating controls, privileged access sprawl, DR and continuity overhead, audit remediation, and regulatory exposure.
A VDI above 2.0 indicates strong value per complexity dollar. Scores are meant for relative comparison across your own portfolio, not as an absolute benchmark. Full methodology, worked examples, and portfolio-level application are in Value Density Index: A Practical Framework for Measuring Business Value Against IT Complexity Cost (IDC #US54465526, April 2026) — request a briefing.
The Readiness Agenda
Most AI programs are not constrained by model access. They are constrained by app sprawl, fragmented data, brittle integration, and uneven governance — conditions built up over years of practical necessity. Readiness is an enterprise capability agenda, not a tooling decision. Five priorities, and what progress actually looks like in each.
Leaders cannot reduce complexity they cannot see. Most organizations track applications but hold no map of integration paths, duplicate capabilities, data dependencies, or the shadow processes running outside governed architecture.
Inventory the whole digital environment, not the application list — integrations, data sources, unstructured concentrations, and ungoverned workflows — then use that baseline to find the friction that actually touches your priority AI use cases.
Progress looks like: integration map completed · shadow processes documented · duplicate capabilities identifiedHeavily used systems can still be poor strategic fits. High utilization hides data fragmentation, fragile integration dependencies, and weak governance — and none of that shows up in a license review.
Score the portfolio on business importance, integration burden, data quality impact, security exposure, and AI workflow relevance. The Value Density Index surfaces the systems consuming disproportionate complexity relative to what they return.
Progress looks like: redundant platforms retired · high-burden low-value systems decommissioned · clear systems of record establishedAI depends on timely, traceable, well-governed data. Duplicate records, conflicting definitions, unmanaged unstructured content, and inconsistent access controls constrain model performance and cap how far a deployment can scale.
Treat governance as a scaling discipline rather than a compliance exercise: metadata standards, lineage requirements, retention policy, access control, and named stewardship across both structured and unstructured information — starting with the domains your target use cases depend on.
Progress looks like: lineage documented for AI-adjacent workflows · stewardship ownership assigned · access policy enforcedETL jobs, custom scripts, API wrappers, and manually maintained logic hold critical workflows together. They work well enough for transactions and fail quietly under AI workloads that need real-time, governed, traceable data movement.
Document the integration dependencies behind your priority use cases and replace brittle point-to-point logic where it creates real operational or security risk. Tighten access controls and monitoring on AI-adjacent dataflows, especially those crossing third-party services.
Progress looks like: brittle integrations replaced or isolated · latency reduced in AI-relevant pipelines · third-party dataflow controls verifiedThe common pattern is a successful pilot, a stalled rollout, and disappointing enterprise adoption. It usually traces back to attempting scale before enough complexity was removed to support it.
Define a limited set of priorities with measurable outcomes and sequence modernization into manageable waves — beginning where data quality, ownership, and sponsorship are already strong. Use each wave to simplify the environment further, so the next one is cheaper.
Progress looks like: AI priorities tied to operational or financial outcomes · each wave linked to prior complexity reduction · governance keeping pace with deploymentDrawn from AI Readiness: Reducing App Sprawl, Data Debt, and Integration Risk to Scale Enterprise AI (IDC #US54661126, June 2026). See how this runs as an engagement →
Background
Dr. Ken Knapton has spent more than two decades in C-level IT roles, leading transformation across financial services, mortgage origination, healthcare, high-tech, hospitality, and entertainment. He is known for one core ability: making technology legible and accountable to the business leaders who fund it.
His background spans software development, enterprise security, CIO and CISO leadership, IDC research, graduate cybersecurity faculty work, and authorship. That mix gives his work a practical point of view. Technology should reduce friction, improve trust, protect the business, and create measurable leverage.
Today, Ken serves as CIO at WIN Brands, the hospitality company behind Costa Vida Fresh Mexican Grill and FatCats Family Entertainment. He also advises small and mid-market businesses through Rocky Mountain CIO, contributes published research as an IDC Adjunct Research Advisor for IT Executive Programs, and teaches graduate-level cybersecurity at ECPI University.
Technology complexity is business friction. Great CIOs reduce that friction until the business can move faster with more confidence.
Signature Frameworks
These frameworks turn technical complexity into management discipline. They help leaders see where technology creates leverage, where it creates risk, and where simplification will move the business faster.
Least privilege and segregation of duties applied to AI agents. Scope authority deliberately, gate high-impact actions, treat ingested content as untrusted, and keep an inventory of what every agent can reach. Structured to align with ISO/IEC 42001.
A business-facing way to quantify, communicate, and govern enterprise tech debt so it can be discussed with CEOs, CFOs, and boards.
Business value delivered per dollar of complexity introduced, scored system by system. The goal is not fewer applications for its own sake — it is higher value density across what remains.
Data sprawl, hoarding, and rot create operational drag and AI risk. Data governance is part of the technology debt conversation.
Third-party services, APIs, cloud dependencies, and shared data flows extend the risk perimeter. Leaders need visibility before failure exposes it.
Tech debt leverage expressed as a health rating — healthy, unhealthy, or sick — system by system. A positive frame executives engage with, and a shared language between IT and the rest of the business.
Credentials remain the leading way attackers get in. A phased, standards-based migration to FIDO2 and WebAuthn, sequenced by user risk, with legacy applications handled deliberately instead of left as permanent exceptions.
Run cost, integration upkeep, change friction, and resilience overhead tracked as a managed liability with named owners — plus guardrails on integration standards, customization limits, and deprecation.
Rocky Mountain CIO applies these frameworks inside growing organizations — assessment, governance, and executive decision support.
Visit Rocky Mountain CIO →Research
Research contributed as an IDC Adjunct Research Advisor for IT Executive Programs, written for technology buyers and the executives who fund them. Five perspectives, published across tech debt, simplification, AI readiness, identity, and agent governance.
Measuring the value an enterprise actually receives from any individual system against the complexity cost of keeping it, so leaders can prioritize what to amplify, simplify, consolidate, or retire. IDC #US54465526, April 2026.
How tech debt inside infrastructure and the data estate inhibits AI implementation, and the sequence for preparing an enterprise before it invests.
Least privilege and segregation of duties applied to AI agents — the control failures that scanning, monitoring, and endpoint tooling are not designed to detect.
Why credential-based authentication has become the primary attack surface rather than a defense, what the ROI of a passwordless program actually looks like, and how to phase a FIDO2 and WebAuthn migration around legacy constraints. IDC, December 2025.
Turning tech debt leverage into a technical health rating that executives and boards can act on, and a common language for prioritizing which debt gets paid down first. With Rob Baigert. IDC #US51849424, September 2024.
Full text is published by IDC. View the complete IDC research profile or request an executive briefing.
Current Operating Lens
At WIN Brands, Ken leads technology across Costa Vida and FatCats, where IT is tightly connected to guest experience, store operations, cybersecurity, data, infrastructure, support, and enterprise platforms. In restaurant and entertainment environments, technology decisions show up quickly in guest friction, order accuracy, loyalty adoption, support volume, and store execution. That makes simplification and governance practical operating disciplines, not abstract IT ideals.
Balancing standardization, brand needs, and operational practicality across distinct businesses.
POS, web, mobile app, loyalty, support, and enterprise customer data workflows that shape guest experience.
Infrastructure, helpdesk, cybersecurity, data intelligence, and enterprise platforms.
Turning technical work into risk, value, friction, speed, and business outcomes.
Field Notes
Agents inherit whatever access they are handed. What may this agent reach, and who approves what it does, are questions worth answering before the second and third agent arrive.
Platform choices affect speed, accuracy, support burden, and guest experience. The CIO role is to make those tradeoffs visible and actionable.
The conversation changes when tech debt is framed as business drag, decision latency, risk concentration, and reduced ability to execute.
Security improves when risk is documented, ownership is clear, controls are understood, and leaders can see whether exposure is increasing or decreasing.
In restaurant and entertainment environments, technology decisions show up in guest friction, order accuracy, loyalty adoption, support volume, and store execution.
Rocky Mountain CIO has service details, the engagement model, and a direct contact path.
Visit Rocky Mountain CIO →Speaking & Media
Ken speaks to CIO, CISO, board, and business audiences on AI agent governance, AI readiness, enterprise tech debt, identity and passwordless authentication, cybersecurity leadership, and the work of translating technology into business outcomes.
Least privilege and segregation of duties are enforced on every employee. Most organizations abandoned both the moment they deployed an agent — and no security tool will flag it.
Why AI readiness starts with infrastructure and data, how to sequence the cleanup, and what to fund first.
How CIOs can turn technical drag into an executive management discipline using leverage, risk, speed, and value.
What negative time-to-exploit means for cyber resilience and how leaders should think beyond patch availability.
Why AI readiness starts with cleaning up the data estate, clarifying ownership, and reducing unmanaged data sprawl.
Why awareness alone does not create adoption, and what leaders must do to build durable security behavior.
Compromised credentials remain the leading initial attack vector. What a phased passwordless program costs, what it returns, and why legacy applications set the timeline.
Rating the technical health of core systems, and reporting that rating to a board in language that changes funding decisions.
Published Works
A Business Leader's Guide to Measuring and Managing Enterprise Tech Debt Leverage.
Enterprise tech debt slows decisions, raises risk, and makes execution harder. This book gives executives a practical way to discuss, measure, and manage that drag in business terms — and a common language for the AI readiness work that follows.
Ken is also the author of Cyber Safety: A Family Guide to Online Security & Technology Standards.
Insights
Advisory · Rocky Mountain CIO
Rocky Mountain CIO applies these frameworks inside growing organizations. Each engagement produces an artifact a CEO, CFO, or board can act on — a ranked portfolio, a sequenced plan, a health baseline, an authority inventory — not a slide deck of observations.
Score your tier 1 and tier 2 systems on annual business value delivered against annual complexity cost. Calibrated with finance and the business owner.
You get: a ranked portfolio, an action per system — amplify, simplify, consolidate, or exit — and the complexity dollars attached to each.
Inventory applications, integration paths, data dependencies, and shadow processes against the AI use cases you actually intend to fund.
You get: a dependency map, the structural friction blocking each use case, and modernization sequenced into waves with owners and measurable outcomes.
Least privilege and segregation of duties applied to AI agents. What each agent can reach, where read, write, and approval authority overlap, and which actions need a human gate.
You get: an agent inventory, an authority boundary per agent, and a control set structured to align with ISO/IEC 42001.
Rate core systems across a continuum from healthy to sick, grouped the way the business thinks — customer-facing, financial, employee productivity.
You get: a health baseline, a refresh cadence, and a funding case executives and boards will engage with.
Phase a FIDO2 and WebAuthn migration by user risk, extend your existing IAM rather than standing something up beside it, and decide deliberately what happens to legacy applications.
You get: a phased rollout plan, a three-to-five year cost and benefit model, and a legacy strategy that doubles as tech debt reduction.
Most engagements begin with a working session — one system, one use case, or one agent — to establish whether the framework fits your environment before anyone commits to scope.
Schedule a briefing →Get in Touch
Use the calendar for advisory, speaking, media, or executive briefing conversations — including briefings on any of the published research.
Based in Utah, serving clients and audiences nationally. Available for executive advisory work, keynotes, panels, podcasts, and board-level briefings.