Daily Tech Digest - August 31, 2025


Quote for the day:

“Our chief want is someone who will inspire us to be what we know we could be.” -- Ralph Waldo Emerson



A Brief History of GPT Through Papers

The first neural network based language translation models operated in three steps (at a high level). An encoder would embed the “source statement” into a vector space, resulting in a “source vector”. Then, the source vector would be mapped to a “target vector” through a neural network and finally a decoder would map the resulting vector to the “target statement”. People quickly realized that the vector that was supposed to encode the source statement had too much responsibility. The source statement could be arbitrarily long. So, instead of a single vector for the entire statement, let’s convert each word into a vector and then have an intermediate element that would pick out the specific words that the decoder should focus more on. ... The mechanism by which the words were converted to vectors was based on recurrent neural networks (RNNs). Details of this can be obtained from the paper itself. These recurrent neural networks relied on hidden states to encode the past information of the sequence. While it’s convenient to have all that information encoded into a single vector, it’s not good for parallelizability since that vector becomes a bottleneck and must be computed before the rest of the sentence can be processed. ... The idea is to give the model demonstrative examples at inference time as opposed to using them to train its parameters. If no such examples are provided in-context, it is called “zero shot”. If one example is provided, “one shot” and if a few are provided, “few shot”.


8 Powerful Lessons from Robert Herjavec at Entrepreneur Level Up That Every Founder Needs to Hear

Entrepreneurs who remain curious — asking questions and seeking insights — often discover pathways others overlook. Instead of dismissing a "no" or a difficult response, Herjavec urged attendees to look for the opportunity behind it. Sometimes, the follow-up question or the willingness to listen more deeply is what transforms rejection into possibility. ... while breakthrough innovations capture headlines, the majority of sustainable businesses are built on incremental improvements, better execution and adapting existing ideas to new markets. For entrepreneurs, this means it's okay if your business doesn't feel revolutionary from day one. What matters is staying committed to evolving, improving and listening to the market. ... setbacks are inevitable in entrepreneurship. The real test isn't whether you'll face challenges, but how you respond to them. Entrepreneurs who can adapt — whether by shifting strategy, reinventing a product or rethinking how they serve customers — are the ones who endure. ... when leaders lose focus, passion or clarity, the organization inevitably follows. A founder's vision and energy cascade down into the culture, decision-making and execution. If leaders drift, so does the company. For entrepreneurs, this is a call to self-reflection. Protect your clarity of purpose. Revisit why you started. And remember that your team looks to you not just for direction, but for inspiration. 


The era of cheap AI coding assistants may be over

Developers have taken to social media platforms and GitHub to express their dissatisfaction over the pricing changes, especially across tools like Claude Code, Kiro, and Cursor, but vendors have not adjusted pricing or made any changes that significantly reduce credits consumption. Analysts don’t see any alternative to reducing the pricing of these tools. "There’s really no alternative until someone figures out the following: how to use cheaper but dumber models than Claude Sonnet 4 to achieve the same user experience and innovate on KVCache hit rate to reduce the effective price per dollar,” said Wei Zhou, head of AI utility research at SemiAnalysis. Considering the market conditions, CIOs and their enterprises need to start absorbing the cost and treat vibe coding tools as a productivity expense, according to Futurum’s Hinchcliffe. “CIOs should start allocating more budgets for vibe coding tools, just as they would do for SaaS, cloud storage, collaboration tools or any other line items,” Hinchcliffe said. “The case of ROI on these tools is still strong: faster shipping, fewer errors, and higher developer throughput. Additionally, a good developer costs six figures annually, while vibe coding tools are still priced in the low-to-mid thousands per seat,” Hinchcliffe added. ... “Configuring assistants to intervene only where value is highest and choosing smaller, faster models for common tasks and saving large-model calls for edge cases could bring down expenditure,” Hinchcliffe added.


AI agents need intent-based blockchain infrastructure

By integrating agents with intent-centric systems, however, we can ensure users fully control their data and assets. Intents are a type of building block for decentralized applications that give users complete control over the outcome of their transactions. Powered by a decentralized network of solvers, agentic nodes that compete to solve user transactions, these systems eliminate the complexity of the blockchain experience while maintaining user sovereignty and privacy throughout the process. ... Combining AI agents and intents will redefine the Web3 experience while keeping the space true to its core values. Intents bridge users and agents, ensuring the UX benefits users expect from AI while maintaining decentralization, sovereignty and verifiability. Intent-based systems will play a crucial role in the next phase of Web3’s evolution by ensuring agents act in users’ best interests. As AI adoption grows, so does the risk of replicating the problems of Web2 within Web3. Intent-centric infrastructure is the key to addressing both the challenges and opportunities that AI agents bring and is necessary to unlock their full potential. Intents will be an essential infrastructure component and a fundamental requirement for anyone integrating or considering integrating AI into DeFi. Intents are not merely a type of UX upgrade or optional enhancement. 


The future of software development: To what can AI replace human developers?

Rather than replacing developers, AI is transforming them into higher-level orchestrators of technology. The emerging model is one of human-AI collaboration, where machines handle the repetitive scaffolding and humans focus on design, strategy, and oversight. In this new world, developers must learn not just to write code, but to guide, prompt, and supervise AI systems. The skillset is expanding from syntax and logic to include abstraction, ethical reasoning, systems thinking, and interdisciplinary collaboration. In other words, AI is not making developers obsolete. It is making new demands on their expertise. ... This shift has significant implications for how we educate the next generation of software professionals. Beyond coding languages, students will need to understand how to evaluate AI- AI-generated output, how to embed ethical standards into automated systems, and how to lead hybrid teams made up of both humans and machines. It also affects how organisations hire and manage talent. Companies must rethink job descriptions, career paths, and performance metrics to account for the impact of AI-enabled development. Leaders must focus on AI literacy, not just technical competence. Professionals seeking to stay ahead of the curve can explore free programs, such as The Future of Software Engineering Led by Emerging Technologies, which introduces the evolving role of AI in modern software development.


Open Data Fabric: Rethinking Data Architecture for AI at Scale

The first principle, unified data access, ensures that agents have federated real-time access across all enterprise data sources without requiring pipelines, data movement, or duplication. Unlike human users who typically work within specific business domains, agents often need to correlate information across the entire enterprise to generate accurate insights. ... The second principle, unified contextual intelligence, involves providing agents with the business and technical understanding to interpret data correctly. This goes far beyond traditional metadata management to include business definitions, domain knowledge, usage patterns, and quality indicators from across the enterprise ecosystem. Effective contextual intelligence aggregates information from metadata, data catalogs, business glossaries, business intelligence tools, and tribal knowledge into a unified layer that agents can access in real-time.  ... Perhaps the most significant principle involves establishing collaborative self-service. This is a significant shift as it means moving from static dashboards and reports to dynamic, collaborative data products and insights that agents can generate and share with each other. The results are trusted “data answers,” or conversational, on-demand data products for the age of AI that include not just query results but also the business context, methodology, lineage, and reasoning that went into generating them.


A Simple Shift in Light Control Could Revolutionize Quantum Computing

A research collaboration led by Vikas Remesh of the Photonics Group at the Department of Experimental Physics, University of Innsbruck, together with partners from the University of Cambridge, Johannes Kepler University Linz, and other institutions, has now demonstrated a way to bypass these challenges. Their method relies on a fully optical process known as stimulated two-photon excitation. This technique allows quantum dots to emit streams of photons in distinct polarization states without the need for electronic switching hardware. In tests, the researchers successfully produced high-quality two-photon states while maintaining excellent single-photon characteristics. ... “The method works by first exciting the quantum dot with precisely timed laser pulses to create a biexciton state, followed by polarization-controlled stimulation pulses that deterministically trigger photon emission in the desired polarization,” explain Yusuf Karli and Iker Avila Arenas, the study’s first authors. ... “What makes this approach particularly elegant is that we have moved the complexity from expensive, loss-inducing electronic components after the single photon emission to the optical excitation stage, and it is a significant step forward in making quantum dot sources more practical for real-world applications,” notes Vikas Remesh, the study’s lead researcher.


AI and the New Rules of Observability

The gap between "monitoring" and true observability is both cultural and technological. Enterprises haven't matured beyond monitoring because old tools weren't built for modern systems, and organizational cultures have been slow to evolve toward proactive, shared ownership of reliability. ... One blind spot is model drift, which occurs when data shifts, rendering its assumptions invalid. In 2016, Microsoft's Tay chatbot was a notable failure due to its exposure to shifting user data distributions. Infrastructure monitoring showed uptime was fine; only semantic observability of outputs would have flagged the model's drift into toxic behavior. Hidden technical debt or unseen complexity in code can undermine observability. In machine learning, or ML, systems, pipelines often fail silently, while retraining processes, feature pipelines and feedback loops create fragile dependencies that traditional monitoring tools may overlook. Another issue is "opacity of predictions." ... AI models often learn from human-curated priorities. If ops teams historically emphasized CPU or network metrics, the AI may overweigh those signals while downplaying emerging, equally critical patterns - for example, memory leaks or service-to-service latency. This can occur as bias amplification, where the model becomes biased toward "legacy priorities" and blind to novel failure modes. Bias often mirrors reality.


Dynamic Integration for AI Agents – Part 1

An integration of components within AI differs from an integration between AI agents. The former relates to integration with known entities that form a deterministic model of information flow. The same relates to inter-application, inter-system and inter-service transactions required by a business process at large. It is based on mapping of business functionality and information (an architecture of the business in organisations) onto available IT systems, applications, and services. The latter shifts the integration paradigm since the very AI Agents decide that they need to integrate with something at runtime based on the overlapping of the statistical LLM and available information, which contains linguistic ties unknown even in the LLM training. That is, an AI Agent does not know what a counterpart — an application, another AI Agent or data source — it would need to cooperate with to solve the overall task given to it by its consumer/user. The AI Agent does not know even if the needed counterpart exists. ... Any AI Agent may have its individual owner and provider. These owners and providers may be unaware of each others and act independently when creating their AI Agents. No AI Agent can be self-sufficient due to its fundamental design — it depends on the prompts and real-world data at runtime. It seems that the approaches to integration and the integration solutions differ for the humanitarian and natural science spheres.


Counteracting Cyber Complacency: 6 Security Blind Spots for Credit Unions

Organizations that conduct only basic vendor vetting lack visibility into the cybersecurity practices of their vendors’ subcontractors. This creates gaps in oversight that attackers can exploit to gain access to an institution’s data. Third-party providers often have direct access to critical systems, making them an attractive target. When they’re compromised, the consequences quickly extend to the credit unions they serve. ... Cybercriminals continue to exploit employee behavior as a primary entry point into financial institutions. Social engineering tactics — such as phishing, vishing, and impersonation — bypass technical safeguards by manipulating people. These attacks rely on trust, familiarity, or urgency to provoke an action that grants the attacker access to credentials, systems, or internal data. ... Many credit unions deliver cybersecurity training on an annual schedule or only during onboarding. These programs often lack depth, fail to differentiate between job functions, and lose effectiveness over time. When training is overly broad or infrequent, staff and leadership alike may be unprepared to recognize or respond to threats. The risk is heightened when the threats are evolving faster than the curriculum. TruStage advises tailoring cyber education to the institution’s structure and risk profile. Frontline staff who manage member accounts face different risks than board members or vendors. 

Daily Tech Digest - August 30, 2025


Quote for the day:

“Let no feeling of discouragement prey upon you, and in the end you are sure to succeed.” -- Abraham Lincoln


Ransomware has evolved – so must our defences

Traditional defences typically monitor north-south traffic (from inside to outside the network), missing the lateral movement that characterises today’s threats. By monitoring internal traffic flows, privileged account behaviour and unusual data transfers, organisations gain the ability to identify suspicious actions in real time and contain threats before they escalate to ransomware deployment or public extortion. The ransomware attack on NASCAR illustrates this breakdown. Attackers from the Medusa ransomware group infiltrated the network using stolen credentials and quietly exfiltrated sensitive user data before launching a broader extortion campaign. Because these internal activities weren’t spotted early, the attack matured to a point of public disclosure, operational disruption and reputational harm. ... The emergence of triple extortion and the increasing sophistication of threat actors indicate that ransomware has entered a new phase. It is no longer solely about file encryption; it is about leveraging every available vector to apply maximum pressure on victims. Organisations must respond accordingly. Relying exclusively on prevention is no longer viable. Detection and response must be prioritised equally. This demands a strategic investment in technologies that provide real-time visibility, contextual insight and adaptive response capabilities.


Proof-of-Concept in 15 Minutes? AI Turbocharges Exploitation

The project, which the researchers dubbed Auto Exploit, is not the first to use LLMs for automated vulnerability research and exploit development. NVIDIA, for example, created Agent Morpheus, a generative AI application that scans for vulnerabilities and create tickets for software developers to fix the issues. Google uses an LLM dubbed Big Sleep to find software flaws in open source projects and suggest fixes. ... The Auto Exploit program shows that the ongoing development of LLM-powered software analysis and exploit generation will lead to the regular creation of proof-of-concept code in hours, not months, weeks, or even days. The median time-to-exploitation of a vulnerability in 2024 was 192 days, according to data from VulnCheck. ... Overall, the fast pace of research and quick adoption of AI tools by threat actors means that defenders do not have much time, says Khayet. In 2024, nearly 40,000 vulnerabilities were reported, but only 768 — or less than 0.2% — were exploited. If AI-augmented exploitation becomes a reality, and vulnerabilities are not only exploited faster but more widely, defenders will truly be in trouble. "We believe that exploits at machine speed demand defense at machine speed," he says. "You have to be able to create some sort of a defense as early as 10 minutes after the CVE is released, and you have to expedite, as much as you can, the fixing of the actual library or the application."


How being "culturally fit" is essential for effective hiring

The evaluation process doesn't end at hiring—it continues throughout the probation period, making it a crucial phase for assessing cultural alignment. Effectively utilising this time helps identify potential cultural mismatches early on, allowing for timely course correction. Tools like scorecards, predefined benchmarks, and culturally responsive assessment tests help minimise bias while ensuring a fair evaluation. ... First, leadership accountability must be strengthened by aligning cultural beliefs into KPIs and performance reviews, ensuring managers are assessed on their ability to model and enforce them. With this, equipping leaders with the necessary training and situational guidance can further reinforce these standards in daily interactions. Additionally, blending recognition and rewards with culture—through incentives, peer recognition programmes, and public appreciation—encourages employees to embody the company's ethos. Open communication channels like pulse surveys, town halls, and anonymous reporting help organisations address concerns effectively. Most importantly, leaders must lead by example, actively participating in cultural initiatives and making transparent decisions reinforcing company ideals. This will strengthen cultural alignment, leading to higher employee satisfaction and greater organisational success.


AI drives content surge but human creativity sets brands apart

The report underlines that skilled human input is still regarded as critical to content quality and audience trust. Survey results illustrate consumer reluctance to embrace content that is fully AI-generated: over 70% of readers, 60% of music listeners, and nearly 60% of video viewers in the US are less likely to engage with content if it is known to be produced entirely by AI. Bain suggests that media companies could use the "human created" label as a point of differentiation in the crowded market, in a manner similar to how "fair trade" has been used for consumer goods. Established franchises and intellectual property (IP) are viewed as important assets, with Bain noting that familiarity and trust in brands continue to guide audience choices, both in music and visual media. ... The report also reviews how monetisation models are being affected by these changes. While core methods, such as subscription tiers and digital advertising, remain largely stable, there is emerging potential in areas like hyper-personalisation and fan engagement - using data and AI to deliver exclusive content or branded experiences. Integrations across media and retail sectors, shoppable content, and more immersive ad formats are also identified as growth opportunities. ... Bain concludes that although the "flooded era" of AI-assisted content poses operational and strategic challenges, creative differentiation will be significant for success.


The CISO succession crisis: why companies have no plan and how to change that

Taking on the cybersecurity leader role is not just about individual skills, the way many companies are structured keeps mid-level security leaders from getting the experience they’d need to move into a CISO role. Myers points to several systemic problems that make effective succession planning tough. “For a lot of cases, the CISO role for the top job is still pretty varied within the organization, whether they’re reporting to the CIO, the CFO, or the CEO,” she explains. “That limits the strategic visibility and influence, which means that the number two doesn’t really get the executive exposure or board-level engagement needed to really step into that role.” The issue gets worse because of the way companies are set up, according to Myers. CISOs often oversee a wide range of responsibilities, risk, compliance, governance, vendors, data privacy and crisis management. But cyber teams are usually lean and split into narrow functions, so most deputies only see a piece of the picture. ... Board experience presents another significant barrier. “The CISO has to have board experience, especially depending on the industry or the type of company and their ownership structure. That’s pretty critical,” Myers says. “That’s a hard thing to just walk into on day one and have that credibility and trust without having had the opportunity to develop it throughout your tenure.”


Forget data labeling: Tencent’s R-Zero shows how LLMs can train themselves

The idea behind self-evolving LLMs is to create AI systems that can autonomously generate, refine, and learn from their own experiences. This offers a scalable path toward more intelligent and capable AI. However, a major challenge is that training these models requires large volumes of high-quality tasks and labels, which act as supervision signals for the AI to learn from. Relying on human annotators to create this data is not only costly and slow but also creates a fundamental bottleneck. It effectively limits an AI’s potential capabilities to what humans can teach it. To address this, researchers have developed label-free methods that derive reward signals directly from a model’s own outputs, for example, by measuring its confidence in an answer. While these methods eliminate the need for explicit labels, they still rely on a pre-existing set of tasks, thereby limiting their applicability in truly self-evolving scenarios. ... “What we found in a practical setting is that the biggest challenge is not generating the answers… but rather generating high-quality, novel, and progressively more difficult questions,” Huang said. “We believe that good teachers are far rarer than good students. The co-evolutionary dynamic automates the creation of this ‘teacher,’ ensuring a steady and dynamic curriculum that pushes the Solver’s capabilities far beyond what a static, pre-existing dataset could achieve.”


There's a Stunning Financial Problem With AI Data Centers

Underlying the broader, often poorly-defined AI tech are data centers, which are vast warehouses stuffed to the brim with specialized chips that transform energy into computational power, thus making all your Grok fact checks possible. The economics of data centers are fuzzy at best, as the ludicrous amount of money spent building them makes it difficult to get a full picture. In less than two years, for example, Texas revised its fiscal year 2025 cost projection on private data center projects from $130 million to $1 billion. ... In other words, new data centers have a very tiny runway in which to achieve profits that currently remain way out of reach. By Kupperman's projections, a brand new data center will quickly become a Theseus' ship made up of some of the most expensive technology money can buy. If a new data center doesn't start raking in mountains of cash ASAP, the cost to maintain its aging parts will rapidly overtake the revenue it can bring in. Given the current rate at which tech companies are spending money without much return — a long-term bet that AI will all but make human labor obsolete — Kupperman estimates that revenue would have to increase ten-fold just to break even. Anything's possible, of course, but it doesn't seem like a hot bet. "I don’t see how there can ever be any return on investment given the current math," he wrote.


Employee retention: 7 strategies for retaining top talent

Smith doesn’t wait for high performers on his IT team to seek out challenges or promotions; rather, department leaders reach out to discuss what the company can offer to keep them engaged, interested, and fulfilled at work. That may mean quickly promoting them to positions or offering them new work with a more senior title, Smith says, explaining that “if we don’t give them more interesting work, they’ll find it elsewhere.” ... Ewles endorses that kind of proactive engagement. She also advises organizations to conduct stay interviews to learn what keeps workers at the organization, and she recommends doing flight risk assessments to identify which workers are likely to leave and how to make them want to stay. “Those can be key differentiators in retaining top talent,” she adds. ... CIOs who want to retain them need to give them more opportunities where they are, she adds. ... Similarly, Anthony Caiafa, who as CTO of SS&C Technologies also has CIO responsibilities, directs interesting work to the high performers on his IT team, saying that they’re “easier to keep if you’re providing them with complex problems to solve.” That, he notes, is in addition to good compensation, mentoring, training, and advancement opportunities. ... Knowing they’re contributing something of value is part of a good retention policy, says Sibyl McCarley, chief people officer at tech company Hirevue.


Challenging Corporate Cultures That Limit Strategic Innovation

A thriving innovation culture requires that companies shift away from rigid, top-down hierarchies in favor of more flexible structures with accessible leaders where communication flows freely up and down the chain of command and across functional groups. Such changes make innovation a more accessible process for employees, prevent communication breakdowns, and streamline decision-making. ... All successful companies enjoy explosive periods of growth as represented by the steep part of the S-curve. When that growth starts to level off, the company is enjoying much success and generating much cash. It is at this point that management teams get comfortable, enjoying the momentum of their success. This is precisely when they should start to become uncomfortable and alert to new innovation possibilities. ... There is a natural tendency to avoid risk, but risk is an essential component of strategic innovation. The key is attacking that risk through the use of intelligent failure—failure that happens with a purpose and provides the insights needed for success. When implementing a major innovation initiative, intelligent failure is an essential part of systematically reducing the most critical risks—the risks that can cause the entire initiative to fail. Success comes from attacking the biggest risks first, addressing fundamental uncertainties early, and taking bite-sized risks through incremental proof-of-concept steps.


Building Real Enterprise AI Agents With Apache Flink

The common approach today is to stitch together a patchwork of disconnected systems: one for data streaming (like Apache Kafka), another for workflow orchestration, one for aggregating all the possible contextual data the agent might need and a separate application runtime for the agent’s logic. This “stitching” approach creates a system that is both operationally complex and technically fragile. Engineers are left managing a brittle architecture where data is handed off between systems, introducing significant latency at each step. This process often relies on polling or micro-batching, meaning the agent is always acting on slightly stale data. ... While Flink provides the perfect engine, the community recognized the need for better native support for agent-specific workflows. This led to Streaming Agents, designed to make Flink the definitive platform for building agents. Crucially, this is not another tool to stitch into your stack. It’s a native framework that directly extends Flink’s own DataStream and Table APIs, making agent development a first-class citizen within the Flink ecosystem. This native approach unlocks the most powerful benefit: the seamless integration of data processing and AI. Before, an engineer might have one Flink job to enrich data, which then writes to a message queue for a separate Python service to apply the AI logic. 

Daily Tech Digest - August 29, 2025


Quote for the day:

"Whatever you can do, or dream you can, begin it. Boldness has genius, power and magic in it." -- Johann Wolfgang von Goethe


The incredibly shrinking shelf life of IT solutions

“Technology cycles are spinning faster and faster, and some solutions are evolving so fast, that they’re now a year-long bet, not a three- or five-year bet for CIOs,” says Craig Kane ... “We are living in a period of high user expectations. Every day is a newly hyped technology, and CIOs are constantly being asked how can we, the company, take advantage of this new solution,” says Boston Dynamics CIO Chad Wright. “Technology providers can move quicker today with better development tools and practices, and this feeds the demand that customers are creating.” ... Not every CIO is switching out software as quickly as that, and Taffet, Irish, and others say they’re certainly not seeing the shelf life for all software and solutions in their enterprise shrink. Indeed, many vendors are updated their applications with new features and functions to keep pace with business and market demands — updates that help extend the life of their solutions. And core solutions generally aren’t turning over any more quickly today than they did five or 10 years ago, Kearney’s Kane says. ... Montgomery says CIOs and business colleagues sometimes think the solutions they have in place are falling behind market innovations and, as a result, their business will fall behind, too. That may be the case, but they may just be falling for marketing hype, she says. Montgomery also cites the fast pace of executive turnover as contributing to the increasingly short shelf life of IT solutions. 


Resiliency in Fintech: Why System Design Matters More Than Ever

Cloud computing has transformed fintech. What once took months to provision can now be spun up in hours. Auto-scaling, serverless computing, and global distribution have enabled firms to grow without massive upfront infrastructure costs. Yet, cloud also changes the resilience equation. Outages at major CSPs — rare but not impossible — can cascade across entire industries. The Financial Stability Board (FSB) has repeatedly warned about “cloud concentration risk.” Regulators are exploring frameworks for oversight, including requirements for firms to maintain exit strategies or multi-cloud approaches. For fintech leaders, the lesson is clear: cloud-first doesn’t mean resilience-last. Building systems that are cloud-resilient (and in some cases cloud-agnostic) is becoming a strategic priority. ... Recent high-profile outages underline the stakes. Trading platforms freezing during volatile markets, digital banks leaving customers without access to funds, and payment networks faltering during peak shopping days all illustrate the cost of insufficient resilience. ... Innovation remains the lifeblood of fintech. But as the industry matures, resilience has become the new competitive differentiator. The firms that win will be those that treat system design as risk management, embedding high availability, regulatory compliance, and cloud resilience into their DNA. In a world where customer trust can be lost in minutes, resilience is not just good engineering.


AI cost pressures fuelling cloud repatriation

IBM thinks AI will present a bigger challenge than the cloud because it will be more pervasive with more new applications being built on it. Consequently, IT leaders are already nervous about the cost and value implications and are looking for ways to get ahead of the curve. Repeating the experience of cloud adoption, AI is being driven by business teams, not by back-office IT. AI is becoming a significant driver for shifting workloads back to private, on-premise systems. This is because data becomes the most critical asset, and Patel believes few enterprises are ready to give up their data to a third party at this stage. ... The cloud is an excellent platform for many workloads, just as there are certain workloads that run extremely well on a mainframe. The key is to understand workload placement: is my application best placed on a mainframe, on a private cloud or on a public cloud? As they start their AI journey, some of Apptio’s customers are not ready for their models, learning and intelligence – their strategic intellectual property – to sit in a public cloud. There are consequences when things go wrong with data, and those consequences can be severe for the executives concerned. So, when a third party suggests putting all of the customer, operational and financial data in one place to gain wonderful insights, some organisations are unwilling to do this if the data is outside their direct control. 


Finding connection and resilience as a CISO

To create stronger networks among CISOs, security leaders can join trusted peer groups like industry ISACs (Information Sharing and Analysis Centers) or associations within shared technology / compliance spaces like cloud, GRC, and regulatory. The protocols and procedures in these groups ensure members can have meaningful conversations without putting them or their organization at risk. ... Information sharing operates in tiers, each with specific protocols for data protection. Top tiers, involving entities like ISACs, the FBI, and DHS, have established protocols to properly share and safeguard confidential data. Other tiers may involve information and intelligence already made public, such as CVEs or other security disclosures. CISOs and their teams may seek assistance from industry groups, partnerships, or vendors to interpret current Indicators of Compromise (IOCs) and other remediation elements, even when public. Continuously improving vendor partnerships is crucial for managing platforms and programs, as strong partners will be familiar with internal operations while protecting sensitive information. ... Additionally, encouraging a culture of continuous learning and development, not just with the security team but broader technology and product teams, will empower employees, distribute expertise, and grow a more resilient and adaptable workforce.


Geopolitics is forcing the data sovereignty issue and it might just be a good thing

At London Tech Week recently UK Prime Minister Keir Starmer said that the way that war is being fought “has changed profoundly,” adding that technology and AI are now “hard wired” into national defense. It was a stark reminder that IT infrastructure management must now be viewed through a security lens and that businesses need to re-evaluate data management technologies and practices to ensure they are not left out in the cold. ... For many, public cloud services have created a false sense of flexibility. Moving fast is not the same as moving safely. Data localization, jurisdictional control, and security policy alignment are now critical to long-term strategy, not barriers to short-term scale. So where does that leave enterprise IT? Essentially, it leaves us with a choice - design for agility with control, or face disruption when the rules change. ... Sovereignty-aware infrastructure isn’t about isolation. It’s about knowing where your data is, who can access it, how it moves, and what policies govern it at each stage. That means visibility, auditability, and the ability to adjust without rebuilding every time a new compliance rule appears. A hybrid multicloud approach gives organizations the flexibility while keeping data governance central. It’s not about locking into one cloud provider or building everything on-prem. 


Recalibrating Hybrid Cloud Security in the Age of AI: The Need for Deep Observability

As AI further fuels digital transformation, the security landscape of hybrid cloud infrastructures is becoming more strained. As such, security leaders are confronting a paradox. Cloud environments are essential for scaling operations, but they also present new attack vectors. ... Amid these challenges, some organisations are realising that their traditional security tools are insufficient. The lack of visibility into hybrid cloud environments is identified as a core issue, with 60 percent of Australian leaders expressing a lack of confidence in their current tools to detect breaches effectively. The call for "deep observability" has never been louder. The research underscores the the need for having a comprehensive, real-time view into all data in motion across the enterprise to improve threat detection and response. Deep observability, combining metadata, network packets, and flow data has become a cornerstone of hybrid cloud security strategies. It provides security teams with actionable insights into their environments, allowing them to spot potential threats in real time. In fact, 89 percent of survey respondents agree that deep observability is critical to securing AI workloads and managing complex hybrid cloud infrastructures. Being proactive with this approach is seen as a vital way to bridge the visibility gap and ensure comprehensive security coverage across hybrid cloud environments.


Financial fraud is widening its clutches—Can AI stay ahead?

Today, organised crime groups are running call centres staffed with human trafficking victims. These victims execute “romance baiting” schemes that combine emotional manipulation with investment fraud. The content they use? AI-generated. The payments they request? ... Fraud attempts rose significantly in a single quarter after COVID hit, and the traditional detection methods fell apart. This is why modern fraud detection systems had to evolve. Now, these systems can analyse thousands of transactions per minute, assigning risk scores that update in real-time. There was no choice. Staying in the old regime of anti-fraud systems was no longer an option when static rules became obsolete almost overnight. ... The real problem isn’t the technology itself. It’s the pace of adoption by bad actors. Stop Scams UK found something telling: While banks have limited evidence of large-scale AI fraud today, technology companies are already seeing fake AI-generated content and profiles flooding their platforms. ... When AI systems learn from historical data that reflects societal inequalities, they can perpetuate discrimination under the guise of objective analysis. Banks using biased training data have inadvertently created systems that disproportionately flag certain communities for additional scrutiny. This creates moral problems alongside operational and legal risks.


Data security and compliance are non-negotiable in any cloud transformation journey

Enterprises today operate in a data-intensive environment that demands modern infrastructure, built for speed, intelligence, and alignment with business outcomes. Data modernisation is essential to this shift. It enables real-time processing, improves data integrity, and accelerates decision-making. When executed with purpose, it becomes a catalyst for innovation and long-term growth. ... The rise of generative AI has transformed industries by enhancing automation, streamlining processes, and fostering innovation. According to a recent NASSCOM report, around 27% of companies already have AI agents in production, while another 31% are running pilots. ... Cloud has become the foundation of digital transformation in India, driving agility, resilience, and continuous innovation across sectors. Kyndryl is expanding its capabilities in the market to support this momentum. This includes strengthening our cloud delivery centres and expanding local expertise across hyperscaler platforms. ... Strategic partnerships are central to how we co-innovate and deliver differentiated outcomes for our clients. We collaborate closely with a broad ecosystem of technology leaders to co-create solutions that are rooted in real business needs. ... Enterprises in India are accelerating their cloud journeys, demanding solutions that combine hyperscaler innovation with deep enterprise expertise. 


Digital Transformation Strategies for Enterprise Architects

Customer experience must be deliberately architected to deliver relevance, consistency, and responsiveness across all digital channels. Enterprise architects enable this by building composable service layers that allow marketing, commerce, and support platforms to act on a unified view of the customer. Event-driven architectures detect behavior signals and trigger automated, context-aware experiences. APIs must be designed to support edge responsiveness while enforcing standards for security and governance. ... Handling large datasets at the enterprise level requires infrastructure that treats metadata, lineage, and ownership as first-class citizens. Enterprise architects design data platforms that surface reliable, actionable insights, built on contracts that define how data is created, consumed, and governed across domains. Domain-oriented ownership via data mesh ensures accountability, while catalogs and contracts maintain enterprise-wide discoverability. ... Architectural resilience starts at the design level. Modular systems that use container orchestration, distributed tracing, and standardized service contracts allow for elasticity under pressure and graceful degradation during failure. Architects embed durability into operations through chaos engineering, auto-remediation policies, and blue-green or canary deployments. 


Unchecked and unbound: How Australian security teams can mitigate Agentic AI chaos

Agentic AI systems are collections of agents working together to accomplish a given task with relative autonomy. Their design enables them to discover solutions and optimise for efficiency. The result is that AI agents are non-deterministic and may behave in unexpected ways when accomplishing tasks, especially when systems interoperate and become more complex. As AI agents seek to perform their tasks efficiently, they will invent workflows and solutions that no human ever considered. This will produce remarkable new ways of solving problems, and will inevitably test the limits of what's allowable. The emergent behaviours of AI agents, by definition, exceed the scope of any rules-based governance because we base those rules on what we expect humans to do. By creating agents capable of discovering their own ways of working, we're opening the door to agents doing things humans have never anticipated. ... When AI agents perform actions, they act on behalf of human users or use an identity assigned to them based on a human-centric AuthN and AuthZ system. That complicates the process of answering formerly simple questions, like: Who authored this code? Who initiated this merge request? Who created this Git commit? It also prompts new questions, such as: Who told the AI agent to generate this code? What context did the agent need to build it? What resources did the AI have access to?

Daily Tech Digest - August 28, 2025


Quote for the day:

“Rarely have I seen a situation where doing less than the other guy is a good strategy.” -- Jimmy Spithill


Emerging Infrastructure Transformations in AI Adoption

Balanced scaling of infrastructure storage and compute clusters optimizes resource use in the face of emerging elastic use cases. Throughput, latency, scalability, and resiliency are key metrics for measuring storage performance. Scaling storage with demand for AI solutions without contributing to technical debt is a careful balance to contemplate for infrastructure transformations. ... Data governance in AI extends beyond traditional access control. ML workflows have additional governance tasks such as lineage tracking, role-based permissions for model modification, and policy enforcement over how data is labeled, versioned, and reused. This includes dataset documentation, drift tracking, and LLM-specific controls over prompt inputs and generated outputs. Governance frameworks that support continuous learning cycles are more valuable: Every inference and user correction can become training data. ... As models become more stateful and retain context over time, pipelines must support real-time, memory-intensive operations. Even Apache Spark documentation hints at future support for stateful algorithms (models that maintain internal memory of past interactions), reflecting a broader industry trend. AI workflows are moving toward stateful "agent" models that can handle ongoing, contextual tasks rather than stateless, single-pass processing.


The rise of the creative cybercriminal: Leveraging data visibility to combat them

In response to the evolving cyber threats faced by organisations and governments, a comprehensive approach that addresses both the human factor and their IT systems is essential. Employee training in cybersecurity best practices, such as adopting a zero-trust approach and maintaining heightened vigilance against potential threats, like social engineering attacks, are crucial. Similarly, cybersecurity analysts and Security Operations Centres (SOCs) play a pivotal role by utilising Security Information and Event Management (SIEM) solutions to continuously monitor IT systems, identifying potential threats, and accelerating their investigation and response times. Given that these tasks can be labor-intensive, integrating a modern SIEM solution that harnesses generative AI (GenAI) is essential. ... By integrating GenAI's data processing capabilities with an advanced search platform, cybersecurity teams can search at scale across vast amounts of data, including unstructured data. This approach supports critical functions such as monitoring, compliance, threat detection, prevention, and incident response. With full-stack observability, or in other words, complete visibility across every layer of their technology stack, security teams can gain access to content-aware insights, and the platform can swiftly flag any suspicious activity.


How to secure digital trust amid deepfakes and AI

To ensure resilience in the shifting cybersecurity landscape, organizations should proactively adopt a hybrid fraud-prevention approach, strategically integrating AI solutions with traditional security measures to build robust, layered defenses. Ultimately, a comprehensive, adaptive, and collaborative security framework is essential for enterprises to effectively safeguard against increasingly sophisticated cyberattacks – and there are several preemptive strategies organizations must leverage to counteract threats and strengthen their security posture. ... Fraudsters are adaptive, usually leveraging both advanced methods (deepfakes and synthetic identities) and simpler techniques (password spraying and phishing) to exploit vulnerabilities. By combining AI with tools like strong and continuous authentication, behavioral analytics, and ongoing user education, organizations can build a more resilient defense system. This hybrid approach ensures that no single point of failure exposes the entire system, and that both human and machine vulnerabilities are addressed. Recent threats rely on social engineering to obtain credentials, bypass authentication, and steal sensitive data, and it is evolving along with AI. Utilizing real-time verification techniques, such as liveness detection, can reliably distinguish between legitimate users and deepfake impersonators. 


Why Generative AI's Future Isn't in the Cloud

Instead of telling customers they needed to bring their data to the AI in the cloud, we decided to bring AI to the data where it's created or resides, locally on-premises or at the edge. We flipped the model by bringing intelligence to the edge, making it self-contained, secure and ready to operate with zero dependency on the cloud. That's not just a performance advantage in terms of latency, but in defense and sensitive use cases, it's a requirement. ... The cloud has driven incredible innovation, but it's created a monoculture in how we think about deploying AI. When your entire stack depends on centralized compute and constant connectivity, you're inherently vulnerable to outages, latency, bandwidth constraints, and, in defense scenarios, active adversary disruption. The blind spot is that this fragility is invisible until it fails, and by then the cost of that failure can be enormous. We're proving that edge-first AI isn't just a defense-sector niche, it's a resilience model every enterprise should be thinking about. ... The line between commercial and military use of AI is blurring fast. As a company operating in this space, how do you navigate the dual-use nature of your tech responsibly? We consider ourselves a dual-use defense technology company and we also have enterprise customers. Being dual use actually helps us build better products for the military because our products are also tested and validated by commercial customers and partners. 


Why DEI Won't Die: The Benefits of a Diverse IT Workforce

For technology teams, diversity is a strategic imperative that drives better business outcomes. In IT, diverse leadership teams generate 19% more revenue from innovation, solve complex problems faster, and design products that better serve global markets — driving stronger adoption, retention of top talent, and a sustained competitive edge. Zoya Schaller, director of cybersecurity compliance at Keeper Security, says that when a team brings together people with different life experiences, they naturally approach challenges from unique perspectives. ... Common missteps, according to Ellis, include over-focusing on meeting diversity hiring targets without addressing the retention, development, and advancement of underrepresented technologists. "Crafting overly broad or tokenistic job descriptions can fail to resonate with specific tech talent communities," she says. "Don't treat DEI as an HR-only initiative but rather embed it into engineering and leadership accountability." Schaller cautions that bias often shows up in subtle ways — how résumés are reviewed, who is selected for interviews, or even what it means to be a "culture fit." ... Leaders should be active champions of inclusivity, as it is an ongoing commitment that requires consistent action and reinforcement from the top.


The Future of Software Is Not Just Faster Code - It's Smarter Organizations

Using AI effectively doesn't just mean handing over tasks. It requires developers to work alongside AI tools in a more thoughtful way — understanding how to write structured prompts, evaluate AI-generated results and iterate them based on context. This partnership is being pushed even further with agentic AI. Agentic systems can break a goal into smaller steps, decide the best order to tackle them, tap into multiple tools or models, and adapt in real time without constant human direction. For developers, this means AI can do more than suggesting code. It can act like a junior teammate who can design, implement, test and refine features on its own. ... But while these tools are powerful, they're not foolproof. Like other AI applications, their value depends on how well they're implemented, tuned and interpreted. That's where AI-literate developers come in. It's not enough to simply plug in a tool and expect it to catch every threat. Developers need to understand how to fine-tune these systems to their specific environments — configuring scanning parameters to align with their architecture, training models to recognize application-specific risks and adjusting thresholds to reduce noise without missing critical issues. ... However, the real challenge isn't just finding AI talent, its reorganizing teams to get the most out of AI's capabilities. 


Industrial Copilots: From Assistants to Essential Team Members

Behind the scenes, industrial copilots are supported by a technical stack that includes predictive analytics, real-time data integration, and cross-platform interoperability. These assistants do more than just respond — they help automate code generation, validate engineering logic, and reduce the burden of repetitive tasks. In doing so, they enable faster deployment of production systems while improving the quality and efficiency of engineering work. Despite these advances, several challenges remain. Data remains the bedrock of effective copilots, yet many workers on the shop floor are still not accustomed to working with data directly. Upskilling and improving data literacy among frontline staff is critical. Additionally, industrial companies are learning that while not all problems need AI, AI absolutely needs high-quality data to function well. An important lesson shared during Siemens’ AI with Purpose Summit was the importance of a data classification framework. To ensure copilots have access to usable data without risking intellectual property or compliance violations, one company adopted a color-coded approach: white for synthetic data (freely usable), green for uncritical data (approval required), yellow for sensitive information, and red for internal IP (restricted to internal use only). 


Will the future be Consolidated Platforms or Expanding Niches?

Ramprakash Ramamoorthy believes enterprise SaaS is already making moves in consolidation. “The initial stage of a hype cycle includes features disguised as products and products disguised as companies. Well we are past that, many of these organizations that delivered a single product have to go through either vertical integration or sell out. In fact a lot of companies are mimicking those single-product features natively on large platforms.” Ramamoorthy says he also feels AI model providers will develop into enterprise SaaS organizations themselves as they continue to capture the value proposition of user data and usage signals for SaaS providers. This is why Zoho built their own AI backbone—to keep pace with competitive offerings and to maintain independence. On the subject of vibe-code and low-code tools, Ramamoorthy seems quite clear-eyed about their suitability for mass-market production. “Vibe-code can accelerate you from 0 to 1 faster, but particularly with the increase in governance and privacy, you need additional rigor. For example, in India, we have started to see compliance as a framework.” In terms of the best generative tools today, he observes “Anytime I see a UI or content generated by AI—I can immediately recognize the quality that is just not there yet.”


Beyond the Prompt: Building Trustworthy Agent Systems

While a basic LLM call responds statically to a single prompt, an agent system plans. It breaks down a high-level goal into subtasks, decides on tools or data needed, executes steps, evaluates outcomes, and iterates – potentially over long timeframes and with autonomy. This dynamism unlocks immense potential but can introduce new layers of complexity and security risk. ... Technology controls are vital but not comprehensive. That’s because the most sophisticated agent system can be undermined by human error or manipulation. This is where principles of human risk management become critical. Humans are often the weakest link. How does this play out with agents? Agents should operate with clear visibility. Log every step, every decision point, every data access. Build dashboards showing the agent’s “thought process” and actions. Enable safe interruption points. Humans must be able to audit, understand, and stop the agent when necessary. ... The allure of agentic AI is undeniable. The promise of automating complex workflows, unlocking insights, and boosting productivity is real. But realizing this potential without introducing unacceptable risk requires moving beyond experimentation into disciplined engineering. It means architecting systems with context, security, and human oversight at their core.


Where security, DevOps, and data science finally meet on AI strategy

The key is to define isolation requirements upfront and then optimize aggressively within those constraints. Make the business trade-offs explicit and measurable. When teams try to optimize first and secure second, they usually have to redo everything. However, when they establish their security boundaries, the optimization work becomes more focused and effective. ... The intersection with cost controls is immediate. You need visibility into whether your GPU resources are being utilized or just sitting idle. We’ve seen companies waste a significant portion of their budget on GPUs because they’ve never been appropriately monitored or because they are only utilized for short bursts, which makes it complex to optimize. ... Observability also helps you understand the difference between training workloads running on 100% utilization and inference workloads, where buffer capacity is needed for response times. ... From a security perspective, the very reason teams can get away with hoarding is the reason there may be security concerns. AI initiatives are often extremely high priority, where the ends justify the means. This often makes cost control an afterthought, and the same dynamic can also cause other enterprise controls to be more lax as innovation and time to market dominate.

Daily Tech Digest - August 27, 2025


Quote for the day:

"Success is the progressive realization of predetermined, worthwhile, personal goals." -- Paul J. Meyer


To counter AI cheating, companies bring back in-person job interviews

Google, Cisco and McKinsey & Co. have all re-instituted in-person interviews for some job candidates over the past year. “Remote work and advancements in AI have made it easier than ever for fake candidates to infiltrate the hiring process,” said Scott McGuckin, vice president of global talent acquisition at Cisco. “Identifying these threats is our priority, which is why we are adapting our hiring process to include increased verification steps and enhanced background checks that may involve an in-person component. ... AI has proven benefits for both job seekers and hiring managers/recruiters. Its use in the job search process grew 6.4% over the past year, while use in core tasks surged even higher, according to online employment marketplace ZipRecruiter. The share of job seekers using AI to draft and refine resumes jumped 39% over last year, while AI-assisted cover letter writing climbed 41%, and AI-based interview prep rose 44%, according to the firm. ... HR and hiring managers should insist on well-lit video interviews, watch for delays or mismatches, ask follow-up questions to spot AI use and verify resume details with background checks and geolocation data. “Some assessment or interview platforms can look at geolocation data, use this to ensure consistency with the resume and application,” Chiba said. 


How procedural memory can cut the cost and complexity of AI agents

Memories are built from an agent’s past experiences, or “trajectories.” The researchers explored storing these memories in two formats: verbatim, step-by-step actions; or distilling these actions into higher-level, script-like abstractions. For retrieval, the agent searches its memory for the most relevant past experience when given a new task. The team experimented with different methods, such vector search, to match the new task’s description to past queries or extracting keywords to find the best fit. The most critical component is the update mechanism. Memp introduces several strategies to ensure the agent’s memory evolves. ... One of the most significant findings for enterprise applications is that procedural memory is transferable. In one experiment, procedural memory generated by the powerful GPT-4o was given to a much smaller model, Qwen2.5-14B. The smaller model saw a significant boost in performance, improving its success rate and reducing the steps needed to complete tasks. According to Fang, this works because smaller models often handle simple, single-step actions well but falter when it comes to long-horizon planning and reasoning. The procedural memory from the larger model effectively fills this capability gap. This suggests that knowledge can be acquired using a state-of-the-art model, then deployed on smaller, more cost-effective models without losing the benefits of that experience.


AI Summaries a New Vector for Malware

The attack uses what researchers call "prompt overdose," a technique in which malicious instructions are repeated dozens of times within invisible HTML styled with properties such as zero opacity, white-on-white text, microscopic font sizes and off-screen positioning. When AI summarizers process this content, the repeated hidden text dominates the model's attention mechanisms, pushing legitimate visible content aside. "When processed by a summarizer, the repeated instructions typically dominate the model's context, causing them to appear prominently - and often exclusively - in the generated summary." ... Cybercriminals have been quick to adapt the technique to fool large language models rather than humans. The attack's effectiveness stems from user reliance on AI-generated summaries for quick content triage, often replacing manual review of original materials. Testing showed that the technique works across AI platforms, including commercial services like Sider.ai and custom-built browser extensions. Researchers also identified factors amplifying the attack's potential impact. Summarizers integrated into widely-used applications could enable mass distribution of social engineering lures across millions of users. The technique could lower technical barriers for ransomware deployment by providing non-technical victims with detailed execution instructions disguised as legitimate troubleshooting advice.


A scalable framework for evaluating health language models

While auto-eval techniques are well equipped to handle the increased volume of evaluation criteria, the completion of the proposed Precise Boolean rubrics by human annotators was prohibitively resource intensive. To mitigate such burden, we refined the Precise Boolean approach to dynamically filter the extensive set of rubric questions, retaining only the most pertinent criteria, conditioned on the specific data being evaluated. This data-driven adaptation, referred to as the Adaptive Precise Boolean rubric, enabled a reduction in the number of evaluations required for each LLM response. ... Current evaluation of LLMs in health often uses Likert scales. We compared this baseline to our data-driven Precise Boolean rubrics. Our results showed significantly higher inter-rater reliability using Precise Boolean rubrics, measured by intra-class correlation coefficients (ICC), compared to traditional Likert rubrics. A key advantage of our approach is its efficiency. The Adaptive Precise Boolean rubrics resulted in high inter-rater agreement of the full Precise Boolean rubric while reducing evaluation time by over 50%. This efficiency gain makes our method faster than even Likert scale evaluations, enhancing the scalability of LLM assessment. The fact that this also provides higher inter-rater reliability supports the argument that this simpler scoring also provides a higher quality signal.


Outdated Fraud Defenses Are a Green Light for Scammers Everywhere

Financial institutions get stuck in a reactive cycle, responding to breaches after the fact and relying heavily on network alerts and reissuing cards en masse to mitigate damage. That’s problematic on all fronts. It’s expensive, increases call center volume and fails to address the root problem. Beyond that, it disrupts the cardholder experience, putting the institution at risk of losing a cardholder’s trust and business. After experiencing a fraudulent attack, cardholders adjust their payment behaviors, regardless of whether the fraudster was successful or not. This could mean they stop using the affected card altogether, switch to a competitor’s product or close their account entirely. ... The tables are turned on the scammer. Instead of detecting fraud as it occurs, financial institutions now have up to 180 days’ lead time to identify a fraud pattern, take action and contain it. This strategic lead time enables early intervention, giving teams the ability to identify emerging fraud typologies, disrupt bad actor behavior patterns and contain the spread before widespread damage occurs. It shifts the institution’s playbook from defense to offense. It also eliminates the need to reissue thousands of cards preemptively, instead identifying small subsets of cardholders most likely to be impacted. Reissues happen only when absolutely necessary, which saves on cost and reputation management. 


SysAdmins: The First Responders of the Digital World

Unlike employees in other departments like sales, finance, marketing, and HR, who can typically log off at 5 p.m. and check out of work until the next morning, IT professionals carry the unique burden of having to be “always on.” For technology vendors in particular, this is especially prevalent; when situations arise that compromise the integrity of key systems and networks, both employees and users can face disruptions to cost organizations revenue and reputational damage. Whether it’s hardware or software issues, the system administrator is there to jump in and patch the issue. ... IT departments are increasingly viewed as “profit protectors,” critical to the bottom line by preventing unplanned expenses and customer churn. As demonstrated by the anecdotes above, system administrators ensure the daily functionality and operational resilience of their organizations, enabling every other team to do their job efficiently. Without system administrators’ constant attention to ensuring things behind the scenes are running smoothly, employees would struggle to fulfill their daily tasks every time an incident occurs. ... Business leaders can show appreciation for these employees by prioritizing mental health initiatives, ensuring IT teams are sufficiently staffed to prevent burnout, and promoting workload balance with generous time-off packages. 


A wake-up call for identity security in devops

The GitHub incident exposed what security teams already suspect—that devops is running headlong into an identity sprawl problem. Identities (human and non-human) are multiplying, permissions are stacking up, and third-party apps are the new soft underbelly. This is where identity security posture management (ISPM) steps in. ISPM takes the principles of cloud security posture management (CSPM)—continuous monitoring, posture scoring, risk-based controls—and applies them to identity. It doesn’t stop at who can log in; it extends into who has access, why they have it, what they can do, and how that access is granted, including via OAuth. ... Modern identity security platforms are stepping in to close this gap. The leading solutions give you deep visibility into the web of permissions spanning developers, service accounts, and third-party OAuth apps. It’s no longer enough to know that a token exists. Teams need full context: who issued the token, what scopes it has, what systems it touches, and how those privileges compare across environments. ... Developers aren’t asking for more security tools, policies, or friction. What they want is clarity, especially if it helps them stay out of the next breach postmortem. That’s why visibility-first approaches work. When security teams show developers exactly what access exists, and why it matters, the conversation shifts from “Why are you blocking me?” to “Thanks for the heads-up.”


"Think Big to Achieve Big": A CEO's advice to today's HR leaders

The traditional perception of HR as an administrative function is obsolete. Today's CHRO is a key driver of organisational transformation, working in close collaboration with the CEO to formulate and achieve overarching goals. This partnership is essential for ensuring that HR initiatives are not just about hiring, but about building a future-ready organisation. This involves enabling talent with the latest technologies, skills, and continuous learning opportunities. Goyal's own collaboration with his CHRO is a model of this integrated approach. They work together to ensure that HR initiatives are fully aligned with the Group's long-term objectives, a dynamic that goes far beyond traditional HR functions. This partnership is what drives sustainable growth and navigates complex challenges. The modern workplace presents a unique set of challenges, from heightened uncertainty to the distinct expectations of Gen Z. Goyal's response to this is a philosophy of active adaptation. To attract and retain young talent, he believes companies must be open to revisiting policies, embracing flexible working hours, and promoting a culture of continuous learning. He emphasises the need for leaders to have an open mindset toward the new generation, just as they would for their own children.


Inside a quantum data center

Quantum-focused measures that might need to be considered include vibrations, electromagnetic sensitivity, and potentially even the speed of the elevators moving hardware between floors. Whether or not there would be one standard encompassing the different types of quantum computers – supercooled, rack-based, optical-tabled etc – or multiple standards to suit all comers is unclear at this stage. ... IBM does also host some dedicated quantum systems at its facilities for customers who don’t want their QPUs on-site, but on-premise enterprise deployments are rare beyond the likes of IBM’s agreement with Cleveland Clinic. They will likely be the exception rather than the norm for enterprises for some time to come, IQM’s Goetz says. “Corporate enterprise customers are not yet buying full systems,” says Goetz. “They are usually accessing the systems through the cloud because they are still ramping up their internal capabilities with the goal to be ready once the quantum computers really have the full commercial value.” Quite what the geography of a world with commercially-useful quantum computers will look like is unclear. Will enterprises be happy with a few centralized ‘quantum cloud’ regions, demand in-country capacity in multiple jurisdictions, or go so far as demanding systems be placed in on-premise or colocated facilities?


Simpler models can outperform deep learning at climate prediction

The researchers see their work as a “cautionary tale” about the risk of deploying large AI models for climate science. While deep-learning models have shown incredible success in domains such as natural language, climate science contains a proven set of physical laws and approximations, and the challenge becomes how to incorporate those into AI models. “We are trying to develop models that are going to be useful and relevant for the kinds of things that decision-makers need going forward when making climate policy choices. While it might be attractive to use the latest, big-picture machine-learning model on a climate problem, what this study shows is that stepping back and really thinking about the problem fundamentals is important and useful,” says study senior author Noelle Selin ... “Large AI methods are very appealing to scientists, but they rarely solve a completely new problem, so implementing an existing solution first is necessary to find out whether the complex machine-learning approach actually improves upon it,” says Lütjens. Some initial results seemed to fly in the face of the researchers’ domain knowledge. The powerful deep-learning model should have been more accurate when making predictions about precipitation, since those data don’t follow a linear pattern. 

Daily Tech Digest - August 26, 2025


Quote for the day:

“When we give ourselves permission to fail, we, at the same time, give ourselves permission to excel.” -- Eloise Ristad


6 tips for consolidating your vendor portfolio without killing operations

Behind every sprawling vendor relationship is a series of small extensions that compound over time, creating complex entanglements. To improve flexibility when reviewing partners, Dovico is wary of vendor entanglements that complicate the ability to retire suppliers. Her aim is to clearly define the service required and the vendor’s capabilities. “You’ve got to be conscious of not muddying how you feel about the performance of one vendor, or your relationship with them. You need to have some competitive tension and align core competencies with your problem space,” she says. Klein prefers to adopt a cross-functional approach with finance and engineering input to identify redundancies and sprawl. Engineers with industry knowledge cross-reference vendor services, while IT checks against industry benchmarks, such as Gartner’s Magic Quadrant, to identify vendors providing similar services or tools. ... Vendor sprawl also lurks in the blind spot of cloud-based services that can be adopted without IT oversight, fueling shadow purchasing habits. “With the proliferation of SaaS and cloud models, departments can now make a few phone calls or sign up online to get applications installed or services procured,” says Klein. This shadow IT ecosystem increases security risks and vendor entanglement, undermining consolidation efforts. This needs to be tackled through changes to IT governance.


Should I stay or should I go? Rethinking IT support contracts before auto-renewal bites

Contract inertia, which is the tendency to stick with what you know, even when it may no longer be the best option, is a common phenomenon in business technology. There are several reasons for it, such as familiarity with an existing provider, fear of disruption, the administrative effort involved in reviewing and comparing alternatives, and sometimes just a simple lack of awareness that the renewal date is approaching. The problem is that inertia can quietly erode value. As organisations grow, shift priorities or adopt new technologies, the IT support they once chose may no longer be fit for purpose. ... A proactive approach begins with accountability. IT leaders need to know what their current provider delivers and how they are being used by the company. Are remote software tools performing as expected? Are updates, patches and monitoring processes being applied consistently across all platforms? Are issues being resolved efficiently by our internal IT team, or are inefficiencies building up? Is this the correct set-up and structure for our business, or could we be making better use of existing internal capacity, by leveraging better remote management tools? Gathering this information allows organisations to have an honest conversation with their provider (and themselves) about whether the contract still aligns with their objectives.


AI Data Security: Core Concepts, Risks, and Proven Practices

Although AI makes and fortifies a lot of our modern defenses, once you bring AI into the mix, the risks evolve too. Data security (and cybersecurity in general) has always worked like that. The security team gets a new tool, and eventually, the bad guys get one too. It’s a constant game of catch-up, and AI doesn’t change that dynamic. ... One of the simplest ways to strengthen AI data security is to control who can access what, early and tightly. That means setting clear roles, strong authentication, and removing access that people don’t need. No shared passwords. No default admin accounts. No “just for testing” tokens sitting around with full privileges. ... What your model learns is only as good (and safe) as the data you feed it. If the training pipeline isn’t secure, everything downstream is at risk. That includes the model’s behavior, accuracy, and resilience against manipulation. Always vet your data sources. Don’t rely on third-party datasets without checking them for quality, bias, or signs of tampering. ... A core principle of data protection, baked into laws like GDPR, is data minimization: only collect what you need, and only keep it for as long as you actually need it. In real terms, that means cutting down on excess data that serves no clear purpose. Put real policies in place. Schedule regular reviews. Archive or delete datasets that are no longer relevant. 


Morgan Stanley Open Sources CALM: The Architecture as Code Solution Transforming Enterprise DevOps

CALM enables software architects to define, validate, and visualize system architectures in a standardized, machine-readable format, bridging the gap between architectural intent and implementation. Built on a JSON Meta Schema, CALM transforms architectural designs into executable specifications that both humans and machines can understand. ... The framework structures architecture into three primary components: nodes, relationships, and metadata. This modular approach allows architects to model everything from high-level system overviews to detailed microservices architectures. ... CALM’s true power emerges in its seamless integration with modern DevOps workflows. The framework treats architectural definitions like any other code asset, version-controlled, testable, and automatable. Teams can validate architectural compliance in their CI/CD pipelines, catching design issues before they reach production. The CALM CLI provides immediate feedback on architectural decisions, enabling real-time validation during development. This shifts compliance left in the development lifecycle, transforming potential deployment roadblocks into preventable design issues. Key benefits for DevOps teams include machine-readable architecture definitions that eliminate manual interpretation errors, version control for architectural changes that provides clear change history, and real-time feedback on compliance violations that prevent downstream issues.


Shadow AI is surging — getting AI adoption right is your best defense

Despite the clarity of this progression, many organizations struggle to begin. One of the most common reasons is poor platform selection. Either no tool is made available, or the wrong class of tool is introduced. Sometimes what is offered is too narrow, designed for one function or team. Sometimes it is too technical, requiring configuration or training that most users aren’t prepared for. In other cases, the tool is so heavily restricted that users cannot complete meaningful work. Any of these mistakes can derail adoption. A tool that is not trusted or useful will not be used. And without usage, there is no feedback, value, or justification for scale. ... The best entry point is a general-purpose AI assistant designed for enterprise use. It must be simple to access, require no setup, and provide immediate value across a range of roles. It must also meet enterprise requirements for data security, identity management, policy enforcement, and model transparency. This is not a niche solution. It is a foundation layer. It should allow employees to experiment, complete tasks, and build fluency in a way that is observable, governable, and safe. Several platforms meet these needs. ChatGPT Enterprise provides a secure, hosted version of GPT-5 with zero data retention, administrative oversight, and SSO integration. It is simple to deploy and easy to use. =


AI and the impact on our skills – the Precautionary Principle must apply

There is much public comment about AI replacing jobs or specific tasks within roles, and this is often cited as a source of productivity improvement. Often we hear about how junior legal professionals can be easily replaced since much of their work is related to the production of standard contracts and other documents, and these tasks can be performed by LLMs. We hear much of the same narrative from the accounting and consulting worlds. ... The greatest learning experiences come from making mistakes. Problem-solving skills come from experience. Intuition is a skill that is developed from repeatedly working in real-world environments. AI systems do make mistakes and these can be caught and corrected by a human, but it is not the same as the human making the mistake. Correcting the mistakes made by AI systems is in itself a skill, but a different one. ... In a rapidly evolving world in which AI has the potential to play a major role, it is appropriate that we apply the Precautionary Principle in determining how to automate with AI. The scientific evidence of the impact of AI-enabled automation is still incomplete, but more is being learned every day. However, skill loss is a serious, and possibly irreversible, risk. The integrity of education systems, the reputations of organisations and individuals, and our own ability to trust in complex decision-making processes, are at stake.


Ransomware-Resilient Storage: The New Frontline Defense in a High-Stakes Cyber Battle

The cornerstone of ransomware resilience is immutability: data written to storage cannot be altered or deleted ever. This write-once-read-many capability means backup snapshots or data blobs are locked for prescribed retention periods, impervious to tampering even by attackers or system administrators with elevated privileges. Hardware and software enforce this immutability by preventing any writes or deletes on designated volumes, snapshots, or objects once committed, creating a "logical air gap" of protection without the need for physical media isolation. ... Moving deeper, efforts are underway to harden storage hardware directly. Technologies such as FlashGuard, explored experimentally by IBM and Intel collaborations, embed rollback capabilities within SSD controllers. By preserving prior versions of data pages on-device, FlashGuard can quickly revert files corrupted or encrypted by ransomware without network or host dependency. ... Though not widespread in production, these capabilities signal a future where storage devices autonomously resist ransomware impact, a powerful complement to immutable snapshotting. While these cutting-edge hardware-level protections offer rapid recovery and autonomous resilience, organizations also consider complementary isolation strategies like air-gapping to create robust multi-layered defense boundaries against ransomware threats.


How an Internal AI Governance Council Drives Responsible Innovation

The efficacy of AI governance hinges on the council’s composition and operational approach. An optimal governance council typically includes cross-functional representation from executive leadership, IT, compliance and legal teams, human resources, product management, and frontline employees. This diversified representation ensures comprehensive coverage of ethical considerations, compliance requirements, and operational realities. Initial steps in operationalizing a council involve creating strong AI usage policies, establishing approved tools, and developing clear monitoring and validation protocols. ... While initial governance frameworks often focus on strict risk management and regulatory compliance, the long-term goal shifts toward empowerment and innovation. Mature governance practices balance caution with enablement, providing organizations with a dynamic, iterative approach to AI implementation. This involves reassessing and adapting governance strategies, aligning them with evolving technologies, organizational objectives, and regulatory expectations. AI’s non-deterministic, probabilistic nature, particularly generative models, necessitates a continuous human oversight component. Effective governance strategies embed this human-in-the-loop approach, ensuring AI enhances decision-making without fully automating critical processes.


The energy sector has no time to wait for the next cyberattack

Recent findings have raised concerns about solar infrastructure. Some Chinese-made solar inverters were found to have built-in communication equipment that isn’t fully explained. In theory, these devices could be triggered remotely to shut down inverters, potentially causing widespread power disruptions. The discovery has raised fears that covert malware may have been installed in critical energy infrastructure across the U.S. and Europe, which could enable remote attacks during conflicts. ... Many OT systems were built decades ago and weren’t designed with cyber threats in mind. They often lack updates, patches, and support, and older software and hardware don’t always work with new security solutions. Upgrading them without disrupting operations is a complex task. OT systems used to be kept separate from the Internet to prevent remote attacks. Now, the push for real-time data, remote monitoring, and automation has connected these systems to IT networks. That makes operations more efficient, but it also gives cybercriminals new ways to exploit weaknesses that were once isolated. Energy companies are cautious about overhauling old systems because it’s expensive and can interrupt service. But keeping legacy systems in play creates security gaps, especially when connected to networks or IoT devices. Protecting these systems while moving to newer, more secure tech takes planning, investment, and IT-OT collaboration.


Agentic AI Browser an Easy Mark for Online Scammers

In an Wednesday blog post, researchers from Guardio wrote that Comet - one of the first AI browsers to reach consumers - clicked through fake storefronts, submitted sensitive data to phishing sites and failed to recognize malicious prompts designed to hijack its behavior. The Tel Aviv-based security firm calls the problem "scamlexity," a messy intersection of human-like automation and old-fashioned social engineering creates "a new, invisible scam surface" that scales to millions of potential victims at once. In a clash between the sophistication of generative models built into browsers and the simplicity of phishing tricks that have trapped users for decades, "even the oldest tricks in the scammer's playbook become more dangerous in the hands of AI browsing." One of the headline features of AI browsers is one-click shopping. Researchers spun up a fake "Walmart" storefront complete with polished design, realistic listings and a seamless checkout flow. ... Rather than fooling a user into downloading malicious code to putatively fix a computer problem - as in ClickFix - a PromptFix attack is a malicious instruction was hidden inside what looks like a CAPTCHA. The AI treated the bogus challenge as routine, obeyed the hidden command and continued execution. AI agents are expected to ingest unstructured logs, alerts or even attacker-generated content during incident response.