Daily Tech Digest by Kannan Subbiah: AI skills

Showing posts with label AI skills. Show all posts

Daily Tech Digest - May 09, 2026

Quote for the day:

“Leaders become great not because of their power, but because of their ability to empower others.” -- John C. Maxwell

🎧 Listen to this digest on YouTube Music

▶ Play Audio Digest

Duration: 22 mins • Perfect for listening on the go.

API-First architecture: The backbone of modern enterprise innovation

Pankaj Tripathi explains that API-first architecture has evolved from a technical choice into a strategic leadership mandate essential for digital survival and modern enterprise innovation. By prioritizing Application Programming Interfaces as the core of strategic ecosystems, organizations can achieve greater agility, seamless scaling, and faster time-to-market metrics. This methodology effectively decouples front-end user experiences from back-end logic, fostering a modular environment that allows for the integration of sophisticated capabilities without the heavy burden of legacy technical debt. In sectors like banking, travel, and retail, this approach facilitates interoperability and unified digital experiences, as evidenced by the massive success of India’s UPI and Open Government Data platforms. Furthermore, API-first design is a critical prerequisite for deploying advanced artificial intelligence at scale, as it eliminates data silos and ensures that AI agents can consume the continuous flow of clean data required for real-time insights. This architecture also supports operational resilience, allowing individual microservices to scale independently during demand surges without stressing the broader system. Transitioning to this model requires a cultural shift toward managing product-centric digital ecosystems that leverage third-party integrations as growth multipliers. Ultimately, embracing an API-first framework provides the structural integrity required to dismantle internal barriers and deliver the exceptional, connected experiences that define modern market leadership in an increasingly complex global economy.

5,000 vibe-coded apps just proved shadow AI is the new S3 bucket crisis

The VentureBeat article details how "vibe coding"—the practice of using natural language AI prompts to build applications—has sparked a significant security crisis, drawing parallels to the notorious S3 bucket exposures of a decade ago. Research by RedAccess and Escape.tech revealed that over 5,000 AI-generated applications are currently exposing sensitive corporate and personal data, including medical records and financial details. This vulnerability stems from popular platforms like Lovable and Replit having public-by-default privacy settings, which allow search engines to index internal tools created by non-technical "citizen developers" without proper access controls. Gartner predicts that by 2028, these prompt-to-app approaches will increase software defects by 2,500%, primarily through code that is syntactically correct but contextually flawed. Shadow AI is identified as a massive financial liability, with IBM reporting that breaches linked to unsanctioned AI tools cost organizations an average of $4.63 million per incident. To combat these risks, the article outlines a comprehensive five-domain CISO audit framework focusing on discovery, authentication, code scanning, data loss prevention, and governance. This strategy emphasizes moving beyond mere gatekeeping to implementing automated inventorying and strict identity management. CISOs are urged to adopt a structured remediation plan to secure their AI environments, ensuring that rapid innovation does not compromise fundamental security hygiene.

How Goldman Sachs, JPMorgan, AIG Are Actually Deploying AI

The article details insights from leaders at Goldman Sachs, JPMorgan Chase, and AIG regarding their strategic deployment of artificial intelligence, particularly following Anthropic’s launch of specialized financial agents. At an event in New York, Goldman Sachs CIO Marco Argenti outlined a three-wave adoption strategy focusing on engineering productivity, operational redesign, and enhanced risk decision-making. He notably described the shift as a transition from purchasing infrastructure to "buying intelligence." JPMorgan Chase CIO Lori Beer stressed that the primary hurdle is not the technology itself but an organization’s capacity to absorb and integrate these tools effectively. CEO Jamie Dimon highlighted Claude’s efficiency, noting it completed accurate research tasks in twenty minutes that typically require forty analyst hours. Meanwhile, AIG CEO Peter Zaffino revealed that AI achieved eighty-eight percent accuracy in insurance claims processing, emphasizing its role in supporting human expertise rather than replacing it. The discussion coincided with Anthropic’s debut of ten pre-built agents designed for high-value workflows like pitchbook creation and KYC screening. Additionally, the article covers a one-point-five billion dollar joint venture between Anthropic, Blackstone, and Goldman Sachs aimed at scaling AI for mid-sized firms. Ultimately, these leaders view AI as a fundamental shift in financial services, demanding both rigorous safety guardrails and profound cultural transformation.

The agentic enterprise will be built on people, not just intelligence; here's how

The shift toward the agentic enterprise signifies a transition where artificial intelligence moves beyond generating insights to autonomous execution and machine-led workflows. While this evolution sparks concerns regarding employee relevance, the article emphasizes that the success of such enterprises hinges more on human readiness than technological intelligence. As AI assumes more execution-oriented tasks, uniquely human capabilities—such as navigating ambiguity, exercising ethical judgment, and managing complex relationships—become increasingly vital. India is positioned as a global leader in this transition due to its high AI talent acquisition and literate workforce. To thrive, organizations must prioritize building an agentic-ready workforce by embedding transformation directly into technology adoption rather than treating it as a separate initiative. This involves fostering a culture of inquiry and psychological safety where experimentation is encouraged. Training should focus on elevating judgment and discretion, particularly in high-stakes areas like strategy and hiring. Ultimately, the most resilient professionals will be those who develop versatile skills that transcend specific tools, while the most successful companies will be those that empower their people to lead alongside AI. By centering human intuition and leadership, the agentic enterprise can effectively balance automated efficiency with the critical oversight necessary for long-term organizational trust and cultural integrity.

AI on trial: The Workday case that CIOs can't ignore

The article "AI on Trial: The Workday Case That CIOs Can’t Ignore" explores the legal battle in Mobley v. Workday Inc., where over 14,000 job applicants over age 40 allege that Workday’s AI-driven recruitment tools caused systematic discrimination. The lawsuit challenges how antidiscrimination laws apply to algorithms that score and rank candidates, placing the vendor’s liability under intense scrutiny. Workday maintains that employers, not the software provider, remain in control of hiring decisions and that their technology focuses strictly on qualifications. However, the case highlights a critical technical dispute over bias detection mathematics, specifically comparing the “four-fifths rule” against standard-deviation analysis. This conflict underscores why Chief Information Officers (CIOs) can no longer rely solely on vendor-provided audits, which may suffer from “drift” or lack independent criteria. The article advises CIOs to establish robust internal oversight committees comprising technical, legal, and ethics experts to independently validate AI outputs. As political environments shift and legal risks surrounding "disparate impact" theories grow, the Workday case serves as a landmark warning. Organizations must move beyond passive trust in AI vendors, adopting proactive governance strategies to ensure their automated hiring processes remain fair, transparent, and legally defensible in an increasingly litigious landscape.

The “Context Poisoning” Crisis: Why Metadata Is the New Security Perimeter

The article "The ‘Context Poisoning’ Crisis: Why Metadata Is the New Security Perimeter" by Sriramprabhu Rajendran explores the emerging threat of context poisoning within agentic AI and retrieval-augmented generation (RAG) pipelines. Context poisoning occurs when AI agents utilize information that is technically valid but semantically incorrect, often due to stale data vectors, recursive hallucinations from agent-generated content, or amplified semantic bias. Unlike traditional cybersecurity, which focuses on access controls and encryption at the network perimeter, this crisis targets the metadata layer where AI systems consume their grounding context. To mitigate these risks, the author proposes a "metadata firebreak" rooted in zero-trust principles. This architecture serves as a critical verification layer that validates every piece of retrieved context before it enters the AI agent’s processing window. The framework is built on four essential pillars: never trusting retrieved chunks by default, continuously verifying data freshness against original source timestamps, enforcing lineage tracking to prevent recursive feedback loops, and applying semantic checksums to maintain truth. Ultimately, as AI agents become integral to enterprise operations, the security focus must shift from merely controlling access to ensuring data veracity. By establishing metadata as the new security perimeter, organizations can ensure that AI-driven decisions remain accurate, compliant, and trustworthy in a complex digital environment.

Three skills that matter when AI handles the coding

In the rapidly evolving landscape where artificial intelligence increasingly manages the mechanical aspects of software development, the value of a developer's expertise is shifting toward higher-level strategic functions. This InfoWorld article argues that as large language models take over the heavy lifting of code generation, three specific "upstream" skills are becoming indispensable for modern engineers. First, developers must master the art of providing precise context; this involves crystallizing complex requirements, architectural designs, and functional constraints into detailed prompts that guide the AI effectively. Second, the ability to critically evaluate and verify model outputs remains crucial. Since AI can produce confident yet incorrect solutions, developers need the technical depth to review generated code against rigorous performance standards and existing frameworks. Finally, deep problem understanding is essential to ensure that the developer is not misled by plausible hallucinations or "confident but wrong" answers. By focusing on these core competencies, teams can leverage AI to accelerate iterative lifecycles, such as spiral development and evolutionary prototyping, while maintaining absolute control over system complexity. Ultimately, those who transition from manual coding to high-level system design and rigorous evaluation will achieve significantly higher productivity, while those failing to adapt risk being left behind in an increasingly competitive AI-driven industry.

Implementing the Sidecar Pattern in Microservices-based ASP.NET Core Applications

In the article "Implementing the Sidecar Pattern in Microservices-based ASP.NET Core Applications," author Joydip Kanjilal explores how the sidecar design pattern effectively addresses cross-cutting concerns like logging, monitoring, and security. By deploying these auxiliary tasks into a separate container or process that runs alongside the primary application, developers can decouple business logic from infrastructure requirements, thereby significantly reducing complexity and enhancing overall maintainability. The author provides a practical implementation walkthrough using an inventory management system where a Transactions API offloads log persistence to a shared file system. A dedicated Sidecar API then monitors this shared storage, processes the incoming logs, and transmits them to Elasticsearch for analysis. This architectural approach facilitates language-agnostic components and allows for the independent scaling of auxiliary services without requiring modifications to the core application code. However, the article highlights significant trade-offs, such as increased resource overhead and potential latency resulting from additional network hops, which may make it less suitable for ultra-latency-sensitive workloads. Furthermore, Kanjilal discusses modern alternatives like the Distributed Application Runtime (Dapr) and potential enhancements through structured logging with Serilog or observability via OpenTelemetry. Ultimately, the sidecar pattern emerges as a robust solution for building modular and resilient microservices in the ASP.NET Core ecosystem while keeping individual services lightweight.

What is Quantum Machine Learning (QML)?

Quantum Machine Learning (QML) represents a transformative convergence of quantum computing and artificial intelligence, leveraging quantum mechanical phenomena to solve complex data-driven problems. The article explores how QML utilizes qubits, which exist in superpositions of states, and entanglement to achieve computational parallelism beyond the reach of classical bits. As of May 2026, the field is firmly rooted in the "Noisy Intermediate-Scale Quantum" (NISQ) era, where advanced hardware like IBM’s Nighthawk and Google’s Willow processors facilitate hybrid workflows. In these systems, classical computers handle data preprocessing and optimization while quantum circuits perform the most computationally intensive subroutines, such as feature mapping in high-dimensional spaces. This synergy is particularly potent for Variational Quantum Algorithms (VQAs) and Quantum Neural Networks (QNNs), which are currently being piloted for drug discovery, financial risk modeling, and advanced materials science. Despite the promise of exponential speedups, the article notes significant hurdles, including qubit decoherence, extreme cooling requirements, and the necessity for more robust error correction. Nevertheless, the transition from theoretical research to early commercial pilots suggests that QML is poised to revolutionize industries by identifying patterns and correlations that remain invisible to traditional machine learning models, eventually paving the way for full-scale fault-tolerant systems by the end of the decade.

The case for data centers in space

The McKinsey article examines the emerging potential of space-based data centers as a strategic solution to the escalating energy and infrastructure constraints hindering terrestrial AI development. As global demand for AI compute skyrockets, traditional land-based facilities face significant hurdles, including lengthy permitting timelines, limited power grid capacity, and the high environmental costs of terrestrial energy production. In contrast, orbital data centers utilize space-qualified hardware modules powered by near-continuous solar energy, effectively bypassing the logistical bottlenecks found on Earth. While current deployment remains more expensive than terrestrial alternatives due to high launch costs, the economics are projected to reach a competitive tipping point once launch prices drop to approximately $500 per kilogram. Philip Johnston, CEO of Starcloud, highlights that these orbital platforms are particularly suited for AI inference workloads where latency requirements—typically staying below 200 milliseconds—are easily met for applications like search queries, chatbots, and back-office automation. Primary customers include hyperscalers and neocloud providers seeking to scale rapidly without traditional energy limitations. Despite remaining technical uncertainties regarding long-term reliability and replacement cycles, the transition of data centers from a terrestrial concept to an orbital reality offers a compelling pathway for unconstrained energy scaling and sustainable high-performance computing in the AI era.

Daily Tech Digest - April 21, 2026

Quote for the day:

“The first step toward success is taken when you refuse to be a captive of the environment in which you first find yourself.” -- Mark Caine

🎧 Listen to this digest on YouTube Music

▶ Play Audio Digest

Duration: 19 mins • Perfect for listening on the go.

Living off the Land attacks pose a pernicious threat for enterprises

"Living off the Land" (LOTL) attacks represent a sophisticated evolution in cybercraft where adversaries eschew traditional malware in favor of weaponizing an enterprise's own legitimate administrative tools. By exploiting native utilities like PowerShell, Windows Management Instrumentation, and various scripting frameworks, attackers can blend seamlessly into routine operational traffic, effectively hiding in plain sight. This stealthy approach allows threat actors—including advanced persistent groups like —to move laterally, escalate privileges, and exfiltrate data without triggering conventional signature-based security alerts. The article highlights that critical infrastructure and financial institutions are particularly vulnerable because they cannot simply disable these essential tools without disrupting vital services. To counter this pernicious threat, CIOs must pivot from reactive, perimeter-centric models toward strategies emphasizing behavioral context and intent. Effective defense requires a combination of rigorous tool hardening, such as enforcing signed scripts and least privilege access, alongside continuous monitoring that analyzes the timing and sequence of administrative actions. Furthermore, empowering security operations teams to engage in proactive threat hunting is essential for identifying the subtle patterns indicative of malicious activity. Ultimately, as attackers increasingly use the environment’s own rules against it, resilience depends on understanding normal operational behavior to distinguish legitimate management from stealthy, long-term intrusion.

UK firms are grappling with mismatched AI productivity gains – employees are more efficient

The , as detailed by IT Pro, highlights a significant "productivity gap" where individual AI adoption is surging while organizational performance remains stagnant. Although nearly 18% of UK employees now utilize daily to improve their output quality and speed, only 10% of organizations have successfully scaled the technology into their core operations. This disconnect stems from a failure to redesign underlying workflows and systems; most companies are merely applying AI to isolated tasks rather than overhauling entire processes. Furthermore, a strategic mismatch exists between leadership and staff: while executives often prioritize cost reduction and short-term efficiency, workers are leveraging AI to enhance the value and creativity of their work. Looking ahead, the report identifies "" as a potential breakthrough capable of augmenting 82% of working hours, yet 58% of executives admit their legacy IT infrastructure is unprepared for such advanced integration. To bridge this gap and unlock significant economic value, Accenture suggests that businesses must move beyond mere experimentation. Success requires a holistic "reinvention" strategy that integrates a robust digital core, comprehensive workforce reskilling, and a shift in focus toward long-term revenue growth rather than simple automation-driven savings.

The backup myth that is putting businesses at risk

The article "The Backup Myth That Is Putting Businesses at Risk" highlights a dangerous misconception: the belief that simply having data backups ensures business safety. While backups are essential for data preservation, they do not prevent the operational paralysis caused by system downtime. This distinction is critical because downtime is incredibly costly, with research from suggesting it can cost businesses approximately $9,000 per minute. Traditional backup solutions often require hours or even days to fully restore systems, leading to significant financial losses and damaged customer reputations. To mitigate these risks, the article advocates for a comprehensive Business Continuity and Disaster Recovery (BCDR) strategy. Unlike basic backups, BCDR solutions facilitate rapid recovery—often within minutes—by utilizing virtualized environments and hybrid cloud architectures. This proactive approach combines local speed with cloud-based resilience, allowing operations to continue seamlessly while primary systems are repaired in the background. Ultimately, the article encourages organizations and Managed Service Providers (MSPs) to shift their focus from technical specifications to tangible business outcomes. By quantifying the financial impact of potential disruptions and prioritizing continuity over mere data storage, businesses can better protect their revenue, reputation, and long-term stability in an increasingly volatile digital landscape.

DPDP rules vs. employee AI usage: Are Indian companies prepared?

emphasizes organizational accountability, consent, and strict control over personal data, yet many Indian companies face a compliance gap due to the rise of "." Employees are organically adopting generative AI tools for productivity, often bypassing formal IT policies and creating invisible data risks. Since the DPDP Act holds organizations responsible for data processing, the use of external AI tools to handle sensitive information—without oversight—poses significant legal and reputational threats. Key challenges include a lack of visibility into data transfers, the absence of AI-specific governance frameworks, and reliance on consumer-grade tools that lack enterprise-level security. To address these vulnerabilities, leadership must shift from restrictive policies to proactive behavioral change. This involves implementing cloud-native architectures that centralize access control, providing sanctioned AI alternatives, and educating staff on purpose limitation. CFOs and CIOs must align to manage financial and operational risks, treating AI governance as essential digital hygiene rather than a future checkbox. Ultimately, true preparedness lies in establishing robust foundations that allow for innovation while ensuring strict adherence to evolving regulatory standards, thereby safeguarding against the potential for high penalties and data misuse in an increasingly AI-driven workplace.

Cloud Complexity: How To Simplify Without Sacrificing Speed

In the modern digital landscape, managing cloud complexity without compromising operational speed is a critical challenge for technology leaders. This Forbes Technology Council article outlines several strategic approaches to streamlining multicloud environments while maintaining agility. Central to these recommendations is the adoption of , which emphasizes creating unified, self-service platforms with embedded guardrails and standardized templates. By leveraging automation and machine learning instead of static dashboards, organizations can enforce security and governance at scale, allowing developers to focus on innovation rather than infrastructure bottlenecks. Furthermore, experts suggest starting with simple Infrastructure as Code (IaC) to avoid overengineering and utilizing distributed databases with open APIs to abstract away underlying complexities. Stabilizing critical systems and resisting unnecessary upgrade cycles can also prevent self-inflicted chaos and operational disruption. Additionally, creating shared architectural foundations and clearly separating roles—specifically between explorers, builders, and operators—ensures that experimentation does not undermine stability. Ultimately, by standardizing on a unified platform layer and fostering a culture of machine-enforced discipline, enterprises can overcome the traditional trade-offs between speed and governance. This holistic approach allows teams to scale effectively, ensuring that infrastructure complexity serves as a foundation for innovation rather than a bottleneck to performance.

Compensation vs. Burnout: The New Retention Calculus for Cybersecurity Leaders

The reveals a profession in turmoil, where only 34% of cybersecurity professionals plan to remain in their current roles. This mass turnover is primarily driven by escalating workloads and stagnant budgets, which have pushed job satisfaction to significant lows. While compensation remains a critical lever—with median salaries ranging from $113,000 for analysts to over $256,000 for functional leaders—the article emphasizes that financial rewards alone are no longer sufficient to ensure long-term retention. Organizations with higher revenues and public listings often provide a significant pay premium, yet even modest salary adjustments can notably increase employee loyalty across the board. However, the true "new calculus" for retention involves addressing the severe mental health strain and burnout affecting the industry, particularly for CISOs who shoulder immense emotional burdens. As artificial intelligence begins to reshape technical roles and productivity, business leaders must pivot from viewing burnout as a personal failing to recognizing it as a strategic organizational risk. Sustaining a resilient workforce now requires integrating formal wellness support, such as mandatory downtime and rotation-based on-call models, into core security programs to balance the intense pressures of preventing the unpreventable in a complex digital landscape.

AI-ready skills are not what you think

The Computerworld article "AI-ready skills are not what you think" highlights a fundamental shift in how enterprises approach workforce preparation for the artificial intelligence era. While early training programs prioritized technical maneuvers like prompt engineering and basic chatbot interactions, these tool-specific skills are quickly becoming obsolete as models evolve. Instead, true AI readiness is defined by durable human capabilities such as critical thinking, data literacy, and independent judgment. The core challenge is no longer teaching employees how to interact with AI, but rather how to supervise it. This includes output validation, systems thinking, and the ability to translate machine-generated insights into meaningful business actions. Crucially, as AI moves from experimental environments into high-stakes operational workflows involving regulatory risk or customer trust, human oversight becomes the primary safeguard. Experts emphasize that technical proficiency must be paired with "human edge" skills like problem framing and storytelling to remain effective. Furthermore, organizational success depends on leadership redefining accountability, ensuring that while AI accelerates analysis, humans remain responsible for final decisions and guardrails. Ultimately, the most valuable skills in an automated world are those that allow professionals to question, validate, and integrate AI outputs into complex business processes effectively and ethically.

Event-Driven Patterns for Cloud-Native Banking - What Works, What Hurts?

In this presentation, explores the architectural patterns essential for building robust and reliable payment systems, drawing from his extensive experience in infrastructure engineering. The core challenge in payment processing is maintaining absolute data integrity and consistency across distributed systems where failure is inevitable. Sougoumarane emphasizes the critical role of , explaining how unique keys prevent duplicate transactions and ensure that retrying a failed operation does not result in double charging. He also discusses the importance of using finite state machines to manage the complex lifecycle of a payment, moving away from monolithic logic toward more manageable, discrete transitions. Furthermore, the session delves into the necessity of immutable ledgers for auditability and the "transactional outbox" pattern to ensure atomicity between database updates and external message queuing. By treating every payment as a formal state transition and prioritizing crash recovery over error prevention, developers can build systems that remain consistent even during network partitions or database outages. Ultimately, the presentation provides a blueprint for distributed consistency in financial contexts, advocating for decoupled services that rely on verifiable proofs of state rather than fragile, long-running distributed locks or manual intervention.

CISOs reshape their roles as business risk strategists

The role of the Chief Information Security Officer (CISO) is undergoing a fundamental transformation from a technical silo to a core business risk management function. Driven largely by the rapid integration of artificial intelligence, which intertwines security directly with operational processes, the modern CISO must now operate as a strategic partner rather than just a technologist. This shift requires moving beyond traditional metrics of application security to a language of enterprise-wide risk, involving financial impact, market growth, and competitive positioning. According to the article, the arrival of generative and agentic AI has made digital and business risks virtually synonymous, forcing security leaders to quantify how mitigation strategies align with overall corporate objectives. Consequently, corporate boards now expect CISOs to provide nuanced advice on whether to accept, transfer, or mitigate specific threats based on the organization’s unique risk tolerance. While many CISOs still struggle with this transition due to their technical engineering backgrounds, the new leadership profile demands proactive engagement with external peers and vendors to inform long-term strategy. Ultimately, the successful "business CISO" is one who moves from a reactive, fear-based compliance mindset to a strategic stance that actively accelerates growth while ensuring robust organizational resilience and stability.

Cloudflare wants to rebuild the network for the age of AI agents

Cloudflare is actively reshaping the global network to accommodate the rise of autonomous AI software through a series of infrastructure updates announced during its "Agents Week" event. Recognizing that traditional networking and security models—designed primarily for human interactive logins—often fail for ephemeral, autonomous processes, the company introduced Cloudflare Mesh. This private networking fabric provides AI agents with a shared private IP space and bidirectional reachability, replacing the manual friction of VPNs and multi-factor authentication with seamless, scoped access to private infrastructure. Beyond connectivity, Cloudflare is empowering agents with essential administrative capabilities, such as the new Registrar API for domain management and an integrated Email Service for outbound and inbound communications. To further support agentic workflows, the company launched "Agent Memory" to preserve conversation context and "Artifacts" for Git-compatible versioned storage. Additionally, a new Agent Readiness Index allows organizations to evaluate how effectively their web presence supports these non-human visitors. By integrating these services into its existing edge network, Cloudflare aims to treat AI agents as first-class citizens, creating a secure and highly scalable control plane that balances the performance needs of automated systems with the stringent security requirements of modern enterprise environments.

Daily Tech Digest - January 21, 2026

Quote for the day:

"People ask the difference between a leader and a boss. The leader works in the open, and the boss in covert." -- Theodore Roosevelt

Why the future of security starts with who, not where

Traditional security assumed one thing: “If someone is inside the network, they can be trusted.” That assumption worked when offices were closed environments and systems lived behind a single controlled gateway. But as Microsoft highlights in its Digital Defense Report, attackers have moved almost entirely toward identity-based attacks because stealing credentials offers far more access than exploiting firewalls. In other words, attackers stopped trying to break in. They simply started logging in. ... Zero trust isn’t about paranoia. It’s about verification. Never trust, always verify only works if identity sits at the center of every access decision. That’s why CISA’s zero trust maturity model outlines identity as the foundation on which all other zero trust pillars rest — including network segmentation, data security, device posture and automation. ... When identity becomes the perimeter, it can’t be an afterthought. It needs to be treated like core infrastructure. ... Organizations that invest in strong identity foundations won’t just improve security — they’ll improve operations, compliance, resilience and trust. Because when identity is solid, everything else becomes clearer: who can access what, who is responsible for what and where risk actually lives. The companies that struggle will be the ones trying to secure a world that no longer exists — a perimeter that disappeared years ago.

Designing Consent Under India's DPDP Act: Why UX Is Now A Legal Compliance

The request for consent must be either accompanied by or preceded by a notice. The notice must specifically contain three things: personal data and purpose for which it is being collected; the manner in which he or she may withdraw consent or make grievance; and the manner in which the complaint may be made to the board. ... “Free” consent also requires interfaces to avoid deceptive nudges or coercive UI design. Consider a consent banner implemented with a large “Accept All” button as the primary call-to-action button while the “Reject” option is kept hidden behind a secondary link that opens multiple additional screens. This creates an asymmetric interaction cost where acceptance requires a single click and refusal demands several steps. If consent is obtained through such interface, it cannot be regarded as voluntary or valid. ... A defensible consent record must capture the full interaction such as which notice version was shown, what purposes were disclosed, language of the notice and the action of the user (click, toggle, checkbox). The standard operational logs might be disposed after 30 or 90 days but the consent logs cannot follow the same cycle. Section 6(10) implicitly states that consent records must be retained as long as the data is being processed for the purposes shown in the notice. If the personal data was collected in 2024 and is still being processed in 2028, the Fiduciary must produce the 2024 consent logs as evidence.

The AI Skills Gap Is Not What Companies Think It Is

Employers often say they cannot find enough AI engineers or people with deep model expertise to keep pace with AI adoption. We can see that in job descriptions. Many blend responsibilities across model development, data engineering, analytics, and production deployment into a single role. These positions are meant to accelerate progress by reducing handoffs and simplifying ownership. And in an ideal world, the workforce would be ready for this. ... So when companies say they are struggling to fill the AI skills gap, what they are often missing is not raw technical ability. They are missing people who can operate inside imperfect environments and still move AI work forward. Most organizations do not need more model builders. ... For professionals trying to position themselves, the signal is similar. Career advantage increasingly comes from showing end-to-end exposure, not mastery of every AI tool. Experience with data pipelines, deployment constraints, and being able to monitor systems matter. Being good at stakeholder communication remains an important skill. The AI skills gap is not a shortage of talent. It is a shortage of alignment between what companies need and what they are actually hiring for. It’s also an opportunity for companies to understand what it really means, and finally close the gap. Professionals can also capitalize on this opportunity by demonstrating end-to-end, applied AI experience.

DevOps Didn’t Fail — We Just Finally Gave it the Tools it Deserved

Ask an Ops person what DevOps success looks like, and you’ll hear something very close to what Charity is advocating: Developers who care deeply about reliability, performance, and behavior in production. Ask security teams and you’ll get a different answer. For them, success is when everyone shares responsibility for security, when “shift left” actually shifts something besides PowerPoint slides. Ask developers, and many will tell you DevOps succeeded when it removed friction. When it let them automate the non-coding work so they could, you know, actually write code. Platform engineers will talk about internal developer platforms, golden paths, and guardrails that let teams move faster without blowing themselves up. SREs, data scientists, and release engineers all bring their own definitions to the table. That’s not a bug in DevOps. That’s the thing. DevOps has always been slippery. It resists clean definitions. It refuses to sit still long enough for a standards body to nail it down. At its core, DevOps was never about a single outcome. It was about breaking down silos, increasing communication, and getting more people aligned around delivering value. Success, in that sense, was always going to be plural, not singular. Charity is absolutely right about one thing that sits at the heart of her argument: Feedback loops matter. If developers don’t see what happens to their code in the wild, they can’t get better at building resilient systems.

The sovereign algorithm – India’s DPDP act and the trilemma of innovation, rights, and sovereignty

At its core, the DPDP Act functions as a sophisticated product of governance engineering. Its architecture is a deliberate departure from punitive, post facto regulation towards a proactive, principles based model designed to shape behavior and technological design from the ground up. Foundational principles such as purpose limitation, data minimization, and storage restriction are embedded as mandatory design constraints, compelling a fundamental rethink of how digital services are conceived and built. ... The true test of this legislative architecture will be its performance in the real world, measured across a matrix of tangible and intangible metrics that will determine its ultimate success or failure. The initial eighteen month grace period for most rules constitutes a critical nationwide integration phase, a live stress test of the framework’s viability and the ecosystem’s adaptability. ... Geopolitically, the framework positions India as a normative leader for the developing world. It articulates a distinct third path between the United States’ predominantly market oriented approach and China’s model of state controlled cyber sovereignty. India’s alternative, which embeds individual rights within a democratic structure while reserving state authority for defined public interests, presents a compelling model for nations across the Global South navigating their own digital transitions.

Everyone Knows How to Model. So Why Doesn’t Anything Get Modeled?

One of the main reasons modeling feels difficult is not lack of competence, but lack of shared direction. There is no common understanding of what should be modeled, how it should be modeled, or for what purpose. In other words, there is no shared content framework or clear work plan. When it is missing, everyone defaults to their own perspective and experience. ... From the outside, it looks like architecture work is happening. In reality, there is discussion, theorizing, and a growing set of scattered diagrams, but little that forms a coherent, usable whole. At that point, modeling starts to feel heavy—not because it is technically difficult, but because the work lacks direction, a shared way of describing things, and clear boundaries. ... To be fair, tools do matter. A bad or poorly introduced tool can make modeling unnecessarily painful. An overly heavy tool kills motivation; one that is too lightweight does not support managing complexity. And if the tool rollout was left half-done, it is no surprise the work feels clumsy. At the same time, a good tool only enables better modeling—it does not automatically create it. The right tool can lower the threshold for producing and maintaining content, make relationships easier to see, and support reuse. ... Most architecture initiatives don’t fail because modeling is hard. They fail because no one has clearly decided what the modeling is for. ... These are not technical modeling problems. They are leadership and operating-model problems.

ChatGPT Health Raises Big Security, Safety Concerns

ChatGPT Health's announcement touches on how conversations and files in ChatGPT as a whole are "encrypted by default at rest and in transit" and that there are some data controls such as multifactor authentication, but the specifics on how exactly health data will be protected on a technical and regulatory level was not clear. However, the announcement specifies that OpenAI partners with network health data firm b.well to enable access to medical records. ... While many security tentpoles remain in place, healthcare data must be held to the highest possible standard. It does not appear that ChatGPT Health conversations are end-to-end encrypted. Regulatory consumer protections are also unclear. Dark Reading asked OpenAI whether ChatGPT Health had to adhere to any HIPAA or regulatory protections for the consumer beyond OpenAI's own policies, and the spokesperson mentioned the coinciding announcement of OpenAI for Healthcare, which is OpenAI's product for healthcare organizations which do need to meet HIPAA requirements. ... even with privacy protections and promises, data breaches will happen and companies will generally comply with legal processes such as subpoenas and warrants as they come up. "If you give your data to any third party, you are inevitably giving up some control over it and people should be extremely cautious about doing that when it's their personal health information," she says.

From static workflows to intelligent automation: Architecting the self-driving enterprise

We often assume fragility only applies to bad code, but it also applies to our dependencies. Even the vanguard of the industry isn’t immune. In September 2024, OpenAI’s official newsroom account on X (formerly Twitter) was hijacked by scammers promoting a crypto token. Think about the irony: The company building the most sophisticated intelligence in human history was momentarily compromised not by a failure of their neural networks, but by the fragility of a third-party platform. This is the fragility tax in action. When you build your enterprise on deterministic connections to external platforms you don’t control, you inherit their vulnerabilities. ... Whenever we present this self-driving enterprise concept to clients, the immediate reaction is “You want an LLM to talk to our customers?” This is a valid fear. But the answer isn’t to ban AI; it is to architect confidence-based routing. We don’t hand over the keys blindly. We build governance directly into the code. In this pattern, the AI assesses its own confidence level before acting. This brings us back to the importance of verification. Why do we need humans in the loop? Because trusted endpoints don’t always stay trusted. Revisiting the security incident I mentioned earlier: If you had a fully autonomous sentient loop that automatically acted upon every post from a verified partner account, your enterprise would be at risk. A deterministic bot says: Signal comes from a trusted source -> execute.

AI is rewriting the sustainability playbook

At first, greenops was mostly finops with a greener badge. Reduce waste, right-size instances, shut down idle resources, clean up zombie storage, and optimize data transfer. Those actions absolutely help, and many teams delivered real improvements by making energy and emissions a visible part of engineering decisions. ... Greenops was designed for incremental efficiency in a world where optimization could keep pace with growth. AI breaks that assumption. You can right-size your cloud instances all day long, but if your AI footprint grows by an order of magnitude, efficiency gains get swallowed by volume. It’s the classic rebound effect: When something (AI) becomes easier and more valuable, we do more of it, and total consumption climbs. ... Enterprises are simultaneously declaring sustainability leadership while budgeting for dramatically more compute, storage, networking, and always-on AI services. They tell stakeholders, “We’re reducing our footprint,” while telling internal teams, “Instrument everything, vectorize everything, add copilots everywhere, train custom models, and don’t fall behind.” This is hypocrisy and a governance failure. ... Greenops isn’t dead, but it is being stress-tested by a wave of AI demand that was not part of its original playbook. Optimization alone won’t save you if your consumption curve is vertical. Rather than treat greenness as just a brand attribute, enterprises that succeed will recognize greenops as an engineering and governance discipline, especially for AI

Your AI strategy is just another form of technical debt

Modern software development has become riddled with indeterminable processes and long development chains. AI should be able to fix this problem, but it’s not actually doing so. Instead, chances are your current AI strategy is saddling your organisation with even more technical debt. The problem is fairly straightforward. As software development matures, longer and longer chains are being created from when a piece of software is envisioned until it’s delivered. Some of this is due to poor management practices, and some of it is unavoidable as programs become more complex. ... These tools can’t talk to each other, though; after all, they have just one purpose, and talking isn’t one of them. The results of all this, from the perspective of maintaining a coherent value chain, are pretty grim. Results are no longer predictable. Worse yet, they are not testable or reproducible. It’s just a set of random work. Coherence is missing, and lots of ends are left dangling. ... If this wasn’t bad enough, using all these different, single-purpose tools adds another problem, namely that you’re fragmenting all your data. Because these tools don’t talk to each other, you’re putting all the things your organisation knows into near-impenetrable silos. This further weakens your value chain as your workers, human and especially AI, need that data to function. ... Bolting AI onto existing systems won’t work. AIs aren’t human, and you can’t replace them one for one, or even five for one. It doesn’t work.

Daily Tech Digest - January 19, 2026

Quote for the day:

"Stop Judging people and start understanding people everyone's got a story" -- @PilotSpeaker

Stop calling it 'The AI bubble': It's actually multiple bubbles, each with a different expiration date

The is actually three distinct layers, each with different economics, defensibility and risk profiles. Understanding these layers is critical, because they won't all pop at once. ... The most vulnerable segment isn't building AI — it's repackaging it. These are the companies that take , add a slick interface and some , then charge $49/month for what amounts to a glorified . Some have achieved rapid initial success, like , which reached approximately $42 million in annual recurring revenue (ARR) in its first year by wrapping GPT models in a user-friendly interface for marketers. But the cracks are already showing. ... Economic researcher points to as an example of the bubble dynamic, noting that the company has made around $1 trillion in AI deals, including a $500 billion data center buildout project, despite being set to generate only $13 billion in revenue. The divergence between investment and plausible earnings "certainly looks bubbly," Bernstein notes. ... But infrastructure has a critical characteristic: It retains value regardless of which specific applications succeed. The fiber optic cables laid during the dot-com bubble weren’t wasted — they enabled YouTube, Netflix and cloud computing. Twenty-five years ago, the original dot-com bubble burst after debt financing built out fiber-optic cables for a future that had not yet arrived, but that future eventually did arrive, and the infrastructure was there waiting.

Modernizing Network Defense: From Firewalls to Microsegmentation

For many years, has been based on the concept of a perimeter defense, likened to a fortified boundary. The functioned as a protective barrier, with a serving as the main point of access control. Individuals and devices within this secured perimeter were considered trustworthy, while those outside were viewed as potential threats. The "perimeter-centric" approach was highly effective when data, applications, and employees were all located within the physical boundaries of corporate headquarters. In the current environment, however, this model is considered not only obsolete but also poses significant risks. ... Microsegmentation significantly mitigates the impact of by transitioning from traditional perimeter-based security to detailed, policy-driven isolation at the level of individual workloads, applications, or containers. By establishing secure enclaves for each asset, it ensures that if a device is compromised, attackers are unable to traverse laterally to other systems. ... Microsegmentation solutions offer detailed insights into application dependencies and inter-server traffic flows, uncovering long-standing technical debt such as unplanned connections, outdated protocols, and potentially risky activities that may not be visible to perimeter-based defenses. ... One significant factor deterring organizations from implementing microsegmentation is the concern regarding increased complexity.

Human-in-the-loop has hit the wall. It’s time for AI to oversee AI

This is not a hypothetical future problem. is already failing in production. When automated systems malfunction — flash crashes in financial markets, runaway digital advertising spend, automated account lockouts or viral content — failure cascades before humans even realize something went wrong. In many cases, humans were “in the loop,” but the loop was too slow, too fragmented or too late. The uncomfortable reality is that human review does not stop machine-speed failures. At best, it explains them after the damage is done. Agentic systems raise the stakes dramatically. Visualizing a multistep agent workflow with tens or hundreds of nodes often results in dense, miles-long action traces that humans cannot realistically interpret. As a result, manually identifying risks, behavior drift or unintended consequences becomes functionally impossible. ... Delegating monitoring tasks to AI does not eliminate human accountability. It redistributes it. This is where trust often breaks down. Critics worry that AI governing AI is like trusting the police to govern themselves. That analogy only holds if oversight is self-referential and opaque. The model that works is layered, with a clear separation of powers. ... Humans shift from reviewing outputs to designing systems. They focus on setting operating standards and policies, defining objectives and constraints, designing escalation paths and failure modes, and owning outcomes when systems fail.

Building leaders in the age of AI

The leaders who end up thriving in the AI era will be those who blend human depth with digital fluency. They will use AI to think with them, not for them. And they will treat this AI moment not as a threat to their leadership but as an opportunity to focus on those elements of their portfolios that only humans can excel at. ... Leaders will need to give teams a set of guardrails (clear values and decision rights) and establish new definitions of quality while fostering a sense of trust and collaboration as new challenges emerge and business conditions evolve. ... Aspiration, judgment, and creativity are “only human” leadership traits—and the characteristics that can provide an irreplaceable competitive edge, especially when amplified using AI. It’s therefore incumbent upon organizations to actively identify and develop the individuals who demonstrate critical intrinsics like resilience, eagerness to learn from mistakes, and the ability to work in teams that will increasingly include both humans and AI agents. ... Organizations must actively cultivate core leadership qualities such as wisdom, empathy, and trust—and they must give the development of these attributes the same attention they do to the development of new IT systems or operating models. That will mean providing time for leaders to do the inner work required to lead others effectively—that is, reflecting, sharing insights with other C-suite leaders, and otherwise considering what success will mean for themselves and the organization.

The Rising Phoenix of Software Engineering

Software is undergoing a tectonic transformation. Modern applications are no longer hand-crafted from scratch. They are assembled from third-party components, APIs, open-source packages, machine-learning models, and now AI-generated snippets. Artificial intelligence, low-code tools, Open-Source Software (OSS), reusable libraries have made the act of writing new code less central to building software than ever before. ... In this new era, the primary challenge is not about builder software faster, cheaper, or more feature-rich. It is how to engineer software safely and predictably in a hostile ecosystem. ... Software engineering, as a discipline, must rise again — not as a metaphor for resilience, but as a mandate for survival. ... The future does not eliminate developers or coders. Assembling, customizing, and scripting third-party components will remain critical. But the accountability layer must shift upward, to professionals trained to reason about system safety, dependencies, and security by design. In other words, software engineers must reemerge as true engineers responsible for understanding not only how their code works, but how and where it runs… and most critically how to secure it. ... To engineer software responsibly, practitioners must model threats, evaluate anti-tamper capabilities, and verify that each dependency meets a baseline of assurance. These tasks were historically reserved for or quality assurance (QA) teams.

The concerning cyber-physical security disconnect

The background of many is in military and law enforcement, which change much slower, but are known for extensive training. The nature of the threats they need to defend against is evolving at a slower pace, and destructive, kinetic threats remain a primary concern. ... The focus of cybersecurity is much more on the insides of an organization. Detection is supposed to catch attackers lurking on compromised devices. Response activities have to consider the entire infrastructure rather than individual hosts. Security measures are spread out across the network, taking a defense-in-depth approach. Physical security is much more outward looking, trying to prevent threats from entering. Detection systems exist within premises, but focus on the outer layers. Response activities are focused on evicting individual threats or denying their access. The majority of security efforts focuses on the perimeter. ... Companies often handle both topics in different teams. Conferences and publications may feature both topics, but often focus on one and rarely address their interdependence. Security assessments like sometimes include a physical component that tends to focus on without involving deep physical security expertise. ... Risks, especially in the form of human threat actors, will always look for the easiest way to materialize. Therefore, they will attack physical assets via their digital components and vice versa, if these flanks are not protected.

Architecting Agility: Decoupled Banking Systems Will Be the Key to Success in 2026

The banking industry is undergoing an evolutionary and market-driven shift. Digital banking systems, once rigid and monolithic, are being reimagined through decoupled architecture, AI-driven intelligence, programmatic technology consumption, and and partnerships. ... Delay is no longer an option — the future of banking is already being built today. To capitalize on these innovations, tech leaders must prioritize digital core banking agility, ensuring integration with new innovations and adapting to evolving market demands. ... Identify suspicious patterns in real time. As illustrated in the figure, a decoupled risk analytics gateway and prompt engine streamlines regulatory reporting and ensures adherence to evolving rules (). Whitney Morgan, vice president at , a fintech provider, states that takes this a notch further by automating regulatory reporting and accelerating product development. ... empowers banks to detect anomalies across large translation datasets with the speed and accuracy that manual processes can’t match. Risk modeling and stress testing will enhance credit risk scoring, market risk simulations, and scenario analysis that drive preemptive and revenue options. ... The banking and financial services innovation race, with challenges in adoption and capturing market advantages, beckons leaders to be nimble and, at the same time, stay focused on the fundamentals. CIOs, CTOs, and other tech leaders can take proactive steps to strike the right balance.

Key Management Testing: The Most Overlooked Pillar of Crypto Security

The majority of security testing in focuses on code correctness or . , however, is mainly considered a procedural issue rather than a technical problem. This is a dangerous false belief. Entropy sources, , and are key to generating. Ineffective randomness, broken device software or a corrupted environment may lead to keys that seem valid but are appallingly weak to attack. The testing mechanisms used to create new wallet addresses for users must be watertight when an exchange generates millions of new addresses. Testing should also be done on key storage. ... The recovery process is one of the most vulnerable areas of key management, yet it is discussed least. Backup and restoration are prone to human error, improperly configured storage, or unsafe transmission. The unfortunate fact about crypto is that recovery mechanisms can be either a saviour or a disaster. Recovery phrases, encrypted backups, and distributed shares need to be repeatedly tested in a real-world, adversarial environment. ... End-to-end lifecycle testing, automatic verification of key states, automated attack simulations and automated recovery protocols that self-heal will be the order of the day. The industry has already become such that key management is no longer a concealed or even supporting part of the security strategies.

Inside the Chip: How Hardware Root of Trust Shifts the Odds Back to Cyber Defenders

Defenders often lack direct control or visibility into the hardware layer where workloads actually execute. This abstraction can obscure low-level threats, allowing attackers to manipulate telemetry, disable software protections, or persist beyond reboots. Crucially, modern attacks are not brute force attempts to break encryption or overwhelm defences. They exploit the assumptions built into how systems start, update, and prove what’s genuine. ... At the centre of this shift is Hardware Root of Trust (HRoT): a security architecture that embeds trust directly into the hardware layer of a device. US National Institute of Standards and Technology (NIST) defines it as “an inherently trusted combination of hardware and firmware that maintains the integrity of information.” In practice, HRoT serves as the anchor for system trust from the moment power is applied. ... For CISOs, HRoT represents an opportunity to strengthen resilience, meet regulatory demands, and finally realise true zero trust. From a resilience standpoint, it changes the balance between prevention and response. By validating integrity from power-on and continuously during operation, it reduces reliance on post-incident investigation and recovery. Compromised devices and systems are stopped early, limiting blast radius and disruption. Regulators are already reinforcing this direction. Frameworks such as the US Department of Defense’s explicitly highlight HRoT as a stronger foundation for assurance.

What AI skills job seekers need to develop in 2026

One of the earliest AI skills involved prompt engineering — being able to get to the necessary AI-generated results by using the right questions. But that baseline skill is being pushed aside by “.” Think of context engineering as prompt engineering on steroids; it involves developing prompts that can deliver consistent and predictive answers. Ideally, “everytime you ask the same question, you always get the same answer,” said , vice president at , a division of . That skill is critical because AI models are changing quickly, and the answers they spout out can differ from day to day. Context engineering is aimed at ensuring consistent outputs despite a rapidly evolving AI ecosystem. ... “Beyond algorithms and coding, the next wave of AI talent must bridge technology, governance and organizational change. The most valuable AI skill in 2026 isn’t coding, it’s building trust,” Seth said. Along those lines, he recommended that job seekers immerse themselves in the technology beyond simply taking a class. “Instead of a course, go to any conference,” Seth said. ... In hiring, genuine AI capability shows up through curiosity and real experience, Blackford said. “Strong candidates can talk honestly about something they tried, what did not work, and what they learned,” he said ... “Things are evolving at such a fast pace that there will be no perfect set of skills,” said Seth. “I would say more than skills, attitudes are more important — that adaptability to change, how quick you are to learn things.”

Daily Tech Digest - November 12, 2025

Quote for the day:

"Always remember, your focus determines your reality." -- George Lucas

Agentic AI and Solution Architects

are intelligent systems designed to operate with autonomy, agency, and authority—three foundational concepts that define their ability to act independently, pursue goals on behalf of users, and make impactful decisions within defined boundaries. These systems are often built using a , where multiple specialized or generalist agents collaborate, either in centralized or decentralized environments. ... As (IT) architects we drive change that creates business opportunities through technical innovation. One of the key activities of a Solution Architect is to design solutions by applying methods and techniques combined with technical and business expertise. The actual solution design process will follow a similar pattern to that of a creative technology design process. An architect will combine and group the different components together according to stakeholder group and will, over several sessions, develop concept views related to key architectural components, establishing different options. Deciding the “right” option will mean balancing the various criteria like functionality, value for money, compliance, quality, and sustainability. IT architecture design involves complex decision-making, planning, and problem-solving that require human expertise and experience. That is where most of the architect’s work is focused on – using knowledge and experience to research a particular subject, to apply design thinking and to solve problems to establish a solution.

Shadow AI risk: Navigating the growing threat of ungoverned AI adoption

Only half (52%) of global organizations claim to have comprehensive controls in place, with smaller companies lagging even further behind. This lack of robust governance and visibility leaves organizations vulnerable to , compliance failures, and . For many organizations, AI controls are lacking. ... As AI systems become more autonomous and capable of acting on behalf of users, the risks grow even more complex. The rise of agentic AI, which can make decisions and take independent action within systems, amplifies the impact of weak identity security controls. As these advanced AI systems are given more control over critical systems and data, the potential risk of security breaches and compliance failures grows exponentially. To keep pace, security teams must evolve their identity security strategies to include these emerging machine entities, treating them with the same rigor as human identities. ... To effectively mitigate the risks associated with and ungoverned AI adoption, organizations need to start with a solid foundation of governance and visibility. That means implementing clear acceptable use guidelines, access controls, activity logging and auditing, and identity governance for AI entities. By treating AI entities as identities that are subject to the same authentication, authorization, and monitoring as human users, organizations can safely harness the benefits of AI without compromising security.

Secure Product Development Framework: More Than Just Compliance

Security risk assessment is a key activity that starts early in development and continues throughout the product life cycle through on-market support and eventual product retirement. references AAMI SW96, “Standard for medical device security - Security risk management for device manufacturers,” as a recommended standard for a security risk assessment process. Security risk assessment considers both safety and business security risks ... Implementing a clear and consistent security risk assessment process within the SPDF can also save time (and money). Focus can be placed on those areas of the design with the highest security risk, instead of on design areas with little to no security risk. Decisions on whether patches need to be applied in the field are easier to make when based on security risk. Leveraging the same security risk process across products and business areas allows teams to focus on execution rather than designing a new process. Once a product is launched, an SPDF can assist with managing that product. Postmarket SPDF activities include vulnerability monitoring/disclosure, patch management, and incident response. A critical component of vulnerability monitoring is the maintenance and continuous use of a software bill of materials (SBOM). The SBOM provides a machine-readable inventory of all custom, commercial, open-source, and third-party software components within the device.

Vibe Coding Can Create Unseen Vulnerabilities

does accelerate app prototyping and makes software collaboration easier, but it also has several shortcomings. Security is a serious concern. Large language models (LLMs) are inherently vulnerable to security risks when used by those without sufficient security experience. Moreover, the risk is amplified by the fact that AI is so flexible that it’s impossible to give out simple, universal rules on how to make AI write secure code for you. LLMs may use outdated libraries, lack input validation, or fail to follow secure practices. AI code generators also lack an understanding of trust boundaries and system architectures. When using vibe coding, programmer oversight and review are necessary to prevent these issues from entering production code. Working with black-box code also makes it difficult to provide context about the app. For example, improper configurations may expose internal logic by sending sensitive code snippets to external APIs. This can be a real problem in highly regulated industries with strict rules about code handling. Vibe coding also tends to add technical debt, accumulating unreviewed or unexplained blocks of code. Over time, these code blocks proliferate, creating a glut and making code maintenance more difficult. Since less experienced developers tend to use vibe coding, they can overlook security issues. Consider the recent Tea Dating Advice hack. A hacker was able to access 72,000 images stored in a public

The state of cloud-native computing in 2025

“We’ve reached a level of maturity in the cloud-native ecosystem that people might think that things are now a bit boring. While AI is a natural extension of and cloud-native architectures, there are changes required in the architecture to support AI workloads compared to previous workloads. Platform engineering continues to have strong customer interest… and new AI enhancements allow for even greater productivity for developers and operators. ...” said Miniman ... “However, runaway complexity and cost threaten to derail mass enterprise success. The modern observability stack has become an exorbitant black hole, delivering insufficient value for its exorbitant cost and demands a fundamental rethink of data management. Simultaneously, the gamble failed, proving too complex and expensive. The imperative is clear and necessitates pulling workloads back from the brink with democratized data management to pull workloads back onto central platforms,” said Zilka. ... “The focus has shifted from how quickly I can deploy, to how I can get a handle on costs and how resilient my platform is to changes or outages like we saw recently with . Teams are recognising the overhead these technologies have introduced for developers and are centralising that work. We’re seeing more platform teams set best practices, use tooling to enforce them and move from “adoption mode” to “operational excellence,” said Rajabi.

Insurability now a core test for boardroom AI & climate strategy

Organisations face growing threats from data poisoning and cyber-attacks, prompting insurers to play a more decisive role in risk management. Levent Ergin, Chief Climate, Sustainability & AI Strategist at , highlighted the increasing scrutiny on what businesses can insure against. ... AI is now a fixture at board meetings due to its direct impact on company valuation. However, he observes a gap between current boardroom discussions and the transformative potential of AI. "AI is now a standing item in every board meeting because it directly shapes valuation. Investors see it as a signal of how forward-thinking a company really is. But many boards are still asking the wrong question: 'How can we use AI to automate or augment our existing processes?' when they should be asking 'What's possible?' It's not just about automating what already exists; it's about reimagining how things are done. ..." said Hanson. ... "Too many businesses still treat AI projects like any other investment, where the return has to be quantified against a specific outcome. In truth, they should be budgeting for failure. The best innovators plan for things not to work first time, just as pharmaceutical companies or tech giants do, because even a 98% failure rate can still produce world-changing results. The moment we stop fearing failure and start funding it, we'll see genuine AI innovation break through," said Hanson.

Are we in a cyber awareness crisis?

To improve cyber awareness, organizations need to move beyond box-ticking exercises and build engagement through relevance and creativity. This is the advice of Simon Backwell, a member of the Emerging Trends Working Group at professional association , and head of information security at software company . He advocates for interactive, rather than static training, where employees can explore why something was suspicious, as they learn by doing, rather than guessing the right answer and moving on. ... Not only does AI present new risks from its use within the business, but also from the way criminals are using it. “ frequently use gen AI chatbots, and , such as robocall scams, now use deepfakes,” notes Candrick. “AI puts social engineering on steroids, yet cybersecurity leaders are still using the same awareness measures that were already insufficient.” While regulatory pressure will play a role in improving AI-related cybersecurity, regulations will always struggle to keep pace, especially in the UK where the process takes time. For example, the is only now filtering through, much like did back in 2018, says Backwell. But with how fast AI is advancing – almost weekly – these rules risk becoming outdated as soon as they’re released. ... “As board alignment weakens, CISOs have to work harder to translate cyber risk into business impact, because boards now rank business valuation as their top post-incident concern,” says Cooke.

How to build a supercomputer

When it comes to ’s architecture, , head of HPC/AI EMEA research lab, at , describes the design as “the architecture that HPE, with its great heritage, builds for the top systems.” A single cabinet in an EX4000 system can hold up to 64 compute blades – high-density modular servers that share power, cooling, and network resources – within eight compute chassis, all of which are cooled by direct-attached liquid-cooled cold plates supported by a cooling distribution unit (CDU). “It's super integrated," he says. “The back part, which is the whole network infrastructure (), matches the front part, which contains the blades.” For Hunter, HLRS has selected hardware, but Haus explains that with Cray EX systems, customers can, more or less, select their processing unit of choice from whichever vendor they want, and the compute infrastructure can be slotted into the system without the need to total reconfiguration. “Should HLRS decide at some point to swap [Hunter’s] AMD plates for the next generation, or use another competitor’s, the rest of the system stays the same. They could have also decided not to use our network – keep the plates and put a different network in, if we have that in the form factor. [HPE Cray EX architecture] is really tightly matched, but at the same time, it’s flexible," he says. Hunter itself is intended as a transitional system to the , which is due to go online in 2027.

The AI Reskilling Imperative: Bridging India's talent and gender gap

Policies should shift from less general policies to specific interventions. Initiatives such as and need to be bolstered with AI-specific courses available online in the local language. The government can: Sponsor and encourage scholarships and mentorships for Women in AI. Develop financial reward systems for companies reaching gender diversity in their AI teams. Introduce AI literacy and ethics into the national education system, beginning at the secondary school level. ... As the main consumer of AI talent, the private sector should be at the forefront. The first one is the skills-first approach to hiring, but reskilling as an ongoing investment is not an option. Companies should: Devote a huge proportion of CSR budgets to simple AI and digital literacy efforts, especially among women in low-income and rural communities; Launch internal reskilling programs to shift existing workers out of positions at risk of automation (e.g., manual software testing, simple data entry) and into new roles, such as AI integrators or data annotators; Embrace explicit ethical standards for the application of AI, including a workforce transition and support strategy. ... The universities will be obliged to redesign courses that incorporate AI's technical wisdom and infuse them with morals, critical thinking, and subject knowledge. Collaboration between industry and academia is important to ensure courses are practical and incorporate real-world projects.

Enterprises to focus AI spend on cost savings & data control

"CIOs will move from experimenting with AI to orchestrating it, governing outcomes, agents, and data. AI leadership will evolve from pilots to performance. CIOs will be accountable for tangible business outcomes, defining clear frameworks that connect AI investments to enterprise KPIs and ROI. That means managing a new hybrid workforce of humans and digital agents, complete with job descriptions, correlated KPIs and measurement standards, and governance guardrails. Yet none of this will succeed without secure information management, ensuring that the data fueling and training these agents is accurate, compliant, and trustworthy. Simply put, good data results in good AI outcomes. As AI accelerates, traditional network and security operations will be reimagined for an always-on, agent-driven enterprise, where value is derived as much from data discipline as from innovation itself," said Bell. ... "A Major brand fallout will force AI accountability. In the next year, we'll likely see a major brand face real damage from AI misuse. It won't be a cyberattack in the traditional sense but something more subtle, like a plain text prompt injection that manipulates a model into acting against intent. These attacks can force hallucinations, expose proprietary or sensitive information, or break customer trust in seconds. Enterprises will need to verify AI behavior the same way they secure their networks, by checking every input and output. The companies that build AI systems with accountability and transparency at the core will be those that keep their reputations intact," said Berry.