Quote for the day:
"If you want to be successful prepare to be doubted and tested." -- Elizabeth McCormick
🎧 Listen to the audio debrief on YouTube
▶ Play Audio DigestDuration: 22 mins • Perfect for listening on the go.
The crisis of synthetic culture
The article discusses a growing concern for CIOs: the "crisis of synthetic
culture" brought on by artificial intelligence. While AI can efficiently
process information and generate human-like text, it fundamentally alters how
organizations create and store knowledge, threatening their authentic culture.
The author points out that culture relies on human experiences, stories, and
shared meaning, which AI cannot genuinely replicate. Instead, AI produces what
the author calls "synthetic truth"—information that sounds plausible and
authoritative but lacks actual human judgment, context, or accountability.
This creates a new operational risk, as employees and leaders may struggle to
differentiate between genuine institutional memory and AI-generated
approximations. If organizations blindly rely on AI to synthesize knowledge or
draft communications, they risk distorting their history and values,
amplifying past errors, or silencing minority viewpoints. The author stresses
that CIOs must expand their roles beyond managing data security to actively
safeguarding organizational meaning and memory. This means implementing strong
AI governance, ensuring human oversight is mandatory for critical decisions,
and making AI outputs traceable to preserve the integrity of the company's
authentic culture.When AI Customer Service Deflects the Wrong Problems
Many brands measure the success of their artificial intelligence customer
service tools by how many inquiries they deflect away from human agents.
However, relying solely on deflection rates can severely damage customer
relationships, particularly during times of economic uncertainty and
inflation. Shoppers today are increasingly skeptical of online information due
to factors like shrinkflation and unreliable reviews. This skepticism prompts
them to contact brands directly for genuine transparency. When customers ask
about price increases or product changes, they are actively looking for
substantive context, not just quick dismissals. According to Ali Fazal, Chief
Marketing Officer of the customer service platform Gladly, using automated
systems to deflect these complex, price-sensitive conversations often
frustrates buyers and ultimately degrades their lifetime value. Instead of
focusing entirely on operational efficiency, organizations should evaluate how
artificial intelligence directly impacts revenue growth and long-term customer
loyalty. Deploying generic models too quickly without industry-specific
context creates major risks, including hallucinations and poor policy
handling. Dedicated human oversight remains absolutely essential for managing
complex disputes, adjusting to rapidly changing conditions, and appropriately
approving financial concessions. Ultimately, artificial intelligence should
not function merely to block customers from reaching human help. Brands must
implement these systems carefully to prioritize strong service and protect
shopper retention.
As artificial intelligence makes cyberattacks faster and more complex, most
organizations are finding that their current security setups are simply not
enough to stop modern threats. According to recent warnings, attackers
currently hold the advantage because they use AI to find and exploit
weaknesses before security teams can react. While many companies are adding
AI tools to their defense systems, they are often doing so faster than they
can properly test them. For example, a recent major breach went completely
unnoticed for almost a week, showing that basic security measures are no
longer enough. To fix this, security leaders need to rethink their approach.
Instead of relying on occasional training sessions, teams should constantly
test their skills and their software in realistic, safe environments that
mimic actual attacks. This helps both the human staff and the automated
tools learn how to work together under pressure. It is also important to
measure success by looking at the quality of decisions and response accuracy
rather than just counting the number of security alerts. By making
continuous practice a core part of their daily work culture, organizations
can better prepare themselves to handle unexpected attacks and keep their
critical systems safe.
As AI computing demands surge, local communities are increasingly resisting
the construction of massive new data centers due to concerns about high
electricity and water usage. To address this tension, the industry is
testing a decentralized approach: paying homeowners to host graphics
processing units (GPUs) right in their garages or homes. Companies are
experimenting with wall-mounted appliances that tap into residential power
and broadband to create distributed computing networks. While this concept
could reduce the need for large-scale facilities and share economic benefits
with households, it faces significant technical hurdles. Home internet
speeds fluctuate, power availability changes throughout the day based on
household appliance usage, and residential hardware failures present complex
logistical challenges. Furthermore, ensuring data security across thousands
of independent locations requires highly sophisticated software
coordination. Because of these constraints, residential networks are not
equipped to handle large-scale AI training, which requires tightly connected
hardware and ultra-fast data transfer. Instead, home-based nodes are best
suited for flexible, independent tasks like data preparation or batch
processing. Ultimately, these household networks are unlikely to replace
traditional data centers entirely. Rather, they will likely become a
supplementary layer managed by central hubs, handling specific tasks while
major facilities manage heavy-duty AI development.
Many leaders find themselves working late into the night, feeling deeply
overwhelmed and exhausted by their responsibilities. According to executive
coach Doug Thorpe, this fatigue happens because business owners often try to
solve their stress without first understanding the specific type of weight
they are carrying. Thorpe explains that the burden of leadership typically
falls into two distinct categories: emotional and operational. Emotional
weight involves feelings of burnout, isolation, and dread. It requires
honest acknowledgment and, in some cases, support from a therapist or coach
to protect your well-being. On the other hand, operational weight occurs
when a business depends entirely on the owner to function. This happens when
the leader becomes a bottleneck for every decision, meaning nothing gets
done if they step away. A common mistake owners make is applying the wrong
solution to their problem. They might try to use personal willpower and
better organization to solve structural gaps, or they might try to simply
rest their way out of a broken business system. To truly find relief,
leaders must pause and ask themselves whether their stress is rooted in
their emotional state or their operational setup, and then apply the
appropriate structural or personal support to move forward.
A recent cyberattack against government agencies in the Asia Pacific region,
likely targeting Taiwan, demonstrates the growing reality of nearly
autonomous threats. According to researchers at the security firm Dream, a
Chinese language threat actor successfully deployed a complex artificial
intelligence framework to compromise systems. The attackers utilized up to
eight interconnected artificial intelligence agents built on specific
operating platforms. These agents worked concurrently to execute an
extensive attack chain, which included conducting reconnaissance, cracking
employee credentials, discovering vulnerabilities, and installing backdoors
on web applications. Notably, the system used a scoring algorithm to
independently evaluate the success of each action and adapt its methods
without human intervention. Taiwan’s Ministry of Digital Affairs later
acknowledged experiencing an attack that matched these characteristics. This
incident signals a significant shift in the security landscape, highlighting
a widening gap between the low cost of executing automated attacks and the
high cost of traditional defense strategies. Security professionals
emphasize that organizations worldwide must now adapt by integrating
artificial intelligence into their own defensive operations. By employing
proactive security measures and automated penetration testing, defenders can
better anticipate threats and close the capability gap before these advanced
methods target a broader range of global businesses and organizations.
Modern applications rely heavily on open-source packages and third-party
code. Because channel partners like Managed Service Providers often
recommend, integrate, and manage these applications, they are increasingly
held accountable when a vulnerability in this software supply chain is
exploited. The challenge is growing because of the sheer volume of
vulnerabilities. Organizations often struggle to patch them all, leaving
vulnerable code in production for months. This is compounded by the
complexity of modern applications, which can have hundreds of hidden
dependencies, and the rise of AI coding assistants, which generate even more
code and dependencies. Threat actors are noticing. They are shifting from
attacking individual endpoints to targeting shared development tools and
open-source projects, knowing that one compromised dependency can spread
across many customer environments. These attacks often bypass traditional
security controls because the software is trusted and signed. Customers and
insurers are responding by demanding more transparency. They expect partners
to provide software inventories, continuous monitoring, and clear
explanations of supply chain risks. Partners who embrace this shift can
become trusted advisors and develop new revenue streams by offering ongoing
security assurance. Those who fail to adapt risk losing credibility and
client relationships.
Most organizations aren’t ready for a Hugging Face-level event
As artificial intelligence makes cyberattacks faster and more complex, most
organizations are finding that their current security setups are simply not
enough to stop modern threats. According to recent warnings, attackers
currently hold the advantage because they use AI to find and exploit
weaknesses before security teams can react. While many companies are adding
AI tools to their defense systems, they are often doing so faster than they
can properly test them. For example, a recent major breach went completely
unnoticed for almost a week, showing that basic security measures are no
longer enough. To fix this, security leaders need to rethink their approach.
Instead of relying on occasional training sessions, teams should constantly
test their skills and their software in realistic, safe environments that
mimic actual attacks. This helps both the human staff and the automated
tools learn how to work together under pressure. It is also important to
measure success by looking at the quality of decisions and response accuracy
rather than just counting the number of security alerts. By making
continuous practice a core part of their daily work culture, organizations
can better prepare themselves to handle unexpected attacks and keep their
critical systems safe.CISO Conversations: Nico Waisman – From Self-Taught Hacker to AI-Driven Offensive Security at XBOW
Nico Waisman, the Chief Information Security Officer at XBOW, built his cybersecurity career entirely without a formal plan. Growing up in Argentina, he became fascinated by technology and taught himself how to find and exploit software vulnerabilities. Without any academic training in the field, he relied on experimentation and reverse engineering to build his foundational skills. In 2003, Waisman joined the security firm Immunity, where he spent seventeen years progressing to a leadership role. This experience helped him develop both offensive security expertise and management skills. He later transitioned to Semmle, which GitHub quickly acquired. At GitHub, he directed the Security Lab, focusing heavily on securing open source software and collaborating with major tech companies. Seeking a new challenge in defensive security, Waisman joined Lyft in 2020 and eventually became their CISO. There, he learned to balance robust defense with the need to maintain rapid engineering cycles. Today, Waisman leads security at XBOW, a company he helped launch that uses artificial intelligence to perform autonomous penetration testing. Looking ahead, he remains focused on the challenges of managing team stress and avoiding burnout. He also observes that as artificial intelligence tools become cheaper, attackers will increasingly use them, creating new challenges for defenders to confidently overcome.Home-Based GPU Networks: Viable Supplements to AI Data Centers?
As AI computing demands surge, local communities are increasingly resisting
the construction of massive new data centers due to concerns about high
electricity and water usage. To address this tension, the industry is
testing a decentralized approach: paying homeowners to host graphics
processing units (GPUs) right in their garages or homes. Companies are
experimenting with wall-mounted appliances that tap into residential power
and broadband to create distributed computing networks. While this concept
could reduce the need for large-scale facilities and share economic benefits
with households, it faces significant technical hurdles. Home internet
speeds fluctuate, power availability changes throughout the day based on
household appliance usage, and residential hardware failures present complex
logistical challenges. Furthermore, ensuring data security across thousands
of independent locations requires highly sophisticated software
coordination. Because of these constraints, residential networks are not
equipped to handle large-scale AI training, which requires tightly connected
hardware and ultra-fast data transfer. Instead, home-based nodes are best
suited for flexible, independent tasks like data preparation or batch
processing. Ultimately, these household networks are unlikely to replace
traditional data centers entirely. Rather, they will likely become a
supplementary layer managed by central hubs, handling specific tasks while
major facilities manage heavy-duty AI development.
Law Firms Increasingly Targeted By Ransomware/Vishing Attacks
Law firms are increasingly becoming primary targets for cybercriminals because they hold a massive amount of highly sensitive, privileged, and commercially valuable client information. Threat actors, such as the Silent Ransom Group, frequently target legal and professional services using straightforward but highly effective social engineering tactics. These methods include voice phishing, impersonating IT help-desk staff, and exploiting legitimate remote-access tools or USB drives to bypass traditional defenses. A recent proposed class-action lawsuit against a major national law firm underscores the severe legal and financial risks associated with these breaches. Unlike typical corporate targets, a compromised law firm faces complex challenges regarding attorney-client privilege, strict ethical duties of confidentiality, and intricate breach notification requirements across multiple jurisdictions. The legal profession must recognize that cybersecurity is no longer just an IT concern but a fundamental professional obligation. To mitigate these risks, law firms must implement comprehensive governance strategies. This approach includes establishing verified procedures for IT support, enforcing phishing-resistant multi-factor authentication, strictly limiting local administrative privileges, and developing robust incident-response plans that account for the unique nature of legal data. By treating data security as a core ethical responsibility, firms can better protect their clients' highly valuable secrets from modern and evolving extortion campaigns.The Weight You’re Carrying Isn’t What You Think It Is
Many leaders find themselves working late into the night, feeling deeply
overwhelmed and exhausted by their responsibilities. According to executive
coach Doug Thorpe, this fatigue happens because business owners often try to
solve their stress without first understanding the specific type of weight
they are carrying. Thorpe explains that the burden of leadership typically
falls into two distinct categories: emotional and operational. Emotional
weight involves feelings of burnout, isolation, and dread. It requires
honest acknowledgment and, in some cases, support from a therapist or coach
to protect your well-being. On the other hand, operational weight occurs
when a business depends entirely on the owner to function. This happens when
the leader becomes a bottleneck for every decision, meaning nothing gets
done if they step away. A common mistake owners make is applying the wrong
solution to their problem. They might try to use personal willpower and
better organization to solve structural gaps, or they might try to simply
rest their way out of a broken business system. To truly find relief,
leaders must pause and ask themselves whether their stress is rooted in
their emotional state or their operational setup, and then apply the
appropriate structural or personal support to move forward.
AI ambition is outpacing enterprise readiness, says NTT DATA’s Suyog Shetty
In a recent interview, NTT DATA's Suyog Shetty explains that while companies are eager to adopt artificial intelligence, their actual readiness often falls short of their ambitions. As organizations move past basic experiments and simple tools toward autonomous systems that can take independent action, they discover that access to technology and funding is rarely the primary hurdle. Instead, the real difficulty lies in execution. Many businesses struggle because their existing foundations, such as data quality, application design, and operational rules, are simply not prepared to support advanced systems at a large scale. Shetty points out that relying on outdated technology creates a structural burden, turning regular maintenance issues into a major obstacle for artificial intelligence. To see real benefits, companies must stop viewing this shift as a simple technology project and start treating it as a core business change. This involves cleaning up data, modernizing underlying applications, and establishing clear guidelines for oversight. Furthermore, he notes that hybrid cloud environments are becoming standard operating models to handle performance and cost needs rather than just existing for regulatory compliance. Finally, Shetty observes that India has a strong opportunity to evolve from a basic technology execution center into a global hub for driving these meaningful business transformations.China-Linked Hacker Shows AI Capabilities in APAC Attack
A recent cyberattack against government agencies in the Asia Pacific region,
likely targeting Taiwan, demonstrates the growing reality of nearly
autonomous threats. According to researchers at the security firm Dream, a
Chinese language threat actor successfully deployed a complex artificial
intelligence framework to compromise systems. The attackers utilized up to
eight interconnected artificial intelligence agents built on specific
operating platforms. These agents worked concurrently to execute an
extensive attack chain, which included conducting reconnaissance, cracking
employee credentials, discovering vulnerabilities, and installing backdoors
on web applications. Notably, the system used a scoring algorithm to
independently evaluate the success of each action and adapt its methods
without human intervention. Taiwan’s Ministry of Digital Affairs later
acknowledged experiencing an attack that matched these characteristics. This
incident signals a significant shift in the security landscape, highlighting
a widening gap between the low cost of executing automated attacks and the
high cost of traditional defense strategies. Security professionals
emphasize that organizations worldwide must now adapt by integrating
artificial intelligence into their own defensive operations. By employing
proactive security measures and automated penetration testing, defenders can
better anticipate threats and close the capability gap before these advanced
methods target a broader range of global businesses and organizations.
Why software supply chain security is the next accountability challenge for channel partners
Modern applications rely heavily on open-source packages and third-party
code. Because channel partners like Managed Service Providers often
recommend, integrate, and manage these applications, they are increasingly
held accountable when a vulnerability in this software supply chain is
exploited. The challenge is growing because of the sheer volume of
vulnerabilities. Organizations often struggle to patch them all, leaving
vulnerable code in production for months. This is compounded by the
complexity of modern applications, which can have hundreds of hidden
dependencies, and the rise of AI coding assistants, which generate even more
code and dependencies. Threat actors are noticing. They are shifting from
attacking individual endpoints to targeting shared development tools and
open-source projects, knowing that one compromised dependency can spread
across many customer environments. These attacks often bypass traditional
security controls because the software is trusted and signed. Customers and
insurers are responding by demanding more transparency. They expect partners
to provide software inventories, continuous monitoring, and clear
explanations of supply chain risks. Partners who embrace this shift can
become trusted advisors and develop new revenue streams by offering ongoing
security assurance. Those who fail to adapt risk losing credibility and
client relationships.
No comments:
Post a Comment