Shadow AI in the Workplace: Data Security Risks and Governance Strategies
Shadow AI arises when employees use AI tools without their organization’s knowledge or approval, often because they are trying to complete everyday work more efficiently. The article argues that simply blocking public AI services may not solve the problem, since employees can still use personal devices, accounts, or connections, leaving organizations with little visibility into what data is being shared. The main risks include exposure of confidential information and personal data, possible damage to trade-secret protection, and legal or contractual consequences. Rather than relying only on bans, organizations should provide practical, approved alternatives and set clear rules about acceptable AI use. Suggested measures include carefully assessed enterprise AI services, locally operated models for highly sensitive information, straightforward data classification, and data loss prevention controls. Employees should understand which tools are permitted, what information must not be entered into AI systems, when additional approval is required, and how to report accidental disclosures. The central message is that governing Shadow AI requires understanding why employees use unapproved tools and giving them safer ways to meet legitimate work needs while maintaining clear accountability.
Designing Consent Management for the DPDP Act: Requirements, Integration and a Reference Architecture
The Digital Personal Data Protection (DPDP) Act of 2023 fundamentally changes how organizations in India handle user consent. Gone are the days of simple checkboxes and ignored privacy policies; consent must now be a provable, purpose-bound record that a user can freely withdraw. The law requires consent to be specific, informed, and tied directly to the exact data needed for a stated purpose. Because organizations must prove they provided clear notices and obtained proper consent, building a robust Consent Management Solution is now a critical architectural requirement. A compliant system needs to version notices in multiple languages, capture consent per purpose rather than through blanket agreements, and immediately propagate any withdrawals to all downstream systems to halt processing. It must also maintain immutable, tamper-evident logs of every consent event to serve as legal evidence. Ultimately, isolated consent management tools are useless. Organizations must integrate their consent systems across collection channels, data platforms, and third-party tools to enforce policies automatically. Without this enterprise-wide integration, a company risks failing audits and violating the strict requirements of the DPDP Act.
Is AI Making Us Worse at Cybersecurity?
While artificial intelligence clearly offers productivity and speed advantages, overreliance on it may be quietly degrading the foundational skills of cybersecurity professionals. When security teams outsource their daily tasks to AI, they lose the essential human creativity required to discover novel threats or approach complex problems from unique angles. The sincere emotion and humor necessary for effective communication also disappear, leaving behind sterile, unremarkable messaging that fails to inspire or effectively warn organizations. Most critically, an overdependence on AI for organizing thoughts and generating analysis directly erodes human critical thinking—a vital capability when confronting unprecedented situations where no playbook exists. Security practitioners are increasingly treating interactions like prompts rather than seeking genuine guidance and shared experiences from their peers. To preserve the integrity and effectiveness of the profession, security leaders and individuals must set firm boundaries regarding when to use these tools. By choosing to independently research, think, and communicate instead of deferring to an algorithm, professionals can maintain the sharp analytical edge that the security industry relies upon.
Social Influence: Conformity and Group Behavior
Social influence and group dynamics shape our daily behavior much more deeply than we often realize. Without any explicit pressure, we frequently change our actions and beliefs to match what our peers consider normal, mostly to avoid rejection or because we trust the group's collective judgment. When authoritative figures step in, people can obey orders that even go against their own conscience, as demonstrated by famous historical experiments where ordinary individuals administered simulated shocks to others. Group settings also shift our individual performance and sense of responsibility. We might work harder when others are watching, or we might contribute less if our individual effort goes unnoticed in the background. In emergencies, the presence of a crowd often reduces the likelihood that any single person will help, simply because everyone assumes someone else will take the lead. Powerful situational factors can easily override a person's individual personality or values. However, breaking this cycle only requires a small spark; having just one ally is usually enough to empower others to speak up. Understanding these hidden social forces is the most practical way to resist unhealthy group pressure.
The fake app on an employee’s phone could be a gateway into your enterprise
Counterfeit mobile applications have evolved from consumer fraud tools into sophisticated entry points for corporate espionage. Threat actors now exploit decentralized workforces by creating high-fidelity clones of essential enterprise apps, such as secure messaging platforms and single sign-on portals. By mimicking trusted software, these fake apps can intercept multi-factor authentication tokens, harvest credentials, and extract proprietary data. The rise of generative AI has accelerated this threat, allowing attackers to decompile legitimate software, understand its authentication flows, and insert malicious code more easily. Attackers often use AI-generated voice clones and targeted phishing to trick employees into downloading these tampered applications. Once installed, the app functions normally while secretly transmitting data to external servers. To defend against this, organizations need a multi-layered approach. This includes enforcing strict application safelisting through mobility management platforms, implementing binary obfuscation in proprietary apps, and deploying mobile threat defense systems for real-time monitoring. Additionally, transitioning to phishing-resistant authentication and educating employees on these specific deceptive tactics are crucial steps in securing mobile endpoints against these targeted attacks.
10 SASE certifications to validate converged network and security skills
As organizations continue to merge their network and security systems, the demand for professionals who understand these unified structures is growing rapidly. This approach, often referred to as Secure Access Service Edge, combines traditional wide area networking with modern security tools to protect data and applications regardless of where users are located. To help IT staff prove their capability in this area, several major technology providers now offer targeted certifications. The article highlights ten specific credentials from organizations such as Cato Networks, Cisco, Fortinet, Palo Alto Networks, and Zscaler. These programs range from short introductory courses focused on basic principles and zero trust concepts to advanced exams that test a candidate's practical skills in designing, deploying, and effectively fixing complex network environments. By pursuing these certifications, network engineers and security specialists can clearly demonstrate their practical knowledge of cloud security, identity based access, and policy management. Ultimately, these credentials provide a reliable way for technical professionals to validate their skills, stay current with shifting industry standards, and confidently manage the secure networks that modern organizations rely on every day to operate smoothly and efficiently.
Getting Past the Post-Quantum Cryptography Discovery Phase
Security leaders face mounting pressure to transition to new encryption standards, yet most are stuck in the initial discovery phase. While many recognize the importance of the shift, few organizations possess the detailed inventories required to map out a clear migration strategy. Finding every instance of older encryption across web servers, virtual private networks, and internal applications remains a massive hurdle. Although experts estimate that a quantum computer capable of breaking current encryption might not arrive until at least the end of the decade, a more immediate threat exists today. Criminals are currently stealing encrypted, highly sensitive data like financial and health records, with the intention of decrypting it once quantum technology matures. This strategy makes the transition urgent, as waiting for a fully capable machine will be far too late for data meant to stay secure for decades. Successfully migrating will require a generational effort similar to the Y2K preparations, demanding careful prioritization and a solid understanding of business dependencies. To begin, organizations can leverage lightweight scanning tools to build a comprehensive inventory, kickstarting the essential journey to modernize their defenses.
Training can spark change, but what makes new behaviours stick? Manish Sinha explains
The article explains why training alone rarely creates lasting behavioural change in organisations. Manish Sinha, CHRO of Mahindra Finance, argues that employees are more likely to adopt new ways of working when they understand their purpose, see practical value, and receive consistent support from leaders. Communication can build awareness, but lasting adoption also depends on what organisations measure, reward, and reinforce in everyday work. Managers are especially important because they translate broad organisational goals into daily expectations and help employees work through uncertainty. Training therefore needs follow-up through coaching, practice, peer learning, refresher sessions, and leadership involvement. Organisational systems must also support the behaviour being encouraged. For example, asking employees to focus on customers while measuring only business volumes can send conflicting signals. Sinha also recommends using regular conversations and field feedback to spot early signs of progress rather than depending solely on formal culture surveys. His broader message is that successful change requires alignment between training, leadership behaviour, performance measures, recognition, accountability, and workplace systems, while allowing local teams enough flexibility to apply shared principles to their circumstances.
The AI graveyard: a running list of projects and startups that didn’t make it
The artificial intelligence industry is experiencing a notable reality check, with roughly forty-two percent of corporate AI projects ultimately being abandoned. A growing list of failed startups and canceled product features highlights the practical challenges of building sustainable software in this market. The reasons for these failures vary widely, ranging from funding shortages and fierce competition to technical hurdles and a lack of genuine user demand. Even industry giants are recalibrating their approaches. OpenAI has rolled back unpopular interface redesigns and discontinued standalone products like its video generator and web browser, opting instead to build those features directly into its primary interface. Similarly, highly anticipated hardware devices like the Humane Pin struggled with performance issues and were quickly absorbed by traditional tech companies. Prominent software tools, including the privacy-focused assistant Ollie and the conversational platform Character, also folded under the weight of severe financial, legal, or competitive pressures. Ultimately, this wave of closures serves as a practical record of market reality, demonstrating that initial investment does not guarantee a lasting product if the underlying utility falls short of user expectations.
Privacy-enhancing technologies boom, but adoption lags: OECD
Privacy-enhancing technologies (PETs) are experiencing rapid growth in research and development, but real-world adoption remains sluggish, according to a recent report by the Organisation for Economic Co-operation and Development (OECD). These technologies allow organizations to analyze and share sensitive information—such as financial records or medical data—without exposing the underlying personal details. While the number of open-source projects and patent filings has skyrocketed over the past decade, potential buyers often hesitate. The reluctance stems from the perceived complexity of the tools, a severe shortage of skilled privacy engineers and cryptographers, and an unclear return on investment. Furthermore, regulatory uncertainty complicates matters, as organizations are unsure how these technologies align with conflicting data protection and compliance rules. Startups developing PETs often face extended pilot periods and struggle to secure contracts, especially as major tech companies begin integrating similar features directly into their cloud platforms. To help overcome these hurdles, the OECD has launched a global repository of real-world use cases to demonstrate that these privacy tools are practical, effective, and ready for commercial deployment.
/articles/ios-crash-sigbus-debugging-experiment/en/smallimage/ios-crash-sigbus-debugging-experiment-thumbnail-1793282827397.jpg)
