Daily Tech Digest by Kannan Subbiah: 6G

Showing posts with label 6G. Show all posts

Daily Tech Digest - April 15, 2026

Quote for the day:

"Definiteness of purpose is the starting point of all achievement." -- W. Clement Stone

🎧 Listen to this digest on YouTube Music

Duration: 22 mins • Perfect for listening on the go.

How to Choose the Right Cybersecurity Vendor

In his 2026 "No-BS Guide" for enterprise buyers, argues that traditional cybersecurity procurement is fundamentally flawed, often falling into the traps of compliance checklists and over-reliance on analyst reports. To navigate a crowded market of over 3,000 vendors, Gupta proposes a framework centered on five critical signals. First, buyers must scrutinize the technical DNA of a vendor’s leadership, ensuring founders possess genuine security expertise rather than just sales backgrounds. Second, evaluations should prioritize architectural depth over superficial feature lists, testing how products handle malicious and unexpected inputs. Third, compliance claims must be verified; instead of accepting simple certificates, buyers should request full and contact auditing firms directly. Fourth, customer evidence is paramount. Prospective buyers should interview current users about "worst-day" incident responses and deployment realities to bypass marketing spin. Finally, assessing a vendor's long-term business viability and roadmap alignment prevents future risks of lock-in or product deprioritization. By treating analyst rankings as mere data points and conducting rigorous technical due diligence, security leaders can avoid "vaporware" and select partners capable of defending against modern threats. This approach moves procurement from a simple checkbox exercise toward a strategic assessment of technical resilience and organizational integrity.

Cyber security chiefs split on quantum threat urgency

Cybersecurity leaders are currently divided over the urgency of addressing , a debate intensified by World Quantum Day and the 2024 release of NIST’s post-quantum cryptography standards. Robin Macfarlane, CEO of RRMac Associates, advocates for immediate action, asserting that quantum technology is already influencing industrial applications and risk analysis at major firms. He warns that traditional encryption methods are nearing obsolescence and urges organizations to proactively audit vulnerabilities and invest in quantum-resilient infrastructure to counter increasingly sophisticated threats. Conversely, Jon Abbott of ThreatAware suggests a more pragmatic approach, arguing that without production-ready quantum computers, the efficacy of modern quantum-proof methods remains speculative. He believes organizations should prioritize more immediate dangers, such as AI-driven malware and ransomware, rather than committing vast resources to quantum migration prematurely. While perspectives vary, both camps agree that establishing a comprehensive inventory of existing encryption is a critical first step. This split highlights a broader strategic dilemma: whether to prepare now for future "" risks or to focus on the rapidly evolving landscape of contemporary cyberattacks. Ultimately, the decision rests on an organization's specific data-retention needs and its exposure to high-value long-term risks versus today's pressing operational vulnerabilities.

Industry risks competing 6G standards as AI, interoperability lag

As the telecommunications industry progresses toward 6G, the transition into 3GPP Release 20 studies highlights significant risks regarding standard fragmentation and delayed AI interoperability. Unlike its predecessors, 6G aims to embed artificial intelligence deeply into network design, yet the lack of coherent standards for data models and interfaces threatens to stifle seamless multi-vendor integration. Experts warn that unresolved issues concerning air interface protocols and spectrum requirements could lead to the emergence of competing global standards, potentially mirroring the fractured landscape seen during the 3G era. Geopolitical tensions further complicate this process, as the scrutiny of contributions from various nations may hinder a unified technical consensus. Furthermore, 6G must address the shortcomings of 5G, such as architectural rigidity and vendor lock-in, by fostering better alignment between 3GPP and . For nations like India, which is actively shaping global frameworks through the Bharat 6G Mission, successful standardization is vital for ensuring economic scalability and nationwide reach. Ultimately, the industry’s ability to formalize these standards by 2028 will determine whether 6G achieves its promised innovation or remains hindered by interoperability gaps and regional silos, failing to deliver a truly global, autonomous network ecosystem.

The great rebalancing: The give and take of cloud and on-premises data management

"The Great Rebalancing" describes a fundamental shift in enterprise data management as organizations transition from "cloud-first" mandates toward a more strategic, hybrid approach. Driven primarily by the rise of and private AI initiatives, this trend involves the selective repatriation of workloads from public clouds back to on-premises or colocation environments. High egress fees, escalating storage costs, and the intensive compute requirements of AI models have made public cloud economics increasingly difficult to justify for many large-scale datasets. Beyond financial concerns, the article highlights how organizations are prioritizing data sovereignty, security, and compliance with strict regulations like GDPR and HIPAA, which are often more effectively managed within a private infrastructure. By deploying AI models closer to their primary data sources, companies can significantly reduce latency and eliminate the pricing unpredictability associated with cloud-native architectures. However, this rebalancing is not a total retreat from the cloud. Instead, it represents a move toward a more nuanced infrastructure model where businesses evaluate each workload based on its specific performance and cost requirements. This hybrid future allows enterprises to leverage the scalability of public cloud services while maintaining the control and efficiency of on-premises systems, ultimately creating a more sustainable data management ecosystem.

Building a Security-First Engineering Culture - The Only Defense That Holds When Everything Else Is Tested

In the article "Building a Security-First Engineering Culture," the author argues that a robust cultural foundation is the most critical defense an organization can possess, especially when technical tools and perimeter defenses inevitably face challenges. The core premise revolves around the "shift-left" philosophy, emphasizing that security must be an intrinsic part of the design and development phases rather than an afterthought or a final hurdle in the release cycle. By moving beyond a reactive mindset, engineering teams are encouraged to adopt a proactive stance where security is a shared responsibility, not just the domain of a specialized department. Key strategies discussed include continuous education to empower developers, the integration of automated security checks into CI/CD pipelines, and the implementation of regular threat modeling sessions. Ultimately, the author suggests that a true security-first culture is defined by transparency and a no-blame environment, which facilitates the early identification and resolution of vulnerabilities. This cultural shift ensures that security becomes a core engineering value, creating a resilient ecosystem that remains steadfast even when individual systems or processes are compromised. By fostering this collective accountability, organizations can build sustainable and trustworthy software in an increasingly complex and evolving digital threat landscape.

Too Many Signals: How Curated Authenticity Cuts Through The Noise

In the Forbes article "Too Many Signals: How Curated Authenticity Cuts Through The Noise," Nataly Kelly explores the pitfalls of modern brand communication, where many companies mistakenly equate authenticity with constant, unfiltered sharing. This "oversharing" often results in a muddled brand identity that confuses consumers instead of connecting with them. To address this, Kelly proposes the concept of "," which involves filtering genuine brand expressions through a strategic lens to ensure every signal reinforces a central story. This disciplined approach is increasingly vital in the age of generative AI, which has flooded the market with low-quality "AI slop," making coherence and emotional resonance more valuable than sheer frequency. Kelly advises marketing leaders to align their content with desired perceptions, maintain consistency across all channels, and avoid performative gestures that lack depth. She also stresses the importance of brand tracking, urging CMOs to treat brand health as a critical business metric rather than a soft one. Ultimately, the article argues that by combining human judgment with data-driven insights, brands can cut through digital noise, fostering long-term memories and meaningful engagement rather than just accumulating fleeting likes in a crowded marketplace.

Fixing encryption isn’t enough. Quantum developments put focus on authentication

Recent advancements in quantum computing research have shifted the cybersecurity landscape, compelling organizations to broaden their defensive strategies beyond standard encryption to include robust authentication. New findings from Google and Caltech indicate that the hardware requirements to break —essential for digital signatures and system access—are significantly lower than previously anticipated, potentially requiring as few as 1,200 logical . This discovery has led major tech players like Google and Cloudflare to move up their "quantum apocalypse" projections to 2029. While many enterprises have focused on protecting stored data from "Harvest Now, Decrypt Later" tactics, experts warn that compromised authentication is far more catastrophic. A quantum-broken credential allows attackers to bypass security perimeters entirely, potentially turning automated software updates into vectors for remote code execution. Although functional, large-scale quantum computers remain in the development phase, the complexity of migrating to post-quantum cryptography (PQC) necessitates immediate action. Organizations are encouraged to form dedicated task forces to inventory vulnerable systems and prioritize the deployment of quantum-resistant authentication protocols. By acknowledging that the timeline for quantum threats is no longer abstract, enterprises can better prepare for a future where traditional cryptographic standards like RSA and elliptic curve cryptography are no longer sufficient to ensure digital sovereignty.

Coordinated vulnerability disclosure is now an EU obligation, but cultural change takes time

In an insightful interview with Help Net Security, Nuno Rodrigues-Carvalho of ENISA explores the evolving landscape of global vulnerability management and the systemic vulnerabilities within the . Following recent funding uncertainties involving MITRE and CISA, Carvalho emphasizes that the CVE system acts as a critical global backbone, yet its reliance on single institutional points of failure necessitates a more distributed and resilient architecture. Within the European Union, the regulatory environment is shifting significantly through the Cyber Resilience Act (CRA) and the NIS2 Directive, which introduce stringent accountability for vendors. These frameworks mandate that manufacturers report exploited vulnerabilities within specific, narrow timelines through a Single Reporting Platform managed by ENISA. Carvalho highlights that while historical cultural barriers once led organizations to view vulnerability disclosure as a liability, modern standards are normalizing coordinated disclosure as a core component of cybersecurity governance. To bolster this effort, ENISA is expanding European vulnerability services and developing the EU Vulnerability Database (EUVD). This initiative aims to provide machine-readable, context-aware information that complements global standards, ensuring that security practitioners have the necessary tools to navigate conflicting data sources while maintaining interoperability. Ultimately, the goal is a more sustainable, transparent ecosystem that prioritizes collective security over individual corporate reputation.

Most organizations make a mess of handling digital disruption

According to a recent Economist Impact study supported by Telstra International, a staggering 75% of organizations struggle to handle digital disruption effectively. The research highlights that while many businesses possess the intent to remain resilient, there is a significant gap between their ambitions and actual execution. This failure is primarily attributed to weak governance, limited coordination with external partners, and poor visibility beyond immediate organizational boundaries. Only 25% of respondents claimed their disruption responses go as planned, with a mere 21% maintaining dedicated teams for digital resilience. Furthermore, existing risk management frameworks are often too narrow, focusing heavily on cybersecurity while neglecting critical factors like geopolitical shifts, supplier vulnerabilities, and climate-related risks. Legacy technology continues to plague about 60% of firms in the US and UK, further complicating the integration of resilience into modern systems. While financial and IT sectors show more progress in modernizing core infrastructure, the public and industrial sectors significantly lag behind. Ultimately, the report emphasizes that technical strength alone is insufficient. Real digital resilience requires senior-level ownership, comprehensive scenario testing across entire ecosystems, and a cultural shift toward readiness to ensure that human judgment and diverse expertise can effectively navigate the complexities of modern digital crises.

Quantum Computing vs Classical Computing – What’s the Real Difference

The guide explores the fundamental differences between classical and quantum computing, emphasizing how they approach problem-solving through distinct physical principles. Classical computers rely on bits, representing data as either a zero or a one, and process instructions linearly using transistors. In contrast, quantum computers utilize qubits, which leverage the principles of superposition and entanglement to represent and process vast amounts of data simultaneously. This multidimensional approach allows quantum systems to potentially solve specific, complex problems — such as large-scale optimization, molecular simulation for drug discovery, and breaking traditional cryptographic codes — exponentially faster than today’s most powerful supercomputers. However, the guide clarifies that quantum computers are not intended to replace classical systems for everyday tasks. Instead, they serve as specialized tools for high-compute workloads. While classical computing is reaching its physical scaling limits, quantum technology faces its own hurdles, including qubit fragility and the ongoing need for robust error correction. As of 2026, the industry is transitioning from experimental NISQ-era devices toward fault-tolerant systems, marking a pivotal moment where quantum advantage becomes increasingly tangible for commercial applications. This "tug of war" suggests a hybrid future where both architectures coexist to drive global innovation and discovery across various sectors.

Daily Tech Digest - March 03, 2026

Quote for the day:

“Appreciate the people who give you expensive things like time, loyalty and honesty.” -- Vala Afshar

Making sense of 6G: what will the ‘agentic telco’ look like?

6G will be the fundamental network for physical AI, promises Nvidia. Think of self-driving cars, robots in warehouses, or even AI-driven surgery. It’s all very futuristic; to actually deliver on these promises, a wide range of industry players will be needed, each developing the functionality of 6G. ... The ultimate goal for network operators is full automation, or “Level 5” automation. However, this seems too ambitious for now in the pre-6G era. Google refers to the twilight zone between Levels 4 and 5, with 4 assuming fully autonomous operation in certain circumstances. Currently, the obvious example of this type of automation is a partially self-driving car. As a user, you must always be ready to intervene, but ideally, the vehicle will travel without corrections. A Waymo car, which regularly drives around without a driver, is officially Level 4. ... Strikingly, most users hardly need this ongoing telco innovation. Only exceptionally extensive use of 4K streams, multiple simultaneous downloads, and/or location tracking can exceed the maximum bandwidth of most forms of 5G. Switch to 4G and in most use cases of mobile network traffic, you won’t notice the difference. You will notice a malfunction, regardless of the generation of network technology. However, the idea behind the latest 5G and future 6G networks is that these interruptions will decrease. Predictions for 6G assume a hundredfold increase in speed compared to 5G, with a similar improvement in bandwidth.

FinOps for agents: Loop limits, tool-call caps and the new unit economics of agentic SaaS

FinOps practitioners are increasingly treating AI as its own cost domain. The FinOps Foundation highlights token-based pricing, cost-per-token and cost-per-API-call tracking and anomaly detection as core practices for managing AI spend. Seat count still matters, yet I have watched two customers with the same licenses generate a 10X difference in inference and tool costs because one had standardized workflows and the other lived in exceptions. If you ship agents without a cost model, your cloud invoice quickly becomes the lesson plan ... In early pilots, teams obsess over token counts. However, for a scaled agentic SaaS running in production, we need one number that maps directly to value: Cost-per-Accepted-Outcome (CAPO). CAPO is the fully loaded cost to deliver one accepted outcome for a specific workflow. ... We calculate CAPO per workflow and per segment, then watch the distribution, not just the average. Median tells us where the product feels efficient. P95 and P99 tell us where loops, retries and tool storms are hiding. Note, failed runs belong in CAPO automatically since we treat the numerator as total fully loaded spend for that workflow (accepted + failed + abandoned + retried) and the denominator as accepted outcomes only, so every failure is “paid for” by the successes. Tagging each run with an outcome state and attributing its cost to a failure bucket allows us to track Failure Cost Share alongside CAPO and see whether the problem is acceptance rate, expensive failures or retry storms.

AI went from assistant to autonomous actor and security never caught up

The first is the agent challenge. AI systems have moved past assistants that respond to queries and into autonomous agents that execute multi-step tasks, call external tools, and make decisions without per-action human approval. This creates failure conditions that exist without any external attacker. An agent with overprivileged access and poor containment boundaries can cause damage through ordinary operation. ... The second category is the visibility challenge. Sixty-three percent of employees who used AI tools in 2025 pasted sensitive company data, including source code and customer records, into personal chatbot accounts. The average enterprise has an estimated 1,200 unofficial AI applications in use, with 86% of organizations reporting no visibility into their AI data flows. ... The third is the trust challenge. Prompt injection moved from academic research into recurring production incidents in 2025. OWASP’s 2025 LLM Top 10 list ranked prompt injection at the top. The vulnerability exists because LLMs cannot reliably separate instructions from data input. ... Wang recommended tiering agents by risk level. Agents with access to sensitive data or production systems warrant continuous adversarial testing and stronger review gates. Lower-risk agents can rely on standardized controls and periodic sampling. “The goal is to make continuous validation part of the engineering lifecycle,” she said.

A scorecard for cyber and risk culture

Cybersecurity and risk culture isn’t a vibe. It’s a set of actions, behaviors and attitudes you can point to without raising your voice. ... You can’t train people into that. You have to build an environment where that behavior makes sense, an environment based on trust and performance not one or the other ... Ownership is a design outcome. Treat it like product design. Remove friction. Clarify choices. Make it hard to do the wrong thing by accident and easy to make the best possible decision. ... If you can’t measure the behavior, you can’t claim the culture. You can claim a feeling. Feelings don’t survive audits, incidents or Board scrutiny. We’ve seen teams measure what’s easy and then call the numbers “maturity.” Training completion. Controls “done.” Zero incidents. Nice charts. Clean dashboards. Meanwhile, the real culture runs beneath the surface, making exceptions, working around friction and staying quiet when speaking up feels risky. ... One of the most dangerous culture metrics is silence dressed up as success. “Zero incidents reported” can mean you’re safe. It can also mean people don’t trust the system enough to speak up. The difference matters. The wrong interpretation is how organizations walk into breaches with a smile. Measure culture as you would safety in a factory. ... Metrics without governance create cynical employees. They see numbers. They never see action. Then they stop caring. Be careful not to make compliance ‘the culture’ as it’s what people do when no one is looking that counts.

Why encrypted backups may fail in an AI-driven ransomware era

For 20 years, I've talked up the benefits of the tech industry's best-practice 3-2-1 backup strategy. This strategy is just how it's done, and it works. Or does it? What if I told you that everything you know and everything you do to ensure quality backups is no longer viable? In fact, what if I told you that in an era of generative AI, when it comes to backups, we're all pretty much screwed? ... The easy-peasy assumption is that your data is good before it's backed up. Therefore, if something happens and you need to restore, the data you're bringing back from the backup is also good. Even without malware, AI, and bad actors, that's not always the way things turn out. Backups can get corrupted, and they might not have been written right in the first place, yada, yada, yada. But for this article, let's assume that your backup and restore process is solid, reliable, and functional. ... Even if the thieves are willing to return the data, their AI-generated vibe-coded software might be so crappy that they're unable to keep up their end of the bargain. Do you seriously think that threat actors who use vibe coding test their threat engines? ... Some truly nasty attacks specifically target immutable storage by seeking out misconfigurations. Here, they attack the management infrastructure, screwing with network data before it ever reaches the backup system. The net result is that before encryption of off-site backups begins, and before the backups even take place, the malware has suitably corrupted and infected the data.

How Deepfakes and Injection Attacks Are Breaking Identity Verification

Unlike social media deception, these attacks can enable persistent access inside trusted environments. The downstream impact is durable: account persistence, privilege-escalation pathways, and lateral movement opportunities that start with a single false verification decision. ... One practical problem for deepfake defense is generalization: detectors that test well in controlled settings often degrade in “in-the-wild” conditions. Researchers at Purdue University evaluated deepfake detection systems using their real-world benchmark based on the Political Deepfakes Incident Database (PDID). PDID contains real incident media distributed on platforms such as X, YouTube, TikTok, and Instagram, meaning the inputs are compressed, re-encoded, and post-processed in the same ways defenders often see in production. ... It’s important to be precise: PDID measures robustness of media detection on real incident content. It does not model injection, device compromise, or full-session attacks. In real identity workflows, attackers do not choose one technique at a time; they stack them. A high-quality deepfake can be replayed. A replay can be injected. An injected stream can be automated at scale. The best media detectors still can be bypassed if the capture path is untrusted. That’s why Deepsight goes even deeper than asking “Is this video a deepfake?”

Virtual twins and AI companions target enterprise war rooms

Organisations invest millions digitising processes and implementing enterprise systems. Yet when business leaders ask questions spanning multiple domains, those systems don’t communicate effectively. Teams assemble to manually cross-reference data, spending days producing approximations rather than definitive answers. Manufacturing experts at the conference framed this as decades of incomplete digitisation. ... Addressing this requires fundamentally changing how enterprise data is structured and accessed. Rather than systems operating independently with occasional data exchanges, the approach involves projecting information from multiple sources onto unified representations that preserve relationships and context. Zimmerman used a map analogy to explain the concept. “If you take an Excel spreadsheet with location of restaurants and another Excel spreadsheet with location of flower shops, and you try to find a restaurant nearby a flower shop, that’s difficult,” he said. “If it’s on the map, it is simple because the data are correlated by nature.” ... Having unified data representations solves part of the problem. Accessing them requires interfaces that don’t force users to understand complex data structures or navigate multiple applications. The conversational AI approach – increasingly common across enterprise software – aims to let users ask questions naturally rather than construct database queries or click through application menus.

The rise of the outcome-orchestrating CIO

Delivering technology isn’t enough. Boards and business leaders want results — revenue, measurable efficiency, competitive advantage — and they’re increasingly impatient with IT organizations that can’t connect their work to those outcomes. ... Funding models change, too. Traditional IT budgets fund teams to deliver features. When the business pivots, that becomes a change request — creating friction even when it’s not an adversarial situation. “Instead, fund a value stream,” Sample says. “Then, whatever the business needs, you absorb the change and work toward shared goals. It doesn’t matter what’s on the bill because you’re all working toward the same outcome.” It’s a fundamental reframing of IT’s role. “Stop talking about shared services,” says Ijam of the Federal Reserve. “Talk about being a co-owner of value realization.” That means evolving from service provider to strategic partner — not waiting for requirements but actively shaping how technology creates business results. ... When outcome orchestration is working, the boardroom conversation changes. “CIOs are presenting business results enabled by technology — not just technology updates — and discussing where to invest next for maximum impact,” says Cox Automotive’s Johnson. “The CFO begins to see technology as an investment that generates returns, not just a cost to be managed.” ... When outcome orchestration takes hold, the impact shows up across multiple dimensions — not just in business metrics, but in how IT is perceived and how its people experience their work.

The future of banking: When AI becomes the interface

Experiences must now adapt to people—not the other way around. As generative capabilities mature, customers will increasingly expect banking interactions to be intuitive, conversational, and personalized by default, setting a much higher bar for digital experience design. ... Leadership teams must now ask harder questions. What proprietary data, intelligence, or trust signals can only our bank provide? How do we shape AI-driven payment decisions rather than merely fulfill them? And how do we ensure that when an AI decides how money moves, our institution is not just compliant, but preferred? ... AI disruption presents both significant risk and transformative opportunity for banks. To remain relevant, institutions must decide where AI should directly handle customer interactions, how seamlessly their services integrate into AI-driven ecosystems, and how their products and content are surfaced and selected by AI-led discovery and search. This requires reimagining the bank’s digital assistant across seven critical dimensions: being front and centre at the point of intent, contextual in understanding customer needs, multi-modal across voice, text, and interfaces, agentic in taking action on the customer’s behalf, revenue-generating through intelligent recommendations, open and connected to broader ecosystems, and capable of providing targeted, proactive support.

The End of the ‘Observability Tax’: Why Enterprises are Pivoting to OpenTelemetry

For enterprises to reclaim their budget, they must first address inefficiency—the “hidden tax” of observability facing many DevOps teams. Every organization is essentially rebuilding the same pipeline from scratch, and when configurations aren’t standardized, engineers aren’t learning from each other; they’re actually repeating the same trial-and-error processes thousands of times over. This duplicated effort leads to a waste of time and resources. It often takes weeks to manually configure collectors, processors, and exporters, plus countless hours of debugging connection issues. ... If data engineers are stuck in a cycle of trial-and-error to manage their massive telemetry, then organizations are stuck drinking from a firehose instead of proactively managing their data in a targeted manner. In a world where AI demands immediate access to enormous volumes of data, this lack of flexibility becomes a fatal competitive disadvantage. If enterprises want to succeed in an AI-driven world, their data infrastructure must be able to handle the rapid velocity of data in motion without sacrificing cost-efficiency. Identifying and mitigating these hidden challenges and costs is imperative if enterprises want to turn their data into an asset rather than a liability. ... When organizations reclaim complete control of their data pipelines, they can gain a competitive edge.

Daily Tech Digest - August 14, 2024

MIT releases comprehensive database of AI risks

While numerous organizations and researchers have recognized the importance of addressing AI risks, efforts to document and classify these risks have been largely uncoordinated, leading to a fragmented landscape of conflicting classification systems. ... The AI Risk Repository is designed to be a practical resource for organizations in different sectors. For organizations developing or deploying AI systems, the repository serves as a valuable checklist for risk assessment and mitigation. “Organizations using AI may benefit from employing the AI Risk Database and taxonomies as a helpful foundation for comprehensively assessing their risk exposure and management,” the researchers write. “The taxonomies may also prove helpful for identifying specific behaviors which need to be performed to mitigate specific risks.” ... The research team acknowledges that while the repository offers a comprehensive foundation, organizations will need to tailor their risk assessment and mitigation strategies to their specific contexts. However, having a centralized and well-structured repository like this reduces the likelihood of overlooking critical risks.

Why Agile Alone Might Not Be So Agile: A Witty Look at Methodology Madness

Agile’s problems often start with a fundamental misunderstanding of what it truly means to be agile. When the Agile Manifesto was penned back in 2001, its authors intended it to be a flexible, adaptable approach to software development, free from the rigid structures and bureaucratic procedures of traditional methodologies. But fast forward to today, and Agile has become its own kind of bureaucratic monster in many organizations — a tyrant disguised as a liberator. Why does this happen? Let’s dissect the two main problems: the roles defined within Agile and the one-size-fits-all mentality that organizations apply to Agile methodology. One of the biggest hurdles to successful Agile adoption is the disconnect between the executive suite and the teams on the ground. Executives often see Agile as a magic bullet for faster delivery and higher productivity, without fully understanding the nuances of the methodology. This disconnect can lead to unrealistic demands and pressure on teams to deliver more with each Sprint, which in turn leads to burnout and decreased quality. Moreover, the Agile Manifesto’s disdain for comprehensive documentation can be problematic in complex projects.

Feature Flags Wouldn’t Have Prevented the CrowdStrike Outage

Feature flagging is a valuable technique for decoupling the release of new features from code deployment, and advanced feature flagging tools usually support percentage-based rollouts. For example, you can enable a feature on X% of targets to ensure it works before reaching 100%. While it’s true that feature flags can help to prevent outages, given the scale and complexity of the CrowdStrike incident, they would not have been sufficient for three reasons. First, a comprehensive staged rollout requires more than just “gradually enable this flag over the next few days”:There has to be an integration with the monitoring stack to perform health checks and stop the rollout if there are problems. There has to be a way to integrate with the CD pipeline to reuse the list of targets to roll out to and a list of health checks to track. Available feature flagging solutions require much work and expertise to support staged rollout at any reasonable scale. Second, CrowdStrike’s config had a complex structure requiring a “configuration system” and a “content interpreter.” Such configs would benefit from first-class schema support and end-to-end type safety.

Putting Threat Modeling Into Practice: A Guide for Business Leaders

One of the primary benefits of threat modeling is its ability to reduce the number of defects that make it to production. By identifying potential threats and vulnerabilities during the design phase, companies can implement security measures that prevent these issues from ever reaching the production environment. This proactive approach not only improves the quality of products but also reduces the costs associated with post-production fixes and patches. ... Threat modeling helps us create reusable artifacts and reference patterns as code, which serve as blueprints for future projects. These patterns encapsulate best practices and lessons learned, ensuring that security considerations are consistently applied across all projects. By embedding these reference patterns into development processes, organizations reduce the need to reinvent the wheel for each new product, saving time and resources. ... The existence of well-defined reference patterns reduces the likelihood of errors during development. Developers can rely on these patterns as a guide, ensuring that they follow proven security practices without having to start from scratch.

The magic of RAG is in the retrieval

The role of the LLM in a RAG system is to simply summarize the data from the retrieval model’s search results, with prompt engineering and fine-tuning to ensure the tone and style are appropriate for the specific workflow. All the leading LLMs on the market support these capabilities, and the differences between them are marginal when it comes to RAG. Choose an LLM quickly and focus on data and retrieval. RAG failures primarily stem from insufficient attention to data access, quality, and retrieval processes. For instance, merely inputting large volumes of data into an LLM with an expansive context window is inadequate if the data is excessively noisy or irrelevant to the specific task. Poor outcomes can result from various factors: a lack of pertinent information in the source corpus, excessive noise, ineffective data processing, or the retrieval system’s inability to filter out irrelevant information. These issues lead to low-quality data being fed to the LLM for summarization, resulting in vague or junk responses. It’s important to note that this isn’t a failure of the RAG concept itself. Rather, it’s a failure in constructing an appropriate “R” — the retrieval model.

What enterprises say the CrowdStrike outage really teaches

CrowdStrike made two errors, enterprises say. First, CrowdStrike didn’t account for the sensitivity of its Falcon client software for endpoints to the tabular data that described how to look for security issues. As a result, an update to that data crashed the client by introducing a condition that had existed before but hadn’t been properly tested. Second, rather than doing a limited release of the new data file that would almost certainly have caught the problem and limited its impact, CrowdStrike pushed it out to its entire user base. ... The 37 who didn’t hold Microsoft accountable pointed out that security software necessarily has a unique ability to interact with the Windows kernel software, and this means it can create a major problem if there’s an error. But while enterprises aren’t convinced that Microsoft contributed to the problem, over three-quarters think Microsoft could contribute to reducing the risk of a recurrence. Nearly as many said that they believed Windows was more prone to the kind of problem CrowdStrike’s bug created, and that view was held by 80 of the 89 development managers, many of whom said that Apple’s MacOS or Linux didn’t pose the same risk and that neither was impacted by the problem.

MIT researchers use large language models to flag problems in complex systems

The researchers developed a framework, called SigLLM, which includes a component that converts time-series data into text-based inputs an LLM can process. A user can feed these prepared data to the model and ask it to start identifying anomalies. The LLM can also be used to forecast future time-series data points as part of an anomaly detection pipeline. While LLMs could not beat state-of-the-art deep learning models at anomaly detection, they did perform as well as some other AI approaches. If researchers can improve the performance of LLMs, this framework could help technicians flag potential problems in equipment like heavy machinery or satellites before they occur, without the need to train an expensive deep-learning model. “Since this is just the first iteration, we didn’t expect to get there from the first go, but these results show that there’s an opportunity here to leverage LLMs for complex anomaly detection tasks,” says Sarah Alnegheimish, an electrical engineering and computer science (EECS) graduate student and lead author of a paper on SigLLM.

Cybersecurity should return to reality and ditch the hype

This shift from educational content to marketing blurs the line between genuine security insights and commercial interests, leading organizations to invest in solutions that may not address their unique challenges. Additionally, buzzword-driven content has become rampant, where terms like “zero-trust architecture” or “blockchain for security” are frequently mentioned in passing without delving into the practicalities and limitations of these technologies. ... we must first recognize the critical distinction between genuine cybersecurity work and the broader tech-centric content that often overshadows it. Real cybersecurity practice is anchored in a relentless pursuit to understand and mitigate the ever-evolving threats to our systems. It is a discipline that demands deep, continuously updated knowledge of systems, networks, and human behavior, alongside a steadfast commitment to the principles of confidentiality, integrity, and availability. True cybersecurity practitioners are those who engage in the laborious tasks of vulnerability assessment, threat modeling, incident response, and the continuous enhancement of security postures, often without the allure of viral recognition or simplistic solutions.

Harnessing AI for 6G: Six Key Approaches for Technology Leaders

Leaders must understand the enabling technologies behind 6G, such as terahertz and quantum communication, and the transformative potential of AI in network deployment and management. ... Engaging with international bodies like the ITU to contribute to the standardization process is crucial. This will ensure AI technologies are integrated into network designs from the beginning. Early involvement in these discussions will also help technology leaders to anticipate future developments and prepare strategies accordingly. ... Advocating for an AI-native 6G network involves embedding large language models and other AI technology into network equipment. This strategy allows autonomous operations and optimizes network management through machine learning algorithms. Such a proactive approach will streamline operations and enhance the reliability and efficiency of the network infrastructure. ... Emphasize the convergence of computing and communication and develop user-centric services that leverage 6G and AI to improve user experiences across various industries. Leaders should focus on creating solutions that are not only technologically advanced but also address the practical needs and preferences of end-users.

GenAI compliance is an oxymoron. Ways to make the best of it

Confoundingly, genAI software sometimes does things that neither the enterprise nor the AI vendor told it to do. Whether that’s making things up (a.k.a. hallucinating), observing patterns no one asked it to look for, or digging up nuggets of highly sensitive data, it spells nightmares for CIOs. This is especially true when it comes to regulations around data collection and protection. How can CIOs accurately and completely tell customers what data is being collected about them and how it is being used when the CIO often doesn’t know exactly what a genAI tool is doing? What if the licensed genAI algorithm chooses to share some of that ultra-sensitive data with its AI vendor parent? “With genAI, the CIO is consciously taking an enormous risk, whether that is legal risk or privacy policy risks. It could result in a variety of outcomes that are unpredictable,” said Tony Fernandes, founder and CEO of user experience agency UEGroup. “If a person chooses not to disclose race, for example, but an AI is able to infer it and the company starts marketing on that basis, have they violated the privacy policy? That’s a big question that will probably need to be settled in court,” he said.

Quote for the day:

"Before you are a leader, success is all about growing yourself. When you become a leader, success is all about growing others" -- Jack Welch

Daily Tech Digest - May 14, 2024

Transforming 6G experience powered by AI/ML

While speed has been the driving force behind previous generations, 6G redefines the game. Yes, it will be incredibly fast, but raw bandwidth is just one piece of the puzzle. 6G aims for seamless and consistent connectivity everywhere. ... This will bridge the digital divide and empower remote areas to participate fully in the digital age. 6G networks will be intelligent entities, leveraging AI and ML algorithms to become: Adaptive: The network will constantly analyze traffic patterns, user demands, and even environmental factors. Based on this real-time data, it will autonomously adjust configurations, optimize resource allocation, and predict user needs for a truly proactive experience. Imagine a network that anticipates your VR gaming session and seamlessly allocates the necessary resources before you even put on the headset. Application-Aware: Gone are the days of one-size-fits-all connectivity. 6G will cater to a diverse range of applications, each with distinct requirements. The network will intelligently recognize the type of traffic – a high-resolution video stream, a critical IoT sensor reading, or a real-time AR overlay – and prioritize resources accordingly. This ensures flawless performance for all users, regardless of their activity.

How data centers can simultaneously enable AI growth and ESG progress

Unlocking AI’s full potential may require organizations to make significant concessions on their ESG goals unless the industry drastically reduces AI’s environmental footprint. This means all data center operators - including both in-house teams and third-party partners - must adopt innovative data center cooling capabilities that can simultaneously improve energy efficiency and reduce carbon emissions. The need for HPC capabilities is not unique to AI. Grid computing, clustering, and large-scale data processing are among the technologies that depend on HPC to facilitate distributed workloads, coordinate complex tasks, and handle immense amounts of data across multiple systems. However, with the rapid rise of AI, the demand for HPC resources has surged, intensifying the need for advanced infrastructure, energy efficiency, and sustainable solutions to manage the associated power and cooling requirements. In particular, the large graphics processing units (GPUs) required to support complex AI models and deep learning algorithms generate more heat than traditional CPUs, creating new challenges for data center design and operation.

Cutting the cord: Can Air-Gapping protect your data?

The first challenge is keeping systems up to date. Software requires patching and upgrading as bugs are found and new features needed. An Air-Gapped system can be updated via USB sticks and CD-Roms, but this is (a) time consuming and (b) introduces a partial connection with the outside world. Chris Hauk, Consumer Privacy Advocate at Pixel Privacy, has observed the havoc this can cause. “Yes, hardware and software both can be easily patched just like we did back in the day, before the internet,” says Hauk. “Patches can be ‘sneakernetted’ to machines on a USB stick. Unfortunately, USB sticks can be infected by malware if the stick used to update systems was created on a networked computer. “The Stuxnet worm, which did damage to Iran’s nuclear program and believed to have been created by the United States and Israel, was malware that targeted Air-Gapped systems, so no system that requires updating is absolutely safe from attacks, even if they are Air-Gapped.” The Air-Gap may suffer breaches. Users may want to take data home or have another reason to access systems. A temporary connection to the outside world, even via a USB stick, poses a serious risk.

Delivering Software Securely: Techniques for Building a Resilient and Secure Code Pipeline

Resilience in a pipeline embodies the system's ability to deal with unexpected events such as network latency, system failures, and resource limitations without causing interruptions. The aim is to design a pipeline that not only provides strength but also maintains self-healing and service continuity. By doing this, you can ensure that the development and deployment of applications can withstand the inevitable failures of any technical environment. ... To introduce fault tolerance into your pipeline, you have to diversify resources and automate recovery processes. ... When it comes to disaster recovery, it is crucial to have a well-organized plan that covers the procedures for data backup, resource provision, and restoration operations. This could include automating backups and using CloudFormation scripts to provision the infrastructure needed quickly. ... How can we ensure that these resilience strategies are not only theoretically effective but also practically effective? Through careful testing and validation. Use chaos engineering principles by intentionally introducing defects into the system to ensure that the pipeline responds as planned.

Cinterion IoT Cellular Modules Vulnerable to SMS Compromise

Cinterion cellular modems are used across a number of industrial IoT environments, including in the manufacturing and healthcare as well as financial services and telecommunications sectors. Telit Cinterion couldn't be immediately reached for comment about the status of its patching efforts or mitigation advice. Fixing the flaws would require the manufacturer of any specific device that includes a vulnerable Cinterion module to release a patch. Some devices, such as insulin monitors in hospitals or the programmable logic controllers and supervisory control and data acquisition systems used in industrial environments, might first need to be recertified with regulators before device manufacturers can push patches to users. The vulnerabilities pose a supply chain security risk, said Evgeny Goncharov, head of Kaspersky's ICS CERT. "Since the modems are typically integrated in a matryoshka-style within other solutions, with products from one vendor stacked atop those from another, compiling a list of affected end products is challenging," he said.

Automotive Radar Testing and Big Data: Safeguarding the Future of Driving

In radar EOL testing, one of the key verification parameters is the radar cross-section (RCS) detection accuracy, which represents the size of an object. Unlike passive objects that have fixed RCS, RTS allows the simulation of various levels of RCS, echoing a desired object size for radar detection. While RTS systems offer versatility for radar testing, they present challenges to overcome. One such challenge is the sensitivity of the system’s millimeter-wave (mmWave) components to temperature variations, which can significantly impact the ability to accurately simulate RCS values. Therefore, controlling the ambient temperature in a testing setup is important to ensuring that the RTS replicates the RCS expected for a given object size. Furthermore, the repercussions extend beyond the immediate operational setbacks with. the need to scrap a number of radar faulty module units. Not only does this represent a direct monetary loss and the overall profit margin, but it also contributes to waste and environmental concerns. All these adverse outcomes, from reduced output capacity to financial losses and environmental impact, highlight the critical importance of integrating analytics software into an automotive radar EOL testing solution.

Nvidia teases quantum accelerated supercomputers

The company revealed that sites in Germany, Japan, and Poland will use the platform to power quantum processing units (QPU) in their high performance computing systems. “Quantum accelerated supercomputing, in which quantum processors are integrated into accelerated supercomputers, represents a tremendous opportunity to solve scientific challenges that may otherwise be out of reach,” said Tim Costa, director, Quantum and HPC at Nvidia. “But there are a number of challenges between us, today, and useful quantum accelerated supercomputing. Today’s qubits are noisy and error prone. Integration with HPC systems remains unaddressed. Error correction algorithms and infrastructure need to be developed. And algorithms with exponential speed up actually need to be invented, among many other challenges.” ... “But another open frontier in quantum remains,” Costa said. “And that’s the deployment of quantum accelerated supercomputers – accelerated supercomputers that integrate a quantum processor to perform certain tasks that are best suited to quantum in collaboration with and supported by AI supercomputing. We’re really excited to announce today the world’s first quantum accelerated supercomputers.”

Tailoring responsible AI: Defining ethical guidelines for industry-specific use

As AI becomes increasingly embedded in business operations, organizations must ask themselves how to prepare for and prevent AI-related failures, such as AI-powered data breaches. AI tools are enabling hackers to develop highly effective social engineering attacks. Right now, having a strong foundation in place to protect customer data is a good place to start. Ensuring third-party AI model providers don’t use your customers’ data also adds protection and control. There are also opportunities for AI to help strengthen crisis management. The first relates to security crises, such as outages and failures, where AI can identify the root of an issue faster. AI can quickly sift through a ton of data to find the “needle in the haystack” that points to the source of the attack or the service that failed. It can also surface relevant data for you much faster using conversational prompts. In the future, an analyst might be able to ask an AI chatbot that’s embedded in its security framework questions about suspicious activity, such as, “What can you tell me about where this traffic originated from?” Or, “What kind of host was this on?”

Taking a ‘Machine-First’ Approach to Identity Management

With microservices, machine identities are proliferating at an alarming rate. Cyberark has reported that the ratio of machine identities to humans in organizations is 45 to 1. At the same time, 87% of respondents in its survey said they store secrets in multiple places across DevOps environments. Curity’s Michal Trojanowski previously wrote about the complex mesh of services comprising an API, adding that securing them is not just about authenticating the user. “A service that receives a request should validate the origin of the request. It should verify the external application that originally sent the request and use an allowlist of callers. ... Using agentless scanning of the identity repositories engineers are using and log analysis, the company first maps all the non-human identities throughout the infrastructure — Kubernetes, databases, applications, workloads, and servers. It creates what it calls attribution— a strong context of which workloads and which humans use each identity, including an understanding its dependencies. Mapping ownership of the various identities also is key. “Think about organizations that have thousands of developers. Security teams sometimes find issues but don’t know how to solve them because they don’t know who to talk with,” Apelblat said.

The limitations of model fine-tuning and RAG

Several factors limit what LLMs can learn via RAG. The first factor is the token allowance. With the undergrads, I could introduce only so much new information into a timed exam without overwhelming them. Similarly, LLMs tend to have a limit, generally between 4k and 32k tokens per prompt, which limits how much an LLM can learn on the fly. The cost of invoking an LLM is also based on the number of tokens, so being economical with the token budget is important to control the cost. The second limiting factor is the order in which RAG examples are presented to the LLM. The earlier a concept is introduced in the example, the more attention the LLM pays to it in general. While a system could reorder retrieval augmentation prompts automatically, token limits would still apply, potentially forcing the system to cut or downplay important facts. To address that risk, we could prompt the LLM with information ordered in three or four different ways to see if the response is consistent. ... The third challenge is to execute retrieval augmentation such that it doesn’t diminish the user experience. If an application is latency sensitive, RAG tends to make latency worse.

Quote for the day:

"What you do makes a difference, and you have to decide what kind of difference you want to make." -- Jane Goodall

Daily Tech Digest - February 13, 2024

Advanced Microsegmentation Strategies for IT Leaders

Microsegmentation, and network segmentation in general, is a 50-year-old cybersecurity strategy that “involves dividing a network into smaller zones to enhance security by restricting the movement of a threat to an isolated segment rather than to the whole network,” says Guy Pearce, a member of the ISACA Emerging Trends Working Group. ... Moyle says that any segmentation (micro or otherwise) can be “part of a security strategy based on use case, architecture and other factors.” He notes that microsegmentation itself isn’t an end goal for security, and that IT leaders should instead see it as “a mechanism that’s part of a broader holistic strategy.” That said, many factors go into a successful microsegmentation implementation, namely careful planning. Microsegmentation goes hand in hand with setting up granular security policies. It also relies on continuous monitoring, evaluation and user education awareness, Pearce says. Successful microsegmentation also requires automation, incident response orchestration and cross-team collaboration. None of that is sustainable without a solid, well-maintained network architecture map.

Could DC win the new data center War of the Currents?

Fundamentally, electronics use DC power. The chips and circuit boards are all powered by direct current, and every computer or other piece of IT equipment that is plugged into the AC mains has to have a “power supply unit” (PSU), also known as a rectifier or switched mode power supply (SMPS) inside the box, turning the power from AC to DC. ... Data centers have an Uninterruptible Power Supply (UPS) designed to power the facility for long enough for generators to fire up. The UPS has to have a large store of batteries, and they are powered by DC. So power enters the data center as AC, is converted to DC to charge the batteries, and then back to AC for distribution to the racks. ... Data centers are now looking at using microgrids for power. That means drawing on-site energy directly from sources such as fuel cells and solar panels. As it turns out, those sources often conveniently produce direct current. A data center could be isolated from the AC grid, and live on its own microgrid. On that grid DC power sources charge batteries, and power electronics which fundamentally run on DC. In that situation, the idea of switching to AC for a short loop around the facility begins to look, well, odd.

5 key metrics for IT success

When merged, speed, quality, and value metrics are essential for any organization undergoing transformation and looking to move away from traditional project management approaches, says Sheldon Monteiro, chief product officer at digital consulting firm Publicis Sapient. “This metric isn’t limited to a specific role or level within an IT organization,” he explains. “It’s relevant for everyone involved in the product development process.” Speed, quality, and value metrics represent a shift from traditional project management metrics focused on time, scope, and cost. “Speed ensures the ability to respond swiftly to change, quality guarantees that changes are made without compromising the integrity of systems, and value ensures that the changes contribute meaningfully to both customers and the business,” Monteiro says. “This holistic approach aligns IT practices with the demands of a continuously evolving landscape.” Focusing on speed, quality, and value provides a more nuanced understanding of an organization’s adaptability and effectiveness. “Focusing on speed, quality, and value provides insights into an organization’s ability to adapt to continuous change,” Monteiro says.

The future of cybersecurity: Anticipating changes with data analytics and automation

In recent years, cybersecurity threats have undergone a notable evolution, marked by the subtler tactics of mature threat actors who now leave fewer artifacts for analysis. The old metaphor ‘looking for a needle in a haystack’ (to describe the detection of malicious activity) is now more akin to ‘looking for a needle in a stack of needles.’ This shift necessitates the establishment of additional context around suspicious events to effectively differentiate legitimate from illegitimate activities. Automation emerges as a pivotal element in providing this contextual enrichment, ensuring that analysts can discern relevant circumstances amid the rapid and expansive landscape of modern enterprises. The landscape of cyber threats continues to further evolve, and recent high-profile data breaches underscore the gravity of the shift. In response to these challenges, data analytics and automation play a crucial role in detecting lateral movement, privilege escalation, and exfiltration, particularly when threat actors exploit zero-day vulnerabilities to gain entry into an environment.

Significance of protecting enterprise data

In a world where data fuels innovation and growth, protecting enterprise data is not optional; it’s essential. The digital age has ushered in a complex threat landscape, necessitating a multifaceted approach to data protection. From next-gen SOCs and application security to IAM, data privacy, and collaboration with SaaS providers, every aspect plays a vital role. As traditional security tools and firewalls are no longer sufficient to detect and respond to modern threats, next-generation security operations centres (SOCs) can play a proactive role by leveraging technologies like AI, machine learning, and user behavior analytics. They can analyse huge volumes of data in real-time to detect even the most well-hidden attacks. Early detection and quick response are crucial to minimise damage from security incidents. Next-gen SOCs play a pivotal role in safeguarding enterprises by enhancing visibility, shortening response times, and reducing security risks. Protecting applications is equally important, as in the digital age, applications are the conduit through which data flows. Many successful breaches target exploitable vulnerabilities residing in the application layer, indicating the need for enterprise IT departments to be extra vigilant about application security.

A changing world requires CISOs to rethink cyber preparedness

A cybersecurity posture that is societally conscious equally requires adopting certain underlying assumptions and taking preparatory actions. Foremost among these is the recognition that neutrality and complacency are anathema to one another in the context of digital threats stemming from geopolitical tension. As I recently wrote, the inherent complexity and significance of norm politicking in international affairs leads to risk that impacts cybersecurity stakeholders in nonlinear fashion. Recent conflicts support the idea that civilian hacking around major geopolitical fault lines, for instance, operates on divergent logics of operations depending on the phase of conflict that is underway. The result of such conditions should not be a reluctance to make statements or take actions that avoid geopolitical relevance. Rather, cybersecurity stakeholders should clearly and actively attempt to delineate the way geopolitical threats and developments reflect the security objectives of the organization and its constituent community. They should do so in a way that is visible to that community.

AI-powered 6G wireless promises big changes

According to Will Townsend, an analyst at Moor Insights & Strategy, things are accelerating more quickly with 6G than 5G did at the same point in its evolution. And speaking of speeds, that will also be one of the biggest and most transformative improvements of 6G over 5G, due to the shift of 6G into the terahertz spectrum range, Townsend says. “This will present challenges because it’s such a high spectrum,” he says. “But you can do some pretty incredible things with instantaneous connectivity. With terahertz, you’re going to get near-instantaneous latency, no lag, no jitter. You’re going to be able to do some sensory-type applications.” ... The new 6G spectrum also brings another benefit – an ability to better sense the environment, says Spirent’s Douglas. “The radio signal can be used as a sensing mechanism, like how sonar is used in submarines,” he says. That can allow use cases that need three-dimensional visibility and complete visualization of the surrounding environment. “You could map out the environment – the shops, buildings, everything – and create a holistic understanding of the surroundings and use that to build new types of services for the market,” Douglas says.

What distinguishes data governance from information governance?

Data governance is primarily concerned with the proper management of data as a strategic asset within an organization. It emphasizes the accuracy, accessibility, security, and consistency of data to ensure that it can be effectively used for decision-making and operations. On the other hand, information governance encompasses a broader spectrum, dealing with all forms of information, not just data. It includes the management of data privacy, security, and compliance, as well as the handling of business processes related to both digital and physical information. ... Implementing data governance ensures that an organization's data is accurate, accessible, and secure, which is vital for operational decision-making and strategic planning. This governance type establishes the necessary protocols and standards for data quality and usage. Information governance, by managing all forms of information, helps organizations comply with legal and regulatory requirements, reduce risks, and enhance business efficiency and effectiveness. It also addresses the management of redundant, outdated, and trivial information, which can lead to cost savings and improved organizational performance.

The Future Is AI, but AI Has a Software Delivery Problem

As more developers become comfortable building AI-powered software, Act Three will trigger a new race: the ability to build, deploy and manage AI-powered software at scale, which requires continuous monitoring and validation at unprecedented levels. This is why crucial DevOps practices for delivering software at scale, like continuous integration and continuous delivery (CI/CD), will play a central role in providing a robust framework for engineering leaders to navigate the complexities of delivering AI-powered software — therefore turning these technological challenges into opportunities for innovation and competitive advantage. Just as software teams have honed practices for getting reliable, observable, available applications safely and quickly into customers’ hands at scale, AI-powered software is yet again evolving these methods. We’re experiencing a paradigm shift from the deterministic outcomes we’ve built software development practices around to a world with probabilistic outcomes. This complexity throws a wrench in the conventional yes-or-no logic that has been foundational to how we’ve tested software, requiring developers to navigate a variety of subjective outcomes.

Generative AI – Examining the Risks and Mitigations

In working with AI, we should be helping executives in the companies we are working with to understand these risks and also the potential applications and innovations that can come from Generative AI. That is why it is essential that we take a moment now to develop a strategy for dealing with Generative AI. By developing a strategy, you will be well positioned to reap the benefits from the capabilities, and will be giving your organization a head-start in managing the risks. When looking at the risks, companies can feel overwhelmed or decide that it represents more trouble than they are willing to accept and may take the stance of banning GenAI. Banning GenAI is not the answer, and will only lead to a bypassing of controls and more shadow IT. So, in the end, they will use the technology but won’t tell you. ... AI risks can be broadly categorized into three types: Technical, Ethical, and Social. Technical risks refer to the potential failures or errors of AI systems, such as bugs, hacking, or adversarial attacks. Ethical risks refer to the moral dilemmas or conflicts that arise from the use or misuse of AI, such as bias, discrimination, or privacy violations. Social risks refer to the impacts of AI on human society and culture, such as unemployment, inequality, or social unrest.

Quote for the day:

"In the end, it is important to remember that we cannot become what we need to be by remaining what we are." -- Max De Pree