Sandy Carielli

Massachusetts

Principal Analyst at Forrester Research

Principal Analyst at Forrester, covering #appsec. Post about security, the Muppets, my beagle. All opinions are my own. she/her/hers

Featured in: Favicon

forrester.com Favicon

techtarget.com Favicon

securityboulevard.com Favicon

cdotrends.com Favicon

globalsecuritymag.com

Articles

As Consumers Turn To Agentic AI Use Cases, Businesses Must Adapt Or Be Left Behind

1 week ago | forrester.com | Sandy Carielli

When we published our report, The Age Of Agents — GenAI-Fueled Virtual Assistants Will Fundamentally Change Digital Interactions, in 2023, we were watching the rise of generative AI and looking around the corner, noting that AI agents will reduce consumer friction and change how consumers engage with digital businesses. Two years later, agentic AI is one of Forrester’s top emerging technologies.
President Trump Amends Previous Cybersecurity Executive Orders: Here Is What You Need To Know

2 weeks ago | forrester.com | Sandy Carielli

On Friday June 6th, President Trump issued an executive order on national cybersecurity. The order amended and struck several provisions in Executive Orders 13694 and 14144, which were respectively issued by President Obama in 2015 and by President Biden in early 2025. The biggest changes were in the areas of software security, post-quantum cryptography, digital identity, fraud management, and AI. In some cases, Trump’s EO dropped technology specifics for certain guidelines.
The State Of Application Security, 2025: Yes, AI Just Made It Harder To Do This Right

1 month ago | forrester.com | Sandy Carielli

Our annual report on the state of application security is one of our favorites. We love digging into the data to see how priorities and adoption have changed. This year, the explosion of AI in applications and in-application development exacerbated existing trends and introduced new concerns. Here are some areas that got our attention.
It’s Time To Start Planning Your Postquantum Migration

1 month ago | forrester.com | Sandy Carielli

While we cannot determine when commercially available quantum computers (aka Q-Day) will be able to break asymmetric cryptography and algorithms, Forrester’s best estimate is that this will happen in 10 years. But it could also happen in five or 20 years. Currently, many governments have established a deadline of 2035 for full migration to use of postquantum cryptography (PQC). The Australian Signals Directorate guidelines for cryptography are the most aggressive, with 2030 as the deadline.
RSAC Conference 2025: Innovation Sandbox Turns 20

1 month ago | forrester.com | Sandy Carielli

RSAC Conference 2025 started off strong last Monday morning with the 20th annual Innovation Sandbox competition. For those unfamiliar with the competition, 10 emerging cybersecurity companies give a 3-minute pitch to a panel of judges, who ask questions and then select a winner and a runner-up. Since the start of the contest, the finalists have collectively seen over 90 acquisitions and over $16.4 billion in investments.
RSAC Conference 2025: Welcome To The Petting Zoo

1 month ago | forrester.com | Sandy Carielli

If you walked the RSAC Conference 2025 show floor this year, you could be forgiven for thinking you were at the world’s strangest petting zoo or furry convention. There were goats! There were puppies! And if real animals on the conference show floor aren’t your thing (social media posts from RSAC 2025 attendees revealed mixed opinions), you also had robot dogs or your pick of people in furry animal costumes.
WAFs Are Now The Center Of Application Protection Suites

Mar 20, 2025 | forrester.com | Sandy Carielli |Andras Cser |Heidi Shey

Although not a new technology by any stretch, WAF solutions continue their evolution. Today, WAF solutions are cloud-based and protect applications and APIs in hybrid and multicloud environments. WAF solution vendors have expanded their remit to address API attacks and layer 7 DDoS and are working to integrate WAFs with bot management, API security, and client-side security tools to offer complete application protection platforms.
Application Modernization And Multicloud Managed Services

Mar 5, 2025 | forrester.com | Bill Martorelli |Sandy Carielli |Cheryl McKinnon

Applications modernization remains a critical priority for enterprises as they continue their journey to the cloud and beyond. While the “lift and shift” era of cloud migration has ended, the modernization journey, continues. And many enterprises require assistance from external service providers, not only for the purpose of modernization, but operational efficiency. In light of this, yesterday we released The Forrester WaveTM: Applications Modernization and Multicloud Managed Services 1Q 2025.
Pixels Unbound: The State Of GenAI For Visual Content

Feb 4, 2025 | forrester.com | Indranil Bandyopadhyay |Leslie Joseph |Sandy Carielli

GenAI for visual content is the subject of many memes—think pictures of humans with three hands. But while the technology is not yet perfect, it’s gaining traction across industries, from retail and manufacturing to insurance and the public sector. Organizations are leveraging this technology to create immersive and interactive customer experiences like virtual try-ons and hyper-personalized marketing campaigns—as well as virtual simulation environments and AI designs.
DeepSeek-R1: Why So Startled?

Feb 4, 2025 | forrester.com | Leslie Joseph |Sandy Carielli |Akshara Naik Lopez

This blog post follows several others by my excellent colleagues at Forrester who have previously offered various approaches to thinking about, and understanding, Deepseek-R1. Last week saw the unmatched hysteria surrounding DeepSeek’s release of an open-source model that purportedly matches GPT-4’s capabilities at a fraction of the cost. Now that the dust is settling, it’s helpful to take a step back and understand all the kerfuffle in proper context.