Daily Tech Digest by Kannan Subbiah

Daily Tech Digest - September 21, 2026

Quote for the day:

“The two most important days in your life are the day you are born and the day you find out why.” -- Mark Twain

🎧 Listen to the audio debrief on YouTube

▶ Play Audio Digest

Duration: 22 mins • Perfect for listening on the go.

Engineering trust at scale: Building the infrastructure behind global payments

The provided article discusses the complex engineering required to build trust and reliability in global payment systems. The core challenge lies in simplifying the user experience while managing the intricate underlying infrastructure, which involves multiple banks, currencies, compliance checks, and domestic payment schemes. Trust is essential, encompassing not just cybersecurity, but also operational resilience, effective transaction routing, and settlement. Payment architectures must handle high transaction volumes without compromising reliability or creating friction for users. As businesses expand globally, payment systems need to connect local networks smoothly, rather than attempting to create a single universal system. Regulatory compliance must be integrated directly into the transaction process, adapting to different regional requirements without adding unnecessary hurdles for businesses. Artificial intelligence is highlighted as a key tool for managing this complexity, especially in detecting fraud and recognizing legitimate behavior to reduce false positives. Finally, the article emphasizes the importance of interoperability. A unified technology layer and tools like Open Finance can help businesses access local payment methods globally without needing to rebuild their systems for each new market. Ultimately, the goal is for the underlying payment infrastructure to manage the complexity so effectively that the end-user experience remains simple and trustworthy.

Google’s open source EnvHarness lets AI agents train against environments that evolve with them

Google has introduced EnvHarness, an open-source framework designed to solve a major problem in AI agent training: static simulators. Usually, when agents practice tasks like software engineering or web navigation, the training environments remain fixed. If an agent repeatedly struggles with a specific step, the environment cannot adapt to help it practice that weakness. Building new environments and testing rules from scratch is costly and time-consuming. EnvHarness addresses this by wrapping a programmable layer around existing simulators. Instead of replacing the original setup or its success checkers, it modifies how the environment interacts with the agent. The framework uses three main components. "Stage" changes the starting conditions of a task. "Contract" adjusts the rules, such as filtering actions or altering what the agent can see. "Chain" links multiple tasks together into a longer sequence. A companion system called EnvRigger automatically analyzes an agent's failures and suggests these modifications to target specific weaknesses. In tests across five major benchmarks, agents trained using EnvHarness saw success rates improve by up to nine percentage points compared to those trained in standard environments. They also completed tasks in fewer steps. By allowing training grounds to evolve alongside the agent, EnvHarness makes learning significantly more efficient.

Why Australian businesses are still underestimating the time it takes to recover from a cyberattack

Many Australian organizations invest heavily in cyber defenses but fail to understand the true timeline for recovering from a system breach. According to recent findings, company leaders often expect normal operations to resume within a few days of an incident, whereas the actual recovery process frequently takes weeks. This disconnect is driven by the growing complexity of modern technology environments, which now span multiple cloud platforms, software services, and vast data systems. Every new layer adds dependencies that must be carefully restored and verified before services can resume. Recognizing that disruptions are inevitable, regulators are shifting their focus from merely preventing attacks to ensuring operational resilience. Rules now require organizations to identify their critical services and prove they can maintain them during severe incidents. To achieve this, companies should focus on defining their essential functions by identifying the minimum people, processes, and technology needed to survive a crisis. Rather than waiting for an emergency to test their systems, organizations must make recovery readiness a continuous, daily practice. By actively aligning their security, technology operations, and data management around clear recovery goals, businesses can build genuine confidence. Ultimately, understanding exactly how and when you can restore critical services is a highly meaningful competitive advantage.

Navigating training, improving and competition restrictions in generative artificial intelligence (AI) agreements

This article explores the complexities of generative AI software license agreements, particularly concerning restrictions on using AI tools and their generated output to develop competing products. It highlights a critical distinction between the use of an AI platform itself and the use of the content it produces. While traditional software agreements limit the use of the software to prevent the development of competitive offerings, generative AI introduces output (like text, code, or images) that users often want to leverage for their own business purposes. The core issue is that AI providers want to protect their models and data, so they often include non-compete clauses. However, these restrictions can be overly broad, potentially hindering users from utilizing the AI-generated output as intended. The article notes that market approaches vary significantly; some providers restrict only the platform's use, while others strictly limit how the output can be used downstream. Due to the lack of clear consensus among providers and uncertainty about how US courts might interpret vague restrictions, the authors emphasize the need for clear, specific language in contracts. Providers need to define the scope of restrictions carefully, and users must ensure the agreements permit their intended use of both the AI platform and its output.

Defenders Think In Lists. Attackers Think In Graphs

Cybersecurity defenders often rely on creating lists to manage their environments, focusing on inventories of assets, known vulnerabilities, and compliance rules. In contrast, attackers think in graphs, looking closely at how these individual assets connect. Once attackers find an entry point, their primary goal is to move laterally by exploiting relationships, permissions, and network pathways to reach critical data. Modern enterprise environments have expanded across cloud platforms, third-party integrations, and AI services, making cyber risk a problem of context rather than simple inventory. An isolated vulnerability matters less than the specific pathway it opens to valuable systems. Furthermore, AI has heavily accelerated the speed at which attackers can map and exploit these complex networks, allowing them to rapidly evaluate thousands of potential attack paths simultaneously. To effectively protect their environments, organizations must stop looking at security controls in isolation. Instead, defenders need to adopt an attacker's mindset by deeply understanding their network's topology and the connections between different systems. By focusing on reachability and context, security teams can successfully bridge the gap between technical data and true business risk. The future of defense lies in understanding how everything connects and quickly anticipating exactly where an attacker might go next.

When Does AI Stop Needing Us?

The recent article from the Communications of the ACM thoughtfully examines how artificial intelligence is moving steadily toward greater independence. It looks at the practical and theoretical limits of these tools, asking if we will eventually reach a point where human guidance is no longer necessary. By reviewing recent progress in computing, the author offers a grounded, realistic look at what the technology can and cannot do right now, deliberately avoiding any dramatic or exaggerated claims. For the everyday professional, this shift means that standard, repetitive tasks are increasingly likely to be handled by machines in the near future. As a result, human skills like deep reasoning, ethical decision making, and navigating complex problems will only become more valuable. The focus moves away from simply processing data and toward interpreting the results that computers provide. Workers are encouraged to understand the boundaries and potential errors of these systems rather than ignoring them. The most practical path forward is to steadily build skills that rely on human connection, understanding, and strategic thought, areas where machines still struggle. Taking time to review which parts of a job are easily automated allows individuals to adapt smoothly, maintaining their value by leaning into genuine human insight.

What Does Day Four Cost? Rethinking How Organizations Measure Resilience

Traditional resilience programs often measure disruptions using operational labels like high, medium, or low risk, which fail to capture the true financial impact over time. As a business interruption stretches from hours into days, the consequences compound, affecting suppliers, customers, and overall revenue. To make informed decisions, organizations need to move beyond static risk ratings and their disconnected spreadsheets. A mature approach evaluates exactly how financial exposure changes over the entire lifespan of a disruption. Rather than viewing business processes in isolation, companies should map their operations to understand how value actually reaches the customer. This means tracking dependencies across technology, facilities, and personnel. By calculating gross exposure, factoring in existing mitigation efforts, and determining the net financial impact, leaders can better justify recovery investments. Furthermore, continuity plans cannot remain static documents updated only once a year. They must evolve as the business changes. While artificial intelligence can help streamline data collection and highlight inconsistencies, it should support rather than replace human judgment. Experienced professionals are still necessary to validate strategies and make final decisions. Ultimately, an effective resilience program connects operational risks to financial realities, giving executives a clear picture of exactly what prolonged downtime will cost the business.

Cyber Defense Alone Can't Keep Critical Services Running

The article explains that states cannot rely on cyber defense alone to keep essential services such as water systems and hospitals running. State CIOs are increasingly responsible for protecting a patchwork of local utilities that depend on digital systems to deliver basic physical services. Survey data shows that most CIOs worry about cyberattacks on critical infrastructure, but budgets and staffing often fall short. The piece argues that states must first identify which facilities would cause the greatest harm if disrupted and then map the dependencies that keep them functioning. Experts quoted in the article stress that availability, not just confidentiality, is the real challenge. Many utilities have become so dependent on internet connectivity that they may not be able to operate manually during an outage. The article highlights “cyber‑informed engineering,” an approach that assumes attackers will eventually breach digital defenses and therefore builds physical safeguards—such as pressure‑reduction valves or time‑delay relays—to limit damage. These measures are often inexpensive but require coordination across water operators, hospitals, and emergency managers. The author concludes that states must prioritize the highest‑consequence risks, run realistic tabletop exercises, and focus resources on the systems that support the most vulnerable communities, because they cannot fix everything at once.

Can AI Safety Evaluators Really Stay Independent?

The article discusses a new proposal backed by Anthropic and OpenAI to allow independent AI safety evaluators closer access to their model development process. As advanced artificial intelligence systems grow more capable, there are increasing concerns about verifying their safety. Traditionally, external evaluations occurred just before a model's public release. However, researchers worry this approach is no longer sufficient, as highly advanced models might learn to recognize testing environments and temporarily hide dangerous behaviors. To address this, researchers are demanding deeper access throughout the entire training process. They want to examine early model versions, training logs, and internal checkpoints to see when concerning behaviors emerge and how they are handled. Anthropic's CEO proposed embedding evaluators directly inside companies with the freedom to investigate incidents and publish findings without corporate editorial control. OpenAI's CEO also expressed support for this approach. Despite these commitments, independent researchers remain cautious. They emphasize that true independence requires more than just access; it demands freedom from company control over information, timing, and publication. The key challenge lies in the implementation details, which have not yet been fully defined by either company. Researchers stress the need for transparent rules to ensure evaluators aren't restricted by narrow scopes or strict nondisclosure agreements, allowing them to effectively hold frontier AI companies accountable.

Architecting Secure and Scalable Facial Verification Systems

The article "Architecting Secure and Scalable Facial Verification Systems" from InfoQ explains the challenges and solutions in building enterprise-grade facial verification systems. The author shares experiences from scaling a prototype into a robust architecture capable of handling high concurrency, such as thousands of employees clocking in simultaneously. Key takeaways emphasize that facial verification must be treated as a distributed systems challenge, not just a simple API integration. Synchronous calls fail under heavy load, so asynchronous queues and circuit breakers are essential to handle traffic spikes. Additionally, decoupling immediate detection tasks from the stateful verification process prevents system bottlenecks. The author also stresses the importance of pushing data quality checks—like adjusting for lighting or blur—to the client device to reduce latency and cloud costs. For privacy and security, the system must enforce strict zero-trust principles, using short-lived tokens instead of raw personal data and implementing aggressive data retention policies. Finally, the article advises using a risk-based decision engine rather than static thresholds, treating confidence scores as probabilistic inputs to maintain accuracy across various transaction types.

Daily Tech Digest - September 20, 2026

Quote for the day:

“The more I read, the more I acquire, the more certain I am that I know nothing.” -- Voltaire

🎧 Listen to the audio debrief on YouTube

▶ Play Audio Digest

Duration: 19 mins • Perfect for listening on the go.

Brain-Machine Interfaces Are Advancing: What Leaders Need to Know About Neurotechnology

The convergence of artificial intelligence, smaller electronics, and advanced materials is accelerating the steady development of brain-machine interfaces, allowing for practical communication between human brains and digital systems. While this field is currently focused on healthcare, with recent clinical studies showing paralyzed patients successfully using neural interfaces to control devices and communicate independently at home, its applications will soon expand. In the near future, industries such as education, manufacturing, and assistive technology will likely adopt these emerging tools to improve human performance and overall accessibility. By the end of the decade, the technology is expected to feature more accurate signals, less invasive hardware, and better machine interpretation of brain activity. Rather than guessing which specific device will dominate the market, organizations and leaders should prepare for these predictable advancements now. This means tracking improvements in neural decoding, exploring diverse interface methods like ultrasound, and considering how neural data might fit into future product lines. Just as importantly, the widespread use of neurotechnology will create new challenges surrounding data privacy, system compatibility, and user control over sensitive neural information. Solving these practical problems will offer significant opportunities for those who calmly anticipate the steady progress of neural engineering and plan accordingly.

Opinion: Tech enables transformation, people achieve it

Daire Cunningham’s article explores why so many organizations struggle to get real value from artificial intelligence, despite the technology being widely available. He notes that while 88% of businesses use AI in some capacity, only a third have managed to scale it across their operations. The core issue, he argues, isn’t a lack of access to advanced tech, but rather the underlying condition of the organizations trying to use it. When companies rush to adopt AI, they often start by looking for a specific tool instead of identifying the actual business problem they need to solve. To succeed, leaders must work backward: map out their processes, figure out where the information is kept, and spot the real bottlenecks. A major roadblock is poor data readiness—many businesses have years of accumulated, disorganized data and permissions. AI tends to expose these underlying flaws rather than cause them. Ultimately, Cunningham believes digital transformation is about rethinking how work gets done, not just adding new software. While AI can process data faster and tackle complex tasks, human judgment and oversight remain essential. True transformation happens when a company prepares its data foundation and empowers its people to use technology responsibly.

CIOs offer guiding principles on how to achieve AI sovereignty

The article discusses the growing importance of AI sovereignty for Chief Information Officers (CIOs). This concept is centered on maintaining control over an organization’s entire AI ecosystem, which encompasses data, models, and the infrastructure hosting those models. As AI technology becomes increasingly integrated into business operations, organizations face mounting risks related to data privacy, regulatory compliance, and potential vendor lock-in. To manage these challenges effectively, CIOs recommend establishing clear guiding principles. First, it is crucial to create a comprehensive inventory of all AI resources currently in use, as you cannot manage what you do not track. Second, organizations must implement robust data and usage controls to monitor information flow and quickly identify any policy violations. This proactive approach helps secure sensitive data. Third, companies should update their incident response plans specifically to address potential AI-related breaches, ensuring they can act swiftly if issues arise. Finally, maintaining transparency and auditability is essential. Knowing who accessed data and how AI tools influence decision-making helps build trust and ensures regulatory compliance. Rather than viewing AI sovereignty as a simple compliance checklist, leaders should treat it as a fundamental strategy for the long-term success and security of the enterprise.

Children's Data Protection in the Age of EdTech and Platform Design

The digital age has made children’s data collection widespread, from location tracking and educational data to behavioral and voice information. While some of this is meant for learning or safety, the concern is that such data can be used for profiling, targeted ads, or boosting engagement without parental consent. This has made data protection laws surrounding children increasingly relevant. India's Digital Personal Data Protection (DPDP) Act, 2023 defines a child as anyone under 18, which is a higher threshold than seen in many other countries. This act requires platforms to secure verifiable parental consent before processing a child’s data and forbids processing that could harm a child’s well-being. Additionally, the DPDP Act bans the tracking, behavioral monitoring, and targeted advertising directed at children, though it provides some exceptions for safe uses in healthcare, education, or child safety. Internationally, there are variations in how children's data is handled. In the United States, COPPA applies to children under 13, while the European Union’s GDPR sets the default age at 16, though member states can adjust it to 13. The UK’s Children’s Code requires platforms that children are likely to use to have high privacy settings by default. For platforms dealing with children's data, balancing data retention limits with educational needs requires clear strategies and compliance checks.

Most enterprises are failing to translate talk into meaningful dependency mapping

The recent feature on digital sovereignty highlights a significant gap between what organizations want and what they can actually achieve. While most companies express a strong desire to regain control over their digital infrastructure, the reality is that true independence remains out of reach for many. The truth is that achieving digital sovereignty is not simply about building internal data centers or buying local software; it requires deep visibility into existing information systems and having credible exit options from major service providers. Unfortunately, most enterprises currently lack these fundamental building blocks. Over the past fifteen years, a rush toward cloud computing has left many businesses heavily dependent on a handful of dominant technology giants. This dependency makes it incredibly difficult to pivot or change providers without facing steep costs and major operational disruption. As artificial intelligence becomes central to business strategy, the stakes for retaining control over data and computing power are higher than ever before. The article suggests that instead of pursuing total independence, leaders should focus on preserving choice. By prioritizing flexible tools and establishing clear governance, organizations can gradually build resilience. Ultimately, sovereignty is about making smart decisions today that prevent complete vendor entanglement in the future.

Agentic Systems and Design Patterns

The shift toward agentic artificial intelligence marks a move from simple text generation to setups that can plan, take action, and learn from their mistakes. When building these systems, developers must first choose an overall structure. A single agent approach is easier to build and manage, making it a great starting point, though it can struggle with complex or extended tasks. Conversely, a multiple agent system uses an orchestrator to delegate work to specialists, which boosts reliability through teamwork but requires careful coordination. Beyond the basic structure, six core design patterns drive how these models function. The ReAct pattern mixes logical thinking with concrete actions in a loop, while CodeAct allows agents to write and test code to achieve their goals. Self reflection acts as an internal critic to refine outputs and fix errors. Basic tool use lets agents interact with outside software, and Agentic RAG improves how they fetch and verify information. Finally, the multiple agent workflow handles massive tasks by dividing them into smaller parallel jobs. For the best results, start with a simple single agent setup and only add complexity when the task demands it. Strong safeguards, like strict iteration limits and clear tool definitions, keep these systems reliable and easy to monitor.

What OT Resilience Actually Controls

The article from SC Media explains that recovering operational technology (OT) after a cyber incident requires a fundamentally different approach than recovering standard IT systems. While IT disaster recovery focuses on system availability—getting servers and applications back online—OT recovery requires "safe-state validation." This means ensuring the manufacturing process can be controlled safely before restarting production. The challenge is that standard IT backups often miss crucial OT engineering data, such as process configurations, device programming, and safety system logic. Without these, a restored system might appear functional but lack the specific parameters needed to operate safely. The author outlines five common failure scenarios in OT resilience, including ransomware affecting control systems, vendor platform outages, and control logic tampering. These scenarios highlight the need for specialized OT backup architectures and recovery procedures. Ultimately, true OT resilience involves validating configurations at the device, system, and process levels, often requiring specialized engineering expertise. This validation step adds time to the recovery process but is essential to prevent unsafe conditions that could lead to physical harm or environmental damage.

Achieving data sovereignty for SaaS with confidential containers and quantum-safe networking

Software vendors hosting services on the public cloud face increasing pressure from customers who want to keep their data secure and private. Often, customers prefer on-premise solutions, which are harder to manage and scale for vendors. A better approach allows vendors to keep their services in the cloud while offering robust security through cryptographic controls, specifically using confidential computing. This technology secures data processed in untrusted environments by isolating it in a trusted execution environment (TEE). Red Hat and Arqit have introduced a setup that uses confidential containers and quantum-safe networking to protect data in transit. They applied this to Arqit's Encryption Intelligence (EI) platform. In this setup, services and data are isolated from the host environment, allowing customers to maintain control over their data while protecting the vendor's intellectual property. The architecture involves three clusters operating in the untrusted environment, communicating via a quantum-safe connection. Trust is established by an outer trustee in a trusted on-premise environment, which verifies the inner trustee in the cloud. This combination of confidential containers and quantum-safe protection for data in transit offers a practical alternative to on-premise deployments, providing strong assurance over data security and sovereignty for both vendors and customers.

AI-led SOC infrastructure shifts from raw data to outcomes

The article discusses a shift in how modern Security Operations Centres (SOCs) measure success in an AI-driven environment. Historically, SOCs focused on volume metrics, such as alerts processed or data ingested, but this model struggles against modern threats across distributed environments. Today, the focus is shifting to measuring outcomes like risk reduction, analyst capacity, and decision quality. The traditional volume-driven model leads to rising costs, overwhelmed analysts, and incremental improvements, failing to deliver clear returns on investment. While AI is viewed as a solution, it has struggled to deliver value when treated simply as an overlay, lacking transparency and integration. To overcome these limits, organizations must build SOCs around productivity rather than throughput, connecting technology investments with operational impact. In this model, AI isn't measured by its theoretical capability but by the work it completes alongside human analysts. A critical component is the use of "Agentic AI" as an execution layer, which coordinates investigations and decisions rather than functioning in isolation. For AI to be effective, it must also be governed to ensure actions are explainable and align with organizational policies, allowing security leaders to demonstrate responsible use and measurable security outcomes.

Data sovereignty is a control problem, not a geography problem

The article argues that data sovereignty is fundamentally about control, not geography. Many organizations assume that storing data within national borders is enough, but the author explains that this view is too narrow. True sovereignty depends on knowing who controls identities, administration, infrastructure, and legal authority over the data. Recent events have exposed how fragile digital infrastructure can be, from attacks on subsea cables to large‑scale outages like the CrowdStrike incident, which disrupted critical services worldwide and led to major financial losses. At the same time, new regulations and the rise of AI have increased the stakes, since sensitive information and intellectual property now flow through cloud‑hosted models governed by foreign jurisdictions. The article stresses that organizations often lack visibility into where their data lives, who can access it, and which laws apply. To regain sovereignty, they must demand transparency from providers, understand dependencies, and treat governance as an architectural requirement rather than an afterthought. Cost and speed still matter, but they can’t outweigh resilience and accountability. Sovereignty, the author concludes, isn’t about abandoning the cloud—it’s about ensuring organizations retain meaningful control so they can manage risk and respond confidently when incidents occur.

Daily Tech Digest - September 19, 2026

Quote for the day:

“The only true wisdom is in knowing you know nothing.” -- Socrates

🎧 Listen to the audio debrief on YouTube

▶ Play Audio Digest

Duration: 20 mins • Perfect for listening on the go.

Building a pre-emptive security architecture — what is it and how can your business adopt one?

With the rise of AI-driven cybersecurity threats, conventional "detect and respond" frameworks are struggling. The speed of attacks has increased, and the volume of vulnerabilities is projected to skyrocket, leading to practitioner burnout. This has prompted a shift toward a pre-emptive security architecture. Instead of waiting to respond to an intrusion, pre-emptive security aims to stop attacks before they cause damage by placing controls directly in the attack path. It's an architectural approach, connecting security across layers—like users, applications, and data—so that a breach in one layer doesn't compromise the whole system. This strategy focuses on anticipating and preventing breaches rather than just limiting the fallout. Key elements of this approach include denying access, deceiving attackers with decoys, and disrupting emerging threats. Techniques like zero trust, secure code development, and confidential computing are central to this model. To implement it, businesses should first identify sensitive data and map out vulnerabilities. This involves understanding potential attack paths and applying the principle of least privilege. Regular penetration testing and continuous monitoring are essential to ensure these controls work without disrupting legitimate business processes. While pre-emptive measures are crucial, they are meant to enhance, not replace, existing security alerts.

Strong fundamentals make next-gen security possible

Instead of constantly chasing the newest security tools, organizations should focus their efforts on mastering five foundational practices to effectively protect their systems. First, businesses must maintain a clear, accurate inventory of all their physical and digital assets across every environment. You simply cannot protect what you do not know exists. Second, carefully managing user identities is critical. Implementing simple but strong measures like multifactor authentication or passkeys significantly lowers the chance of compromised accounts. Third, security strategies should match the specific needs and risk tolerance of the business. By identifying the most valuable data and establishing clear priorities, security teams can focus their resources exactly where they matter most. Fourth, while preventing attacks is important, organizations must also prioritize true resilience. This means keeping secure backups, writing clear recovery plans, and actively practicing those plans so employees know exactly what to do during a crisis. Finally, security professionals and business leaders need to speak the same language. By translating technical risks into clear business impacts, such as potential financial costs, teams can make better decisions together. Mastering these basic, everyday practices may not seem exciting, but it provides a much stronger defense against real threats than simply buying the latest technology.

The cloud outage that should terrify the CIO

A recent Microsoft Azure outage that simultaneously knocked out major AI services, including ChatGPT, Claude, Grok, and Copilot, serves as a stark warning for business leaders. The disruption highlights a growing, hidden vulnerability: concentrated cloud dependency. As organizations increasingly weave artificial intelligence into their core operations, they are inadvertently stacking their critical workflows on the same shared infrastructure. When a major cloud region fails, the impact is no longer limited to a single application going offline. Instead, automated business processes, financial transactions, and customer support pipelines can grind to a sudden halt, leading to massive financial losses. What makes this risk especially dangerous is that many companies are completely unaware of their true exposure. Organizations rely on countless third-party software vendors, who in turn depend on major cloud providers. This creates a chain of invisible dependencies where an outage at a provider you do not directly use can still freeze your business. To protect their operations, technology leaders must actively map their entire software dependency chains, including the artificial intelligence layer. They need to design their critical systems to smoothly switch to backup providers during failures and clearly present the financial risks of cloud downtime to their executive boards.

The Control Plane Is Not the Trust Plane

The article from Security Boulevard, titled "The Control Plane Is Not the Trust Plane," explores the evolving landscape of AI governance. The author argues that while control planes—systems designed to govern what an AI agent is permitted to do—are necessary, they are no longer sufficient. As organizations deploy more AI agents, a critical gap emerges: the need to verify history, provenance, and the actual context of an action. To address this, the author proposes a new conceptual layer: the "trust plane." A control plane answers questions about possibility, such as which identities exist and what policies apply. In contrast, the trust plane answers questions about history, focusing on why a specific action belongs to a legitimate chain of authority. It requires "evidence receipts" to understand the full context—who initiated the request, what identity was used, and what was actually accepted by the receiving system. The article emphasizes that trust should not rely on centralization, which creates single points of failure. Instead, it advocates for a distributed approach where nodes retain local identity while sharing verifiable evidence. Ultimately, as AI systems transition from tools to active participants, securing both control and trust is vital for maintaining accountability and operational integrity.

California child-safety laws expand age checks to addictive feeds, AI chatbots

California has introduced a series of new child safety laws that regulate artificial intelligence chatbots and social media platforms, establishing the state as a leader in digital age verification. These bills aim to create safer online environments for children by making device based age checks the standard. A central piece of this legislation is a new rule requiring independent safety audits and annual risk assessments for companion chatbots. This measure was inspired by a tragic case where a teenager was allegedly influenced by a chatbot to end his life. Major industry players, including the creators of ChatGPT and media advocacy groups, have voiced their support for these rules. In response, artificial intelligence providers are already implementing mandatory safety modes for users under eighteen. Additionally, the new laws ban social media platforms from offering addictive features to children under sixteen. Companies must now verify age before enabling these tools, with severe financial penalties of up to fifty thousand dollars per affected child for those who knowingly violate the rules. Finally, lawmakers clarified how age signals should be shared by operating systems, ensuring that open source developers are not unfairly burdened. As artificial intelligence continues to grow, other states are expected to adopt similar protective measures.

Enabling the next generation of AI data centers

The article describes how AI is forcing a fundamental rethink of data center design, mainly because traditional facilities were built for predictable CPU workloads and steady growth. AI training clusters, by contrast, demand far higher power density, faster deployment timelines, and more complex infrastructure coordination. The author explains that developers are now planning gigawatt‑scale campuses where power, cooling, transmission, water, and long‑term operations must be designed as one integrated system rather than separate components. Site selection has become a balancing act: inexpensive land may lack grid access, while power‑ready sites may come with long interconnection delays or higher costs. To keep projects moving, many operators are turning to hybrid or off‑grid power solutions, including gas generation, batteries, and microgrids, even though these approaches require more capital and careful permitting. Cooling is also shifting toward liquid systems and thermal storage to handle dense AI loads and reduce peak energy use. The article stresses that early permitting work and cross‑discipline alignment are now essential, because regulatory, environmental, and community constraints can shape a project as much as engineering choices. Ultimately, the piece argues that success depends on making early, realistic decisions that translate AI demand into infrastructure that can be delivered at speed and scale.

Is Your Organisation’s Data Secure?

Data security is critical, and many free, open-source tools now offer robust protection, making strong encryption accessible to organizations of all sizes. Encrypting data prevents unauthorized access by converting plaintext into unreadable ciphertext, which requires a specific key to decipher. The transparency of open-source software allows a global community of experts to continuously evaluate the code, often identifying vulnerabilities faster than with closed, proprietary systems. A comprehensive security strategy must address data in two states: at rest and in transit. Data at rest, such as information stored on hard drives or databases, is a high-value target for attackers. Encrypting this data ensures that even if physical devices are stolen, the information remains secure. Data in transit moves between systems over networks like the internet and can be intercepted. Tools like OpenSSL, Let's Encrypt, WireGuard, and OpenSSH provide essential encryption for data in transit, securing web traffic, remote access, and file transfers. Regulatory frameworks worldwide further emphasize the importance of data encryption to protect personal and financial information. By leveraging these open-source tools, organizations can build resilient defenses against data breaches.

Cybersecurity Work-Life Balance Starts With Actually Turning Off

The constant pressure of defending against relentless threats has made it incredibly difficult for cybersecurity professionals to step away from their work. Sam Van Ryder, a veteran in operational technology security, emphasizes that achieving a healthy balance requires individuals to genuinely disconnect, while employers must actively protect their team's downtime. Often, organizations talk about this balance as a benefit without creating the environment necessary for people to log off. With ongoing staffing shortages and constant alerts, the inability to rest is no longer just a personal wellness issue; it is a direct security risk. When security teams are exhausted, their judgment naturally suffers, creating the exact vulnerabilities that attackers actively look to exploit in critical systems. Recognizing this, leaders need to ensure time off is fully respected. This means no emails, no emergency messages, and no checking the daily news. If a team member tries to work on their day off, leaders should send them back to their rest. Furthermore, recovery should not be limited to an annual vacation. Regular breaks throughout the year are completely essential for maintaining a strong and focused workforce. Ultimately, the most effective way to maintain long-term security is for individuals to step back, turn everything off, and simply recharge.

Beyond Age-Gating: Regulating Platform Design for Child Safety

India's approach to child online safety currently relies on basic age restrictions and rapid content removals, but these conventional measures fail to address a much deeper issue: structural platform design. With millions of children accessing the internet daily, the conversation must shift from simply blocking entry to reforming how digital services are actually built from the ground up. Features such as recommendation algorithms, automatic video playback, and default direct messaging settings shape the online experience of a child and their exposure to risk long before content moderation even occurs. Global evidence clearly shows that simple age limits are frequently bypassed, leaving many young users vulnerable to the exact same risks. Furthermore, current safety metrics only track formal complaints rather than measuring the actual frequency of exposure to harmful material. To create a genuinely safer environment, policymakers must begin regulating platform design directly. Rather than treating safety as an afterthought, features that enable direct contact with strangers should be restricted by default. India can utilize its existing consumer protection laws to classify manipulative interfaces as unfair practices. Large digital services should be required to justify structural changes affecting minors, disable behavioral tracking, and publish independently audited data on how often children encounter harmful content online.

The DPDP cross-border transfer rules aren't live yet; so why are contracts being redrafted as if they are?

Many legal teams and companies are prematurely rewriting contracts to comply with the cross-border data transfer rules of India's Digital Personal Data Protection Act. However, these specific rules will not actually take effect until roughly May 2027. Currently, organizations are making the mistake of forcing strict European-style data protection clauses into their Indian contracts. This approach is highly counterproductive because India's legal model is vastly different. While the European system requires strict safeguards for every single transfer, India will use a much more open approach. This means that data can flow freely to any country unless the government explicitly restricts it. Because the government has not yet released a list of restricted countries, there is no solid legal basis to enforce strict transfer mechanisms right now. Including heavy compliance requirements prematurely can easily lock businesses into unnecessary legal burdens and costs. Instead of overcomplicating current agreements, legal teams should draft adaptable clauses that allow for future updates once the rules officially take effect. During this waiting period, companies should focus on understanding their data flows rather than creating rigid compliance structures. Lawyers must also be totally transparent with clients, clarifying that these contract changes are preparations for the future, not immediate legal obligations.

Daily Tech Digest - September 18, 2026

Quote for the day:

“An investment in knowledge pays the best interest.” -- Benjamin Franklin

🎧 Listen to the audio debrief on YouTube

▶ Play Audio Digest

Duration: 24 mins • Perfect for listening on the go.

Brevo supply-chain attack injected ClickFix scripts on customer sites

Brevo, a popular digital marketing and customer management platform, recently experienced a security breach affecting its website and tools embedded on customer sites. On September 14, attackers used a compromised Cloudflare API key, which had been mistakenly left inside the company's application code, to alter the platform's web traffic. For about five and a half hours, the attackers injected malicious scripts into Brevo's web forms and chat tools. When visitors loaded a website using these tools, they saw a fake verification screen urging them to run a harmful command, a technique known as a ClickFix attack. Additionally, if the visitor was logged into a WordPress site as an administrator, the script secretly attempted to install a hidden backdoor plugin called Web Media Optimizer. Security researchers estimate this incident may have affected up to one hundred thousand websites. Once Brevo identified the issue, the company quickly removed the unauthorized access, deleted the harmful files, and confirmed that core systems like email delivery and customer data remained secure. Website administrators who were logged in during the attack window are advised to carefully check their plugin lists for any unauthorized additions and update their passwords to ensure their systems remain completely safe.

Abandoned IoT apps keep sending sensitive data to broken servers

A recent study by the University of Massachusetts Amherst highlights the significant security risks posed by abandoned Internet of Things (IoT) companion apps. These apps, used to control smart devices like thermostats and cameras, often remain on users' phones long after developers stop updating them. The researchers analyzed over 61,500 abandoned Android IoT apps and found that a staggering number contained software dependencies linked to known vulnerabilities. Many of these apps were still being downloaded by millions of users, despite not receiving an update in over two years. Furthermore, these apps often bundle old software libraries and hard-coded web addresses, many of which no longer function or belong to entirely different owners. This creates a dangerous scenario where sensitive data, gathered through permissions like camera and location access, is sent to broken or potentially malicious endpoints. While the study found similar rates of known vulnerabilities in both abandoned and actively maintained apps, the real issue lies in the destination of the data. Over 40% of the data sinks in abandoned apps were associated with unreachable or vulnerable endpoints, compared to less than 1% in active apps. This research underscores the need for users to regularly review and uninstall abandoned IoT apps to minimize their security exposure.

Is your low code security keeping up with business speed?

Low code development platforms have transformed how organizations build applications, often leading to a misconception that they are as unstructured as vibe coding — the practice of relying entirely on artificial intelligence to generate software from casual prompts. However, while low code environments provide more structure and included guardrails than AI generated code, they still present significant security challenges that teams cannot ignore. Because these platforms empower everyday users to assemble functional applications quickly using visual interfaces, they introduce risks related to improper data handling, misconfigured permissions, and poor access controls. Included security features within low code platforms offer a baseline of protection, ensuring that development is not merely a chaotic environment, but they are not a complete safety net. To maintain a secure environment, IT departments must establish clear governance policies and conduct regular audits of user created applications. Without proper oversight, everyday builders might unintentionally expose sensitive company information or create software vulnerabilities that external attackers could exploit. Ultimately, organizations must strike a careful balance between enabling rapid, accessible software creation and maintaining strict security standards across the board. Relying solely on a platform's default protections is a risky approach; continuous monitoring and proactive management remain essential to keeping your business data truly safe.

Prioritise on the best governance, not the best model

The article from FutureCISO highlights that by mid-2026, the deployment of AI agents in Asia Pacific enterprises has significantly outpaced governance capabilities. Research shows that active AI agents have nearly tripled in a year, while the time to create them has halved. Gartner predicts that 40% of enterprise applications will feature embedded task-specific AI agents by the end of 2026. However, this rapid adoption has led to a rise in "shadow AI," with security incidents doubling year over year, according to IBM. The core issue is a lack of visibility; many organizations do not know what AI agents they have deployed. Lavy Stokhamer from Standard Chartered emphasizes that organizations need the same accountability and visibility for AI agents as they do for human employees, applications, and privileged accounts. A real-time inventory is crucial to understanding what each agent is authorized to do, the data it can access, and who is accountable. This comprehensive inventory of agent identities and permissions is fundamentally the "organizational chart for a digital workforce." Without knowing what digital actors exist and their authority, it is impossible to govern, secure, or manage risk at scale, leading to significant challenges in trust, resilience, and economics.

Malicious JavaScript Evaded VirusTotal in Seven of Eight E-Commerce Storefront Attacks

A recent cybersecurity investigation has revealed that traditional malware scanners are struggling to detect sophisticated e-commerce storefront attacks. Security researchers identified four distinct malicious JavaScript operations actively targeting online retailers. Across these campaigns, they found eight unique payloads designed to run quietly in a shopper's browser. Remarkably, when these payloads were tested against standard security tools, seven of the eight completely evaded detection by VirusTotal, and none were flagged as malicious by URLScan. These attacks succeed because they do not break the website. A modern storefront can look and function perfectly normally while the hidden script secretly siphons affiliate revenue, hijacks clicks, manipulates analytics, or opens a backdoor for remote access. To avoid detection, the malicious code uses clever evasion tactics, such as waiting for specific mobile devices, operating only during certain hours, or staying dormant until particular product buttons load on the page. Because these scripts only execute under exact conditions, traditional signature-based scanners often miss them during routine checks. This incident underscores a critical shift in e-commerce security. Relying solely on standard vendor trust or basic scans is no longer enough. Protecting online storefronts now requires advanced, behavior-based monitoring to catch these elusive threats in live traffic.

Rethinking Disaster Recovery Planning Using Optimized Sequencing

This article from Disaster Recovery Journal focuses on how organizations can improve their IT disaster recovery plans by optimizing their recovery sequences. When a widespread system outage occurs, simply restoring applications one by one based on a static list isn't always effective. Systems rely on each other—for example, an essential business app might need its database and identity services to be brought back online first. The author argues that companies need to look at multiple factors when deciding what to restore first. These include technical dependencies, recovery time objectives, and the potential impact on revenue and critical services. Because tech environments are always changing, with new applications and integrations being added, a fixed recovery sequence can quickly become outdated. To handle this, organizations can adopt recovery optimization. This approach uses existing data on dependencies and business priorities to compute the best recovery sequence for a specific situation. It allows teams to adjust their strategy based on current needs, whether that means prioritizing strict recovery timelines or protecting revenue. Ultimately, using an explainable, data-driven method helps teams make better decisions during a crisis and improves the value of their disaster recovery exercises.

Zombie Workloads Haunt Data Center Efficiency Efforts

Zombie workloads, such as unused applications or abandoned storage volumes, are creating notable challenges in data center efficiency. According to recent findings from the International Data Center Authority, up to 13% of US cloud usage is attributed to these idle workloads. The issue stems from scenarios like incomplete post-merger integrations and employees leaving apps active. The problem is becoming more critical with the rise of AI and GPUs, as the cost of idle time rises steeply compared to traditional CPU workloads. To address this, organizations are relying on Cloud FinOps tools and observability tools that find inactive resources. While features like scale-to-zero in serverless architectures offer some relief, they bring challenges like cold starts. The complexities of AI workloads also make hunting for zombies difficult, because they introduce issues like abandoned GPUs and mid-flight pipeline crashes. Effective management is built upon having sound policies. Clear guidelines, automated reminders, and routine scans are important in curbing zombie workloads. The cost of failing to decommission these idle assets has severe implications.

A Framework for Taming Unstructured Data at Scale

The provided article from CDO Magazine discusses the critical need for a framework to manage unstructured data, which constitutes 80% to 90% of corporate information. This "dark matter" includes emails, PDFs, and Teams messages, often lacking visibility and posing significant risks. The author, Lana DeMaria, highlights two main drivers for this urgency: the rise of "shadow AI," where employees might unknowingly feed sensitive data into public models, and the evolution of ransomware into "double extortion" tactics that target valuable unstructured data. Traditional governance methods, such as manual classification and reliance on regular expressions, fail because they are not scalable and treat governance as a one-time event rather than a continuous process. To address these challenges, the article proposes a cyclical, automated framework centered on three layers: Discovery (indexing data in place), Classification (using AI for semantic analysis), and Continuous Compliance (automating lifecycle management, including defensible deletion). By leveraging AI, organizations can better understand their data, manage risks, and ensure that governance scales effectively. Ultimately, implementing this framework allows leaders to turn unstructured data from a liability into a strategic asset for the enterprise.

The Standard BI Playbook Wasn't Built for the Physical Economy

The standard business intelligence approach often fails when applied to the physical economy, which includes industrial distribution, manufacturing, and marine transportation. These sectors do not suffer from a lack of information but rather struggle with making that information accessible across the organization. Traditional advice assumes data is already organized in a central location, but industrial companies typically rely on fragmented legacy systems, isolated applications, and numerous manual spreadsheets. To make any meaningful progress, companies must first do the practical work of gathering this scattered data into one unified platform. Furthermore, the typical strategy assumes teams are eager for new reports and have dedicated analysts ready to use them. In reality, operational teams are deep domain experts who are often overwhelmed by manual reporting tasks and naturally skeptical of new tools. They need immediate, reliable answers to handle their daily operations, not long-term analytical deep dives. Success in this environment should not be measured by how many reports are created, but by how many hours of manual work are eliminated. By focusing on centralizing information, sharing knowledge across departments, and automating tedious processes, industrial organizations can give employees their time back and significantly improve how they operate on a daily basis.

You Can’t Patch Cybersecurity Burnout: Joe Marshall’s Human Incident Response Framework

The provided article details Joe Marshall's Human Incident Response Framework, introduced during his CYBR.SEC.CON. 2026 keynote. Inspired by his grueling experience fighting the VPNFilter botnet in 2018, Marshall argues the cybersecurity industry expertly manages technical incident response but fails to support the human defenders. His framework provides a playbook to address occupational stress by first differentiating "burnout" into four specific injuries: actual burnout (workload exhaustion), secondary traumatic stress, vicarious trauma, and moral injury. Because they stem from different causes, they require distinct responses beyond just taking time off. The framework challenges the notion that stress merely comes from long hours, highlighting six exposure factors like content type and secrecy that make different cybersecurity roles uniquely taxing. It adapts military and emergency medicine concepts, classifying human strain into four zones: Ready, Reacting, Injured, and Crisis. Crucially, it replaces passive "open-door policies" with structured peer check-ins designed to establish baselines and recognize when a colleague is struggling. While offering practical tools like a 43-page Field Guide and a two-page Playbook, Marshall stresses the framework is a detection aid, not a clinical replacement. It aims to give the industry a shared vocabulary to recognize human distress and properly escalate issues without turning support into surveillance.

Daily Tech Digest - September 17, 2026

Quote for the day:

“The moment you’re comfortable is the moment you stop growing.” -- Allison Dunn

🎧 Listen to the audio debrief on YouTube

▶ Play Audio Digest

Duration: 24 mins • Perfect for listening on the go.

AI Security Spending Jumps as Fear Outpaces Proof of Value

Companies are heavily investing in artificial intelligence for cybersecurity, often prioritizing swift adoption over clear proof of its effectiveness. Driven by the transition of AI from a testing phase into active use, along with the rising deployment of AI by bad actors, organizations feel immense pressure to keep pace. For many chief information security officers (CISOs), fear of falling behind and the need for "blame insurance" against potential breaches are accelerating spending. In fact, a significant number of CISOs cite AI as their top priority for new budget allocations. Despite this aggressive funding, the most common AI implementations often fall short of delivering the highest returns. The challenge is compounded by the inherent difficulty of measuring the return on investment (ROI) in cybersecurity, where success is defined by preventing events like data breaches rather than generating direct profit. Experts advise a more deliberate approach, urging organizations to move past the hype. Rather than adopting AI simply for the sake of having it, companies should focus on areas where the technology can genuinely lower risk and handle repetitive tasks. Thoughtful integration, backed by strong governance and clear goals, will ultimately determine which organizations benefit most from their AI cybersecurity investments.

Salesforce’s massive outage exposes the hidden risks of cloud dependencies

A massive Salesforce outage during its flagship Dreamforce event has underscored the hidden architectural risks of cloud dependency. A roughly seven-and-a-half-hour service disruption on September 16 impacted multiple instances across all regions, initially stemming from a core system component struggling with an "external dependency failure" linked to a legacy login server. Although the issue was resolved by mid-afternoon through manual interventions after automated rolling restarts fell short, the outage highlights that cloud systems do not eradicate architectural vulnerabilities. Instead, these dependencies can become enterprise risks when a central platform fails. The service failure emphasizes the necessity of looking beyond immediate access restoration. Enterprises must transition into a reconciliation phase to address "temporal data problems," ensuring transactions, scheduled jobs, and downstream systems remain consistent. The disruption proves that a legacy component's age is less critical than its role within the system's dependency graph. Organizations should not equate modernization simply with replacing old technology. They must assess dependency concentration, failure blast radius, and isolation strategies. While there are no signs of a security incident, industry experts suggest automated AI tools or recent workforce reductions might have played a role in the disruption. Future post-incident reviews must provide clear insights into failure propagation and preventive measures.

Crypto Industry Figures Blackmailed by Revolut's Hacker

A recent data breach at the British financial services company Revolut has exposed the sensitive personal information of roughly six hundred and eighty high-profile cryptocurrency exchange customers. An extortion group calling itself "Iamnotavillain" orchestrated the attack without breaking into the bank's secure servers. Instead, the criminals gained access to a legitimate Italian government email system. By posing as authorized law enforcement officials for several months, they submitted fraudulent data requests to the bank's compliance team. Believing the inquiries were authentic, employees handed over highly confidential customer files. This exposed data included passport copies, verification photographs, home addresses, phone numbers, and detailed transaction histories. The attackers specifically targeted users with substantial digital asset activity, and notable industry figures such as former Mt. Gox executive Mark Karpelès were among the victims. After securing these detailed identity packages, the hackers launched a blackmail campaign. They demanded a ransom payment of three million dollars, requested in the privacy-focused digital currency Monero, to prevent the information from being released. The extortionists even set up a public website with a countdown clock, threatening to sell the stolen records to other criminal organizations if the company failed to meet their demands within a strict twenty-four hour window.

Stop Treating CSS Container Queries Like Traditional Media Queries

The article clarifies the common misconception that CSS container queries and media queries serve the same purpose. Despite having a 94% browser support rate, container queries are vastly underutilized. Many developers mistakenly treat them interchangeably because of their similar syntax, but they fundamentally differ in their approach to responsive design. Media queries focus outward on the "macro" layout. They check the viewport's dimensions to adjust overarching page structures, such as main grids or full-width headers. Conversely, container queries look inward at "micro" layouts. They allow individual components, like cards or widgets, to adapt based on the available space within their specific parent container, rather than the entire screen size. This distinction is crucial for creating reusable components that maintain their layout integrity regardless of where they are placed on a page. The author advises against replacing media queries entirely with container queries. Instead, the focus should be on a separation of concerns. Media queries remain ideal for page-level adjustments, while container queries shine when a component's layout depends on its immediate context. However, container queries require an extra wrapper element, cannot query their own block size without collapsing, and cannot accept custom property values. Ultimately, understanding these differences unlocks more resilient responsive design.

Trust becomes the product: Five takeaways from the Splunk .conf26 keynotes

The recent Splunk conference centered on a critical theme for modern businesses: trust is the most important element when deploying artificial intelligence agents. As these agents shift from being simple tools to functioning as autonomous digital teammates, they are handling complex tasks around the clock. This shift requires a strong system of record to ensure they act appropriately. A major takeaway is the necessary merging of system monitoring and security. Because it is difficult to tell the difference between a software error, a security breach, or a poorly executed AI command, companies must combine their monitoring and security data to accurately diagnose issues. Cost management is another significant focus. AI agents can quickly become expensive to run if they are not carefully controlled, meaning businesses need better visibility into their data usage to prevent unexpected bills. Furthermore, managing the massive amounts of data required for these systems must become more affordable and efficient so companies do not have to choose which information to keep. Ultimately, organizations are treating AI agents like new employees. They are granting them limited permissions initially and slowly increasing their responsibilities as they prove their reliability, ensuring that human oversight remains an essential part of the process.

Architecting for the Knowledge You Can’t Capture

The article argues that organizations often underestimate how much essential knowledge never makes it into their documentation or AI systems. It opens with a familiar scenario: an experienced engineer is asked to “document everything” before leaving, but what gets captured is only the clean, idealized version of the work. The subtle judgments, exceptions, and sensory cues that guide real decisions never appear in the flowcharts or transcripts, leaving future teams without the insight needed to handle unusual situations. The author explains that this gap reflects the nature of tacit knowledge—skills and perceptions people rely on but rarely articulate. Modern AI can learn from examples, but when expertise is rare or incidents are infrequent, there simply isn’t enough data for models to infer the missing judgment. The article proposes a structured elicitation protocol that pushes experts to clarify thresholds, exceptions, evidence, and escalation paths, turning vague statements into actionable rules. It also outlines a four‑layer architecture—capture, representation, serving, and transmission—to preserve context, surface uncertainty, and support apprenticeship when documentation falls short. The core message is that organizations must design for the knowledge people can’t easily express, or their AI systems will remain blind to the expertise that actually keeps operations running.

How to keep AI-generated code aligned with your standards

The article discusses the challenge of keeping AI-generated code aligned with organizational standards. As more developers use AI coding tools, the risk of accumulating technical and operational debt increases if code is only judged by whether it works functionally. To prevent this, engineering teams must clearly document their non-functional requirements, such as security rules, performance expectations, and data governance policies. These standards should not remain hidden as tribal knowledge. Instead, they must be explicit, machine-readable, and fed into the AI tools as context before any code is generated. Furthermore, organizations should enforce these rules by turning them into automated acceptance criteria within their continuous integration and delivery pipelines. This ensures that any AI-generated code is automatically checked for compliance, security, and performance before it merges. Experts recommend treating AI output as untrusted until it passes the exact same rigorous reviews, tests, and monitoring as human-written code. Ultimately, governing AI-generated code requires shifting from manual audits to automated, systemic enforcement. By maintaining clear specifications, integrating standards into automated testing, and adapting context engines to learn from past decisions, development teams can safely scale their AI use while keeping code quality strictly aligned with enterprise expectations over the long term.

Human-in-the-loop oversight is critical for enterprise AI: 4 experts explain why

Enterprise AI systems increasingly require human-in-the-loop (HITL) oversight to ensure accountability and mitigate risks associated with flawed AI outputs. The FTC's actions against DoNotPay highlight the legal perils of deploying unchecked AI, driving the adoption of software with built-in human escalation for complex workflows. While HITL is meant to catch model errors before they become compliance or legal issues, experts warn against relying solely on an AI's self-assessed confidence score to trigger review, as a confident model can still be wrong. Effective HITL design involves intelligent routing that escalates issues to the appropriate personnel based on organizational risk tolerance, rather than a simple binary system. Furthermore, real oversight demands more than a rubber-stamp approval process; it requires reviewers with the context and time to actually evaluate the AI's work and overturn it if necessary, combating the tendency for reviewers to become biased in favor of the AI's suggestions. Legislation like the EU AI Act necessitates demonstrable proof of this oversight through clear audit trails. Successful implementations, like those by Nominal and IgniteTech, often mandate human approval for critical actions and use "grounding," which forces the AI to rely only on verified company data or escalate the query if it lacks the information, ensuring accountability remains firmly with human operators.

Passkeys in the post-quantum era: Why FIDO needs more than new algorithms

The provided article discusses the need to prepare the FIDO2 ecosystem, which includes passkeys, for the post-quantum era. Passkeys, which rely on asymmetric cryptography, are vulnerable to future quantum computers that could potentially break the current public-key algorithms like RSA and elliptic curve cryptography.

The author, Johann-Philipp Thiers, explains that transitioning to Post-Quantum Cryptography (PQC) is a complex process. It goes beyond simply swapping out algorithms. PQC algorithms often result in larger keys and signatures, which can be problematic for resource-constrained authenticators like hardware security keys due to memory, processing power, and transport limitations.

Furthermore, the transition involves updating the entire trust chain, including metadata service signatures, certificate formats, and relying party support. The author emphasizes that FIDO’s current crypto-agility is beneficial but requires coordination among various stakeholders, such as operating systems, browsers, and certification programs. Practical demonstrators are crucial for identifying engineering challenges like message sizes, performance impacts, and interoperability issues. Ultimately, securing passkeys against quantum threats requires a gradual, coordinated effort involving standardization, testing, and careful engineering to ensure their long-term viability.

AI made software development unrecognizable. Is cybersecurity next?

Artificial intelligence is rapidly reshaping the cybersecurity landscape, much as it has already transformed software development. While the shift in security might take slightly longer, experts predict that fundamental changes are inevitable. Security Operations Centers will soon rely heavily on autonomous agents to perform initial triage, allowing human analysts to focus on complex oversight and critical decisions. This transition is essential because AI is drastically increasing the discovery of vulnerabilities, creating a massive backlog that security teams struggle to absorb and remediate. Furthermore, as attackers begin using AI to launch high speed automated threats, organizations must deploy their own rapid containment systems to respond effectively. This shift will also alter the cybersecurity workforce. Rather than eliminating jobs, organizations will likely adopt flatter teams featuring highly experienced senior professionals at one end and junior staff at the other, putting pressure on middle management roles. AI might also serve as a unifying interface to manage sprawling security toolsets. To prepare, security leaders should begin testing agents on high volume tasks while establishing strong governance frameworks. Most importantly, leaders must ensure that every autonomous agent has a designated human owner who remains fully accountable for its actions and potential failures within the organization.