The IT Circle: Corma interviews Ahmed, CEO of CastleBee,

Interview with Ahmed Chreif

CEO of CastleBee, a consulting firm specialising in Data, Cloud, and GDPR to drive operational excellence.

In this conversation, Ahmed shares lessons from more than 10 years in IT consulting and entrepreneurship. He explains why young professionals should go beyond pure technical skills to engage directly with business needs, and why developers today cannot ignore cloud, data, and cyber. He reflects on a global deployment project across multiple Eramet factories, where governance, architecture, and change management were as critical as technology. He stresses that visibility and cartography of applications are the foundation of cybersecurity, and that IT communication depends on people who can vulgarise, synthesise, and lead change. Looking ahead, he warns that CIOs must integrate cyber and GDPR “by design” from the start, because even small companies can be wiped out by a single phishing attack.

What advice would you give to someone starting out in IT in 2025?

With more than ten years of recruitment and consulting behind me, I think many young graduates underestimate the importance of understanding the business need. At school, we learn coding languages and technical stacks, but not how to qualify a client’s need and translate it into functional and technical deliverables. That is the skill that makes a difference.

So my first advice is to choose internships or projects where you will interact with clients. Get out of the purely technical prism and expose yourself to the reality of translating business needs into concrete solutions.

Second, do not stay confined to development. A developer today is part of a broader architecture that spans cloud, cyber, and data. You need at least a basic culture in these areas: what is an ETL, how data pipelines and orchestrators work, what are the basics of cybersecurity and authentication, and what defines a dataset. These are not “extra” anymore, they are part of the job.

💡 “Do not stay stuck in pure technique. Understand the business need and build a culture across cloud, data, and cyber.”

What IT project are you most proud of, and which one challenged you the most?

The most significant project I have led was at Eramet. Over two years, we deployed a data solution across their factories in France, Norway, the USA, Argentina, Gabon, Senegal, and New Caledonia. We were a team of four from CastleBee, and I was program director with a project manager and developers.

We had to design a standardised data architecture, implement governance, train local teams, and handle the change management. We went on-site in protective gear, observed how factory teams worked, and adapted the solution to each site. By the end, the solution was live across all factories, including a brand new lithium production plant in Argentina designed with more environmentally respectful processes. That project was not only technically complex but also strategically important for French innovation in lithium.

💡 “We went from site to site, in factories across the world, training teams, handling governance, and deploying a live data solution that still runs today.”

What impact will AI have on SaaS environments that are already complex?

There is no universal answer. SaaS applications are countless, and not all need AI. The right question is: for which use case, at what level, and to address what problem?

At the end of the day, SaaS replicates business processes in digital form. If AI can accelerate or simplify those processes, it has value. But you do not always need a “smart hammer” to kill a fly. Some tasks will benefit massively, others hardly at all. For me, it is case by case.

💡 “AI will certainly impact SaaS, but not everywhere and not in the same way. It is always case by case.”

How have you seen SaaS adoption evolve over the last 10+ years?

The pattern is always the same: early adopters, the mainstream, and laggards. Ten years ago, on the data side, a few companies like AXA invested tens of millions. They failed at first because they focused only on technology without aligning with business use cases and ROI. There was a “magical” aura around data and AI back then, with the idea that spending alone would guarantee results.

From 2017 onward, cloud technologies, ETL, and Spark started to mature and democratise. That triggered real adoption across industries from banking to retail to logistics. By 2025, maturity is much higher. Many companies now talk about data mesh, data-driven models, and cloud-native stacks. Of course, there are still laggards. Some retailers, for example, are only catching up now.

For AI, I feel today it is where data was ten years ago. There is hype, experimentation, and investment, but still a lack of clarity on real ROI.

Why is visibility over the application landscape so important?

It is absolutely crucial. Every CIO today is working on this. You cannot secure what you cannot see. Yet in most big companies I have worked with, real cartographies of the information system do not exist. Knowledge is scattered in people’s heads, not formalised in dashboards.

The first step in cybersecurity is to build a clear, shared map of applications, data flows, and users. Then comes the human factor: training employees to avoid phishing and risky behaviours. Around 80 percent of incidents come from human error.

In many of my client missions, real application visibility simply does not exist. In some factories, we still discover forms of shadow IT that escape official control. That is the reality: without visibility, you are blind.

💡 “The first step of cybersecurity is visibility. You cannot secure what you cannot see.”

What are best practices for IT communication with the rest of the organisation?

Communication means vulgarising and synthesising. IT teams need people who can lead change, not just technicians who speak in jargon. Having project managers or product owners inside IT who know how to speak to business teams makes all the difference. Training IT staff to communicate and drive change should be a priority.

What will the CIO role look like in five years?

It will not be easy. The pace of technological change means CIOs will need to appropriate more subjects than before, especially cyber and GDPR. You cannot launch a company today without building these “by design”. For small and medium businesses, a phishing attack can literally put them out of business.

That is why I believe the CIO of tomorrow must integrate compliance, security, and data governance from the start. At the same time, they will need to keep learning continuously because what is cutting-edge today may be obsolete in ten years.

💡 “CIOs can no longer ignore cyber and GDPR. These must be built in by design from day one.”

‍