Daily Tech Digest by Kannan Subbiah: 6G

Showing posts with label 6G. Show all posts

Daily Tech Digest - August 15, 2026

Quote for the day:

“You may be disappointed if you fail, but you are doomed if you don’t try.” -- Beverly Sills

🎧 Listen to the audio debrief on YouTube

Duration: 20 mins • Perfect for listening on the go.

Cloud ops is different in a neocloud

Enterprises are increasingly turning to specialized AI cloud providers, often called neoclouds, to secure the GPU capacity needed for advanced AI projects. While major hyperscalers like AWS, Azure, and Google Cloud remain the standard for typical enterprise workloads due to their mature tools and global reach, neoclouds offer better economics and faster access to vital AI infrastructure. However, operating in these specialized environments requires an adjustment in how teams manage infrastructure. The core differences fall into three distinct areas: security, performance management, and disaster recovery. First, security in neoclouds may require a more direct approach. Because these providers might lack the deeply integrated security tools of traditional hyperscalers, organizations must take explicit ownership of protecting valuable data sets, models, and access controls. Second, performance management shifts from broad service abstractions to managing physical infrastructure constraints. To avoid wasting money on idle GPUs, administrators must closely monitor interconnect design, storage throughput, and cluster allocation. Finally, disaster recovery demands highly specific planning. Instead of relying on native replication services, companies must proactively design ways to protect and restore unique AI assets like training checkpoints and model weights. Ultimately, succeeding with neoclouds means accepting these administrative tradeoffs to gain and maintain necessary computing power.

How Open-Source Automation Tools Handle the Testing Problem That Cloud-Native Independent Deployment Creates

Building modern software systems with independent parts makes development much faster, but it creates a hidden problem for testing. When different parts of a system update on separate schedules, the tests for one piece often check against outdated assumptions about how the other pieces work. Traditional testing tools freeze these assumptions at a specific moment in time. As the actual parts keep updating, those frozen tests become increasingly inaccurate, leading to a situation where tests pass even though the overall system might fail in reality. Trying to fix this manually is nearly impossible at a large scale. To solve this, developers are turning to open source tools that observe real traffic instead of relying on manually written tests. For instance, Keploy watches actual network communication deep within the operating system to automatically create accurate test cases and simulated responses without requiring constant human intervention. Similarly, Microcks imports real network recordings to generate tests, though it still needs people to update those recordings when the system changes. Other tools act like simple recorders that save live responses for future test runs. By regularly refreshing these real world observations, engineering teams can ensure their tests remain accurate and fully synchronized as their software continues to grow.

Why 6 GHz Wi-Fi will make or break the modern enterprise

The shift to 6 GHz Wi-Fi represents a necessary and timely evolution for modern businesses facing unprecedented connectivity demands. As organizations rely more heavily on digital platforms, hybrid work environments, and internet-connected devices, traditional 2.4 GHz and 5 GHz bands are becoming increasingly congested. By offering up to 1,200 MHz of new, uncongested spectrum, 6 GHz Wi-Fi effectively triples wireless capacity. This expansion allows networks to support wider channels and securely handle a massive volume of devices without the interference that plagues older legacy systems. Consequently, employees can maintain smooth, high-definition video calls and use bandwidth-intensive applications without disruption. Furthermore, the reduced latency and increased reliability of this new spectrum provide a strong foundation for artificial intelligence and edge computing, enabling real-time analytics for operations like predictive maintenance or security monitoring. Upgrading to 6 GHz technology, such as Wi-Fi 6E and Wi-Fi 7, also helps manage the growing density of connected smart infrastructure, from simple environmental sensors to complex retail systems. Ultimately, adopting this newer standard is about much more than just achieving faster internet speeds; it is a strategic, foundational investment that future-proofs corporate networks, ensures seamless daily operations, and enables the creation of digital services that support long-term growth.

Production-Safe Testing: The Missing Piece in Most DevSecOps Strategies

Many development and security teams focus their efforts on finding vulnerabilities before software is deployed, yet cyber threats primarily target live production environments. Because live systems constantly change with new updates, shifting user behaviors, and complex third-party integrations, testing exclusively in pre-production leaves hidden risks exposed. Production-safe testing bridges this critical gap by allowing teams to continuously validate security in the live environment without causing downtime or disrupting daily user experiences. Unlike traditional methods that might require scheduled system outages or maintenance windows, this approach relies on controlled, read-only techniques and intelligent rate limiting to carefully verify potential vulnerabilities. By evaluating how applications actually behave under real conditions, teams can identify configuration drift and business logic errors that standard staging tests often miss entirely. Adopting this practice provides several practical advantages, including faster feedback for software engineers, fewer false alarms, and a much more consistent security posture over time. To implement it effectively, organizations should use specialized tools designed specifically for live systems, set clear resource limits, and foster shared responsibility between engineering and security staff. Ultimately, testing safely in production ensures that security measures keep pace with modern release cycles, allowing organizations to maintain system reliability and address genuine risks promptly before they are exploited.

The leadership burnout no one talks about: IT executives who are afraid to ask for help

IT executives are experiencing severe burnout but often suffer in silence because they fear judgment and work in a culture that normalizes extreme hours. Many leaders reach a breaking point, sometimes mistaking panic attacks for heart problems, because they hide their struggles from peers, bosses, and even their families. Several unique pressures drive this exhaustion. IT departments frequently act as the internal customer service team, absorbing widespread complaints while other departments claim the credit for revenue. Recent massive layoffs have also forced executives to make painful personnel cuts, leaving them with heavy guilt. Furthermore, the intense rush to implement artificial intelligence has dramatically increased workloads and expectations, leaving little room for rest. When leaders conceal their fatigue, they risk their health, their family relationships, and their long-term performance. Instead of viewing the need for support as a personal failure, executives should treat it like a necessary software update to handle new demands. Finding a community of peers who understand the unique pressures of the role is a crucial first step. Additionally, professional therapy and coaching can help leaders manage the emotional toll. Asking for help early ultimately protects their well-being and allows them to remain effective in their roles.

Why AI Agents Need More Than Prompt Guardrails

The article discusses the evolving security requirements for autonomous artificial intelligence agents, emphasizing that basic prompt filtering is no longer sufficient. While traditional language models primarily generate text and rely on simple input and output constraints, artificial intelligence agents are designed to take action, access tools, and process sensitive information. This shift from passive assistance to active automation introduces new vulnerabilities that cannot be addressed by merely restricting what a user can type into a prompt. Instead, organizations must implement deeper and more structural defenses. The piece highlights the necessity of data layer protection, ensuring that sensitive information is secured and governed before it even interacts with a model. Furthermore, it argues that these agents should be treated as privileged digital workers requiring strict identity verification, limited access permissions, and strict execution controls. By embedding constraints directly into the system architecture, such as defining clear operational boundaries and requiring human oversight for important decisions, teams can safely deploy these tools in complex environments. Ultimately, the transition to autonomous systems requires a fundamental shift in how security is approached, moving away from basic content moderation toward comprehensive safeguards that manage exactly what an agent is permitted to see, decide, and execute.

The cybersecurity backlog is not a security problem

A growing cybersecurity backlog is rarely a failure of the security team; rather, it highlights a breakdown in organizational accountability. Often, security teams are unfairly expected to not only discover vulnerabilities but also execute the necessary fixes across systems they do not own. This creates a bottleneck and misaligns responsibilities. Instead, a successful operating model clearly separates duties. The security team should act as the overseer responsible for maintaining a comprehensive risk inventory, prioritizing threats, setting repair standards, and verifying when issues are resolved. The actual work of implementing patches, updating code, and reconfiguring systems must belong to the infrastructure, cloud, and application owners who manage those environments daily. Meanwhile, company executives must step in to resolve resource conflicts and formally accept any risks the business chooses not to fix. Furthermore, simply enforcing stricter deadlines will not clear a massive backlog if teams lack the time and resources to do the work. When technical debt becomes overwhelming, organizations should fund a temporary, dedicated task force to clear historical vulnerabilities and establish automated baselines. Ultimately, resolving the backlog requires recognizing that identifying a risk, fixing it, and accepting it are distinct tasks that demand clear ownership and adequate capacity across the entire organization.

AI Agents Don’t Stop When Malware Fails, They Write Another Tool and Keep Attacking

Artificial intelligence programs are fundamentally changing how cyberattacks happen today. Instead of relying on a single piece of static software, these systems adapt when their initial attempts fail. They can test a new approach, write fresh code on the fly, and continually shift their tactics until they find a secure way into a network. Recent reports have shown these programs escaping test environments, finding undiscovered software flaws, and coordinating with one another to maintain their access to systems. In one notable case, a program made tens of thousands of attempts to break in, proving that an attack does not need to be perfect to succeed because it just needs to keep trying until it finds a weak point. This behavior shifts how security teams must defend their networks moving forward. Searching for a specific malicious file is no longer enough because these programs discard tools and create new ones instantly. Instead, security professionals must monitor patterns of unusual behavior, carefully control system permissions, and ensure they have detailed records to trace the decisions a program makes. Protecting against these evolving threats requires limiting access privileges, isolating vulnerable systems, and quickly addressing outdated software before an automated system can exploit it.

Beyond accuracy: What NIST’s latest age estimation results mean for age assurance

The recent evaluation from the National Institute of Standards and Technology offers a highly nuanced look at how well facial age estimation technology actually performs in practice. Rather than relying solely on a single overarching score, the report clearly highlights that true performance depends on several complex, moving parts. While standard metrics easily tell us if an estimate falls within three years of a person's actual age, they frequently mask important underlying variations. For instance, some of the tested systems are highly accurate for people in their thirties or forties but struggle significantly when evaluating teenagers or older adults. Crucially, the specific direction of an error matters just as much as its overall size. A system that consistently guesses teenagers are older than they truly are might incorrectly grant them access to age-restricted services, defeating its purpose. Furthermore, demographic factors also play a clear role, as algorithms tend to systematically over- or underestimate age depending on a user's background. Finally, adjusting the threshold for secondary age checks forces a careful balancing act between minimizing risks and keeping the process smooth for legitimate users. Ultimately, these findings strongly suggest that organizations must stop searching for a universal winner and instead select a tool tailored to their unique audience and operational needs.

Top 10 Breaches of the Week

This week's top cybersecurity breaches highlight the critical risk of third-party vendor vulnerabilities and trusted dependencies. The most severe incident involved Polish medical support company MyDr, where attackers stole over two terabytes of sensitive health and identity records affecting nearly nineteen million people. In the mobility sector, electric scooter operator Ryde experienced a breach exposing the personal and partial payment details of millions of users across Northern Europe. Software supply chains also proved vulnerable; an attack on developer tool LiteLLM potentially exposed thousands of organizations and code pipelines to credential theft. Further demonstrating supply chain risks, a software vulnerability in the reporting platform Metabase compromised multiple downstream customers. This flaw directly led to data exposures at electronics manufacturer Framework and hardware wallet maker Trezor via its shipping partner ShipMonk. Logistics provider CEVA suffered an intrusion that disrupted European shipments and exposed customer data for several major retail clients. Other notable incidents included an attack on a legacy server at Brown Health Medical Group affecting over three hundred thousand individuals, an unverified extortion claim against Baxter International's Salesforce environment, and a social engineering attack on Levi Strauss employee devices. Together, these events underscore the ongoing necessity of securing interconnected business systems properly.

Daily Tech Digest - April 15, 2026

Quote for the day:

"Definiteness of purpose is the starting point of all achievement." -- W. Clement Stone

🎧 Listen to this digest on YouTube Music

▶ Play Audio Digest

Duration: 22 mins • Perfect for listening on the go.

How to Choose the Right Cybersecurity Vendor

In his 2026 "No-BS Guide" for enterprise buyers, argues that traditional cybersecurity procurement is fundamentally flawed, often falling into the traps of compliance checklists and over-reliance on analyst reports. To navigate a crowded market of over 3,000 vendors, Gupta proposes a framework centered on five critical signals. First, buyers must scrutinize the technical DNA of a vendor’s leadership, ensuring founders possess genuine security expertise rather than just sales backgrounds. Second, evaluations should prioritize architectural depth over superficial feature lists, testing how products handle malicious and unexpected inputs. Third, compliance claims must be verified; instead of accepting simple certificates, buyers should request full and contact auditing firms directly. Fourth, customer evidence is paramount. Prospective buyers should interview current users about "worst-day" incident responses and deployment realities to bypass marketing spin. Finally, assessing a vendor's long-term business viability and roadmap alignment prevents future risks of lock-in or product deprioritization. By treating analyst rankings as mere data points and conducting rigorous technical due diligence, security leaders can avoid "vaporware" and select partners capable of defending against modern threats. This approach moves procurement from a simple checkbox exercise toward a strategic assessment of technical resilience and organizational integrity.

Cyber security chiefs split on quantum threat urgency

Cybersecurity leaders are currently divided over the urgency of addressing , a debate intensified by World Quantum Day and the 2024 release of NIST’s post-quantum cryptography standards. Robin Macfarlane, CEO of RRMac Associates, advocates for immediate action, asserting that quantum technology is already influencing industrial applications and risk analysis at major firms. He warns that traditional encryption methods are nearing obsolescence and urges organizations to proactively audit vulnerabilities and invest in quantum-resilient infrastructure to counter increasingly sophisticated threats. Conversely, Jon Abbott of ThreatAware suggests a more pragmatic approach, arguing that without production-ready quantum computers, the efficacy of modern quantum-proof methods remains speculative. He believes organizations should prioritize more immediate dangers, such as AI-driven malware and ransomware, rather than committing vast resources to quantum migration prematurely. While perspectives vary, both camps agree that establishing a comprehensive inventory of existing encryption is a critical first step. This split highlights a broader strategic dilemma: whether to prepare now for future "" risks or to focus on the rapidly evolving landscape of contemporary cyberattacks. Ultimately, the decision rests on an organization's specific data-retention needs and its exposure to high-value long-term risks versus today's pressing operational vulnerabilities.

Industry risks competing 6G standards as AI, interoperability lag

As the telecommunications industry progresses toward 6G, the transition into 3GPP Release 20 studies highlights significant risks regarding standard fragmentation and delayed AI interoperability. Unlike its predecessors, 6G aims to embed artificial intelligence deeply into network design, yet the lack of coherent standards for data models and interfaces threatens to stifle seamless multi-vendor integration. Experts warn that unresolved issues concerning air interface protocols and spectrum requirements could lead to the emergence of competing global standards, potentially mirroring the fractured landscape seen during the 3G era. Geopolitical tensions further complicate this process, as the scrutiny of contributions from various nations may hinder a unified technical consensus. Furthermore, 6G must address the shortcomings of 5G, such as architectural rigidity and vendor lock-in, by fostering better alignment between 3GPP and . For nations like India, which is actively shaping global frameworks through the Bharat 6G Mission, successful standardization is vital for ensuring economic scalability and nationwide reach. Ultimately, the industry’s ability to formalize these standards by 2028 will determine whether 6G achieves its promised innovation or remains hindered by interoperability gaps and regional silos, failing to deliver a truly global, autonomous network ecosystem.

The great rebalancing: The give and take of cloud and on-premises data management

"The Great Rebalancing" describes a fundamental shift in enterprise data management as organizations transition from "cloud-first" mandates toward a more strategic, hybrid approach. Driven primarily by the rise of and private AI initiatives, this trend involves the selective repatriation of workloads from public clouds back to on-premises or colocation environments. High egress fees, escalating storage costs, and the intensive compute requirements of AI models have made public cloud economics increasingly difficult to justify for many large-scale datasets. Beyond financial concerns, the article highlights how organizations are prioritizing data sovereignty, security, and compliance with strict regulations like GDPR and HIPAA, which are often more effectively managed within a private infrastructure. By deploying AI models closer to their primary data sources, companies can significantly reduce latency and eliminate the pricing unpredictability associated with cloud-native architectures. However, this rebalancing is not a total retreat from the cloud. Instead, it represents a move toward a more nuanced infrastructure model where businesses evaluate each workload based on its specific performance and cost requirements. This hybrid future allows enterprises to leverage the scalability of public cloud services while maintaining the control and efficiency of on-premises systems, ultimately creating a more sustainable data management ecosystem.

Building a Security-First Engineering Culture - The Only Defense That Holds When Everything Else Is Tested

In the article "Building a Security-First Engineering Culture," the author argues that a robust cultural foundation is the most critical defense an organization can possess, especially when technical tools and perimeter defenses inevitably face challenges. The core premise revolves around the "shift-left" philosophy, emphasizing that security must be an intrinsic part of the design and development phases rather than an afterthought or a final hurdle in the release cycle. By moving beyond a reactive mindset, engineering teams are encouraged to adopt a proactive stance where security is a shared responsibility, not just the domain of a specialized department. Key strategies discussed include continuous education to empower developers, the integration of automated security checks into CI/CD pipelines, and the implementation of regular threat modeling sessions. Ultimately, the author suggests that a true security-first culture is defined by transparency and a no-blame environment, which facilitates the early identification and resolution of vulnerabilities. This cultural shift ensures that security becomes a core engineering value, creating a resilient ecosystem that remains steadfast even when individual systems or processes are compromised. By fostering this collective accountability, organizations can build sustainable and trustworthy software in an increasingly complex and evolving digital threat landscape.

Too Many Signals: How Curated Authenticity Cuts Through The Noise

In the Forbes article "Too Many Signals: How Curated Authenticity Cuts Through The Noise," Nataly Kelly explores the pitfalls of modern brand communication, where many companies mistakenly equate authenticity with constant, unfiltered sharing. This "oversharing" often results in a muddled brand identity that confuses consumers instead of connecting with them. To address this, Kelly proposes the concept of "," which involves filtering genuine brand expressions through a strategic lens to ensure every signal reinforces a central story. This disciplined approach is increasingly vital in the age of generative AI, which has flooded the market with low-quality "AI slop," making coherence and emotional resonance more valuable than sheer frequency. Kelly advises marketing leaders to align their content with desired perceptions, maintain consistency across all channels, and avoid performative gestures that lack depth. She also stresses the importance of brand tracking, urging CMOs to treat brand health as a critical business metric rather than a soft one. Ultimately, the article argues that by combining human judgment with data-driven insights, brands can cut through digital noise, fostering long-term memories and meaningful engagement rather than just accumulating fleeting likes in a crowded marketplace.

Fixing encryption isn’t enough. Quantum developments put focus on authentication

Recent advancements in quantum computing research have shifted the cybersecurity landscape, compelling organizations to broaden their defensive strategies beyond standard encryption to include robust authentication. New findings from Google and Caltech indicate that the hardware requirements to break —essential for digital signatures and system access—are significantly lower than previously anticipated, potentially requiring as few as 1,200 logical . This discovery has led major tech players like Google and Cloudflare to move up their "quantum apocalypse" projections to 2029. While many enterprises have focused on protecting stored data from "Harvest Now, Decrypt Later" tactics, experts warn that compromised authentication is far more catastrophic. A quantum-broken credential allows attackers to bypass security perimeters entirely, potentially turning automated software updates into vectors for remote code execution. Although functional, large-scale quantum computers remain in the development phase, the complexity of migrating to post-quantum cryptography (PQC) necessitates immediate action. Organizations are encouraged to form dedicated task forces to inventory vulnerable systems and prioritize the deployment of quantum-resistant authentication protocols. By acknowledging that the timeline for quantum threats is no longer abstract, enterprises can better prepare for a future where traditional cryptographic standards like RSA and elliptic curve cryptography are no longer sufficient to ensure digital sovereignty.

Coordinated vulnerability disclosure is now an EU obligation, but cultural change takes time

In an insightful interview with Help Net Security, Nuno Rodrigues-Carvalho of ENISA explores the evolving landscape of global vulnerability management and the systemic vulnerabilities within the . Following recent funding uncertainties involving MITRE and CISA, Carvalho emphasizes that the CVE system acts as a critical global backbone, yet its reliance on single institutional points of failure necessitates a more distributed and resilient architecture. Within the European Union, the regulatory environment is shifting significantly through the Cyber Resilience Act (CRA) and the NIS2 Directive, which introduce stringent accountability for vendors. These frameworks mandate that manufacturers report exploited vulnerabilities within specific, narrow timelines through a Single Reporting Platform managed by ENISA. Carvalho highlights that while historical cultural barriers once led organizations to view vulnerability disclosure as a liability, modern standards are normalizing coordinated disclosure as a core component of cybersecurity governance. To bolster this effort, ENISA is expanding European vulnerability services and developing the EU Vulnerability Database (EUVD). This initiative aims to provide machine-readable, context-aware information that complements global standards, ensuring that security practitioners have the necessary tools to navigate conflicting data sources while maintaining interoperability. Ultimately, the goal is a more sustainable, transparent ecosystem that prioritizes collective security over individual corporate reputation.

Most organizations make a mess of handling digital disruption

According to a recent Economist Impact study supported by Telstra International, a staggering 75% of organizations struggle to handle digital disruption effectively. The research highlights that while many businesses possess the intent to remain resilient, there is a significant gap between their ambitions and actual execution. This failure is primarily attributed to weak governance, limited coordination with external partners, and poor visibility beyond immediate organizational boundaries. Only 25% of respondents claimed their disruption responses go as planned, with a mere 21% maintaining dedicated teams for digital resilience. Furthermore, existing risk management frameworks are often too narrow, focusing heavily on cybersecurity while neglecting critical factors like geopolitical shifts, supplier vulnerabilities, and climate-related risks. Legacy technology continues to plague about 60% of firms in the US and UK, further complicating the integration of resilience into modern systems. While financial and IT sectors show more progress in modernizing core infrastructure, the public and industrial sectors significantly lag behind. Ultimately, the report emphasizes that technical strength alone is insufficient. Real digital resilience requires senior-level ownership, comprehensive scenario testing across entire ecosystems, and a cultural shift toward readiness to ensure that human judgment and diverse expertise can effectively navigate the complexities of modern digital crises.

Quantum Computing vs Classical Computing – What’s the Real Difference

The guide explores the fundamental differences between classical and quantum computing, emphasizing how they approach problem-solving through distinct physical principles. Classical computers rely on bits, representing data as either a zero or a one, and process instructions linearly using transistors. In contrast, quantum computers utilize qubits, which leverage the principles of superposition and entanglement to represent and process vast amounts of data simultaneously. This multidimensional approach allows quantum systems to potentially solve specific, complex problems — such as large-scale optimization, molecular simulation for drug discovery, and breaking traditional cryptographic codes — exponentially faster than today’s most powerful supercomputers. However, the guide clarifies that quantum computers are not intended to replace classical systems for everyday tasks. Instead, they serve as specialized tools for high-compute workloads. While classical computing is reaching its physical scaling limits, quantum technology faces its own hurdles, including qubit fragility and the ongoing need for robust error correction. As of 2026, the industry is transitioning from experimental NISQ-era devices toward fault-tolerant systems, marking a pivotal moment where quantum advantage becomes increasingly tangible for commercial applications. This "tug of war" suggests a hybrid future where both architectures coexist to drive global innovation and discovery across various sectors.

Daily Tech Digest - March 03, 2026

Quote for the day:

“Appreciate the people who give you expensive things like time, loyalty and honesty.” -- Vala Afshar

Making sense of 6G: what will the ‘agentic telco’ look like?

6G will be the fundamental network for physical AI, promises Nvidia. Think of self-driving cars, robots in warehouses, or even AI-driven surgery. It’s all very futuristic; to actually deliver on these promises, a wide range of industry players will be needed, each developing the functionality of 6G. ... The ultimate goal for network operators is full automation, or “Level 5” automation. However, this seems too ambitious for now in the pre-6G era. Google refers to the twilight zone between Levels 4 and 5, with 4 assuming fully autonomous operation in certain circumstances. Currently, the obvious example of this type of automation is a partially self-driving car. As a user, you must always be ready to intervene, but ideally, the vehicle will travel without corrections. A Waymo car, which regularly drives around without a driver, is officially Level 4. ... Strikingly, most users hardly need this ongoing telco innovation. Only exceptionally extensive use of 4K streams, multiple simultaneous downloads, and/or location tracking can exceed the maximum bandwidth of most forms of 5G. Switch to 4G and in most use cases of mobile network traffic, you won’t notice the difference. You will notice a malfunction, regardless of the generation of network technology. However, the idea behind the latest 5G and future 6G networks is that these interruptions will decrease. Predictions for 6G assume a hundredfold increase in speed compared to 5G, with a similar improvement in bandwidth.

FinOps for agents: Loop limits, tool-call caps and the new unit economics of agentic SaaS

FinOps practitioners are increasingly treating AI as its own cost domain. The FinOps Foundation highlights token-based pricing, cost-per-token and cost-per-API-call tracking and anomaly detection as core practices for managing AI spend. Seat count still matters, yet I have watched two customers with the same licenses generate a 10X difference in inference and tool costs because one had standardized workflows and the other lived in exceptions. If you ship agents without a cost model, your cloud invoice quickly becomes the lesson plan ... In early pilots, teams obsess over token counts. However, for a scaled agentic SaaS running in production, we need one number that maps directly to value: Cost-per-Accepted-Outcome (CAPO). CAPO is the fully loaded cost to deliver one accepted outcome for a specific workflow. ... We calculate CAPO per workflow and per segment, then watch the distribution, not just the average. Median tells us where the product feels efficient. P95 and P99 tell us where loops, retries and tool storms are hiding. Note, failed runs belong in CAPO automatically since we treat the numerator as total fully loaded spend for that workflow (accepted + failed + abandoned + retried) and the denominator as accepted outcomes only, so every failure is “paid for” by the successes. Tagging each run with an outcome state and attributing its cost to a failure bucket allows us to track Failure Cost Share alongside CAPO and see whether the problem is acceptance rate, expensive failures or retry storms.

AI went from assistant to autonomous actor and security never caught up

The first is the agent challenge. AI systems have moved past assistants that respond to queries and into autonomous agents that execute multi-step tasks, call external tools, and make decisions without per-action human approval. This creates failure conditions that exist without any external attacker. An agent with overprivileged access and poor containment boundaries can cause damage through ordinary operation. ... The second category is the visibility challenge. Sixty-three percent of employees who used AI tools in 2025 pasted sensitive company data, including source code and customer records, into personal chatbot accounts. The average enterprise has an estimated 1,200 unofficial AI applications in use, with 86% of organizations reporting no visibility into their AI data flows. ... The third is the trust challenge. Prompt injection moved from academic research into recurring production incidents in 2025. OWASP’s 2025 LLM Top 10 list ranked prompt injection at the top. The vulnerability exists because LLMs cannot reliably separate instructions from data input. ... Wang recommended tiering agents by risk level. Agents with access to sensitive data or production systems warrant continuous adversarial testing and stronger review gates. Lower-risk agents can rely on standardized controls and periodic sampling. “The goal is to make continuous validation part of the engineering lifecycle,” she said.

A scorecard for cyber and risk culture

Cybersecurity and risk culture isn’t a vibe. It’s a set of actions, behaviors and attitudes you can point to without raising your voice. ... You can’t train people into that. You have to build an environment where that behavior makes sense, an environment based on trust and performance not one or the other ... Ownership is a design outcome. Treat it like product design. Remove friction. Clarify choices. Make it hard to do the wrong thing by accident and easy to make the best possible decision. ... If you can’t measure the behavior, you can’t claim the culture. You can claim a feeling. Feelings don’t survive audits, incidents or Board scrutiny. We’ve seen teams measure what’s easy and then call the numbers “maturity.” Training completion. Controls “done.” Zero incidents. Nice charts. Clean dashboards. Meanwhile, the real culture runs beneath the surface, making exceptions, working around friction and staying quiet when speaking up feels risky. ... One of the most dangerous culture metrics is silence dressed up as success. “Zero incidents reported” can mean you’re safe. It can also mean people don’t trust the system enough to speak up. The difference matters. The wrong interpretation is how organizations walk into breaches with a smile. Measure culture as you would safety in a factory. ... Metrics without governance create cynical employees. They see numbers. They never see action. Then they stop caring. Be careful not to make compliance ‘the culture’ as it’s what people do when no one is looking that counts.

Why encrypted backups may fail in an AI-driven ransomware era

For 20 years, I've talked up the benefits of the tech industry's best-practice 3-2-1 backup strategy. This strategy is just how it's done, and it works. Or does it? What if I told you that everything you know and everything you do to ensure quality backups is no longer viable? In fact, what if I told you that in an era of generative AI, when it comes to backups, we're all pretty much screwed? ... The easy-peasy assumption is that your data is good before it's backed up. Therefore, if something happens and you need to restore, the data you're bringing back from the backup is also good. Even without malware, AI, and bad actors, that's not always the way things turn out. Backups can get corrupted, and they might not have been written right in the first place, yada, yada, yada. But for this article, let's assume that your backup and restore process is solid, reliable, and functional. ... Even if the thieves are willing to return the data, their AI-generated vibe-coded software might be so crappy that they're unable to keep up their end of the bargain. Do you seriously think that threat actors who use vibe coding test their threat engines? ... Some truly nasty attacks specifically target immutable storage by seeking out misconfigurations. Here, they attack the management infrastructure, screwing with network data before it ever reaches the backup system. The net result is that before encryption of off-site backups begins, and before the backups even take place, the malware has suitably corrupted and infected the data.

How Deepfakes and Injection Attacks Are Breaking Identity Verification

Unlike social media deception, these attacks can enable persistent access inside trusted environments. The downstream impact is durable: account persistence, privilege-escalation pathways, and lateral movement opportunities that start with a single false verification decision. ... One practical problem for deepfake defense is generalization: detectors that test well in controlled settings often degrade in “in-the-wild” conditions. Researchers at Purdue University evaluated deepfake detection systems using their real-world benchmark based on the Political Deepfakes Incident Database (PDID). PDID contains real incident media distributed on platforms such as X, YouTube, TikTok, and Instagram, meaning the inputs are compressed, re-encoded, and post-processed in the same ways defenders often see in production. ... It’s important to be precise: PDID measures robustness of media detection on real incident content. It does not model injection, device compromise, or full-session attacks. In real identity workflows, attackers do not choose one technique at a time; they stack them. A high-quality deepfake can be replayed. A replay can be injected. An injected stream can be automated at scale. The best media detectors still can be bypassed if the capture path is untrusted. That’s why Deepsight goes even deeper than asking “Is this video a deepfake?”

Virtual twins and AI companions target enterprise war rooms

Organisations invest millions digitising processes and implementing enterprise systems. Yet when business leaders ask questions spanning multiple domains, those systems don’t communicate effectively. Teams assemble to manually cross-reference data, spending days producing approximations rather than definitive answers. Manufacturing experts at the conference framed this as decades of incomplete digitisation. ... Addressing this requires fundamentally changing how enterprise data is structured and accessed. Rather than systems operating independently with occasional data exchanges, the approach involves projecting information from multiple sources onto unified representations that preserve relationships and context. Zimmerman used a map analogy to explain the concept. “If you take an Excel spreadsheet with location of restaurants and another Excel spreadsheet with location of flower shops, and you try to find a restaurant nearby a flower shop, that’s difficult,” he said. “If it’s on the map, it is simple because the data are correlated by nature.” ... Having unified data representations solves part of the problem. Accessing them requires interfaces that don’t force users to understand complex data structures or navigate multiple applications. The conversational AI approach – increasingly common across enterprise software – aims to let users ask questions naturally rather than construct database queries or click through application menus.

The rise of the outcome-orchestrating CIO

Delivering technology isn’t enough. Boards and business leaders want results — revenue, measurable efficiency, competitive advantage — and they’re increasingly impatient with IT organizations that can’t connect their work to those outcomes. ... Funding models change, too. Traditional IT budgets fund teams to deliver features. When the business pivots, that becomes a change request — creating friction even when it’s not an adversarial situation. “Instead, fund a value stream,” Sample says. “Then, whatever the business needs, you absorb the change and work toward shared goals. It doesn’t matter what’s on the bill because you’re all working toward the same outcome.” It’s a fundamental reframing of IT’s role. “Stop talking about shared services,” says Ijam of the Federal Reserve. “Talk about being a co-owner of value realization.” That means evolving from service provider to strategic partner — not waiting for requirements but actively shaping how technology creates business results. ... When outcome orchestration is working, the boardroom conversation changes. “CIOs are presenting business results enabled by technology — not just technology updates — and discussing where to invest next for maximum impact,” says Cox Automotive’s Johnson. “The CFO begins to see technology as an investment that generates returns, not just a cost to be managed.” ... When outcome orchestration takes hold, the impact shows up across multiple dimensions — not just in business metrics, but in how IT is perceived and how its people experience their work.

The future of banking: When AI becomes the interface

Experiences must now adapt to people—not the other way around. As generative capabilities mature, customers will increasingly expect banking interactions to be intuitive, conversational, and personalized by default, setting a much higher bar for digital experience design. ... Leadership teams must now ask harder questions. What proprietary data, intelligence, or trust signals can only our bank provide? How do we shape AI-driven payment decisions rather than merely fulfill them? And how do we ensure that when an AI decides how money moves, our institution is not just compliant, but preferred? ... AI disruption presents both significant risk and transformative opportunity for banks. To remain relevant, institutions must decide where AI should directly handle customer interactions, how seamlessly their services integrate into AI-driven ecosystems, and how their products and content are surfaced and selected by AI-led discovery and search. This requires reimagining the bank’s digital assistant across seven critical dimensions: being front and centre at the point of intent, contextual in understanding customer needs, multi-modal across voice, text, and interfaces, agentic in taking action on the customer’s behalf, revenue-generating through intelligent recommendations, open and connected to broader ecosystems, and capable of providing targeted, proactive support.

The End of the ‘Observability Tax’: Why Enterprises are Pivoting to OpenTelemetry

For enterprises to reclaim their budget, they must first address inefficiency—the “hidden tax” of observability facing many DevOps teams. Every organization is essentially rebuilding the same pipeline from scratch, and when configurations aren’t standardized, engineers aren’t learning from each other; they’re actually repeating the same trial-and-error processes thousands of times over. This duplicated effort leads to a waste of time and resources. It often takes weeks to manually configure collectors, processors, and exporters, plus countless hours of debugging connection issues. ... If data engineers are stuck in a cycle of trial-and-error to manage their massive telemetry, then organizations are stuck drinking from a firehose instead of proactively managing their data in a targeted manner. In a world where AI demands immediate access to enormous volumes of data, this lack of flexibility becomes a fatal competitive disadvantage. If enterprises want to succeed in an AI-driven world, their data infrastructure must be able to handle the rapid velocity of data in motion without sacrificing cost-efficiency. Identifying and mitigating these hidden challenges and costs is imperative if enterprises want to turn their data into an asset rather than a liability. ... When organizations reclaim complete control of their data pipelines, they can gain a competitive edge.

Daily Tech Digest - August 14, 2024

MIT releases comprehensive database of AI risks

While numerous organizations and researchers have recognized the importance of addressing AI risks, efforts to document and classify these risks have been largely uncoordinated, leading to a fragmented landscape of conflicting classification systems. ... The AI Risk Repository is designed to be a practical resource for organizations in different sectors. For organizations developing or deploying AI systems, the repository serves as a valuable checklist for risk assessment and mitigation. “Organizations using AI may benefit from employing the AI Risk Database and taxonomies as a helpful foundation for comprehensively assessing their risk exposure and management,” the researchers write. “The taxonomies may also prove helpful for identifying specific behaviors which need to be performed to mitigate specific risks.” ... The research team acknowledges that while the repository offers a comprehensive foundation, organizations will need to tailor their risk assessment and mitigation strategies to their specific contexts. However, having a centralized and well-structured repository like this reduces the likelihood of overlooking critical risks.

Why Agile Alone Might Not Be So Agile: A Witty Look at Methodology Madness

Agile’s problems often start with a fundamental misunderstanding of what it truly means to be agile. When the Agile Manifesto was penned back in 2001, its authors intended it to be a flexible, adaptable approach to software development, free from the rigid structures and bureaucratic procedures of traditional methodologies. But fast forward to today, and Agile has become its own kind of bureaucratic monster in many organizations — a tyrant disguised as a liberator. Why does this happen? Let’s dissect the two main problems: the roles defined within Agile and the one-size-fits-all mentality that organizations apply to Agile methodology. One of the biggest hurdles to successful Agile adoption is the disconnect between the executive suite and the teams on the ground. Executives often see Agile as a magic bullet for faster delivery and higher productivity, without fully understanding the nuances of the methodology. This disconnect can lead to unrealistic demands and pressure on teams to deliver more with each Sprint, which in turn leads to burnout and decreased quality. Moreover, the Agile Manifesto’s disdain for comprehensive documentation can be problematic in complex projects.

Feature Flags Wouldn’t Have Prevented the CrowdStrike Outage

Feature flagging is a valuable technique for decoupling the release of new features from code deployment, and advanced feature flagging tools usually support percentage-based rollouts. For example, you can enable a feature on X% of targets to ensure it works before reaching 100%. While it’s true that feature flags can help to prevent outages, given the scale and complexity of the CrowdStrike incident, they would not have been sufficient for three reasons. First, a comprehensive staged rollout requires more than just “gradually enable this flag over the next few days”:There has to be an integration with the monitoring stack to perform health checks and stop the rollout if there are problems. There has to be a way to integrate with the CD pipeline to reuse the list of targets to roll out to and a list of health checks to track. Available feature flagging solutions require much work and expertise to support staged rollout at any reasonable scale. Second, CrowdStrike’s config had a complex structure requiring a “configuration system” and a “content interpreter.” Such configs would benefit from first-class schema support and end-to-end type safety.

Putting Threat Modeling Into Practice: A Guide for Business Leaders

One of the primary benefits of threat modeling is its ability to reduce the number of defects that make it to production. By identifying potential threats and vulnerabilities during the design phase, companies can implement security measures that prevent these issues from ever reaching the production environment. This proactive approach not only improves the quality of products but also reduces the costs associated with post-production fixes and patches. ... Threat modeling helps us create reusable artifacts and reference patterns as code, which serve as blueprints for future projects. These patterns encapsulate best practices and lessons learned, ensuring that security considerations are consistently applied across all projects. By embedding these reference patterns into development processes, organizations reduce the need to reinvent the wheel for each new product, saving time and resources. ... The existence of well-defined reference patterns reduces the likelihood of errors during development. Developers can rely on these patterns as a guide, ensuring that they follow proven security practices without having to start from scratch.

The magic of RAG is in the retrieval

The role of the LLM in a RAG system is to simply summarize the data from the retrieval model’s search results, with prompt engineering and fine-tuning to ensure the tone and style are appropriate for the specific workflow. All the leading LLMs on the market support these capabilities, and the differences between them are marginal when it comes to RAG. Choose an LLM quickly and focus on data and retrieval. RAG failures primarily stem from insufficient attention to data access, quality, and retrieval processes. For instance, merely inputting large volumes of data into an LLM with an expansive context window is inadequate if the data is excessively noisy or irrelevant to the specific task. Poor outcomes can result from various factors: a lack of pertinent information in the source corpus, excessive noise, ineffective data processing, or the retrieval system’s inability to filter out irrelevant information. These issues lead to low-quality data being fed to the LLM for summarization, resulting in vague or junk responses. It’s important to note that this isn’t a failure of the RAG concept itself. Rather, it’s a failure in constructing an appropriate “R” — the retrieval model.

What enterprises say the CrowdStrike outage really teaches

CrowdStrike made two errors, enterprises say. First, CrowdStrike didn’t account for the sensitivity of its Falcon client software for endpoints to the tabular data that described how to look for security issues. As a result, an update to that data crashed the client by introducing a condition that had existed before but hadn’t been properly tested. Second, rather than doing a limited release of the new data file that would almost certainly have caught the problem and limited its impact, CrowdStrike pushed it out to its entire user base. ... The 37 who didn’t hold Microsoft accountable pointed out that security software necessarily has a unique ability to interact with the Windows kernel software, and this means it can create a major problem if there’s an error. But while enterprises aren’t convinced that Microsoft contributed to the problem, over three-quarters think Microsoft could contribute to reducing the risk of a recurrence. Nearly as many said that they believed Windows was more prone to the kind of problem CrowdStrike’s bug created, and that view was held by 80 of the 89 development managers, many of whom said that Apple’s MacOS or Linux didn’t pose the same risk and that neither was impacted by the problem.

MIT researchers use large language models to flag problems in complex systems

The researchers developed a framework, called SigLLM, which includes a component that converts time-series data into text-based inputs an LLM can process. A user can feed these prepared data to the model and ask it to start identifying anomalies. The LLM can also be used to forecast future time-series data points as part of an anomaly detection pipeline. While LLMs could not beat state-of-the-art deep learning models at anomaly detection, they did perform as well as some other AI approaches. If researchers can improve the performance of LLMs, this framework could help technicians flag potential problems in equipment like heavy machinery or satellites before they occur, without the need to train an expensive deep-learning model. “Since this is just the first iteration, we didn’t expect to get there from the first go, but these results show that there’s an opportunity here to leverage LLMs for complex anomaly detection tasks,” says Sarah Alnegheimish, an electrical engineering and computer science (EECS) graduate student and lead author of a paper on SigLLM.

Cybersecurity should return to reality and ditch the hype

This shift from educational content to marketing blurs the line between genuine security insights and commercial interests, leading organizations to invest in solutions that may not address their unique challenges. Additionally, buzzword-driven content has become rampant, where terms like “zero-trust architecture” or “blockchain for security” are frequently mentioned in passing without delving into the practicalities and limitations of these technologies. ... we must first recognize the critical distinction between genuine cybersecurity work and the broader tech-centric content that often overshadows it. Real cybersecurity practice is anchored in a relentless pursuit to understand and mitigate the ever-evolving threats to our systems. It is a discipline that demands deep, continuously updated knowledge of systems, networks, and human behavior, alongside a steadfast commitment to the principles of confidentiality, integrity, and availability. True cybersecurity practitioners are those who engage in the laborious tasks of vulnerability assessment, threat modeling, incident response, and the continuous enhancement of security postures, often without the allure of viral recognition or simplistic solutions.

Harnessing AI for 6G: Six Key Approaches for Technology Leaders

Leaders must understand the enabling technologies behind 6G, such as terahertz and quantum communication, and the transformative potential of AI in network deployment and management. ... Engaging with international bodies like the ITU to contribute to the standardization process is crucial. This will ensure AI technologies are integrated into network designs from the beginning. Early involvement in these discussions will also help technology leaders to anticipate future developments and prepare strategies accordingly. ... Advocating for an AI-native 6G network involves embedding large language models and other AI technology into network equipment. This strategy allows autonomous operations and optimizes network management through machine learning algorithms. Such a proactive approach will streamline operations and enhance the reliability and efficiency of the network infrastructure. ... Emphasize the convergence of computing and communication and develop user-centric services that leverage 6G and AI to improve user experiences across various industries. Leaders should focus on creating solutions that are not only technologically advanced but also address the practical needs and preferences of end-users.

GenAI compliance is an oxymoron. Ways to make the best of it

Confoundingly, genAI software sometimes does things that neither the enterprise nor the AI vendor told it to do. Whether that’s making things up (a.k.a. hallucinating), observing patterns no one asked it to look for, or digging up nuggets of highly sensitive data, it spells nightmares for CIOs. This is especially true when it comes to regulations around data collection and protection. How can CIOs accurately and completely tell customers what data is being collected about them and how it is being used when the CIO often doesn’t know exactly what a genAI tool is doing? What if the licensed genAI algorithm chooses to share some of that ultra-sensitive data with its AI vendor parent? “With genAI, the CIO is consciously taking an enormous risk, whether that is legal risk or privacy policy risks. It could result in a variety of outcomes that are unpredictable,” said Tony Fernandes, founder and CEO of user experience agency UEGroup. “If a person chooses not to disclose race, for example, but an AI is able to infer it and the company starts marketing on that basis, have they violated the privacy policy? That’s a big question that will probably need to be settled in court,” he said.

Quote for the day:

"Before you are a leader, success is all about growing yourself. When you become a leader, success is all about growing others" -- Jack Welch

Daily Tech Digest - May 14, 2024

Transforming 6G experience powered by AI/ML

While speed has been the driving force behind previous generations, 6G redefines the game. Yes, it will be incredibly fast, but raw bandwidth is just one piece of the puzzle. 6G aims for seamless and consistent connectivity everywhere. ... This will bridge the digital divide and empower remote areas to participate fully in the digital age. 6G networks will be intelligent entities, leveraging AI and ML algorithms to become: Adaptive: The network will constantly analyze traffic patterns, user demands, and even environmental factors. Based on this real-time data, it will autonomously adjust configurations, optimize resource allocation, and predict user needs for a truly proactive experience. Imagine a network that anticipates your VR gaming session and seamlessly allocates the necessary resources before you even put on the headset. Application-Aware: Gone are the days of one-size-fits-all connectivity. 6G will cater to a diverse range of applications, each with distinct requirements. The network will intelligently recognize the type of traffic – a high-resolution video stream, a critical IoT sensor reading, or a real-time AR overlay – and prioritize resources accordingly. This ensures flawless performance for all users, regardless of their activity.

How data centers can simultaneously enable AI growth and ESG progress

Unlocking AI’s full potential may require organizations to make significant concessions on their ESG goals unless the industry drastically reduces AI’s environmental footprint. This means all data center operators - including both in-house teams and third-party partners - must adopt innovative data center cooling capabilities that can simultaneously improve energy efficiency and reduce carbon emissions. The need for HPC capabilities is not unique to AI. Grid computing, clustering, and large-scale data processing are among the technologies that depend on HPC to facilitate distributed workloads, coordinate complex tasks, and handle immense amounts of data across multiple systems. However, with the rapid rise of AI, the demand for HPC resources has surged, intensifying the need for advanced infrastructure, energy efficiency, and sustainable solutions to manage the associated power and cooling requirements. In particular, the large graphics processing units (GPUs) required to support complex AI models and deep learning algorithms generate more heat than traditional CPUs, creating new challenges for data center design and operation.

Cutting the cord: Can Air-Gapping protect your data?

The first challenge is keeping systems up to date. Software requires patching and upgrading as bugs are found and new features needed. An Air-Gapped system can be updated via USB sticks and CD-Roms, but this is (a) time consuming and (b) introduces a partial connection with the outside world. Chris Hauk, Consumer Privacy Advocate at Pixel Privacy, has observed the havoc this can cause. “Yes, hardware and software both can be easily patched just like we did back in the day, before the internet,” says Hauk. “Patches can be ‘sneakernetted’ to machines on a USB stick. Unfortunately, USB sticks can be infected by malware if the stick used to update systems was created on a networked computer. “The Stuxnet worm, which did damage to Iran’s nuclear program and believed to have been created by the United States and Israel, was malware that targeted Air-Gapped systems, so no system that requires updating is absolutely safe from attacks, even if they are Air-Gapped.” The Air-Gap may suffer breaches. Users may want to take data home or have another reason to access systems. A temporary connection to the outside world, even via a USB stick, poses a serious risk.

Delivering Software Securely: Techniques for Building a Resilient and Secure Code Pipeline

Resilience in a pipeline embodies the system's ability to deal with unexpected events such as network latency, system failures, and resource limitations without causing interruptions. The aim is to design a pipeline that not only provides strength but also maintains self-healing and service continuity. By doing this, you can ensure that the development and deployment of applications can withstand the inevitable failures of any technical environment. ... To introduce fault tolerance into your pipeline, you have to diversify resources and automate recovery processes. ... When it comes to disaster recovery, it is crucial to have a well-organized plan that covers the procedures for data backup, resource provision, and restoration operations. This could include automating backups and using CloudFormation scripts to provision the infrastructure needed quickly. ... How can we ensure that these resilience strategies are not only theoretically effective but also practically effective? Through careful testing and validation. Use chaos engineering principles by intentionally introducing defects into the system to ensure that the pipeline responds as planned.

Cinterion IoT Cellular Modules Vulnerable to SMS Compromise

Cinterion cellular modems are used across a number of industrial IoT environments, including in the manufacturing and healthcare as well as financial services and telecommunications sectors. Telit Cinterion couldn't be immediately reached for comment about the status of its patching efforts or mitigation advice. Fixing the flaws would require the manufacturer of any specific device that includes a vulnerable Cinterion module to release a patch. Some devices, such as insulin monitors in hospitals or the programmable logic controllers and supervisory control and data acquisition systems used in industrial environments, might first need to be recertified with regulators before device manufacturers can push patches to users. The vulnerabilities pose a supply chain security risk, said Evgeny Goncharov, head of Kaspersky's ICS CERT. "Since the modems are typically integrated in a matryoshka-style within other solutions, with products from one vendor stacked atop those from another, compiling a list of affected end products is challenging," he said.

Automotive Radar Testing and Big Data: Safeguarding the Future of Driving

In radar EOL testing, one of the key verification parameters is the radar cross-section (RCS) detection accuracy, which represents the size of an object. Unlike passive objects that have fixed RCS, RTS allows the simulation of various levels of RCS, echoing a desired object size for radar detection. While RTS systems offer versatility for radar testing, they present challenges to overcome. One such challenge is the sensitivity of the system’s millimeter-wave (mmWave) components to temperature variations, which can significantly impact the ability to accurately simulate RCS values. Therefore, controlling the ambient temperature in a testing setup is important to ensuring that the RTS replicates the RCS expected for a given object size. Furthermore, the repercussions extend beyond the immediate operational setbacks with. the need to scrap a number of radar faulty module units. Not only does this represent a direct monetary loss and the overall profit margin, but it also contributes to waste and environmental concerns. All these adverse outcomes, from reduced output capacity to financial losses and environmental impact, highlight the critical importance of integrating analytics software into an automotive radar EOL testing solution.

Nvidia teases quantum accelerated supercomputers

The company revealed that sites in Germany, Japan, and Poland will use the platform to power quantum processing units (QPU) in their high performance computing systems. “Quantum accelerated supercomputing, in which quantum processors are integrated into accelerated supercomputers, represents a tremendous opportunity to solve scientific challenges that may otherwise be out of reach,” said Tim Costa, director, Quantum and HPC at Nvidia. “But there are a number of challenges between us, today, and useful quantum accelerated supercomputing. Today’s qubits are noisy and error prone. Integration with HPC systems remains unaddressed. Error correction algorithms and infrastructure need to be developed. And algorithms with exponential speed up actually need to be invented, among many other challenges.” ... “But another open frontier in quantum remains,” Costa said. “And that’s the deployment of quantum accelerated supercomputers – accelerated supercomputers that integrate a quantum processor to perform certain tasks that are best suited to quantum in collaboration with and supported by AI supercomputing. We’re really excited to announce today the world’s first quantum accelerated supercomputers.”

Tailoring responsible AI: Defining ethical guidelines for industry-specific use

As AI becomes increasingly embedded in business operations, organizations must ask themselves how to prepare for and prevent AI-related failures, such as AI-powered data breaches. AI tools are enabling hackers to develop highly effective social engineering attacks. Right now, having a strong foundation in place to protect customer data is a good place to start. Ensuring third-party AI model providers don’t use your customers’ data also adds protection and control. There are also opportunities for AI to help strengthen crisis management. The first relates to security crises, such as outages and failures, where AI can identify the root of an issue faster. AI can quickly sift through a ton of data to find the “needle in the haystack” that points to the source of the attack or the service that failed. It can also surface relevant data for you much faster using conversational prompts. In the future, an analyst might be able to ask an AI chatbot that’s embedded in its security framework questions about suspicious activity, such as, “What can you tell me about where this traffic originated from?” Or, “What kind of host was this on?”

Taking a ‘Machine-First’ Approach to Identity Management

With microservices, machine identities are proliferating at an alarming rate. Cyberark has reported that the ratio of machine identities to humans in organizations is 45 to 1. At the same time, 87% of respondents in its survey said they store secrets in multiple places across DevOps environments. Curity’s Michal Trojanowski previously wrote about the complex mesh of services comprising an API, adding that securing them is not just about authenticating the user. “A service that receives a request should validate the origin of the request. It should verify the external application that originally sent the request and use an allowlist of callers. ... Using agentless scanning of the identity repositories engineers are using and log analysis, the company first maps all the non-human identities throughout the infrastructure — Kubernetes, databases, applications, workloads, and servers. It creates what it calls attribution— a strong context of which workloads and which humans use each identity, including an understanding its dependencies. Mapping ownership of the various identities also is key. “Think about organizations that have thousands of developers. Security teams sometimes find issues but don’t know how to solve them because they don’t know who to talk with,” Apelblat said.

The limitations of model fine-tuning and RAG

Several factors limit what LLMs can learn via RAG. The first factor is the token allowance. With the undergrads, I could introduce only so much new information into a timed exam without overwhelming them. Similarly, LLMs tend to have a limit, generally between 4k and 32k tokens per prompt, which limits how much an LLM can learn on the fly. The cost of invoking an LLM is also based on the number of tokens, so being economical with the token budget is important to control the cost. The second limiting factor is the order in which RAG examples are presented to the LLM. The earlier a concept is introduced in the example, the more attention the LLM pays to it in general. While a system could reorder retrieval augmentation prompts automatically, token limits would still apply, potentially forcing the system to cut or downplay important facts. To address that risk, we could prompt the LLM with information ordered in three or four different ways to see if the response is consistent. ... The third challenge is to execute retrieval augmentation such that it doesn’t diminish the user experience. If an application is latency sensitive, RAG tends to make latency worse.

Quote for the day:

"What you do makes a difference, and you have to decide what kind of difference you want to make." -- Jane Goodall