DEV Community: ZanReal

How to speed up a Next.js application without guessing

Mateusz Janota — Mon, 10 Aug 2026 13:27:39 +0000

Performance work in Next.js often starts with the wrong question: “what can we optimize?”. That is too broad. Soon the team is compressing images, moving components, removing libraries, changing cache settings and hoping the graphs improve. Sometimes they do. More often, nobody knows which change helped or whether the original bottleneck was even in that area.

A better question is: which route is slow, for whom, at which moment, and why? Only then does optimization become useful. This guide walks through a practical process: measurement, diagnosis and concrete Next.js techniques — Server Components, caching, Cache Components, Partial Prerendering, bundle analysis, images and third-party scripts.

A fast application is not an accident

Speed is not one metric. An application can have a fast first byte but ship too much JavaScript. It can have a small bundle but wait for a slow CMS. It can score well on the homepage and still be painful on a logged-in detail view.

Do not start with “let’s optimize Next.js”. Start with one route and one symptom:

the server response takes too long,
users see a blank screen,
interaction becomes available too late,
one section loads much later than the rest,
production is slow while local development looks fine.

Each symptom points to a different cause. A slow fetch is diagnosed differently from a large client component or a heavy marketing script.

Establish a baseline

Before changing code, record the baseline. At minimum, build the app and capture repeatable measurements for the selected route.

pnpm build
pnpm check

The build output shows first-load JavaScript per route. If one page ships much more JavaScript than similar views, inspect client components and imports before touching server code.

If the project has a bundle analyzer, run it separately:

ANALYZE=true pnpm build

Do not compare from memory. Write down concrete numbers: first-load JS, response time, LCP, TBT, request count and the largest assets.

Separate server problems from browser problems

The first split is simple: is the user waiting for HTML, or for JavaScript and browser resources?

If TTFB is high, inspect the server: CMS, database, third-party APIs, cache, metadata generation and dynamic Next.js features. If TTFB is reasonable but interaction is late, inspect bundle size, hydration, third-party scripts and heavy client components.

A small helper can reveal expensive server operations quickly:

export async function measure<T>(label: string, fn: () => Promise<T>): Promise<T> {
  const start = performance.now();
  try {
    return await fn();
  } finally {
    const duration = Math.round(performance.now() - start);
    console.info(`[perf] ${label}: ${duration}ms`);
  }
}

In production, send this data to your observability tool. Locally, even a simple measurement can show whether the bottleneck is the CMS, rendering, or duplicated queries.

Server Components should be the default

In the App Router, a component should stay on the server until it truly needs the browser. use client is for state, effects, click handlers and browser APIs. It is not needed to render text, links, cards, article lists or data fetched on the server.

export default async function BlogPage() {
  const posts = await getBlogPosts();
  return <BlogList posts={posts} />;
}

If BlogList only renders data, it should not be a client component. Move interactivity into the smallest possible child:

// Server component
export function BlogCard({ post }: { post: BlogPost }) {
  return (
    <article>
      <h2>{post.title}</h2>
      <SaveButton postId={post.id} />
    </article>
  );
}

The browser receives less JavaScript while the server still renders complete HTML.

Cache is not one switch

Caching in Next.js works well when the freshness rule is explicit. Otherwise it is easy to cache something user-specific or fetch live data that could safely be revalidated every few minutes.

export async function getCaseStudies() {
  const response = await fetch("https://example.com/api/case-studies", {
    next: { revalidate: 3600 },
  });

  return response.json();
}

For CMS content, a time-based revalidation window or publish webhook is often enough. For user-specific data, you need a different strategy because shared cache can become a security bug.

Avoid fetching the same data repeatedly

One route can fetch the same document multiple times: once for metadata, once for page content, once for JSON-LD and once for related sections. It is easy to miss because each request hides in a different helper.

import { cache } from "react";

export const getPost = cache(async (slug: string, locale: "en" | "pl") => {
  return sanityClient.fetch(postQuery, { slug, locale });
});

Cache at the right level. If the result depends on locale, preview, userId or a feature flag, those values must be part of the arguments or cache key.

Cache Components and `use cache`

In newer Next.js versions, look beyond classic fetch with revalidate. Cache Components let you describe which parts of the tree are cacheable while other parts remain dynamic.

export async function FeaturedPosts() {
  'use cache';

  const posts = await getFeaturedPosts();
  return <PostGrid posts={posts} />;
}

This is especially useful for pages with a stable marketing shell and a few dynamic islands. Not everything has to wait for the slowest section.

Partial Prerendering: static shell, dynamic islands

Partial Prerendering lets you treat a page as a combination of a stable shell and dynamic parts. The user sees structure earlier, while slower sections resolve through Suspense.

import { Suspense } from "react";

export default function Page() {
  return (
    <>
      <Hero />
      <Suspense fallback={<RelatedPostsSkeleton />}> 
        <RelatedPosts />
      </Suspense>
    </>
  );
}

This is not an excuse to hide slow queries behind a skeleton. It is a way to prevent one slower section from blocking the whole page when the business experience allows it to load later.

Reduce bundle size through `use client` boundaries

If one use client directive sits high in the tree, a large imported subtree can move to the browser. This is a common reason route bundles grow after a seemingly small UI change.

Instead of marking a whole section as client-side, extract only the interactive element:

// Client component
"use client";

export function ExpandButton() {
  const [open, setOpen] = useState(false);
  return <button onClick={() => setOpen((value) => !value)}>Toggle</button>;
}

The rest of the section can stay on the server. This usually helps more than micro-optimizing code inside the component.

Load heavy UI only when needed

Maps, charts, editors, animation libraries and complex forms do not always need to be part of the first load. If they are below the fold or behind an interaction, use a dynamic import.

import dynamic from "next/dynamic";

const PricingCalculator = dynamic(() => import("./pricing-calculator"), {
  loading: () => <div>Loading calculator...</div>,
});

Verify the build after the change. A dynamic import only helps if it actually reduces the main route bundle or moves cost to the moment when the user needs it.

Images: inspect LCP, do not guess

Images are often the largest payload, but not every image needs the same treatment. First identify the LCP element. If it is the hero, set dimensions, use an appropriate format and mark it as priority. If the image is lower on the page, priority can hurt.

import Image from "next/image";

<Image
  src={hero.url}
  alt={hero.alt}
  width={1600}
  height={900}
  priority
/>;

Do not set priority on many images at once. The browser cannot treat everything as the most important asset.

Third-party scripts are part of performance

Analytics, widgets, chat tools, consent managers and advertising pixels can hurt more than your application code. In Next.js, choose a loading strategy that matches the script's importance.

import Script from "next/script";

<Script
  src="https://example.com/widget.js"
  strategy="afterInteractive"
/>;

If the script is not needed for the first interaction, consider loading it later or only after user consent.

Verify every change

Good optimization ends with comparison. After a change, record:

route bundle size before and after,
duration of the slowest server operations,
LCP/TBT/CLS for the same route,
request count and largest resources,
draft mode or preview behavior if the route uses CMS data.

The worst scenario is several changes at once and one final score. Then you do not know what helped, what hurt and what was neutral.

A practical order of work

If you do not know where to start, use this order:

Pick one route and record baseline metrics.
Decide whether the bottleneck is server-side or browser-side.
Remove obvious duplicated fetching.
Shrink use client boundaries.
Move heavy UI behind Suspense or dynamic imports.
Make caching and revalidation explicit.
Then tune images and third-party scripts.

A fast Next.js application is the result of small, verified decisions. Measure, change one thing, and write down the result. That turns optimization from guessing into engineering work.

Simplify Next.js Proxy: from one large file to NEMO

Mateusz Janota — Mon, 10 Aug 2026 13:27:20 +0000

Next.js Proxy usually starts small. You add one redirect from an old path. Then an exception for draft mode. Later come locale handling, security headers, admin protection, legacy URLs after a content migration, and a special case for a crawler.

After a few months, one file becomes a place nobody wants to touch. Every change feels risky: will the redirect run before locale detection? Will Sanity preview still work? Will the private section guard catch static assets? Will a new redirect create a loop?

This article shows a practical way out. The goal is not to switch libraries for the sake of it. The goal is to make edge routing readable, testable and safe to extend. NEMO helps treat Proxy as an explicit set of proxy rules instead of one growing chain of conditions.

Proxy that grew faster than the app

The typical problem is not just file length. It is mixed responsibility. SEO redirects sit next to authentication. Locale detection sits next to draft mode. Security headers sit next to historical paths from a blog migration.

export function Proxy(request: NextRequest) {
  const { pathname } = request.nextUrl;

  if (pathname.startsWith("/_next")) {
    return NextResponse.next();
  }

  if (pathname.startsWith("/old-blog")) {
    return NextResponse.redirect(new URL("/blog", request.url));
  }

  if (!pathname.startsWith("/pl") && prefersPolish(request)) {
    return NextResponse.redirect(new URL(`/pl${pathname}`, request.url));
  }

  if (pathname.startsWith("/dashboard") && !hasSession(request)) {
    return NextResponse.redirect(new URL("/login", request.url));
  }

  const response = NextResponse.next();
  response.headers.set("x-frame-options", "DENY");
  return response;
}

The code may work, but it is hard to evolve safely. The missing piece is a clear model: which rules run first, which rules are exceptions, which only decorate the response, and which stop request handling completely.

Name responsibilities before changing code

Before introducing NEMO, split the problem into responsibilities. Most applications need a similar list:

technical paths Proxy should not touch,
legacy redirects after migrations,
URL canonicalization,
locale prefixes and language routing,
draft mode and preview exceptions,
session-protected sections,
security headers,
request diagnostics and metrics.

Only after this list is explicit can you decide the order. That order is more important than the library itself. A good order prevents most accidental regressions.

A rule should do one thing

The simplest model is a function that receives a request and optionally returns a response. If it returns nothing, the next rule continues.

type ProxyRule = (request: NextRequest) => NextResponse | undefined;

const rules: ProxyRule[] = [
  skipInternalPaths,
  legacyRedirects,
  draftModeBypass,
  localeRedirects,
  authGate,
  securityHeaders,
];

export function Proxy(request: NextRequest) {
  for (const rule of rules) {
    const response = rule(request);
    if (response) {
      return response;
    }
  }

  return NextResponse.next();
}

NEMO helps formalize this pattern as a proxy composition. The important rule remains the same: one rule, one responsibility, explicit order.

Put technical exceptions first

Proxy should not accidentally process Next.js files, images, favicons, health checks or endpoints that need to remain neutral. Keep those exceptions at the top. They reduce work and prevent surprising side effects.

const INTERNAL_PREFIXES = ["/_next", "/favicon.ico", "/robots.txt", "/sitemap.xml"];

function skipInternalPaths(request: NextRequest) {
  const { pathname } = request.nextUrl;

  if (INTERNAL_PREFIXES.some((prefix) => pathname.startsWith(prefix))) {
    return NextResponse.next();
  }
}

This looks basic, but these conditions often end up in random places. Then a new rule can start redirecting assets or breaking a preview endpoint.

Treat draft mode as a separate contract

Draft mode is easy to break because it behaves differently from normal traffic. Preview can see draft documents, unpublished slugs and technical query parameters. You do not want a locale rule or SEO redirect to run before preview logic.

function draftModeBypass(request: NextRequest) {
  if (request.nextUrl.searchParams.has("__vercel_draft")) {
    return NextResponse.next();
  }

  if (request.cookies.has("__prerender_bypass")) {
    return NextResponse.next();
  }
}

This does not mean draft mode should bypass every protection in every application. It means the rule should be named, tested and placed deliberately.

SEO redirects without loops

Legacy redirects are easier to maintain as data, not as a long series of conditions. That makes them easier to review, remove later and test in a table.

const redirects = new Map([
  ["/old-blog/docker", "/blog/docker-for-beginners-practical-guide"],
  ["/pl/old-blog/docker", "/pl/blog/docker-dla-poczatkujacych"],
]);

function legacyRedirects(request: NextRequest) {
  const target = redirects.get(request.nextUrl.pathname);
  if (!target) {
    return;
  }

  return NextResponse.redirect(new URL(target, request.url), 308);
}

For a larger redirect set, add validation that detects redirects to the same path. A loop in Proxy can block the page before the app has a chance to render an error.

Locale routing is not content fallback

A locale rule should decide the URL shape, not whether an article exists in a given language. Those are different problems. Proxy can enforce a /pl prefix, but the blog page still has to check whether the document has slug.pl or slug.en.

function localeRedirects(request: NextRequest) {
  const { pathname } = request.nextUrl;

  if (pathname.startsWith("/pl")) {
    return;
  }

  if (prefersPolish(request)) {
    const url = request.nextUrl.clone();
    url.pathname = `/pl${pathname}`;
    return NextResponse.redirect(url, 307);
  }
}

This distinction matters for drafts. A missing English slug should not make a Polish article render under an English URL. That belongs in the query and detail page logic, not in Proxy.

Test URLs, not implementation details

Good Proxy tests speak in URLs. Do not only check that an internal helper was called. Check what a user, crawler or Sanity preview will see.

it.each([
  ["/old-blog/docker", 308, "/blog/docker-for-beginners-practical-guide"],
  ["/pl/blog/docker-dla-poczatkujacych", 200, null],
  ["/blog/post?__vercel_draft=1", 200, null],
  ["/_next/static/chunk.js", 200, null],
])("handles %s", (path, status, location) => {
  const response = Proxy(makeRequest(path));
  expect(response.status).toBe(status);
  expect(response.headers.get("location")).toBe(location);
});

Keep separate cases for production traffic and draft mode. That is where conflicts between language, preview and redirects usually appear.

Migrate without a big-bang rewrite

Do not rewrite all Proxy in one commit. A safe migration is intentionally boring:

Freeze current behavior in table-driven tests.
Extract one responsibility into a proxy rule.
Keep rule order visible in one place.
Run the URL table after every extraction.
Only then remove the old condition from the large proxy file.

If a rule needs five parameters and knowledge of three other rules, the boundary is probably wrong.

What you gain

Good Proxy does not have to be short. It has to be predictable. After the refactor you should be able to answer:

which rule runs first,
which rule stops request handling,
which paths are excluded from Proxy,
how draft mode avoids normal redirects,
where to add a new redirect without breaking auth and i18n.

That is the real value of using NEMO here: less hidden logic, fewer accidental loops, and less stress every time routing changes.

Not Just AI Chat: How a Skill-Based Agent Supports Everyday Work

Mateusz Janota — Fri, 17 Jul 2026 07:05:42 +0000

AI is now present in many companies, but that does not automatically mean its capabilities are always being used well. It often helps only in isolated ways: writing text, summarizing meetings, organizing notes, or doing quick research. That can be useful, but there is a big difference between occasional AI use and integrating it into company processes in a sensible way. And that is exactly where AI agents and skills come in. See how these solutions work, explore their use cases, and find out how you can use them in your own work.

Many companies have already gone through the first stage of working with AI. First came the standard chat. Later, more tailored browser-based assistants appeared, such as custom GPTs in OpenAI tools or Gems in Gemini. That was a clear step forward, because it made it easier to define the context, tone, and types of tasks such a tool should support.

It quickly becomes clear, however, that this still does not solve everything. When AI is meant to provide support not occasionally, but regularly, within a specific process and according to specific rules, a standalone assistant stops being enough. You still need different tools for different tasks, still have to watch quality, still need to add context, improve the output, and check whether the final result is actually usable. The user is also limited mainly to a single prompt and, at most, a knowledge base, which is not always enough to get the desired result.

This is exactly where AI agents and skills come in, making it possible to move from ad hoc AI use to a more structured way of working. Instead of relying on limited browser-based assistants and hoping for the right answer, a company can gain more advanced, easier-to-use support that can also be developed and adapted to its own needs in a straightforward way.

What is an AI agent?

Put simply, an AI agent is a tool prepared for a specific role. It does not work only like a chat interface answering one question after another, but like an assistant embedded in a specific type of work. That is why it often turns out to be much more specialized.

Such an agent can be configured, for example, for content creation, sales support, organizing documentation, or technical tasks. What sets it apart from browser-based assistants is that it does not start every time from an empty field and a new prompt. It works within a more structured context and according to specific rules. It also gives you much more control: you can provide it with a full set of requirements, information, and restrictions, while not being nearly as limited by the top-down guidelines imposed by browser-based tool providers.

That matters for companies because day-to-day work rarely comes down to a single instruction. It usually involves several stages, different standards, revisions, and dependencies between people, documents, and tools. An agent becomes valuable when it can fit into that structure and improve the way company processes run.

How does it work? From the user’s perspective, the workflow is very similar to talking to a standard AI chat. You tell the agent what you need, and it carries it out. The difference is that it can draw on a broader base of guidelines and information, choose its own way of completing tasks, and use tools and software along the way. If you give it access, it can help you edit an Excel spreadsheet, create a document, pull information from the internet, update a database, and more. It can also verify the results before delivering them to you.

What are skills?

A skill is a specialized set of instructions, rules, and best practices that an agent uses for a specific task.

For example, in a marketing department one skill may be responsible for brand tone of voice. Another may focus on writing blog articles. Another may handle social media posts. At the end, the agent can use a separate skill to verify whether the final output matches the guidelines.

In another team, skills may relate to technical documentation, ticket descriptions, test case creation, or organizing project knowledge.

This is exactly what skills do: they help the agent understand how to complete a specific task, which rules to use along the way, and how to check the result at the end. Thanks to that, you do not have to open one assistant to write a blog post, another to create newsletter content, and a third to review it. You simply work with one agent in one window, and it selects the right skills on its own and uses them during the process.

Why is a skill more than an expanded prompt?

At first glance, it may seem that a skill is simply a longer prompt. In reality, the difference is bigger. In a regular chat, you can enter even a very detailed instruction, but with more complex tasks a problem appears quickly: you have to fit too many rules, too much context, and too many expectations into one place at once. On top of that, there are length limitations and the risk that something gets skipped along the way or disappears deeper into the conversation. With the next task, you often have to set everything up again anyway. That still works for simpler things, but when the work has several stages and a specific standard, that model simply becomes inconvenient.

A skill organizes things differently. Instead of packing everything into one instruction, you can separate roles and then combine them into one process. When creating an article, one layer can guard brand tone, another the structure of the text, and another the final editing. In technical work, you can similarly separate documentation, requirement descriptions, review standards, and the preparation of supporting materials.

As a result, the company gains more control, more consistency, and less dependence on whether someone happened to "write a good prompt."

Use cases: from content to IT

The biggest value of agents and skills becomes visible when they take over the most repetitive and time-consuming parts of everyday work. They can help gather information, shape it into something coherent, adjust the result to agreed rules, and check whether everything is correct before the material moves forward. That is exactly where it becomes clear that AI can effectively bring more order to the way a team works. Below are a few example use cases for agents and skills. Some of them may inspire you to implement a similar approach in your own company.

Content and marketing

This is one of the most natural places to start, because here the difference between one-off AI use and a well-structured process becomes visible very quickly. In a standard chat, you can ask for a draft of an article, a post, or an email. The real challenge starts later, when that material has to be adjusted to the brand tone, campaign goal, channel requirements, text structure, and final quality standards.

That is why, in practice, a content agent often works much better. It can handle different types of content and choose the right skills for each one. In one task, it may use a skill for blog articles; in another, a skill for product descriptions; and in yet another, skills for newsletters or SEO content. On top of that, there may be a separate skill that guards brand voice, another for final review, and yet another for the requirements of a specific channel or audience.

This kind of solution becomes especially useful when one company creates many different types of content, each governed by slightly different rules. A blog article requires a different structure than a newsletter. A product description for a company’s own store will look different from one prepared for a marketplace or for a specific retail chain that imposes its own limits on length, information layout, or the way product parameters are presented.

In a well-configured model, it looks very simple from the user’s perspective: you write to one agent and describe what you need, and it selects the right skills to complete the task. Thanks to that, there is no need to manually switch between different assistants or explain every time how the article, product description, newsletter, or campaign copy should look.

Such an agent can create, among other things:

blog and how-to articles,
product descriptions, including versions tailored to different guidelines and sales channels,
SEO copy, for example category descriptions,
newsletters and marketing emails,
landing page copy,
social media posts,
service and offer descriptions.

This does not mean that the agent "replaces a copywriter." It simply helps you get to a workable draft faster, one that is closer to the company’s standard and much better suited to the specific goal than a random draft from a chat.

Sales and client communication

In sales, a lot of time is taken up by tasks that come back almost every day: preparing an offer, responding to an inquiry, sending a follow-up after a meeting, summarizing arrangements, or refining sales materials. All of this usually happens under time pressure, so it is easy to end up with communication that is too general, inconsistent, or simply written in a rush.

An agent can help bring order to this area. Instead of building every message from scratch, a salesperson gets support that understands the logic of the process, can turn notes into a sensible structure, and helps keep the communication both clear and natural. If a company has different client types or different offer variants, skills help organize that without having to revisit the same arrangements over and over again.

The biggest benefit here is not speed alone. It is more about the fact that fewer things have to be stitched together manually, and the quality of communication becomes more predictable.

Operations, procedures, and internal knowledge

This is a less flashy area than content or sales, but in many companies this is where a noticeable improvement can be felt. Knowledge tends to be scattered across documents, emails, notes, and messaging apps, and in some cases it remains only in the heads of certain employees. As the team grows, that starts to cost more and more time.

An agent with skills can support the organization of procedures, checklists, work standards, and internal materials. It is worth using it, for example, to collect scattered arrangements into a more usable form, standardize documents, or organize information in a way that makes it easy to access at any time.

This may not be the most spectacular use of AI, but it is often one of the most sensible. Less chaos in internal knowledge usually means fewer mistakes, fewer recurring questions, and smoother onboarding for new team members.

IT and software development

In technical teams, the challenge is usually not a lack of competence, but how much time is lost by constantly switching between different types of tasks. A developer, tech lead, or technical project manager does not only build the solution, but also describes requirements, clarifies tasks, translates technical issues into language the business can understand, creates documentation, and checks the quality of what moves forward.

An agent becomes extremely valuable support in each of these areas. It relieves the team where working material needs to be organized quickly, but it can also support programming itself: prepare a solution outline, help with refactoring, suggest tests, catch potential issues, or organize a piece of code before further work begins. The point is not to replace the developer, but to shorten the path to a sensible starting point and take some of the most repetitive work off the team’s shoulders.

A properly configured agent can improve, for example:

preparing solution outlines and implementation variants,
refactoring and code cleanup,
writing and expanding tests,
support with debugging and error analysis,
creating and organizing technical documentation,
describing tickets and requirements,
preparing test cases,
maintaining review standards,
translating technical issues into language the business can understand,
collecting and organizing project knowledge.

A well-configured agent therefore helps not only to "generate something," but above all to shorten the distance between technical context and a usable result that the rest of the team can actually work with.

What does a company gain from agents and skills?

The most important benefit is not simply that something can be done faster. Speed alone means very little if the result still needs a lot of fixing or if someone has to explain the rules from scratch every time.

Much more important are the effects you can see in everyday work: less manual reconstruction of context, more consistent quality, a shorter path from a brief or notes to usable material, and less chaos between people, documents, and tools. On top of that come easier scaling of repetitive tasks and more control over how AI is used within the company.

Most often, this translates into very concrete benefits:

time savings in tasks that return regularly,
fewer revisions and less work done twice,
greater consistency in communication, content, and documents,
faster onboarding of new team members,
easier organization of knowledge and work standards,
more predictable outcomes, even when tasks are handled by different people.

An agent with skills vs. a browser-based assistant

Browser-based assistants are still very useful, especially for simpler, one-off tasks. Most often, however, they rely primarily on what you type into the prompt and possibly on an attached knowledge base. That is enough as long as the task is simple. With more complex work, however, it quickly turns out that you have to keep adding more rules manually, click through settings, or switch between different assistants. That is exactly where an agent with skills gives you more freedom, control, and convenience.

Area	Browser-based assistant	AI agent with skills
Starting point	Reacts mainly to the current prompt and possibly a knowledge base	Works according to a defined role and a set of rules
Context	Often has to be rebuilt	Is better embedded in the process
Quality	Depends heavily on the prompt	It is easier to maintain a consistent standard
Style and tone	You have to keep reminding it	They can be handled by separate skills
Multi-step tasks	More likely to lose conditions and priorities	Can combine several layers of work at once
Ease of use	With more complex tasks, it is easy to get stuck adding details and clicking through options	One window, one agent, while the skill selection happens on its side
Teamwork	Harder to build a shared way of working	Easier to base work on one common standard
Uses tools and software on the computer	No	Yes

Put briefly: a browser-based assistant works well when you need quick help. An agent with skills is better suited to tasks where AI is meant to operate not occasionally, but in a more structured, convenient, and controlled way.

Does implementing an AI agent have to be complicated?

It does not. There is no need to build a large system covering every department and every process right away. It makes much more sense to start with one area where you can already see a lot of manual work, repetition, or chaos today. For one company, that may be content. For another, documentation. For another, preparing offers or organizing the work of a technical team.

This approach brings two benefits. First, you see results faster. Second, it is easier to build a solution that really fits the way the company works, instead of adding technology "just in case."

Why will agents and skills become increasingly important?

In many companies, AI is no longer a novelty, and the first stage of fascination with this technology has already passed. More and more often, a more practical question appears: how do you use artificial intelligence in a way that actually saves time, reduces disorder, and maintains a sensible work standard?

This is exactly the point at which agents and skills become more important. They help turn one-off AI use into a solution that can be embedded in a specific process, developed together with the team, and adapted to the company’s real needs. Thanks to that, artificial intelligence stops being just a helper for quick tasks and starts working like a tool that brings order to the way people work and genuinely improves company processes.

Want to see whether an agent with skills would make sense in your company? Get in touch with us. During a consultation, we will help you assess which process is worth starting with and how to approach it so that the solution genuinely makes work easier.

AI and ML in cybersecurity: how does technology help detect threats? The case of Bitdefender

Mateusz Janota — Fri, 17 Jul 2026 07:05:25 +0000

AI and machine learning are increasingly shaping how cyber threats are detected and analyzed today. Instead of relying solely on known signatures, modern protection systems can recognize patterns, anomalies, and behaviors that may indicate an attack. See how this works in practice based on the technologies used by Bitdefender.

Bitdefender is a cybersecurity solutions provider used by individual users, businesses, and OEM partners. At that scale, protection cannot rely solely on manual analysis or simple file comparisons against a database of known threats. It requires mechanisms that can spot suspicious relationships faster and cope better with new, previously unknown attacks as well.

This is exactly where AI and machine learning play an important role. In Bitdefender technologies, they help analyze large volumes of data, identify relationships that are hard for humans to notice, and detect signals of a potential attack earlier. This is not a single feature or one model, but a whole set of methods that collectively strengthen protection effectiveness.

Although AI and ML often appear side by side, they do not mean exactly the same thing. Machine learning is part of the broader field of artificial intelligence and is used to make decisions or predictions based on data. In cybersecurity, this primarily means better threat detection before threats can cause real damage.

Why Isn't One Model Enough in Cybersecurity?

There is no single universal machine learning model in threat protection that works in every situation. Files are analyzed differently than process behavior, and anomalies at the level of a specific system require yet another approach. That is why Bitdefender uses different types of ML, matching them to specific tasks. This approach includes, among other things:

deep learning models,
large language models (LLMs),
supervised learning,
unsupervised learning,
self-supervised learning.

If ready-made approaches do not solve a specific problem, Bitdefender Labs creates its own models tailored to that particular challenge.

How Does Bitdefender Use ML in Practice?

One example of deep learning in Bitdefender GravityZone is feature extraction. This means automatically pulling out important information from input data so the system can recognize characteristic patterns associated with malicious activity.

In on-demand scanning, this type of analysis helps detect malware based on many signals at the same time. These include, for example, API calls, patterns present in the code, file headers, or network behavior. As a result, detection does not rely solely on simple matching against known signatures, but above all on recognizing features typical of malicious software.

This approach clearly shows the advantage of models that learn from data. Instead of looking only for what has already been described, the system can identify behaviors and relationships that look suspicious even when there is not yet a ready-made definition of the threat.

HyperDetect and Process Behavior Analysis

Another example is the patented HyperDetect technology. In this case, Bitdefender combines supervised and unsupervised learning algorithms to analyze the behavior of running processes and catch activity that may indicate an attack.

This matters because some threats do not look like classic malware that can be recognized by a known code pattern. Instead, they reveal themselves only through the way they operate: unusual actions, suspicious relationships between processes, or sequences of behavior that deviate from the norm. HyperDetect was designed precisely to spot these kinds of signals.

This technology also uses large language models, which support the identification of potential threats by adjusting the model's decision boundary margin. As a result, HyperDetect can be more sensitive to new, previously unknown variants of malware.

Protection Against Fileless Attacks

One area where Bitdefender's proprietary models are particularly important is protection against fileless attacks. This type of cyberattack does not rely on launching a traditional malware file. Instead, it uses legitimate system tools such as PowerShell or the command line to carry out an infection or perform malicious actions.

That is exactly why such threats can be difficult for traditional antivirus solutions to detect. They do not always leave behind the typical trace of a suspicious file, and some of their activity may look like normal system operation.

How can you defend against this? The Bitdefender Labs team developed custom ML models capable of extracting features from command lines and PowerShell scripts. This makes it possible to detect patterns typical of attacks operating in memory and attacks built around tools that are legitimate in themselves. For this achievement, the company received the "Key Innovators" title awarded by the European Commission.

Detecting Anomalies at the Level of a Specific System

Another interesting part of Bitdefender's approach is custom solutions used to detect anomalies within a specific customer system. In this case, each such system receives its own individually trained ML model.

This type of solution monitors the behavior of a given system and compares it against various warning signals: MITRE® attack indicators, Bitdefender Labs' own indicators, and events specific to the given user. Over time, the model adapts to what is normal in that environment and what may indicate risk. The detected deviations are then reported to security teams.

This approach has strong practical value. Every organization operates a little differently, uses a different set of tools, and has its own activity patterns. That is why effective anomaly detection often requires not only knowledge of global attack techniques, but also an understanding of the local context of a specific system.

Scalability Is Also Part of Effectiveness

Bitdefender technologies operate across consumer, business, and OEM segments. On the one hand, this gives them very broad threat visibility. On the other, it places high demands on machine learning models.

It is not enough to build a model that works well in a lab or on one type of infrastructure. You also need to ensure that it maintains performance across very different hardware, from servers in data centers to home routers. That is why scalability here is not an extra, but a requirement for using AI and ML effectively across different environments.

What Do the Results Say?

The effectiveness of such solutions is best assessed by their results. Bitdefender points out that, thanks to the use of ML models and proprietary AI solutions, as early as 2014 it was able to identify the behavioral characteristics of WannaCry ransomware, one of the most high-profile encryption attacks of recent years. That was as much as three years before the threat appeared in the wild!

The company also regularly achieves very strong results in independent tests. In AV-Comparatives Advanced Threat Protection tests, Bitdefender consistently blocks threats before they are executed, with higher effectiveness than many competitors.

This Is a Good Time to Act: Use AI-Supported Protection in Your Company

The Bitdefender example clearly shows the direction effective protection is taking today. It is no longer just about detecting known threats, but about identifying signals that may indicate a problem more quickly.

Use this approach in your company - instead of reacting in panic only once an attack has already happened, it is better to act in advance and calmly choose protection suited to your environment. We can help you with that. Tell us what you need, and we will suggest which Bitdefender solutions will work best for you and handle the implementation.

When a company suddenly loses access to its data. What does a ransomware attack look like, and how can you protect yourself aga…

Mateusz Janota — Fri, 17 Jul 2026 07:02:38 +0000

Monday morning. A typical start to the week at a company. Someone is checking email, someone else is logging into the sales system, and in accounting they are just opening the document database from the previous month. Everything is working as usual.

And then suddenly something stops adding up. Files will not open, folders look strange, and systems start to slow down. A few minutes later, a message appears that no one wants to see: Your data has been encrypted. To recover it, pay a ransom in cryptocurrency.

And it is at that exact moment that many companies realize one thing - they are not prepared for a situation like this.

A ransomware attack can bring a company's operations to a halt in a matter of minutes. That is why it is important not only to know how to prepare for it, but above all to implement that preparation effectively.

What exactly is ransomware?

Ransomware is a type of malicious software designed for one very specific purpose: to block access to data and extort a ransom for its recovery.

Once it gets into a system, the program begins encrypting files - documents, databases, projects, archives, or photos. In theory, the data is still there, but it cannot be opened.

Users then receive a message from the attackers saying that access to the data will be restored after a specified amount is paid, usually in cryptocurrency.

The problem is that payment offers no guarantee that the files will be recovered, and the data may already have been copied by criminals.

Moreover, even if the company regains access to its data after paying the ransom, that does not necessarily mean the problems are over. If the vulnerability in the system or the "backdoor" left by the attackers is not thoroughly removed after the attack, the same organization is often attacked again. Cybercriminals know very well that if someone has paid once, there is a good chance they will do so again.

That is why ransomware is now one of the most damaging cyber threats to businesses.

How do cybercriminals get into company systems?

Contrary to popular belief, most attacks do not begin with a spectacular break-in. More often, it looks much more... ordinary.

One of the most common scenarios is an email message that looks completely harmless. It may be an invoice, an order confirmation, or a document from a supposed contractor. Clicking the attachment is enough to launch malicious software.

Another popular attack vector is vulnerabilities in outdated software. Cybercriminals actively look for systems that have not been updated and exploit known vulnerabilities.

Also frequent targets are remote access services for computers and servers, such as RDP (Remote Desktop Protocol). If they are exposed to the internet and protected only by a password (or not at all...), they can become an easy entry point for attackers. In the security industry, people even joke that RDP sometimes stands for "Ransomware Deployment Protocol" today, because systems compromised this way are sometimes used directly to launch ransomware across a company's network.

Sometimes the problem is also:

weak passwords for company systems,
no additional authentication at login,
overly broad user permissions,
no infrastructure monitoring.

In practice, this means that an attack is not always the result of a single mistake. It is usually a combination of several small oversights that together create the perfect opportunity for criminals.

Why is ransomware so severe for companies?

The biggest problem is not the attack itself, but its consequences.

When data is encrypted, a company may lose access to customer databases, project documentation, sales systems, accounting tools, archives, or working copies.

In many cases, this means a complete halt to work.

In addition, other problems arise:

operational downtime,
loss of customer trust,
risk of data leakage,
system recovery costs.

That is why cybersecurity is increasingly seen as an extremely important part of business continuity.

What really determines whether a company can cope with an attack?

There is no single tool that guarantees one hundred percent security. Effective protection is based rather on a combination of several elements.

One of the most important, and unfortunately often overlooked, steps is creating regular backups. Backups make it possible to restore data even when a system has been infected. It is important, however, to ensure that they are stored outside the main network. The need to test them regularly should not be underestimated either.

Software updates are just as important. Many attacks exploit vulnerabilities that system vendors fixed long ago. If you do not update the programs used in your company, you are consciously giving up security and exposing yourself to losses.

Employee awareness also matters greatly. Even the best technical safeguards can be bypassed if someone unknowingly runs a malicious file. That is why it is worth conducting cybersecurity training on a regular basis.

In addition, it is worth taking care of:

Strong passwords and multi-factor authentication - a password alone is often not enough. Multi-factor authentication adds a second login step - for example, a code from an app or confirmation on a phone. Thanks to this, even if someone learns the password, they still will not be able to log in to the system.
Limiting user permissions - not every employee needs access to all data and systems. Granting permissions only where they are truly needed reduces the risk that a potential attack will spread across the company's entire infrastructure.
Network segmentation - in a well-designed infrastructure, the network is divided into smaller parts. As a result, even if one device becomes infected, the threat will not automatically spread to every system in the company.
Monitoring the IT infrastructure - modern security systems can detect unusual behavior on the network, such as the sudden encryption of a large number of files or suspicious traffic between servers. Detecting such signals early makes it possible to respond before the problem gets out of control.

Each of these elements reduces the risk that a single incident will paralyze the entire company.

We must remember, however, that in the world of cybersecurity, there is no one hundred percent guarantee of protection. Even well-secured organizations can become the target of an attack. That is why, in addition to prevention, it is equally important to prepare for a crisis situation - which means creating an action plan that allows you to respond quickly, limit the scale of the problem, and restore the company's normal operations as soon as possible.

How do modern protection systems help?

Traditional antivirus tools worked mainly by detecting known threats. The problem is that modern attacks often look completely different from how they used to. Criminals have more and more options and use them in increasingly creative ways.

That is why modern security systems analyze the behavior of programs and processes in real time.

One example of such a solution is the Bitdefender GravityZone platform, which uses, among other things:

behavioral analysis,
machine learning,
system activity monitoring.

This makes it possible to detect and stop suspicious actions, such as the sudden encryption of a large number of files, before they cause serious damage. This means protection is not based solely on responding after the fact, but on detecting threats at a very early stage.

In addition, Bitdefender GravityZone enables the restoration of modified files, centralized management of security policies across the company, and much more - all in an accessible, easy-to-use panel.

Why are more and more companies working with security partners?

Cybersecurity is an area that changes extremely rapidly. New attack methods appear practically every day, and maintaining an adequate level of protection requires specialized knowledge.

That is why many companies choose to work with technology partners who help them:

select the right security solutions,
implement protection systems,
monitor IT infrastructure,
respond to security incidents.

At ZanReal, we help companies build secure digital environments - from infrastructure audits and security configuration to the implementation of professional protection tools.

As an official Bitdefender partner, we implement solutions such as Bitdefender GravityZone, which make it possible to effectively protect computers, servers, and company networks against modern threats.

We have one goal: to ensure that cybersecurity is not a source of stress for a company, but a stable foundation for its operations.

And if you want to carry out a security audit or implement Bitdefender solutions in your company, get in touch with us. We will help you choose and implement protection tailored to your needs.

AI Without a Revolution: 8 Small Implementations That Take the Pressure Off Your Team

Mateusz Janota — Fri, 17 Jul 2026 06:59:09 +0000

Not every company needs to start its AI journey with a big project, complex automation, and a technical revolution. Very often, calmly organizing a single process brings more value than an ambitious plan that later proves hard to get moving. Here are 8 examples of simple implementations that help save time without making work more complicated.

Today, many companies hear about AI mainly in the context of agents, automation, and large-scale transformations. The problem is that this often sounds more like a complex technology project than real support for everyday work. If you do not deal with it on a daily basis, it is easy to feel discouraged: you do not know where to start, what to tackle, or what actually makes sense.

On top of that, large implementations are often associated with something expensive, time-consuming, and highly technical. And that is enough to block action right at the start, even when there really are areas in the company where AI could help quickly.

That is why, in day-to-day practice, a better first step may be a small AI implementation that organizes a specific part of the work and immediately takes some repetitive tasks off the team's plate. It is a good approach when you want to calmly test where artificial intelligence actually makes sense, without turning the whole organization upside down.

Small AI Implementations Are Often the Best Place to Start

With AI, it is easy to fall into the trap of thinking you need to change the whole company right away. Meanwhile, in many organizations, a step-by-step approach is simply more sensible.

A small AI implementation usually has a few things in common:

it addresses one specific problem,
it is based on a repeatable process,
it can be tested quickly,
it does not require rebuilding the whole company,
it allows people to stay in control and verify the results.

At the start, AI works especially well wherever a team repeats similar activities: writing, analyzing, organizing information, answering similar questions, or preparing working drafts of content.

Now let us look at some specific examples of small implementations.

Where Does AI Deliver Quick Results Without a Major Revolution?

Not every company needs advanced scenarios right away. Sometimes it is enough to choose one area where employees lose the most time on predictable, repetitive tasks.

1. An Assistant for Creating Product Descriptions

If you sell many similar products, writing descriptions by hand quickly turns into tedious, repetitive work. AI can prepare a first draft based on an agreed format, tone, and the most important product information.

You do not need to introduce full automation right away. Very often, simply shortening the work from "writing from scratch" to "reviewing and refining" already brings the team significant relief.

2. A Generator for Replies to Repetitive Emails

In many companies, the inbox looks very similar: the same questions about the offer, timelines, availability, quotes, implementation, or rules of cooperation. AI can help prepare working replies faster, while keeping a consistent tone and the basic information intact.

This is especially useful in sales, customer service, recruitment, administration, and support teams. A person still approves the message, but no longer wastes time writing the same thing from scratch for the hundredth time.

Over time, it is of course worth considering introducing automation - but at the beginning, even support with drafting email responses can noticeably ease the load on employees.

3. An Analytical Assistant for Data and Reports

Not everyone needs an advanced BI system with an AI layer right away. Sometimes a solution that helps review data faster, find trends, identify deviations, and prepare a clear summary is enough.

Artificial intelligence can help with:

sales analysis,
interpreting campaign results,
comparing time periods,
spotting anomalies,
preparing short conclusions for management or the team.

AI does not replace business thinking here. It helps you get to the point where you know what is worth paying attention to faster.

4. An Internal Knowledge Base for the Team

In many companies, knowledge is scattered: some is in documents, some on Slack, some in emails, and some only in the heads of the longest-serving employees. Then the same questions keep coming back: how did we do this, where is that file, what was agreed.

In situations like these, AI-based tools work well as an internal knowledge base. They help the team reach information faster, instead of searching for it from scratch every time or asking the same people again and again. Solutions like this also speed up the onboarding of new employees.

5. Support for Creating Social Media Content

AI can help when you have the knowledge and the topics, but you lack the time, rhythm, or creative spark to prepare posts. The point is not to mindlessly publish AI-generated posts, but to build drafts, variations, and a communication plan faster.

What is more, AI can be a real goldmine of content ideas. With artificial intelligence, you can also generate hooks and opening lines for posts, turn longer materials into shorter publications, adapt the tone to specific channels, and much more. A simple assistant packed with knowledge about you and your brand is enough to make social media communication much easier.

6. Summaries of Meetings and Notes

This is one of the most underestimated small AI implementations. After a meeting, there are often a lot of loose notes left and not many concrete takeaways. AI can help turn a conversation record or rough notes into a clear summary: decisions, tasks, responsibilities, and next steps.

7. Working Drafts of Offers and Documents

In companies, a lot of time is often consumed not so much by delivering the service itself as by preparing materials about it. AI can help, among other things, with creating first versions of:

offers,
summaries of the scope of work,
internal briefs,
checklists,
project kickoff documents.

8. Categorizing and Organizing Information

Many companies process a lot of content every day: tickets, forms, inquiries, leads, notes, customer feedback. AI can support the initial organizing, tagging, and grouping of this information.

Thanks to that, it becomes possible, among other things, to route cases to the right people faster, identify customers' most common problems, organize feedback, and reduce manual administrative work.

How Do You Choose the First Area for an AI Implementation?

So how do you find a good area for an AI implementation without losing your mind? Most of the time, mistakes do not come from the company knowing too little about artificial intelligence. The problem is usually the wrong starting point. Instead of starting with the question, "what can we do with AI?", it is better to ask:

where employees lose time on repetitive tasks,
which tasks are predictable and easy to describe,
where even a small reduction in working time would bring relief,
which processes are simple and can be automated without major changes to how the company operates.

A good first use case is usually:

simple,
repeatable,
frequent,
measurable,
low-risk,
easy to evaluate after a few weeks.

What Is Not Worth Doing at the Start?

The tool itself does not solve the problem. If the process is chaotic and the data is scattered, AI will only make that mess bigger. That is why it is better to avoid a few traps at the beginning.

1. Do Not Start with the Most Complex Process

If your first AI project concerns an area full of exceptions, dependencies, and risks, it is easy to conclude that it makes no sense. The problem is often simply that the entry point was too difficult. Artificial intelligence-based solutions can work, but at the beginning, it is better to start with a simple project and develop it gradually.

2. Do Not Hand Over Full Control Without Verification

In small AI implementations, the following model works very well: artificial intelligence prepares, a human checks. It is safer and usually more practical than trying full automation from day one.

3. Do Not Implement AI Just Because "Everyone Else Is Doing It"

The best results come from an approach based on a specific goal: less manual work, faster execution, better access to knowledge, shorter time needed to prepare materials. It is not worth rushing into AI implementation just because it is fashionable right now and everyone is chasing it. It is better to first look for repetitive, time-consuming processes in the company and only then match specific solutions to them.

4. Do Not Assume AI Will Work Well Without Sensible Data

For AI to really help, it needs something to work with. The problem is not only poor, chaotic, or inconsistent data, but also the lack of data. If a company has no documented processes, source materials, or organized information to rely on, it is hard to expect satisfactory and useful results.

In short: AI will not guess what nobody in the company has previously collected, described, or organized. That is why, before the implementation itself, you first need to take care of the basics. Only then will the tool genuinely speed up work and help people make better decisions.

When Is It Worth Talking About an AI Implementation in Your Company?

If you can see repetitive tasks on your side that take time away from the team, but you do not want to start with a complicated project, this is usually exactly where a good first step begins.

And you do not have to handle everything on your own. Let us know what you need - we will suggest where to start, take the implementation off your hands, and make sure everything works as it should. At ZanReal, we help match AI solutions to the way a company really operates - without adding tools for the sake of it and without pushing a revolution when it is enough to improve one process wisely.

If you want to check which small AI implementation is worth starting with in your company, let us talk. We will help you choose a solution that takes work off your employees' plates and helps you save time.