The IT Nerd

Liquibase is calling attention to a growing accountability challenge as AI agents take on a greater role in changing production systems. Findings from the company’s 2026 State of Database Change Governance Report, published in March, show that 96.5% of respondents report at least one AI or LLM interaction with their production databases, while only 32% always or often create audit-ready database change history.  The warning follows new government action on autonomous AI.

On October 12, 2026, the UK government announced it is developing a specialist capability to respond to serious incidents involving AI agents, working with the National Cyber Security Centre, Department for Culture, Media and Sport, and the AI Security Institute. The government said that when such incidents occur, it must be able to quickly establish what went wrong and contain the risks. In the United States, a concept paper from NIST’s National Cybersecurity Center of Excellence focuses on identity, authorization, and auditing for AI agents, noting that agents are often treated as generic service accounts without dedicated accountability controls.

For enterprises, the same implications extend to production databases. Whether investigating an incident or proving control to an auditor, organizations need a reliable record of what changed, who or what initiated it (human or an AI agent), whether it was authorized, and what controls ran. When AI agents generate and deploy database changes, sometimes through shared service accounts, that record is often the hardest evidence to produce.

The Database Audit Readiness Gap

The 2026 State of Database Change Governance Report, based on a survey of 426 database, platform, technology practitioners and senior technology leaders, reveals a gap between how frequently organizations face audits and how consistently they maintain the evidence needed to demonstrate control:

• Audits are constant. 95.3% of respondents face multiple compliance or database audits annually, including 21.6% who face seven or more.
• Evidence is inconsistent. Only 32% always or often create audit-ready database change history. Another 39% do so sometimes, while 21% rarely or never do.
• Controls depend on people. Only 35% always or often automate security or compliance checks on database changes.
• Drift detection is inconsistent. Only 31% always or often automate drift detection, while 48% do so only sometimes.
• AI adds new risk. 46.5% cite ungoverned AI-generated SQL as a top AI-related database change risk.

Most organizations have governance processes, but the controls and evidence supporting those processes aren’t always applied consistently. As AI increases the speed and volume of database change, that gap becomes increasingly difficult to manage.

When AI Makes the Change, Who’s Accountable?

The accountability questions haven’t changed: What changed? Who authorized it? Were the right controls enforced? What has changed is how hard they are to answer once AI agents generate SQL  and initiate change through automated workflows. In the same survey, 33.6% of respondents report AI-generated  SQL interacting with their production databases, and 21.8% report human review if governance controls aren’t embedded upstream.

Organizations can’t rely on someone remembering to review a change, or on reconstructing its history after deployment. Governance has to be enforced inside the delivery process, with the evidence captured as each change happens.

Liquibase Secure 6.0 Brings Continuous Governance to Database Change

As AI accelerates software delivery, organizations need consistent policies, visibility into change activity, and a reliable record of how controls were applied, regardless of whether changes originate with developers or AI agents.

Introduced September 30, Liquibase Secure 6.0 brings these capabilities together in a unified platform to see, govern, and control database change across teams, pipelines, databases, and agents:

• Change Intelligence centralizes database change activity, deployment history, and policy outcomes, making it easier to understand what changed and demonstrate which controls were applied. Changes originating from developers or AI agents can be governed and tracked when deployed through supported Liquibase workflows.
• Centralized policy management lets teams define rules once and apply them everywhere, starting from 50+ prebuilt policy rules.
• Role-based access control and governed exceptions determine who can manage policies, assignments, exceptions, and governed assets, preserving separation of duties without slowing developers down.

The release builds on Agent Safe Governance, which helps enterprises validate, track, and govern database change whether it’s created by people or AI.

It’s Audit Season. Be Audit-Ready. Always.

Audits shouldn’t test your memory. Organizations need to know what changed, demonstrate that the right controls were followed, and produce evidence without reconstructing activity across tickets, logs, and spreadsheets.

To help organizations address these challenges, Liquibase has launched It’s Audit Season, an initiative focused on closing the gap between database change governance and audit readiness.

The campaign draws on findings from the 2026 State of Database Change Governance Report to highlight the risks of inconsistent controls, fragmented evidence, and the growing role of AI in software delivery. It includes a free Audit Readiness Assessment, an audit checklist, and practical guidance informed by the 2026 report.

Audit season comes around. Audit readiness never leaves.

Learn more: www.liquibase.com/auditseason

Liquibase today announced that Liquibase Secure is now available in Google Cloud Marketplace and Microsoft Marketplace, joining its existing listings in AWS Marketplace and Snowflake Marketplace. The expanded availability is part of Liquibase’s commitment to being easy to do business with: customers can buy Liquibase Secure through the channel that fits their organization and govern database change wherever their applications and data run.

This extended availability comes as the way software is built is changing quickly. Developers are shipping more frequently, AI coding assistants are generating more code, and agents are beginning to participate across the software delivery lifecycle. That means more database change, from more sources, moving toward production faster.

Liquibase Secure gives enterprises one governed path for standardized change, whether it was written by a developer, generated with AI, or initiated through an automated workflow.

Buy Through the Cloud. Govern Across the Enterprise.

With the addition of Google Cloud Marketplace and Microsoft Marketplace, Liquibase Secure is now available in multiple marketplaces. Buying through a marketplace lets organizations work through the cloud accounts and procurement processes they already have, simplify vendor onboarding, and consolidate billing alongside their other cloud spend. Customers can continue to buy directly from Liquibase or through its partners.

More Change Requires Better Control

AI coding assistants are already generating more code, which means more database change moving through the software delivery lifecycle. Now AI is moving beyond assistance. Agents can generate SQL, modify schemas, propose migrations, and increasingly take action through automated workflows.

The problem isn’t whether a database change was written by a human or AI. The question is what governs that change before it reaches production and what evidence is left behind after it does.

That becomes even more important as software delivery becomes more autonomous. An agent may generate a change, automated systems may validate and deploy it, and no person may manually touch it along the way. Enterprises still need to know what changed, who or what initiated it, what controls were applied, and what ultimately reached production.

Liquibase Secure puts governance and proof of control directly into the database delivery process. Organizations can:

• Automate database change through version-controlled CI/CD workflows.
• Stop risky changes before production with automated policy checks.
• Govern changes made by humans and AI with the same policies and approvals.
• Maintain an audit trail for database changes made by humans and AI agents.
• Detect drift and out-of-band change across environments.
• Recover faster with versioned change history and rollback context.

With Change Intelligence in Liquibase Secure, teams gain centralized visibility into database deployment activity, risk, drift, and policy outcomes across environments.

As software delivery becomes more autonomous, governance can’t depend on a human being in the loop. It has to be built into the path to production.

Availability

Liquibase Secure is available now in Google Cloud Marketplace and Microsoft Marketplace.

For more information about Liquibase Secure, visit Liquibase.com.

Liquibase today announced the general availability of Liquibase Secure 6.0, a major release that makes it easier for enterprises to automate and govern database change across mission-critical applications, data products, and AI initiatives.

The way enterprises build and deliver technology is changing quickly. Application and data teams are releasing more often, developers have more autonomy, and AI is dramatically increasing the volume of code and database change enterprises produce. But the controls around database change have not kept pace. Policies are still often scattered across pipelines, configuration files, repositories, and teams, making them difficult to manage consistently as organizations scale.

Liquibase Secure 6.0 changes that model by moving database change governance from pipeline-by-pipeline configuration to enterprise scale. Organizations can see database change across the enterprise, understand and remediate issues when they occur, define and manage policies from one place, set governed exceptions when they are needed, and control who has the authority to manage those policies. It gives enterprises a simpler way to answer three questions that become harder as the volume of change grows: What changed? Was it allowed? Who controls the rules?

Change Intelligence Turns Database Change Visibility Into Action

At the center of Liquibase Secure 6.0 is Change Intelligence, a completely new capability that gives enterprises a clearer picture of database change across applications, pipelines, teams, and environments.

Database teams have historically had to reconstruct what happened from pipeline logs, tickets, screenshots, and other disconnected sources. That becomes especially painful when something goes wrong. Teams need to understand what changed, where it failed, whether environments have drifted, what risk was introduced, and what they should do next.

Change Intelligence brings deployment activity, environment status, drift, policy outcomes, failures, and change history together in one place. Teams can understand how changes are moving across environments, identify where risk is building, and see what needs attention without manually piecing together the story across individual pipelines and tools.

More importantly, Change Intelligence helps teams move from visibility to action. When a deployment fails, AI-driven analysis helps teams understand what happened and provides remediation guidance to resolve the issue faster. Change Intelligence also centralizes audit evidence, giving engineering, security, and compliance teams a structured record of database change throughout the delivery lifecycle.

For executives and operators alike, Change Intelligence helps enterprises understand what is happening across the database estate, identify problems faster, and determine what to do next.

Making Enterprise Database Change Governance Easier

Governance has traditionally come with a tradeoff. Enterprises want consistent standards and stronger controls but they don’t want to create another layer of process that slows down delivery.

Liquibase Secure 6.0 also introduces a new graphical interface for policy management that makes governing database change much easier. Teams can create, organize, apply, and manage policies from one place instead of relying on pipeline-by-pipeline configuration or specialized command-line knowledge.

The new experience includes 50+ prebuilt policy rules based on years of working with some of the world’s largest and most complex enterprises. Teams can start with proven controls, organize them into reusable policy packages, and apply them across the applications and environments where they are needed.

The new experience also makes exceptions part of the governance model rather than something teams have to work around. When a legitimate exception is needed, teams can scope where it applies, document why it exists, control who can make it, and retain the decision in the audit history. Organizations can maintain consistent standards without pretending every application, data product, team, or database operates exactly the same way.

Controlling Who Can Change the Rules

As database change governance moves from individual pipelines to the enterprise, organizations also need control over who owns and manages those standards.

Liquibase Secure 6.0 introduces role-based access control that determines who can manage policies, assignments, exceptions, and governed assets. Organizations can separate ownership of governance from application and data delivery, creating clear responsibilities around who defines the rules and who works within them.

This allows enterprises to maintain separation of duties without taking autonomy away from development teams. Developers can continue moving quickly inside established boundaries, while database, platform, security, and compliance teams maintain control over the standards that protect the organization.

Together, Change Intelligence, centralized policy management, and role-based access control create a new operating model for database change. Enterprises can see what changed, govern what is allowed, and control who owns the rules from one platform rather than stitching together controls across individual pipelines.

Governance as a Force Multiplier for AI

AI is increasing how quickly enterprises can build and deliver applications and data products. But that advantage erodes if every increase in development speed creates a corresponding increase in manual review, operational risk, and governance overhead.

That is why governance becomes a force multiplier for AI. When database standards are defined up front and enforced automatically, enterprises can move faster with AI without requiring a human to review every database change it helps create. Whether a change is written by a developer or generated with AI assistance, the same policies and controls can be applied before it reaches production.

The goal is not to slow AI down so existing governance processes can keep up. Liquibase Secure 6.0 makes it possible for governance to operate at the speed of development, giving teams the freedom to increase the speed and volume of change while maintaining the controls the enterprise requires.

That model extends beyond AI. Liquibase Secure supports more than 65 database platforms, giving organizations a consistent governance layer across heterogeneous database environments. Platform and DevOps teams can scale database self-service without scaling governance overhead, database teams can spend less time rebuilding controls and reviewing routine changes, and security and compliance teams can put controls and evidence closer to the point of change.

As mission-critical applications, data products, and AI initiatives increase the speed, volume, and sources of database change, Liquibase Secure 6.0 gives enterprises one place to see that change, govern how it happens, and control who can change the rules, whether the change comes from a human or AI.

Availability

Liquibase Secure 6.0 is generally available September 30, 2026. The release includes Change Intelligence, the new graphical interface for centralized policy management, role-based access control, governed exception management, and 50 prebuilt policy rules.

For more information about Liquibase Secure 6.0, visit www.liquibase.com/liquibase-secure.

Liquibase today announced a major expansion of its global partner ecosystem and the appointment of Phil Robinson as Vice President of Global Channels and Alliances. The move builds on strong momentum for Liquibase Secure and growing enterprise demand for governed database change as AI, modernization, security, and compliance reshape software delivery.

Robinson brings more than two decades of channel, alliance, and enterprise open-source experience to Liquibase. Most recently, he served as Vice President of Global Channels at Digital.ai, where he helped redesign and relaunch the company’s channel program globally. Before that, he spent more than eight years at Atlassian, where he built and scaled global alliance programs with GSIs and Federal SIs, including Accenture, Deloitte, PwC, and Capgemini. His experience also includes leadership roles at Magento, Alfresco, and Hewlett Packard Enterprise across open source, cloud, systems integration, and enterprise software.

Trusted by 20 of the Fortune 100 and supported by a global community with more than 100 million downloads, Liquibase is investing in partners to help enterprises close the database delivery gap and build new services around Database Change Governance.

Robinson will lead Liquibase’s global partner strategy across partner recruitment, enablement, joint marketing, and partner-led services around Database Change Governance, while deepening the company’s engagement with cloud marketplaces and government partners.

AI is exposing the database delivery gap

Modern application and data delivery has accelerated in waves. Agile increased release velocity. Cloud spread applications, databases, and data platforms across more teams, tools, and environments. Enterprises responded by investing in CI/CD, automated testing, infrastructure-as-code, and security controls. But database change often remained governed through tickets, manual reviews, disconnected scripts, and processes that varied across teams, tools, and database platforms.

That disconnect has made the database one of the last major constraints on modern application and data delivery. Application code, infrastructure, and security increasingly move together, while database change is still treated as a separate process in many organizations. The result is fragmented governance, slower releases, and limited visibility into what changed, who approved it, and whether it is safe to deploy.

AI is not creating the database delivery gap. It is exposing it. As AI assistants and agents generate more software, they also increase the volume and speed of database change flowing through delivery systems that were never designed to operate at that scale. The challenge is no longer simply automating deployments. It is keeping database change synchronized with application code, infrastructure, and security before it reaches production.

The governance gap is widening. According to Liquibase’s 2026 State of Database Change Governance Report, 96% of organizations now have AI interacting with production databases, and 70% ship database changes weekly or faster. Yet only 28% enforce governance through automated controls and evidence, while 39% say they cannot reliably track what changed where.

For partners, this represents a significant opportunity to help customers modernize database delivery, govern AI-assisted development, strengthen compliance, reduce production risk, and bring database change into the same DevSecOps practices already established for application code. As enterprises look to scale AI safely, they need partners who can help modernize the processes that AI is exposing as bottlenecks.

Database Change Governance provides the control plane that keeps database change synchronized with application code, infrastructure, and security across the software delivery lifecycle. Liquibase Secure operationalizes that control plane across development teams, CI/CD pipelines, AI agents, and more than 65 database platforms, enabling enterprises to accelerate software delivery without sacrificing governance.

Why this is a partner opportunity now

For partners, this shift is a chance to become indispensable to their most complex customers. As database change outruns the ability to govern it, enterprises need a partner who can restore control at the exact point where developer velocity, compliance, and AI readiness collide. Liquibase provides an opportunity for partners to turn that challenge into a repeatable practice spanning advisory, implementation and managed services, reaching every environment a customer runs, from mainframe to cloud to lakehouse.

At the center of the opportunity is Liquibase Secure, which helps enterprises automate, secure, and govern database change across complex environments. With policy checks to deliver standardized change, advanced drift detection, structured audit trails, always-on evidence gathering, and more, Liquibase Secure gives developers, platform teams, security leaders, and compliance teams a governed path for every database change.

Liquibase already works with a robust group of consulting, cloud, public sector, and technology partners. Under Robinson’s leadership, the company plans to expand partner coverage both geographically and into specific industry sectors, creating clear paths for partners to build solutions and deliver Liquibase Secure, Database

Organizations interested in joining the Liquibase partner ecosystem can learn more at liquibase.com/partners.

Today, Liquibase is proud to release the open source Liquibase CVE Library (Common Vulnerabilities and Exposures Library) to foster security and transparency across the Liquibase Community. The free, publicly available library helps users of older versions of Liquibase Community identify existing vulnerabilities and get a clearer sense of their security posture. By tying vulnerability data directly to Liquibase releases, the CVE Library helps teams see their risk exposure, compare versions, and take informed action to secure the software they run.

Attackers need only to find a single exploit to breach a network and IT infrastructure, making comprehensive CVE libraries increasingly invaluable to security teams seeking to stay ahead of Mythos-class threat capabilities by patching all known weaknesses before they can be targeted.

To date, the Liquibase Community project has been downloaded over 100 million times.

How does the Liquibase CVE Library work?

Every time Liquibase ships a new release, automated security scanning tools analyze both the Docker image and the Liquibase binary for known vulnerabilities. Scanning also runs against previously published images, maintaining an up-to-date view of the evolving threat landscape and catching anything that surfaces post-release. The site organizes everything by image and version. You can see a high-level security grade and CVE counts for the latest release, drill into any specific version for the full vulnerability list, or use the comparison tool to see exactly which CVEs were resolved, or introduced, between two releases.

Which environments are supported?

• Docker images: The official Liquibase Community Docker image.
• Liquibase binary: Vulnerabilities in the Liquibase JARs themselves, regardless of how you install it.

What you’ll see

For each vulnerability, the CVE Library shows:

• CVE ID, Severity, and CVSS score: Presented with clear information and links to learn more.
• Affected package: The specific details needed to understand what is vulnerable.
• Fix available: The package version that resolves it, if one exists; and where applicable, the first Liquibase image version where the CVE no longer appears.
• Component type: Additional vulnerability details to help understand the risk.
• First-party vs. third-party: Whether the vulnerability is in Liquibase’s own code or an upstream dependency.

The full list is filterable by severity, component type, and keyword search, and can be exported as CSV or PDF. (Please also see figures with press release link on Business Wire, linked above.)

Part of a broader commitment to the Community

The CVE Library doesn’t stand alone. Since September of 2025, Liquibase has released a steady stream of enhancements and fixes for the Liquibase Community. Recently, in May of 2026, Liquibase standardized on two clear paths to updates: quarterly Community releases and continuous nightly builds on GitHub (available at github.com/liquibase/liquibase/releases/tag/nightly). The CVE Library now makes that ongoing work readily visible so users don’t have to just trust that issues are being addressed, they can see it, release by release.

For teams that need enterprise assurance

The Liquibase CVE Library gives Community users clear visibility into known vulnerability exposure. For organizations running Liquibase in regulated, mission-critical, AI-enabled, or enterprise production environments, visibility is often the first step. Liquibase Secure provides a fully supported enterprise distribution with SLA-backed support, tested components, policy checks, drift detection, structured audit logs, and governance controls for teams that need to reduce risk while maintaining delivery velocity.

Take a look and get involved

The Liquibase Community thrives because people around the world step up to contribute. Here’s how to get in touch and take part:

• Explore the CVE Library today at https://cve-library.liquibase.com.
• Ask questions or start a discussion on the Liquibase Forum.
• Report a bug or request a feature in the GitHub issue tracker at github.com/liquibase/liquibase.

Liquibase today announced Liquibase Secure 5.2, a major release introducing Agent Safe Governance for AI-generated database change. Liquibase Secure 5.2 helps enterprises validate, track, and govern database change before and after production, whether created by humans or AI.

Liquibase also announced that Liquibase Secure earned five 2026 TrustRadius Top Rated Awards across Database DevOps, Build Automation, Release Management, Database Management, and Version Control. TrustRadius Top Rated Awards are based entirely on customer reviews, with no paid placement or analyst opinion, and recognize products that meet criteria for review recency, customer rating, and category relevance.

Companies are moving faster across applications, infrastructure, data products, and AI initiatives. But every application, data product, and AI model still depends on database change. That creates a new pressure point: database changes can now be generated in seconds, while many enterprise controls still rely on tickets, manual reviews, disconnected scripts, and after-the-fact audit trails.

According to Liquibase’s State of Database Change Governance report, 96% of organizations allow AI to interact with production databases. As tools such as Cursor, Claude, GitHub Copilot, and other AI assistants become part of the developer workflow, database changes are no longer created only by humans. But faster creation does not mean those changes are safe to deploy.

Agent Safe Governance is Liquibase’s answer to that shift. AI can help create a database change, but it cannot bypass the checks, approvals, audit trails, schema lineage, drift detection, and recovery controls enterprises require before production.

AI is changing how database changes are created. Liquibase Secure governs how they reach production.

“AI agents are becoming part of how developers work, but they should not have a free pass to change production databases,” said Pete Pickerill, Co-Founder at Liquibase. “Agent Safe Governance means AI can help create a database change, while Liquibase Secure validates it, tracks it, checks it against policy, preserves schema lineage, detects drift, and controls how it moves to production. That is the balance enterprises need: faster development without turning database change into an unmanaged risk surface.”

Liquibase Secure 5.2 uses the Liquibase MCP server to connect AI-assisted workflows to govern database change management. Developers and AI assistants can create Liquibase-formatted changelogs, schema updates, rollback logic, and AI-generated DDL, while Liquibase Secure applies policy checks, governance workflows, drift detection, and audit-ready evidence before changes reach production.

Liquibase Secure 5.2 Brings Agent Safe Governance to the Database Layer: Liquibase Secure 5.2 gives enterprises one control plane for every database change, human or AI. The release connects new AI-assisted workflows with the proven governance controls enterprises already rely on to validate, track, and secure database change.

AI-assisted database change authoring through the Liquibase MCP server: The Liquibase MCP server connects AI-assisted workflows to Liquibase Secure, helping developers and AI assistants create structured, reviewable, and governed database changelogs, schema updates, rollback logic, and AI-generated DDL. AI can assist with authoring, but Liquibase Secure governs the path to production.

Change Intelligence and schema lineage for human and AI-generated change: Liquibase Secure gives teams visibility into the full lifecycle of every database change. Change Intelligence helps teams understand what changed, who or what created it, where it ran, whether controls were followed, how the schema changed over time, whether drift exists, and what evidence is available for audit or investigation.

Policy checks and drift detection as the governance foundation: Liquibase Secure applies policy checks before deployment to help teams block risky operations, enforce standards, support separation of duties, and validate compliance requirements. Drift detection helps identify when environments no longer match the approved database state, including manual updates, emergency fixes, shadow changes, or AI-assisted changes that bypass governed workflows.

Expanded enterprise database coverage: Liquibase Secure 5.2 deepens support for complex enterprise database estates with new capabilities for Teradata, MongoDB, and DynamoDB. These enhancements help teams extend governed change across the databases that power mission-critical applications, data products, and AI systems.

Machine-Readable Vulnerability Intelligence with VEX: Liquibase Secure 5.2 adds Vulnerability Exploitability eXchange, or VEX, support to provide machine-readable vulnerability assessments for Liquibase products. Published through the Liquibase VEX repository, included alongside SBOM files inside the Secure distribution, and available as standalone files on the Liquibase download site, VEX helps enterprise security teams understand vulnerability context, integrate with automated scanners, and streamline security response.

One Control Plane. Every Database. Every Change. Human or AI. Liquibase Secure 5.2 extends Liquibase’s role as the enterprise control plane for database change. It helps organizations govern database change across human developers, AI assistants, CI/CD pipelines, and production environments.

For regulated industries, this is already a board-level issue. Financial services, healthcare, insurance, retail, media, and technology organizations must prove that database changes are reviewed, approved, traceable, recoverable, and compliant. AI does not remove that requirement. It raises the stakes.

With Liquibase Secure 5.2, enterprises can move from reactive database control to continuous governance, with one consistent way to manage database change across applications, data products, and AI systems.

Liquibase Secure’s five 2026 TrustRadius Top Rated Awards reinforce the same customer demand driving this release: database change needs to move faster, stay governed, and remain trusted across increasingly complex enterprise environments.

Availability

Liquibase Secure 5.2 is available now. Learn more about Agent Safe Governance and Liquibase Secure 5.2.

Liquibase today announced The Financial Services Playbook for Governed Database Change, a new executive guide designed to help financial institutions modernize and secure one of the last major control gaps in enterprise technology delivery: database change.

Built for CIOs, CTOs, platform engineering leaders, database architects, and compliance teams, the playbook examines how banks, insurers, payment processors, fintechs, and capital markets firms continue to face a growing governance gap between highly automated application delivery pipelines and still-manual database change processes.

Field research for the Playbook was conducted across hundreds of financial services engagements spanning enterprise banks, regional institutions, credit unions, global insurers, payment processors, fintechs, and capital markets firms.

Among key findings:

• The problem is universal. Manual database change execution is the industry baseline, not a maturity problem at lagging organizations.
• Compliance is the accelerant. SOX, PCI DSS, SOC 2, and DORA are driving purchase decisions. When auditors flag deficiencies, budget materializes.
• The DBA bottleneck is structural. Executive mandates to remove DBA involvement from routine changes are appearing at the largest institutions.
• The proven path is pilot, platform, enterprise. Start with two to five applications, build the pipeline through platform engineering, then scale.
• Multi-database reality is the baseline. Oracle, SQL Server, PostgreSQL, Snowflake, DynamoDB, Databricks. Partial coverage is not governance.

Organizations that close this gap deliberately will set the standard. The rest will be forced to catch up by their auditors, their regulators, or a production incident.

Drawing on field research from hundreds of financial services engagements, the playbook argues that manual database change execution remains the industry norm, even at highly mature institutions. It outlines how mounting regulatory scrutiny from frameworks including SOX, PCI DSS 4.0, SOC 2, DORA, and emerging operational resilience requirements is accelerating demand for governed database delivery pipelines.

The playbook also addresses a growing concern around AI adoption in software delivery.

Liquibase recently explored that emerging threat in its analysis: Banks Focus on AI Models. Mythos Class Attackers Focus on Your Databases.

Rather than focusing narrowly on tooling, the playbook walks readers through the operational realities financial institutions face today, including DBA bottlenecks, fragmented deployment tooling, audit evidence reconstruction, schema drift, and growing separation-of-duties concerns.

The guide also details a practical maturity path for organizations seeking to modernize database governance.

• The governance gap: why database delivery remains structurally different from application delivery
• How governance failures create operational, audit, and regulatory exposure
• The evolving role of DBAs, platform engineering, and compliance teams
• An eight-principle target operating model for governed database change
• A phased rollout strategy covering pilot, platform, and enterprise adoption
• A framework for evaluating build-versus-buy governance approaches
• Metrics financial leaders can use to justify modernization investments
• The impact of AI-generated SQL and hybrid cloud database environments on governance strategy

TL;DR: FinServ Operational Resilience Is At Risk

Manual database change execution is throttling data security and is the FinServ industry baseline, not a maturity problem at slow-adopter organizations.

Organizations that embed governance directly into database delivery pipelines now will gain operational resilience and regulatory advantages. Institutions that delay modernization risk being forced into reactive remediation by data loss or corruption incidents, by audit pressures, and by competitive market forces.

The executive summary of The Financial Services Playbook for Governed Database Change is available now from Liquibase: https://www.liquibase.com/resources/ebooks/financial-services-playbook-for-governed-database-change

Liquibase today unveiled Liquibase Change Intelligence and a new suite of Liquibase Secure Deployment Connectors, expanding how enterprises understand, govern, and operationalize database change across modern delivery environments.

The new capabilities are designed to help teams understand database changes, monitor delivery performance, identify risk earlier, resolve issues up to 95% faster, and centralize audit evidence, while extending governed database change into the systems where developers, DBAs, and change teams already work, including ServiceNow, GitHub, Harness, and Terraform.

The announcement addresses a persistent gap in enterprise delivery. While application and infrastructure changes have become more automated, observable, and standardized, database change still too often moves through ticket attachments, side-channel SQL, manual approvals, and inconsistent execution paths. The result is slower investigations, weaker auditability, and more risk around outages, data integrity, and compliance.

Change Intelligence helps teams see what changed and respond faster

Liquibase Change Intelligence is designed to give teams a clearer view of what changed, how changes are moving across environments, where drift is emerging, and what requires attention next.

It brings together deployment activity, environment-level change status, drift signals, policy outcomes, and operational history so teams can answer critical questions faster: What changed? Where did it fail? Which environments are out of sync? Is drift increasing? What needs to be fixed now?

When failures occur, Change Intelligence is designed to help teams investigate with greater speed and context through AI-driven analysis that identifies likely causes and provides remediation guidance. Instead of forcing teams to reconstruct events from scattered logs, tickets, and tribal knowledge, it gives them a more direct path from issue to understanding to action.

Change Intelligence is also designed to help organizations centralize audit evidence for what changed, who approved it, where it ran, and what happened. That gives engineering, security, and compliance teams a more structured and accessible record of database change activity, reducing reliance on screenshots, manual evidence gathering, and fragmented reporting.

New connectors extend governed database change into the tools teams already use

Liquibase also unveiled a new suite of Liquibase Secure Deployment Connectors designed to extend governed database change into the platforms many enterprises already use to plan, approve, and deliver work.

For teams using ServiceNow, the connector is designed to bring database change into the existing approval process so approved tickets can result in governed, auditable deployments instead of manual SQL execution and disconnected handoffs.

For teams using GitHub, the connector is designed to bring database change into the same pull request and workflow model already used for application code, adding policy checks, validation, and deployment history tied to commits and branches.

For teams using Harness, the connector is designed to preserve existing pipelines while adding stronger governance, centralized visibility, and compliance-grade auditability around database changes.

For teams using Terraform, the connector is designed to extend infrastructure as code to the database layer, connecting Liquibase Secure to Terraform-managed instances through existing pipelines while enforcing database policies, applying versioned changeSets, and maintaining a complete audit trail over time.

Together, the connectors are designed to remove one of the biggest barriers to stronger database governance: the belief that teams need to rebuild their workflows to get it. Instead, Liquibase is extending governed database change into the systems teams already use, while strengthening traceability, standardization, and audit evidence across the delivery lifecycle.

Built for a new era of AI, data integrity, and operational accountability

The new capabilities reflect a broader shift in how enterprises are thinking about AI readiness and operational risk.

As AI initiatives expand, more changes are being generated, reviewed, and pushed through delivery systems at higher speed and greater scale. But when database change remains inconsistent, weakly governed, or hard to trace, the resulting risk does not stay isolated at the database layer. It carries into applications, analytics, automation, and AI-driven systems.

By helping organizations better understand database changes, catch drift earlier, investigate failures faster, and centralize audit evidence, Liquibase is giving enterprises a stronger operational foundation for trusted applications, data products, and AI initiatives.

Availability

Liquibase Change Intelligence, Liquibase Secure Deployment Connectors, and related capabilities are expected to begin rolling out in fall 2026. Additional details will be shared closer to availability.

Liquibase, the leader in Database Change Governance, today released the 2026 State of Database Change Governance Report, new research on how enterprises are managing database change as AI becomes embedded across production systems, analytics, and delivery pipelines. The report finds that AI interaction with enterprise databases is now widespread, while governance automation and consistent enforcement have not kept pace with the speed and scale of change. (The report and graphic are linked at bottom.)

For CIOs, the issue is not that AI touches production data. The issue is whether the organization can prove control at the database layer when change is frequent, environments are heterogeneous, and AI introduces new pathways for change and access. At AI scale, manual governance struggles to keep up. That is where risk compounds and then surfaces as data quality failures, audit friction, and outcomes leaders cannot explain.

Key survey findings:

• AI interaction: 96.5% of respondents report at least one AI or LLM interaction with their production databases, including analytics and reporting, training pipelines, internal copilots, and AI-generated SQL.
• Change velocity: 68.1% deploy database changes weekly or faster, including 10.8% deploying multiple times per day and 18.8% deploying daily.
• AI-era risk: 64.3% cite data quality issues as a top AI-related risk, and 46.5% cite ungoverned AI-generated SQL as a key concern.
• Estate complexity: Organizations report an average of five database and data platform types, and 29.1% manage ten or more database types.
• Governance gap: Only 28.1% report database change governance that is standardized and consistently enforced, while 42.3% remain at Ad hoc or Emerging. Only 7.7% report fully automated governance using policy as code with real-time enforcement.
• Audit pressure compounds the challenge. The report finds 95.3% of respondents undergo multiple compliance or database audits per year, with more than one in five facing seven or more audits annually.

The report highlights a widening operating gap. Enterprises are shipping database change continuously across diverse platforms, while governance often depends on documentation, manual review, and fragmented evidence. In an AI era, those approaches do not scale. As AI automations and AI-generated changes increase, the cost of inconsistent enforcement rises, and the blast radius of a single unmanaged change expands across downstream analytics and AI systems.

What customer behavior telemetry shows at AI scale:

Anonymized Liquibase Secure product telemetry, separate from the survey results, reveals the following.

• Governance is the default: 99.25% of Liquibase Secure sessions run with governance enabled, a necessary baseline as AI increases the volume of proposed change.
• Standardization enables automation: Nearly 86% of observed changelog activity is in XML and YAML, supporting machine-readable change definitions that AI-scale delivery can validate and enforce.
• Controls must exist before CI: About 90% of sessions run outside CI, reinforcing that as AI accelerates change, governance has to shift left into the developer workflow.
• Adoption starts with proof: Reporting is among the most exercised capabilities, reflecting early demand for audit-ready traceability as AI makes decisions harder to defend without evidence.

A practical roadmap and scorecard for CIOs

Beyond the survey findings, the report provides a staged operating model for moving from ad hoc database change to standardized, enforced, and observable governance, without slowing delivery. It also introduces a CIO-ready scorecard that pairs reliability metrics (MTTD and MTTR) with coverage metrics for automated controls, audit evidence, and AI-governed change, so leaders can measure progress and risk reduction over time.

Here’s a link to a summary of the 2026 State of Database Change Governance Report.

Liquibase, the leader in Database Change Governance, today announced the release of Liquibase Secure 5.1, extending modeled Change Control to Snowflake. With 5.1, enterprises can govern Snowflake control plane changes with the same rigor and automation they already apply to schema evolution, closing a critical gap in data platform security, compliance, and AI readiness. Liquibase Secure 5.1 also expands database platform coverage, including new support for additional cloud and enterprise data stores.

Snowflake has become mission-critical infrastructure for analytics, data products, and AI initiatives. As organizations scale DataOps and internal developer platforms, Snowflake changes are no longer isolated technical updates. They are platform-level changes that impact trust, availability, and every downstream consumer. Yet many of the most consequential changes still happen outside standardized governance, often delivered as scripts with limited visibility, weak enforcement, and evidence that is difficult to assemble when it matters most.

Modeled Change Control for Snowflake

Liquibase Secure 5.1 treats key Snowflake control plane changes as first-class, modeled change types, rather than opaque scripts. That modeling enables precise policy enforcement, object-aware drift detection, and audit-ready evidence at the level where access, movement, and execution are defined.

With Liquibase Secure 5.1, data platform teams can govern Snowflake changes across access and security configuration, data sharing and movement, platform and cost controls, and automated execution, using standardized workflows across environments and teams.

Key outcomes include:

• Stop risky Snowflake control plane changes before they reach production
• Standardize how Snowflake changes are delivered across environments and teams
• Automatically generate audit-ready evidence for every change
• Detect drift and out-of-band updates to governed Snowflake objects
• Recover faster with traceable, reversible changes and tested rollback procedures

This closes a long-standing gap for organizations that govern schema evolution, yet still struggle with over-permission creep, ungoverned data movement, and control plane drift that can undermine security posture and AI initiatives.

Built for DataOps, data products, and AI readiness

As Snowflake increasingly powers feature engineering, model training, and AI-driven decisioning, the blast radius of ungoverned change grows. A single access change can expose sensitive training data. An unreviewed sharing update can expand compliance scope. An execution change can silently alter business-critical logic. Liquibase Secure 5.1 helps data platform teams keep Snowflake predictable, auditable, and reliable as usage scales, without turning governance into a bottleneck.

Expanding database support across Liquibase’s industry-leading coverage

Liquibase Secure continues to deliver broad database coverage across 60+ platforms, from mainframe DB2 to cloud-native data stores. Liquibase Secure 5.1 expands support for Snowflake, Databricks, and MongoDB, and adds new platform support for Couchbase, AWS Keyspaces, DataStax Enterprise, and AlloyDB for Google Cloud. This breadth helps enterprises standardize change governance across heterogeneous environments using a single platform instead of stitching together siloed tools and processes. Teams can apply consistent workflows and generate unified, audit-ready evidence across their database estate, reducing operational overhead while preserving the flexibility to adopt new technologies without rebuilding governance each time.

Enterprise partnership, not just tooling

Liquibase brings more than a decade of frontline experience helping enterprises govern database change at scale. In addition to the platform, Liquibase provides hands-on professional services, a dedicated customer success organization, and ongoing advisory support to help teams operationalize Change Control across their delivery model.

Availability

Liquibase Secure 5.1 is available now. To learn more about Change Control for Snowflake and Database Change Governance, visit liquibase.com.