iiinova — where your digital self keeps evolving

Aaron Engelsrud @aaronengelsrud.com · 28/08/2026

A Backup You've Never Restored Isn't a Backup Last successful backup timestamp is not a recovery posture. Last successful restore test, with a named RTO you actually hit, is. If you haven’t restored PeopleSoft end-to-end this year, assume you can’t.

110

Aaron Engelsrud @aaronengelsrud.com · 28/08/2026

Feature Delivery Is Slowing. Security Delivery Isn't. PeopleSoft HCM and FSCM drop to two update images a year in 2027 because that's what customers actually absorb. Security patches went the other direction. Your staffing plan has to serve both curves.

000

Aaron Engelsrud @aaronengelsrud.com · 27/08/2026

Ask Who Has PeopleTools Security. Then Run the Query. You'll get a name and a shrug: three or four people, maybe five. The join across role, permission list and user profile usually says eleven, and two of them left in 2023.

000

Aaron Engelsrud @aaronengelsrud.com · 27/08/2026

Undocumented Customizations Are Future Incidents The customization that isn’t in your inventory will be the one that breaks on the next Image, and nobody will know why until payroll fails. A living list of custom objects, owned by someone, is cheaper than the war room.

000

Aaron Engelsrud @aaronengelsrud.com · 26/08/2026

The Component You Forgot Is the One They Use August brought a 9.8 in PeopleTools plumbing most sites forgot was still enabled. Same pattern as June. The dangerous surface isn't what you built—it's what you never turned off.

000

Aaron Engelsrud @aaronengelsrud.com · 26/08/2026

The Promotion Path Is the Real Security Boundary Who can move a project from DEV to PROD is a bigger control than most firewall rules. If your change path still runs on tribal knowledge and a shared App Designer login, you don’t have a promotion process. You have a hope.

000

Aaron Engelsrud @aaronengelsrud.com · 25/08/2026

Patch Fatigue Is Arithmetic, Not Attitude Oracle went from four security events a year to roughly twelve. Nobody's DBA headcount tripled to match. Stop calling it a discipline problem and start calling it what the math says it is: a staffing decision nobody said out loud.

000

Aaron Engelsrud @aaronengelsrud.com · 25/08/2026

Your Integration Account Is Probably Overprivileged Most PeopleSoft integrations run under a shared service account with more access than any single human. That account’s permissions are rarely reviewed because “it has to work.” Map what it can touch before the next audit asks.

000

Aaron Engelsrud @aaronengelsrud.com · 24/08/2026

A Test Environment That Drifts Is a Test You Can't Trust Different PeopleTools patch level, different customizations, data from two refreshes ago. Every difference between test and production is a false result waiting to surface on a Saturday night.

000

Aaron Engelsrud @aaronengelsrud.com · 23/08/2026

The Dangerous CVE Usually Needs a Login Unauthenticated vulnerabilities get the headlines and the emergency change windows. The ones that quietly reach critical data often need only a low-privileged account and a user willing to click. Model the interior, not just the perimeter.

000

Aaron Engelsrud @aaronengelsrud.com · 22/08/2026

Measure Patching in Dates, Not Intentions "We're current within a quarter" is a feeling. Release date, triage date, test apply, production apply—four columns for your last four security releases—is a number. Most teams have never written the table.

000

Aaron Engelsrud @aaronengelsrud.com · 21/08/2026

The Cheapest Roadmap Intelligence You'll Buy All Year Conference registration costs less than one week of guessing at Oracle's timelines. Roadmap sessions are where release dates that affect your next budget cycle actually get answered—and early pricing deadlines pass quietly.

000

Aaron Engelsrud @aaronengelsrud.com · 20/08/2026

Advisories Are Revised After You Read Them The July Critical Patch Update has been revised twice since it was published. Patching once against a document that keeps changing isn't a completed task—it's a subscription you have to keep reading.

000

Aaron Engelsrud @aaronengelsrud.com · 19/08/2026

Knowing Your Release Isn't Knowing Your Patch Level "We're on 8.61" is not an answer to a CVE question. Both fresh PeopleTools vulnerabilities this quarter were release-specific and patch-specific, and only one of those two numbers is usually written down anywhere.

000

Aaron Engelsrud @aaronengelsrud.com · 19/08/2026

Oracle wants customers staged to install the next Database RU the day it ships (19c 19.32 / 26ai 23.26.3, 20 Oct). For PeopleSoft shops the blocker was never finding the patch — it's the change window. open.substack.com/pub/peoples...

peoplesoftcloud.com

The Next Database RU Is a Deadline, Not a Suggestion

Aaron Engelsrud | Published on PeopleSoftCloud.com

000

Aaron Engelsrud @aaronengelsrud.com · 18/08/2026

Oracle's Security Calendar Changed and Yours Probably Didn't Critical Security Patch Updates now land monthly, not quarterly—one ships today. If your change calendar still shows four security windows a year, you've built a 30-day lag into every critical fix.

000

Aaron Engelsrud @aaronengelsrud.com · 18/08/2026

Automation Is a Security Feature Automated builds, automated patching, automated deployments, and automated testing reduce human error. Consistency is one of the strongest security controls you can implement.

100

Aaron Engelsrud @aaronengelsrud.com · 16/08/2026

PeopleSoft Upgrades Are Getting Easier Selective adoption changed the conversation. Modern PeopleSoft upgrades aren't necessarily multi-year projects anymore. The process is finally catching up to the promise.

000

Aaron Engelsrud @aaronengelsrud.com · 15/08/2026

The Best Time to Test Disaster Recovery Is Before You Need It Backups are comforting. Restores are confidence. If you haven't tested your recovery process recently, you don't actually know your recovery time objective.

120

Aaron Engelsrud @aaronengelsrud.com · 14/08/2026

Least Privilege Works in ERP Too Most security incidents don't require hackers. They require excessive permissions. Regular role reviews remain one of the highest-value security activities in PeopleSoft.

010

Aaron Engelsrud @aaronengelsrud.com · 14/08/2026

Your Internet Gateway Deserves Attention PIA, WebLogic, Integration Broker, Elasticsearch, and Process Scheduler all create attack surfaces. Security isn't a firewall anymore—it's layered architecture.

010

Aaron Engelsrud @aaronengelsrud.com · 12/08/2026

Security Starts with PeopleTools Many critical security improvements don't arrive in application images—they arrive in PeopleTools. Staying current isn't just about features; it's about protecting your environment.

000

Aaron Engelsrud @aaronengelsrud.com · 11/08/2026

Quarterly Patching Beats Five-Year Projects Would you rather perform four predictable maintenance events a year or one massive upgrade every five years? Modern PeopleSoft favors incremental change over big-bang projects.

000

Aaron Engelsrud @aaronengelsrud.com · 10/08/2026

Every PUM You Skip Becomes Technical Debt Skipping updates saves time today but creates larger upgrade projects tomorrow. The organizations with the easiest upgrades are usually the ones upgrading continuously.

000

Aaron Engelsrud @aaronengelsrud.com · 26/04/2026

When you stop trying to control outcomes and start focusing on removing obstacles, things shift pretty quickly. You realize most teams don't actually need more direction. They just need fewer things getting in their way.

000

Aaron Engelsrud @aaronengelsrud.com · 25/04/2026

PeopleSoft is less about the technology and more about the history inside it. Every customization tells a story. Every integration solved a problem at some point. You're not just managing a system, you're inheriting decisions.

110

Aaron Engelsrud @aaronengelsrud.com · 24/04/2026

You can tell a lot about a team by how they handle mistakes. Do people hide them? Or do they surface them quickly? Speed of recovery is usually more important than perfection.

000

Aaron Engelsrud @aaronengelsrud.com · 23/04/2026

Automation is great… until you automate a bad process. Then you just get bad results faster.

000

Aaron Engelsrud @aaronengelsrud.com · 22/04/2026

I noticed something about myself not too long ago… I was cutting people off in conversation more than I realized. Not intentionally, but enough to shape the conversation. People would get to a point, pause for half a second, and I'd jump in.

100

Aaron Engelsrud @aaronengelsrud.com · 22/04/2026

Every roadmap looks clean and logical. Until it meets reality. Then it becomes a series of “quick adjustments” that somehow last six months.

010

Aaron Engelsrud @aaronengelsrud.com · 21/04/2026

At some point in every IT career, you realize: The system everyone complains about… is also the system no one wants to be responsible for replacing. That's when you know it’s mission-critical.

000

Aaron Engelsrud @aaronengelsrud.com · 19/04/2026

If your team is afraid to tell you something is broken, you don't have a technical problem. You have a culture problem. And cultural problems are always harder to fix.

000

Aaron Engelsrud @aaronengelsrud.com · 18/04/2026

Cloud didn't eliminate operational problems. It just changed where they live. You trade hardware issues for configuration issues. You trade capacity planning for cost management. The work doesn't go away. It just evolves.

000

Aaron Engelsrud @aaronengelsrud.com · 17/04/2026

There are two types of documentation in IT: 📝 Documentation that doesn’t exist 📝 Documentation that exists but is no longer accurate

000

Aaron Engelsrud @aaronengelsrud.com · 16/04/2026

Up to now, the team has been building momentum with automation, IaC, and observability. Now comes the real challenge: letting go of control. Chapter 5 opens with a DBA pushing back on managed databases. And honestly, it's a fair reaction.

320

Aaron Engelsrud @aaronengelsrud.com · 16/04/2026

One of the best things a leader can say is: “I don’t know, what do you think?” Not as a deflection, but as an invitation. You'd be surprised how often your team already has the answer.

000

Aaron Engelsrud @aaronengelsrud.com · 15/04/2026

Every time I hear “we just need to replace Campus Solutions,” I always pause for a second… Replace it with what, exactly?

100

Aaron Engelsrud @aaronengelsrud.com · 15/04/2026

Most ERP roadmaps fail before they ever begin.

100

Aaron Engelsrud @aaronengelsrud.com · 14/04/2026

Most outages don’t come from big, dramatic failures. They come from small, reasonable changes that seemed like a good idea at the time. That’s why discipline in change management matters way more than heroics after something breaks.

010

Aaron Engelsrud @aaronengelsrud.com · 13/04/2026

There’s a difference between being busy and being effective. I’ve had days where I was slammed for 10 hours straight and accomplished almost nothing that mattered. And I’ve had days where I made one or two key decisions that moved everything forward.

210

Aaron Engelsrud @aaronengelsrud.com · 12/04/2026

Servant leadership isn't about being passive. It's about being intentional with where you spend your energy. Sometimes that means stepping in to help. Sometimes it means stepping back so someone else can grow. The goal isn’t control.

100

Aaron Engelsrud @aaronengelsrud.com · 02/04/2026

I'm becoming a bigger fan of small, consistent improvements over big transformations. AI is reinforcing this. The big stuff looks great in slides. The small stuff is what actually changes how teams work day to day.

000

Aaron Engelsrud @aaronengelsrud.com · 01/04/2026

Every time we modernize something, we uncover five decisions from 10+ years ago that actually made sense at the time. It's a good reminder: today's “why would they do that?" is tomorrow's “oh… now I get it."

010

Aaron Engelsrud @aaronengelsrud.com · 31/03/2026

PeopleSoft isn’t "old”, it's just very honest. 😀 It shows you exactly how your business actually works… not how you wish it worked. That's uncomfortable sometimes, but also really useful if you lean into it.

000

Aaron Engelsrud @aaronengelsrud.com · 30/03/2026

One underrated skill: explaining technical things in a way that doesn’t make people feel dumb. It’s harder than it sounds. But it’s probably more valuable than knowing the technical thing in the first place.

010

Aaron Engelsrud @aaronengelsrud.com · 29/03/2026

I used to think confidence came from knowing the answer. Now I think it comes from being okay not knowing, and still moving forward anyway. That shift changes everything.

000

Aaron Engelsrud @aaronengelsrud.com · 28/03/2026

We spend a lot of time talking about modernizing PeopleSoft. Less time talking about modernizing how we operate PeopleSoft. The second one probably matters more.

000

Aaron Engelsrud @aaronengelsrud.com · 27/03/2026

The longer I work in IT, the more I realize leadership is mostly about removing friction. Not adding process. Not adding oversight. Just quietly making it easier for good people to do good work.

100

Aaron Engelsrud @aaronengelsrud.com · 26/03/2026

Every time someone says "PeopleSoft can't do that," I get a little skeptical. Most of the time, it's not that it can't… It’s that we haven’t figured out the clean way to do it yet. There’s a big difference.

000