Daily Tech Digest by Kannan Subbiah: Data Center

Showing posts with label Data Center. Show all posts

Daily Tech Digest - September 29, 2026

Quote for the day:

"We don't grow when things are easy. We grow when we face challenges." -- Elizbeth McCormick

🎧 Listen to the audio debrief on YouTube

Duration: 18 mins • Perfect for listening on the go.

Nine unlikely trends shaping software development

The software development landscape is experiencing a surprising shift where older, foundational technologies are re-emerging to overtake modern trends. According to InfoWorld, nine unexpected reversals are currently shaping the industry. Plain JavaScript is moving to absorb TypeScript, transforming the latter into a simple linting tool rather than a mandatory compilation step. Similarly, SQL is seeing a strong resurgence over ORMs and NoSQL databases, valued for its rigorous structure and new capabilities like running in the browser via WebAssembly. Developers are also finding that local IDEs often outperform cloud development environments due to the sheer power of modern laptops. In system architecture, monolithic designs are beating out microservices, as teams realize the deep complexities and network latency of microservices are often unnecessary for their goals. Instead of complex API integrations, developers are embracing cohesive "batteries-included" frameworks that reduce brittle glue code. We are also seeing a shift back to on-premises hardware over default cloud deployments, a preference for specialized engineering roles over the myth of the true full-stack developer, WebAssembly challenging Docker with faster, lightweight portability, and Java reclaiming dominance on the server side thanks to highly scalable virtual threads.

Beyond redundancy: Why dynamic stability matters in AI data centers

As artificial intelligence transforms data centers, the traditional approach to facility resilience is no longer enough. The challenge has shifted from static redundancy to dynamic stability. In conventional computing setups, uninterruptible power supplies and backup generators act as insurance against hardware failure. However, massive clusters of AI accelerators can change their power demand in milliseconds during training cycles. These tightly synchronized shifts create massive, instant power transitions without any actual equipment failing. Because thousands of GPUs can jump from low to full power demand almost instantly, they stress the entire electrical system. Utilities, grid researchers, and infrastructure companies are now focusing on active control to keep generators, batteries, and the grid synchronized during these sudden load changes. Modern power systems are being reimagined as dynamic buffers rather than just emergency backups, utilizing advanced firmware to absorb rapid power spikes without constantly cycling and degrading batteries. Ultimately, it is not enough for an AI data center to merely survive a localized power loss event. Operators must actively manage how the entire electrical infrastructure behaves millisecond by millisecond, ensuring the facility remains fully stable and completely responsive to the extreme, repetitive power swings of heavy AI workloads.

The human-on-the-loop advantage for MSSPs

Artificial intelligence is quickly changing how Managed Security Service Providers (MSSPs) operate, offering the ability to analyze data, automate workflows, and accelerate investigations at speeds humans cannot match. MSSPs face growing pressures—including skills shortages, complex attack surfaces, and tight budgets—making AI a crucial tool for scaling operations. However, despite the rise of automated security, AI does not eliminate the need for skilled cybersecurity professionals. Instead, it shifts the focus to a "human-on-the-loop" model, where analysts no longer perform every task manually but set guardrails, review high-risk decisions, and step in during complex incidents. AI excels at finding patterns and reducing noise, but it lacks the contextual understanding and nuanced judgment required to navigate ambiguous, real-world security threats. Furthermore, as attackers increasingly use AI-enabled techniques like prompt injection and model exploitation, AI systems themselves have become part of the attack surface. This makes human oversight essential to validate findings and challenge automated decisions. Ultimately, the most successful MSSPs will be those that blend AI-driven efficiency with adaptable, highly trained professionals who know when to trust the technology and when to override it.

IT Service Operations Is Ready For Its AI Moment

IT service operations are stepping into a new era where artificial intelligence finally moves from theory to practical application. For years, service desks and IT operations teams have struggled with a growing volume of routine requests, endless alerts, and the constant pressure to resolve issues faster. Now, the integration of artificial intelligence is offering a reliable way to shift from a reactive approach to a more proactive model. By applying modern AI tools, organizations can automate the categorization and routing of support tickets, significantly reducing the manual effort required from IT staff. Furthermore, intelligent virtual agents and improved self-service portals provide employees with immediate answers to common problems, creating a smoother and more efficient experience for everyone involved. For more complex incidents, AI assists support teams by quickly summarizing historical data and suggesting potential fixes, which directly cuts down the time it takes to restore normal operations. However, achieving this transition requires more than just buying new software. Technology leaders must focus on organizing their underlying data and refining their existing service workflows. When executed thoughtfully, adopting AI in service operations frees up technical teams to focus on strategic projects rather than getting bogged down by repetitive troubleshooting.

7 reasons IT managers fail to exceed your expectations

Many IT managers fail to meet or exceed expectations despite having strong technical backgrounds, often because the role requires skills they haven't developed. According to industry experts, the transition from a top-performing individual contributor to a manager requires critical thinking, business understanding, and leadership—areas where technical training falls short. Seven core reasons outline why IT managers often struggle in their roles. First, many are promoted without formal management training, leaving them ill-equipped to guide teams. They may also lack the emotional intelligence and interpersonal skills necessary to handle complex situations. Additionally, an individual might simply be the wrong fit for a specific management position, or they may lack clear expectations and performance metrics from their own supervisors. Sometimes, professionals take management roles just to advance their careers, even if they prefer staying technical. When they do take the role, they often juggle too many responsibilities without clear prioritization from the CIO, making it hard to stay on track. Finally, struggling managers often focus purely on flawless technology execution rather than solving the actual business problems at hand. CIOs can fix these issues by offering mentorship, establishing technical career tracks, and setting clear, business-driven goals.

Background Check Fraud: What Screening Can Miss

It is a troubling reality for security and human resources leaders that every fraudulent employee discovered by experts had successfully passed a standard background check. This vulnerability is not a flaw in the background checks themselves, which simply answer a narrow question by confirming that records exist, documents are legitimate, and names match database entries. Instead, the issue lies in the widening identity gap that has become an enormous business risk, costing companies hundreds of millions of dollars. Bad actors can now easily steal real identities, build convincing personas, optimize resumes for automated screeners, and even use generative artificial intelligence to navigate video interviews. Because traditional screening systems are not designed to compare a person's claimed history against independent sources, they fail to reveal inconsistencies in a broader digital footprint. A fabricated persona often appears legitimate if the underlying documents check out. To combat this growing threat, organizations must adopt a strategy of ongoing identity corroboration throughout the entire employment lifecycle. This broader approach focuses on ensuring that an individual is consistent, traceable, and genuine across multiple independent sources, shifting the focus from merely asking if a document is real to verifying if the person actually is who they claim to be.

Stolen AI credentials feed growing LLM proxy economy

Threat actors are increasingly utilizing over 80,000 proxy servers, known as transfer stations, to cloak illicit traffic to frontier AI models. This growing underground economy relies on stolen AI subscription credentials and API keys, which are often harvested through information stealers, phishing campaigns, and supply chain attacks targeting privileged developer accounts. By hiding the geographic origin of their traffic, attackers bypass provider controls to conduct model distillation attacks. In these attacks, carefully designed prompts extract valuable knowledge from top tier models to train competing AI systems. Security researchers have traced a significant portion of this activity to IP addresses in China and Hong Kong, echoing recent warnings from federal agencies about industrial scale distillation efforts. Beyond distillation, these proxy networks fuel widespread AI token theft, leading to hundreds of thousands of dollars in financial losses for victimized organizations. The proxies are often powered by open source relay platforms like sub2api, supported by a surprisingly robust commercial ecosystem of resellers and proxy vendors. To combat this rising threat, security experts strongly advise organizations to treat AI credentials as critical production secrets. Enterprises should implement short lived tokens, enforce strict spending limits, monitor for unusual request volumes, and quickly revoke any compromised keys.

AI Resilience: As AI Gets Smarter, Are Humans Still Getting Better?

As organizations shift toward more autonomous AI systems that reason and act, a critical new risk is emerging: cognitive dependency. While traditional AI governance focuses on machine accuracy and safety, there is growing concern about what happens to human capability when critical thinking is heavily delegated to technology. Offloading complex tasks like analysis and decision-making creates an efficiency paradox where enormous productivity gains might lead to gradual cognitive atrophy in human workers. To counter this, meaningful oversight must go beyond merely having a "human in the loop" who passively clicks approval buttons. True oversight requires a "human at the helm" who retains the ability to understand context, challenge the AI's assumptions, and confidently override recommendations when necessary. This introduces the concept of "AI resilience"—the organizational imperative to ensure employees maintain their independent judgment and domain expertise alongside AI adoption. Building this resilience involves deliberate practices, such as requiring humans to formulate their own initial judgments before viewing AI outputs and conducting critical tasks independently of AI. Ultimately, the goal is not to limit artificial intelligence, but to ensure that as machines become smarter, human workers do not lose the essential critical thinking skills required to properly govern them.

Five Ways To Use AI Coding Agents to Improve Your Software Architecture

AI coding agents are becoming essential tools for improving software architecture, especially as systems grow more complex and often rely on poorly understood legacy services. Modern architectures frequently integrate older services for specific tasks, but these often lack accurate documentation, making their use risky. AI coding agents can bridge this knowledge gap by mapping system designs, documenting data flows, and identifying potential security or logic flaws within legacy code. If necessary, these agents can even refactor the code to improve maintainability and mitigate architectural risks. Beyond dealing with legacy systems, AI agents are highly effective at finding and fixing both generic and organization-specific architectural flaws, such as API design issues or Domain-Driven Design boundary violations. They are also adept at identifying and patching security vulnerabilities, which is particularly valuable when architectures incorporate open-source packages. Furthermore, while AI agents significantly speed up coding and free teams to experiment, they must be guided by specific, measurable architectural goals and trade-offs to ensure quality. By doing so, teams can rapidly generate Minimum Viable Architectures (MVAs) and evaluate the code through measurable tests, creating a solid foundation for robust, scalable, and secure systems.

Chrome Store Hosts 'Poper Blocker' Spyware Downloaded by Millions

Millions of users have unwittingly downloaded a malicious browser extension called Poper Blocker, believing it to be a legitimate ad blocker. Despite carrying Google’s "Featured" badge and "Established Publisher" status on the Chrome Web Store, researchers at Bay Area Labs identified the program as sophisticated spyware. Once installed, the extension quietly gathers extensive amounts of sensitive information. It records detailed browser histories, captures screenshots, and extracts highly specific data from AI chatbot interactions on platforms like ChatGPT and Gemini. To bypass security reviews, the software remains inactive for its first 24 hours and uses methods to avoid detection, such as hiding its code and recognizing test environments. It then communicates with an external server to execute harmful commands. The developer behind the app, an opaque company known as Big Star Labs, has previously been caught distributing similar spyware, yet several of its applications remain freely available to millions of users. Security experts warn that standard data protection tools struggle to detect this behavior because the stolen data is heavily disguised. The situation highlights a broader issue in the digital marketplace, where users have very limited ways to distinguish safe utilities from deceptive software designed to quietly monitor their private lives each day.

Daily Tech Digest - September 19, 2026

Quote for the day:

“The only true wisdom is in knowing you know nothing.” -- Socrates

🎧 Listen to the audio debrief on YouTube

▶ Play Audio Digest

Duration: 20 mins • Perfect for listening on the go.

Building a pre-emptive security architecture — what is it and how can your business adopt one?

With the rise of AI-driven cybersecurity threats, conventional "detect and respond" frameworks are struggling. The speed of attacks has increased, and the volume of vulnerabilities is projected to skyrocket, leading to practitioner burnout. This has prompted a shift toward a pre-emptive security architecture. Instead of waiting to respond to an intrusion, pre-emptive security aims to stop attacks before they cause damage by placing controls directly in the attack path. It's an architectural approach, connecting security across layers—like users, applications, and data—so that a breach in one layer doesn't compromise the whole system. This strategy focuses on anticipating and preventing breaches rather than just limiting the fallout. Key elements of this approach include denying access, deceiving attackers with decoys, and disrupting emerging threats. Techniques like zero trust, secure code development, and confidential computing are central to this model. To implement it, businesses should first identify sensitive data and map out vulnerabilities. This involves understanding potential attack paths and applying the principle of least privilege. Regular penetration testing and continuous monitoring are essential to ensure these controls work without disrupting legitimate business processes. While pre-emptive measures are crucial, they are meant to enhance, not replace, existing security alerts.

Strong fundamentals make next-gen security possible

Instead of constantly chasing the newest security tools, organizations should focus their efforts on mastering five foundational practices to effectively protect their systems. First, businesses must maintain a clear, accurate inventory of all their physical and digital assets across every environment. You simply cannot protect what you do not know exists. Second, carefully managing user identities is critical. Implementing simple but strong measures like multifactor authentication or passkeys significantly lowers the chance of compromised accounts. Third, security strategies should match the specific needs and risk tolerance of the business. By identifying the most valuable data and establishing clear priorities, security teams can focus their resources exactly where they matter most. Fourth, while preventing attacks is important, organizations must also prioritize true resilience. This means keeping secure backups, writing clear recovery plans, and actively practicing those plans so employees know exactly what to do during a crisis. Finally, security professionals and business leaders need to speak the same language. By translating technical risks into clear business impacts, such as potential financial costs, teams can make better decisions together. Mastering these basic, everyday practices may not seem exciting, but it provides a much stronger defense against real threats than simply buying the latest technology.

The cloud outage that should terrify the CIO

A recent Microsoft Azure outage that simultaneously knocked out major AI services, including ChatGPT, Claude, Grok, and Copilot, serves as a stark warning for business leaders. The disruption highlights a growing, hidden vulnerability: concentrated cloud dependency. As organizations increasingly weave artificial intelligence into their core operations, they are inadvertently stacking their critical workflows on the same shared infrastructure. When a major cloud region fails, the impact is no longer limited to a single application going offline. Instead, automated business processes, financial transactions, and customer support pipelines can grind to a sudden halt, leading to massive financial losses. What makes this risk especially dangerous is that many companies are completely unaware of their true exposure. Organizations rely on countless third-party software vendors, who in turn depend on major cloud providers. This creates a chain of invisible dependencies where an outage at a provider you do not directly use can still freeze your business. To protect their operations, technology leaders must actively map their entire software dependency chains, including the artificial intelligence layer. They need to design their critical systems to smoothly switch to backup providers during failures and clearly present the financial risks of cloud downtime to their executive boards.

The Control Plane Is Not the Trust Plane

The article from Security Boulevard, titled "The Control Plane Is Not the Trust Plane," explores the evolving landscape of AI governance. The author argues that while control planes—systems designed to govern what an AI agent is permitted to do—are necessary, they are no longer sufficient. As organizations deploy more AI agents, a critical gap emerges: the need to verify history, provenance, and the actual context of an action. To address this, the author proposes a new conceptual layer: the "trust plane." A control plane answers questions about possibility, such as which identities exist and what policies apply. In contrast, the trust plane answers questions about history, focusing on why a specific action belongs to a legitimate chain of authority. It requires "evidence receipts" to understand the full context—who initiated the request, what identity was used, and what was actually accepted by the receiving system. The article emphasizes that trust should not rely on centralization, which creates single points of failure. Instead, it advocates for a distributed approach where nodes retain local identity while sharing verifiable evidence. Ultimately, as AI systems transition from tools to active participants, securing both control and trust is vital for maintaining accountability and operational integrity.

California child-safety laws expand age checks to addictive feeds, AI chatbots

California has introduced a series of new child safety laws that regulate artificial intelligence chatbots and social media platforms, establishing the state as a leader in digital age verification. These bills aim to create safer online environments for children by making device based age checks the standard. A central piece of this legislation is a new rule requiring independent safety audits and annual risk assessments for companion chatbots. This measure was inspired by a tragic case where a teenager was allegedly influenced by a chatbot to end his life. Major industry players, including the creators of ChatGPT and media advocacy groups, have voiced their support for these rules. In response, artificial intelligence providers are already implementing mandatory safety modes for users under eighteen. Additionally, the new laws ban social media platforms from offering addictive features to children under sixteen. Companies must now verify age before enabling these tools, with severe financial penalties of up to fifty thousand dollars per affected child for those who knowingly violate the rules. Finally, lawmakers clarified how age signals should be shared by operating systems, ensuring that open source developers are not unfairly burdened. As artificial intelligence continues to grow, other states are expected to adopt similar protective measures.

Enabling the next generation of AI data centers

The article describes how AI is forcing a fundamental rethink of data center design, mainly because traditional facilities were built for predictable CPU workloads and steady growth. AI training clusters, by contrast, demand far higher power density, faster deployment timelines, and more complex infrastructure coordination. The author explains that developers are now planning gigawatt‑scale campuses where power, cooling, transmission, water, and long‑term operations must be designed as one integrated system rather than separate components. Site selection has become a balancing act: inexpensive land may lack grid access, while power‑ready sites may come with long interconnection delays or higher costs. To keep projects moving, many operators are turning to hybrid or off‑grid power solutions, including gas generation, batteries, and microgrids, even though these approaches require more capital and careful permitting. Cooling is also shifting toward liquid systems and thermal storage to handle dense AI loads and reduce peak energy use. The article stresses that early permitting work and cross‑discipline alignment are now essential, because regulatory, environmental, and community constraints can shape a project as much as engineering choices. Ultimately, the piece argues that success depends on making early, realistic decisions that translate AI demand into infrastructure that can be delivered at speed and scale.

Is Your Organisation’s Data Secure?

Data security is critical, and many free, open-source tools now offer robust protection, making strong encryption accessible to organizations of all sizes. Encrypting data prevents unauthorized access by converting plaintext into unreadable ciphertext, which requires a specific key to decipher. The transparency of open-source software allows a global community of experts to continuously evaluate the code, often identifying vulnerabilities faster than with closed, proprietary systems. A comprehensive security strategy must address data in two states: at rest and in transit. Data at rest, such as information stored on hard drives or databases, is a high-value target for attackers. Encrypting this data ensures that even if physical devices are stolen, the information remains secure. Data in transit moves between systems over networks like the internet and can be intercepted. Tools like OpenSSL, Let's Encrypt, WireGuard, and OpenSSH provide essential encryption for data in transit, securing web traffic, remote access, and file transfers. Regulatory frameworks worldwide further emphasize the importance of data encryption to protect personal and financial information. By leveraging these open-source tools, organizations can build resilient defenses against data breaches.

Cybersecurity Work-Life Balance Starts With Actually Turning Off

The constant pressure of defending against relentless threats has made it incredibly difficult for cybersecurity professionals to step away from their work. Sam Van Ryder, a veteran in operational technology security, emphasizes that achieving a healthy balance requires individuals to genuinely disconnect, while employers must actively protect their team's downtime. Often, organizations talk about this balance as a benefit without creating the environment necessary for people to log off. With ongoing staffing shortages and constant alerts, the inability to rest is no longer just a personal wellness issue; it is a direct security risk. When security teams are exhausted, their judgment naturally suffers, creating the exact vulnerabilities that attackers actively look to exploit in critical systems. Recognizing this, leaders need to ensure time off is fully respected. This means no emails, no emergency messages, and no checking the daily news. If a team member tries to work on their day off, leaders should send them back to their rest. Furthermore, recovery should not be limited to an annual vacation. Regular breaks throughout the year are completely essential for maintaining a strong and focused workforce. Ultimately, the most effective way to maintain long-term security is for individuals to step back, turn everything off, and simply recharge.

Beyond Age-Gating: Regulating Platform Design for Child Safety

India's approach to child online safety currently relies on basic age restrictions and rapid content removals, but these conventional measures fail to address a much deeper issue: structural platform design. With millions of children accessing the internet daily, the conversation must shift from simply blocking entry to reforming how digital services are actually built from the ground up. Features such as recommendation algorithms, automatic video playback, and default direct messaging settings shape the online experience of a child and their exposure to risk long before content moderation even occurs. Global evidence clearly shows that simple age limits are frequently bypassed, leaving many young users vulnerable to the exact same risks. Furthermore, current safety metrics only track formal complaints rather than measuring the actual frequency of exposure to harmful material. To create a genuinely safer environment, policymakers must begin regulating platform design directly. Rather than treating safety as an afterthought, features that enable direct contact with strangers should be restricted by default. India can utilize its existing consumer protection laws to classify manipulative interfaces as unfair practices. Large digital services should be required to justify structural changes affecting minors, disable behavioral tracking, and publish independently audited data on how often children encounter harmful content online.

The DPDP cross-border transfer rules aren't live yet; so why are contracts being redrafted as if they are?

Many legal teams and companies are prematurely rewriting contracts to comply with the cross-border data transfer rules of India's Digital Personal Data Protection Act. However, these specific rules will not actually take effect until roughly May 2027. Currently, organizations are making the mistake of forcing strict European-style data protection clauses into their Indian contracts. This approach is highly counterproductive because India's legal model is vastly different. While the European system requires strict safeguards for every single transfer, India will use a much more open approach. This means that data can flow freely to any country unless the government explicitly restricts it. Because the government has not yet released a list of restricted countries, there is no solid legal basis to enforce strict transfer mechanisms right now. Including heavy compliance requirements prematurely can easily lock businesses into unnecessary legal burdens and costs. Instead of overcomplicating current agreements, legal teams should draft adaptable clauses that allow for future updates once the rules officially take effect. During this waiting period, companies should focus on understanding their data flows rather than creating rigid compliance structures. Lawyers must also be totally transparent with clients, clarifying that these contract changes are preparations for the future, not immediate legal obligations.

Daily Tech Digest - September 18, 2026

Quote for the day:

“An investment in knowledge pays the best interest.” -- Benjamin Franklin

🎧 Listen to the audio debrief on YouTube

▶ Play Audio Digest

Duration: 24 mins • Perfect for listening on the go.

Brevo supply-chain attack injected ClickFix scripts on customer sites

Brevo, a popular digital marketing and customer management platform, recently experienced a security breach affecting its website and tools embedded on customer sites. On September 14, attackers used a compromised Cloudflare API key, which had been mistakenly left inside the company's application code, to alter the platform's web traffic. For about five and a half hours, the attackers injected malicious scripts into Brevo's web forms and chat tools. When visitors loaded a website using these tools, they saw a fake verification screen urging them to run a harmful command, a technique known as a ClickFix attack. Additionally, if the visitor was logged into a WordPress site as an administrator, the script secretly attempted to install a hidden backdoor plugin called Web Media Optimizer. Security researchers estimate this incident may have affected up to one hundred thousand websites. Once Brevo identified the issue, the company quickly removed the unauthorized access, deleted the harmful files, and confirmed that core systems like email delivery and customer data remained secure. Website administrators who were logged in during the attack window are advised to carefully check their plugin lists for any unauthorized additions and update their passwords to ensure their systems remain completely safe.

Abandoned IoT apps keep sending sensitive data to broken servers

A recent study by the University of Massachusetts Amherst highlights the significant security risks posed by abandoned Internet of Things (IoT) companion apps. These apps, used to control smart devices like thermostats and cameras, often remain on users' phones long after developers stop updating them. The researchers analyzed over 61,500 abandoned Android IoT apps and found that a staggering number contained software dependencies linked to known vulnerabilities. Many of these apps were still being downloaded by millions of users, despite not receiving an update in over two years. Furthermore, these apps often bundle old software libraries and hard-coded web addresses, many of which no longer function or belong to entirely different owners. This creates a dangerous scenario where sensitive data, gathered through permissions like camera and location access, is sent to broken or potentially malicious endpoints. While the study found similar rates of known vulnerabilities in both abandoned and actively maintained apps, the real issue lies in the destination of the data. Over 40% of the data sinks in abandoned apps were associated with unreachable or vulnerable endpoints, compared to less than 1% in active apps. This research underscores the need for users to regularly review and uninstall abandoned IoT apps to minimize their security exposure.

Is your low code security keeping up with business speed?

Low code development platforms have transformed how organizations build applications, often leading to a misconception that they are as unstructured as vibe coding — the practice of relying entirely on artificial intelligence to generate software from casual prompts. However, while low code environments provide more structure and included guardrails than AI generated code, they still present significant security challenges that teams cannot ignore. Because these platforms empower everyday users to assemble functional applications quickly using visual interfaces, they introduce risks related to improper data handling, misconfigured permissions, and poor access controls. Included security features within low code platforms offer a baseline of protection, ensuring that development is not merely a chaotic environment, but they are not a complete safety net. To maintain a secure environment, IT departments must establish clear governance policies and conduct regular audits of user created applications. Without proper oversight, everyday builders might unintentionally expose sensitive company information or create software vulnerabilities that external attackers could exploit. Ultimately, organizations must strike a careful balance between enabling rapid, accessible software creation and maintaining strict security standards across the board. Relying solely on a platform's default protections is a risky approach; continuous monitoring and proactive management remain essential to keeping your business data truly safe.

Prioritise on the best governance, not the best model

The article from FutureCISO highlights that by mid-2026, the deployment of AI agents in Asia Pacific enterprises has significantly outpaced governance capabilities. Research shows that active AI agents have nearly tripled in a year, while the time to create them has halved. Gartner predicts that 40% of enterprise applications will feature embedded task-specific AI agents by the end of 2026. However, this rapid adoption has led to a rise in "shadow AI," with security incidents doubling year over year, according to IBM. The core issue is a lack of visibility; many organizations do not know what AI agents they have deployed. Lavy Stokhamer from Standard Chartered emphasizes that organizations need the same accountability and visibility for AI agents as they do for human employees, applications, and privileged accounts. A real-time inventory is crucial to understanding what each agent is authorized to do, the data it can access, and who is accountable. This comprehensive inventory of agent identities and permissions is fundamentally the "organizational chart for a digital workforce." Without knowing what digital actors exist and their authority, it is impossible to govern, secure, or manage risk at scale, leading to significant challenges in trust, resilience, and economics.

Malicious JavaScript Evaded VirusTotal in Seven of Eight E-Commerce Storefront Attacks

A recent cybersecurity investigation has revealed that traditional malware scanners are struggling to detect sophisticated e-commerce storefront attacks. Security researchers identified four distinct malicious JavaScript operations actively targeting online retailers. Across these campaigns, they found eight unique payloads designed to run quietly in a shopper's browser. Remarkably, when these payloads were tested against standard security tools, seven of the eight completely evaded detection by VirusTotal, and none were flagged as malicious by URLScan. These attacks succeed because they do not break the website. A modern storefront can look and function perfectly normally while the hidden script secretly siphons affiliate revenue, hijacks clicks, manipulates analytics, or opens a backdoor for remote access. To avoid detection, the malicious code uses clever evasion tactics, such as waiting for specific mobile devices, operating only during certain hours, or staying dormant until particular product buttons load on the page. Because these scripts only execute under exact conditions, traditional signature-based scanners often miss them during routine checks. This incident underscores a critical shift in e-commerce security. Relying solely on standard vendor trust or basic scans is no longer enough. Protecting online storefronts now requires advanced, behavior-based monitoring to catch these elusive threats in live traffic.

Rethinking Disaster Recovery Planning Using Optimized Sequencing

This article from Disaster Recovery Journal focuses on how organizations can improve their IT disaster recovery plans by optimizing their recovery sequences. When a widespread system outage occurs, simply restoring applications one by one based on a static list isn't always effective. Systems rely on each other—for example, an essential business app might need its database and identity services to be brought back online first. The author argues that companies need to look at multiple factors when deciding what to restore first. These include technical dependencies, recovery time objectives, and the potential impact on revenue and critical services. Because tech environments are always changing, with new applications and integrations being added, a fixed recovery sequence can quickly become outdated. To handle this, organizations can adopt recovery optimization. This approach uses existing data on dependencies and business priorities to compute the best recovery sequence for a specific situation. It allows teams to adjust their strategy based on current needs, whether that means prioritizing strict recovery timelines or protecting revenue. Ultimately, using an explainable, data-driven method helps teams make better decisions during a crisis and improves the value of their disaster recovery exercises.

Zombie Workloads Haunt Data Center Efficiency Efforts

Zombie workloads, such as unused applications or abandoned storage volumes, are creating notable challenges in data center efficiency. According to recent findings from the International Data Center Authority, up to 13% of US cloud usage is attributed to these idle workloads. The issue stems from scenarios like incomplete post-merger integrations and employees leaving apps active. The problem is becoming more critical with the rise of AI and GPUs, as the cost of idle time rises steeply compared to traditional CPU workloads. To address this, organizations are relying on Cloud FinOps tools and observability tools that find inactive resources. While features like scale-to-zero in serverless architectures offer some relief, they bring challenges like cold starts. The complexities of AI workloads also make hunting for zombies difficult, because they introduce issues like abandoned GPUs and mid-flight pipeline crashes. Effective management is built upon having sound policies. Clear guidelines, automated reminders, and routine scans are important in curbing zombie workloads. The cost of failing to decommission these idle assets has severe implications.

A Framework for Taming Unstructured Data at Scale

The provided article from CDO Magazine discusses the critical need for a framework to manage unstructured data, which constitutes 80% to 90% of corporate information. This "dark matter" includes emails, PDFs, and Teams messages, often lacking visibility and posing significant risks. The author, Lana DeMaria, highlights two main drivers for this urgency: the rise of "shadow AI," where employees might unknowingly feed sensitive data into public models, and the evolution of ransomware into "double extortion" tactics that target valuable unstructured data. Traditional governance methods, such as manual classification and reliance on regular expressions, fail because they are not scalable and treat governance as a one-time event rather than a continuous process. To address these challenges, the article proposes a cyclical, automated framework centered on three layers: Discovery (indexing data in place), Classification (using AI for semantic analysis), and Continuous Compliance (automating lifecycle management, including defensible deletion). By leveraging AI, organizations can better understand their data, manage risks, and ensure that governance scales effectively. Ultimately, implementing this framework allows leaders to turn unstructured data from a liability into a strategic asset for the enterprise.

The Standard BI Playbook Wasn't Built for the Physical Economy

The standard business intelligence approach often fails when applied to the physical economy, which includes industrial distribution, manufacturing, and marine transportation. These sectors do not suffer from a lack of information but rather struggle with making that information accessible across the organization. Traditional advice assumes data is already organized in a central location, but industrial companies typically rely on fragmented legacy systems, isolated applications, and numerous manual spreadsheets. To make any meaningful progress, companies must first do the practical work of gathering this scattered data into one unified platform. Furthermore, the typical strategy assumes teams are eager for new reports and have dedicated analysts ready to use them. In reality, operational teams are deep domain experts who are often overwhelmed by manual reporting tasks and naturally skeptical of new tools. They need immediate, reliable answers to handle their daily operations, not long-term analytical deep dives. Success in this environment should not be measured by how many reports are created, but by how many hours of manual work are eliminated. By focusing on centralizing information, sharing knowledge across departments, and automating tedious processes, industrial organizations can give employees their time back and significantly improve how they operate on a daily basis.

You Can’t Patch Cybersecurity Burnout: Joe Marshall’s Human Incident Response Framework

The provided article details Joe Marshall's Human Incident Response Framework, introduced during his CYBR.SEC.CON. 2026 keynote. Inspired by his grueling experience fighting the VPNFilter botnet in 2018, Marshall argues the cybersecurity industry expertly manages technical incident response but fails to support the human defenders. His framework provides a playbook to address occupational stress by first differentiating "burnout" into four specific injuries: actual burnout (workload exhaustion), secondary traumatic stress, vicarious trauma, and moral injury. Because they stem from different causes, they require distinct responses beyond just taking time off. The framework challenges the notion that stress merely comes from long hours, highlighting six exposure factors like content type and secrecy that make different cybersecurity roles uniquely taxing. It adapts military and emergency medicine concepts, classifying human strain into four zones: Ready, Reacting, Injured, and Crisis. Crucially, it replaces passive "open-door policies" with structured peer check-ins designed to establish baselines and recognize when a colleague is struggling. While offering practical tools like a 43-page Field Guide and a two-page Playbook, Marshall stresses the framework is a detection aid, not a clinical replacement. It aims to give the industry a shared vocabulary to recognize human distress and properly escalate issues without turning support into surveillance.

Daily Tech Digest - September 11, 2026

Quote for the day:

"At the end of the day, your job isn’t to get the requirements right—your job is to change the world." -- Jeff Patton

🎧 Listen to the audio debrief on YouTube

▶ Play Audio Digest

Duration: 23 mins • Perfect for listening on the go.

From tokenmaxxing to valuemaxxing

Recently, major technology companies have started abandoning the practice of measuring artificial intelligence success by the sheer volume of usage. This older approach encouraged employees to consume high amounts of computing resources, leading to wasted effort and rapidly depleted budgets. Instead, organizations are shifting their focus toward measuring the actual business value generated by these tools. However, experts note that simply looking at the final value is not enough. A more complete approach involves understanding both the financial benefit of the outcome and the precise cost required to produce it. To make this transition successful, companies must change how their employees interact with these systems. Staff should be trained to use the tools efficiently, avoiding the costly habit of repeatedly refining requests for a perfect answer when a good enough response will do. Furthermore, businesses need to stop treating these expenses as standard technology costs. Instead, these investments should be carefully integrated into high-level financial planning, with clear links between spending and strategic goals. By focusing on practical applications and educating their workforce on cost-effective habits, leaders can build a sustainable strategy that delivers genuine results without creating unpredictable financial risks for the organization.

Sovereign cloud and digital autonomy: Industry trends and what’s next

The era of unrestricted, borderless cloud computing is shifting as organizations increasingly prioritize governed digital autonomy through sovereign cloud architectures. While early cloud adoption focused heavily on global scalability and cost, enterprises now face intense pressure from regulators and boards to strictly control exactly where data resides, who can access it, and which legal jurisdictions apply. Sovereign cloud goes beyond simple data residency by ensuring organizations maintain operational independence, absolute encryption key ownership, and localized administrative control. This approach is rapidly evolving alongside artificial intelligence, as regulated sectors urgently need secure environments to train complex models without risking cross-border data exposure. Consequently, many organizations are adopting a balanced hybrid model, securely placing highly sensitive workloads in sovereign environments while leaving general operations in mainstream public clouds. Heavily regulated industries, including government, finance, healthcare, and telecommunications, are leading this vital transition to protect critical infrastructure and maintain public trust. Although sovereign clouds often require a higher initial financial investment for localized infrastructure and specialized compliance tools, they effectively mitigate severe regulatory penalties and disruptive business interruptions. Ultimately, sovereign cloud strategies offer stronger resilience and regulatory alignment, allowing modern organizations to maintain necessary global reach while carefully enforcing strict local control where security and trust absolutely demand it.

Why enterprises should start with on-site AI agents

Enterprises exploring artificial intelligence should prioritize building on-site agents rather than focusing on external options that roam the web. While in-browser and off-browser agents promise broad reach and automation, they present significant risks for brand-sensitive or highly regulated organizations. When an external agent misquotes a price or misrepresents a policy, the business still faces the consequences, even though it does not control the agent's underlying model or decision logic. By contrast, an on-site agent provides complete governance. Organizations can choose the model, set strict behavioral boundaries, and grant the agent direct, secure access to internal systems and existing data interfaces. This deliberate approach transforms the agent into a reliable, governed interface rather than a risky experiment. To succeed, companies should ensure every action taken by the agent is logged for routine auditing and design clear pathways for human intervention during complex situations. Furthermore, as this technology evolves, user-owned agents will likely interact directly with these governed on-site agents to negotiate tasks automatically. Establishing a secure, fully controlled foundation today prepares businesses for this inevitable future. Ultimately, while expanding customer reach is very tempting, maintaining strict accountability and control must remain the primary focus for any responsible enterprise deployment.

Banking Technology at a Strategic Crossroads

Banks today face a critical choice regarding the technology that powers their daily operations, as the infrastructure they select will directly influence how well they adapt to changing customer needs and market conditions. The available options generally fall into three distinct categories, each carrying different implications for future stability and growth. The first path involves sticking with older systems that are no longer actively improved. While these setups might feel familiar, they are increasingly expensive to maintain and struggle to support modern features, often leaving banks at a dead end. The second approach attempts to fix this by adding new, disconnected software on top of aging foundations. Although this might offer a quick temporary fix, it ultimately creates a tangled, fragile web of systems where data gets stuck and internal processes slow down. The most sustainable path involves choosing modern systems that integrate directly into a bank's core operations. Rather than creating separate silos, this approach ensures that everything works together seamlessly. This built-in flexibility allows banks to safely adopt new capabilities over time without breaking existing workflows. Ultimately, the continued success of any financial institution relies heavily on having a foundation that can evolve naturally as new challenges arise.

Getting ahead of ‘harvest-now-decrypt-later’: Post-quantum cryptography planning

While fully functioning quantum computers might seem far off, the threat they pose to your sensitive information is already a reality. Adversaries are actively capturing and storing encrypted data today with the plan to decrypt it years from now when quantum technology becomes available. This tactic means that any data requiring long-term confidentiality, such as medical records, trade secrets, or classified information, is currently at risk. In response, standard-setting organizations have already published clear timelines, requiring the phase-out of current encryption methods by the year 2030 and their complete removal by 2035. Preparing for this shift is not as simple as installing a quick software update. It requires a thorough and often time-consuming inventory of everywhere encryption is used across your entire organization, including hidden systems and third-party tools. Rather than just swapping one formula for another, organizations need to build flexible systems that can easily adapt to future security changes. The first step is simply discovering where your vulnerabilities lie, and you can start this process immediately without waiting for outside vendors or special budget approvals from your board. The organizations that will struggle the most are the ones that delay planning and wait for others to make the first move.

Security becomes the control plane for enterprise AI factories

As businesses increasingly integrate artificial intelligence into their operations, they face a new landscape of security challenges. Traditional cybersecurity methods were not built to handle the complexities of modern artificial intelligence systems, which rely on continuous data processing and autonomous agents. These agents can execute tasks and make decisions without direct human oversight. If their access is poorly managed or compromised, they could accidentally take harmful actions or create openings for attackers. Because these models operate differently from standard software, they require specialized protection that focuses on data integrity and strict identity management. To address these emerging threats, security must be built directly into the foundational hardware and physical servers rather than added as an afterthought. Companies are focusing on hardware level trust and preparing for future risks by integrating advanced cryptographic measures. Additionally, applying strict access controls to these agents, ensuring they only have the minimum permissions necessary, is critical. Many organizations are also keeping sensitive tasks on their own physical servers to maintain tighter control over their data and systems. Ultimately, successfully deploying artificial intelligence requires treating security as a core component of the initial system design, ensuring that these tools remain safe and controlled by the organization.

The Future of Data Stewardship in an AI‑Driven Era

Data stewardship has traditionally been the backbone of effective data governance, focusing on ensuring information quality, consistency, and compliance across an organization. Historically, this meant that data stewards managed operational tasks like defining business terms, monitoring data accuracy, and resolving routine issues. They acted as the essential link connecting formal governance policies with everyday business practices. However, the landscape is shifting rapidly. With the rise of advanced analytics, artificial intelligence, and generative AI models, the context in which these professionals work has transformed completely. Today, companies depend on high quality data not just for basic reporting, but to power automated decisions and sophisticated AI driven products. This shift significantly raises the stakes for how information is managed, explained, and trusted. Consequently, the role of a data steward is evolving beyond traditional domain expertise. It now requires strong communication skills, cross functional collaboration, and a deep understanding of emerging technologies. While artificial intelligence can help automate certain routine stewardship tasks and offer intelligent recommendations, it also introduces entirely new governance risks and ethical obligations. Moving forward, successful data stewardship will depend on balancing these new automated capabilities with the careful human oversight required to maintain trust and security in an increasingly complex digital environment.

Why Security Debt May Be a Bigger Risk Than Security Spend

Organizations frequently invest heavily in protecting their digital assets, yet this spending often increases system complexity rather than true safety. In a recent interview, security expert Selim Aissi explains that this accumulated risk is known as security debt, and it can be far more dangerous than having a limited budget. Security debt typically grows when companies layer too many different tools without improving automation or reducing underlying operational complexity. While many organizations appear mature on paper by focusing strictly on compliance checklists, true resilience requires building systems that can actively withstand and recover from actual threats. For instance, rather than simply encrypting stored information, a truly resilient approach protects data throughout its entire lifecycle, whether it is moving, in use, or resting. When communicating these issues to company leadership, security professionals must avoid focusing on pure technical metrics. Instead, they should frame security debt in clear business terms, explaining exactly how unpatched systems or overly complex tools could lead to significant downtime or revenue loss. As technologies like artificial intelligence continue to evolve before standard safety guidelines are established, managing this security debt becomes increasingly critical to maintaining stable, secure, and resilient business operations over the long term.

The hidden capacity inside aging data centers: Uncovering performance, capacity, and capital through efficiency

The piece argues that many operators are struggling to find enough power for growing AI and high‑performance computing needs, largely because grid connections now take years and utilities demand steep deposits. With colocation vacancy near zero and new builds already pre‑committed, the author suggests that the most practical option is to unlock unused capacity inside older data centers. These facilities often waste significant energy through outdated cooling designs, low rack densities, and high PUE levels, which translates directly into higher operating costs. Instead of waiting for new power allocations, operators can use utility‑funded energy audits to pinpoint inefficiencies at no cost. Once those blind spots are identified, straightforward improvements—such as aisle containment, raising temperature setpoints, upgrading fan systems, and modernizing UPS units—can reclaim meaningful stranded power. Utilities frequently offer rebates and custom incentives to help fund these upgrades, turning long payback periods into much shorter, more manageable ones. The article’s core message is that modernizing legacy sites is both financially sensible and operationally necessary. By improving efficiency, operators gain usable compute capacity, reduce electricity expenses, and cut carbon emissions, all without relying on new grid connections that may be years away.

Getting a stranger’s phone kicked off the cellular network costs a few dollars

Researchers at Michigan State University and partner schools have uncovered critical vulnerabilities in how cellular carriers manage lost and stolen device reporting. According to their findings, an attacker can easily and cheaply block a stranger’s device from cellular networks. By exploiting weaknesses across devices, carrier reporting portals, and cross-carrier block lists, the researchers demonstrated that anyone can remotely disconnect a device for just a few dollars, without needing physical access to it. The core issue lies in the 15-digit serial number (IMEI) embedded in every cellular device. Carriers accept lost-device reports based on thin identity checks, allowing attackers to use anonymous prepaid accounts. Furthermore, the system only verifies brief network activity rather than actual ownership, and surprisingly, even non-phone devices like smart home alarm panels can be targeted and blocked without notifying the owner. In one test, the team successfully blocked unreleased smartphones by acquiring their IMEIs from supply chain databases. The researchers proposed several fixes, such as stricter device certification to prevent unauthorized IMEI leakage, mandatory government ID verification for reporting portals, and better cross-carrier record sharing to establish trust. The findings highlight a pressing need for stronger security protocols in cellular network infrastructure.

Daily Tech Digest - September 10, 2026

Quote for the day:

"What you leave out is just as important as what you leave in." -- Jason Fried

🎧 Listen to the audio debrief on YouTube

▶ Play Audio Digest

Duration: 23 mins • Perfect for listening on the go.

Post-quantum cryptography adoption and the national security implications

As quantum computers rapidly advance, they are turning theoretical vulnerabilities in modern encryption into immediate real-world threats. Experts warn that the transition to post-quantum cryptography must begin today, even if fully capable systems remain several years away. Because building these massive machines requires immense capital and infrastructure, their use will largely be restricted to nation-states and powerful corporations rather than everyday cybercriminals. This dynamic creates a severe national security risk. Hostile governments can routinely harvest encrypted data right now with the clear intention of decrypting it later when the technology fully matures. While large banks and federal agencies will likely prioritize upgrading their defenses, smaller targets like local utilities, regional hospitals, and critical manufacturing facilities often lack the resources or perceived risk to invest in new security standards. This leaves a dangerous gap in collective defense that state-sponsored actors can exploit for economic espionage or infrastructure disruption. To combat this uneven landscape, experts suggest enforcing strict government mandates, integrating updated algorithms by default into cloud services, increasing executive awareness, and expanding academic training. Addressing these vulnerabilities early ensures that critical networks remain secure, proving that immediate preparation is absolutely essential for long-term national security.

The need to fortify cloud integrity as cracks increase

As organizations rapidly integrate artificial intelligence and complex networking models, managing cloud security is becoming increasingly difficult. Jim Reavis, chief executive of the Cloud Security Alliance, notes that while modern cloud technology is highly capable, the operating structures surrounding it remain fragmented and messy. A major recurring issue is the shared responsibility model. Many companies mistakenly assume their cloud providers handle all security, yet customers often carry the bulk of the burden for protecting their data, applications, and user identities. The rapid rise of artificial intelligence complicates this further. Because these predictive tools are prone to errors and unintended actions, companies must establish clear boundaries, defined goals, and strict oversight rather than expecting the technology to police itself. Reavis highlights the concept of limiting automated systems by introducing strict autonomy rules, ensuring they only perform specific, approved tasks to prevent accidental damage or data loss caused by simple misconfigurations. Furthermore, outdated operational technology and disconnected internal teams create dangerous blind spots. When security, risk, and development departments operate in isolation, they leave cracks that intruders easily exploit. To safely adopt new capabilities, businesses must modernize their structural operations, unify their risk management strategies, and consistently maintain human control across their digital systems.

What AI Is Revealing About Your Bank’s Transformation

Financial institutions are moving artificial intelligence from testing phases into daily operations, but this shift is exposing hidden flaws in how these organizations function. The technology itself is not creating new problems; rather, it is shining a light on old, unresolved issues from past attempts to modernize. Many banks upgraded their digital tools over the years while leaving their internal departments disconnected. Because these separate systems do not share information smoothly, the resulting environment is too fragmented for advanced tools to work properly. As a result, companies discover that while their new technology is ready to go, their internal foundations are not. Banks that previously took the time to truly connect their systems are now seeing clear, measurable benefits. Meanwhile, those that simply pasted new tools over old habits are struggling to see real value. The focus is now moving away from programs that simply offer advice toward systems that actively manage routine tasks. To succeed today, these banks must stop viewing this as just a technology issue and recognize it as a fundamental operational challenge. Strengthening their internal foundations will allow them to actually improve customer experiences and stay ahead in the market.

Backlogs? Where We’re Going We Don’t Need Backlogs

This episode of the CISO Series Podcast features producer David Spark and co-host Steve Zalewski alongside Varsha Agrawal, head of information security at Prosper Marketplace. They explore the challenging reality of artificial intelligence vendors and the growing issue of lock-in. While businesses hope AI will seamlessly clear backlogs and save time, attendees at AI summits often leave with more questions than answers, realizing no magical solution currently exists. The hosts discuss the risk of handing over critical workflows, customer experiences, and data models to external vendors whose incentives might suddenly shift. Agrawal argues that vendor lock-in with AI is uniquely unpredictable because pricing models and the very existence of the tools frequently change, making it impossible to evaluate long-term costs upfront. She highlights that lock-in extends beyond data and contracts—it deeply affects employees who become accustomed to specific tools and workflows. Instead of blindly trusting AI solutions, the panel stresses the importance of having confidence in a system's constraints and building organizational readiness to switch tools when necessary. Furthermore, the episode briefly touches on boardroom communication, noting that true security governance requires boards to ask critical questions about detection and recovery rather than relying on oversimplified dashboards.

Leap second proposal will keep software stacks in sync

Global timekeeping experts are preparing to vote on a crucial proposal to end the practice of adding or subtracting leap seconds to Coordinated Universal Time. For decades, scientists added leap seconds to keep atomic clocks synchronized with the Earth's gradually slowing rotation. However, because the planet's rotation has recently accelerated, timekeepers now face the unprecedented prospect of applying a negative leap second. This poses a significant threat to global digital infrastructure. Computer systems, databases, and interconnected software applications were never designed to subtract time, and doing so could trigger widespread system failures, database corruption, and major outages across financial networks and cloud platforms. To prevent these risks, the General Conference on Weights and Measures will vote to make coordinated time continuous starting in May 2027. This change would allow atomic time to drift slightly from the Earth's physical rotation over centuries, up to a maximum of one hour. Technology analysts strongly support this transition, arguing that preserving exact astronomical time synchronization is no longer worth the severe operational risks to modern enterprise technology. Passing the proposal ensures long term stability and predictability for the countless computer systems that run our highly connected modern world.

Beyond shared responsibility: When AI acts, who owns the blast radius?

As artificial intelligence evolves from answering questions to actively executing tasks, the traditional shared-responsibility models used for cloud computing are no longer sufficient. Cloud security models historically divided duties by infrastructure layers, with vendors securing the environment and customers securing their data. However, agentic AI operates differently, distributing authority across complex chains of models, platforms, and partners at machine speeds. Today, an AI agent might possess legitimate access and permissions but still produce unintended or harmful business outcomes, separating authorization from the actual intent and final result. Because these systems now hold agency within business processes—capable of accessing data, calling tools, and executing thousands of steps autonomously—the industry desperately needs a new shared-accountability framework. This emerging model must clearly define who authorizes actions, who can intervene, and who ultimately owns the consequences when something goes wrong. Security platforms are racing to become the control layer, aiming to validate identity and contain runtime behaviors. Yet, organizations remain accountable for defining acceptable outcomes and managing recovery when AI systems trigger unforeseen events. Ultimately, establishing clear ownership across every automated handoff is critical before deploying these powerful, independent agents into production environments.

Retail colo in the age of AI: One size does not fit all

The rapid expansion of artificial intelligence is fundamentally changing how retail colocation data centers operate around the world, proving that standardized infrastructure is no longer sufficient. Historically, colocation providers offered uniform spaces with predictable power and cooling limits, which worked perfectly for traditional enterprise applications. However, artificial intelligence introduces workloads that demand significantly higher power density and advanced cooling methods, such as liquid cooling systems. Providers are realizing that a single operational model cannot accommodate these extreme variations. While some customers require massive clusters for training complex models, others need smaller setups closer to end users for swift inference tasks. Consequently, retail colocation facilities must become much more flexible. They need to redesign their environments to support diverse requirements within the same building, balancing specialized zones with traditional racks. This essential shift requires strategic investments in upgraded power distribution and innovative thermal management systems. By moving away from rigid approaches, data center operators can successfully cater to the unique demands of artificial intelligence without alienating their conventional enterprise clients. Ultimately, embracing true adaptability allows colocation providers to remain competitive, ensuring they can support the next generation of computing while maintaining sustainable and highly efficient operations across their diverse customer base.

80% of AI projects fail, and Gallagher’s India CIO says he knows why

Many enterprise artificial intelligence initiatives fall short of expectations because companies focus on the technology rather than the core business problem. According to Julen Mohanty, a technology leader at the insurance firm Gallagher, roughly 80% of AI projects fail for this exact reason. Instead of finding a practical use case that increases revenue, reduces costs, or manages risk, organizations often adopt the latest tools and then search for places to apply them. Similarly, starting a project simply to reduce headcount is a misguided approach. The real goal should be to improve the underlying process. While automation can drastically speed up tasks like proposal generation and claims processing, human oversight remains vital. Machines can perform repetitive work efficiently, but accountability must always rest with people. A successful strategy requires measuring a process before automating it to ensure real efficiency gains are possible. Furthermore, robust data governance must come first, as data is only valuable when a company knows how to connect it to a specific outcome. Ultimately, a collaborative company culture and strong security controls are just as important as the chosen platform. By keeping humans in the loop and solving real problems, businesses can implement these advanced systems successfully.

AI notetakers at work could leave companies at risk for lawsuits

AI note-taking applications have become popular workplace tools for recording meetings and generating helpful summaries, but their rapid rise has sparked significant privacy concerns and complex legal challenges. According to attorney Brian McGinnis, multiple lawsuits against vendors like Otter, Fireflies, and Granola focus on whether these tools unlawfully capture communications without adequate notice or proper consent. A major issue is how conversation data is subsequently processed, particularly if it is used to train AI models or create highly regulated biometric voiceprints. These specific practices potentially violate federal wiretapping statutes and strict state laws, such as the Illinois Biometric Information Privacy Act and California's two-party consent rules, which require every single participant to agree to being recorded. While an outright ban on AI notetakers is highly unlikely, companies face substantial risks if they allow employees to freely deploy these applications without clear operational guidelines. To mitigate legal exposure, McGinnis advises organizations to establish comprehensive internal policies governing AI usage. Businesses should ensure employees only use approved tools, enable all built-in notice features, and strictly obtain explicit consent from all meeting participants before recording begins. As the technology expands into wearable devices, navigating the complex rules around privacy and recording consent will remain a critical, ongoing challenge for employers.

The five important tools for controlling AI costs

As generative artificial intelligence becomes a standard feature in modern software applications, managing the associated computing costs has become a critical challenge for engineering teams. Fortunately, there are five practical methods to keep these expenses under control without sacrificing overall performance. First, teams should use model routing, which directs simpler tasks to smaller, cheaper models rather than relying on the most powerful, expensive option for everything. Second, semantic caching helps by identifying identical user intents, even when phrased differently, and serving previously stored answers to bypass the AI entirely. Third, prompt caching allows developers to keep essential background data stored directly in the AI engine's memory, eliminating the need to repeatedly send and pay for the same context. Fourth, practicing prompt discipline through data filtering ensures that only the most relevant information reaches the AI, which cuts down on wasteful input charges. Finally, setting strict response constraints forces the AI to output exactly what is needed, like pure data, instead of generating polite but expensive conversational filler. By implementing these five core strategies, developers can build smart, reliable tools while maintaining a firm grip on their budgets, ensuring that technological progress does not lead to unexpected financial strain over time.