Daily Tech Digest by Kannan Subbiah: IT skill

Showing posts with label IT skill. Show all posts

Daily Tech Digest - April 30, 2026

Quote for the day:

"You've got to get up every morning with determination if you're going to go to bed with satisfaction." --George Lorimer

🎧 Listen to this digest on YouTube Music

▶ Play Audio Digest

Duration: 15 mins • Perfect for listening on the go.

The dreaded IT audit: How to get through it and what to avoid

The article "The dreaded IT audit: how to get through it and what to avoid" from IT Pro encourages organizations to reframe the auditing process as a strategic business asset rather than a burdensome cost center. Successfully navigating an audit requires maintaining a comprehensive, up-to-date inventory of all technology assets—including those used by remote workforces—to ensure security, safety, and insurance compliance. Even startups should establish structured auditing processes, as these evaluations proactively identify vulnerabilities and optimize operational efficiency. To streamline the experience, the article recommends prioritizing high-risk areas, such as software licensing, and utilizing customized spot checks instead of repetitive, standardized reviews that may fail to uncover meaningful insights. Crucially, leaders must adopt an open-minded approach to findings; the goal is to engage in transparent discussions about discovered issues rather than becoming defensive. Key pitfalls to avoid include treating the audit as a one-time administrative hurdle, relying on outdated manual tracking methods, and ignoring the gathered data. Instead, organizations should leverage audit results to inform staff training and drive practical improvements. By viewing the audit as a strategic opportunity for growth, companies can significantly strengthen their cybersecurity posture and ensure long-term sustainability in a digital economy.

Privacy in the AI era is possible, says Proton's CEO, but one thing keeps him up at night

In a wide-ranging interview at the Semafor World Economy Summit, Proton CEO Andy Yen addressed the critical tension between the rapid advancement of artificial intelligence and the fundamental right to digital privacy. Yen voiced significant concerns regarding the current AI trajectory, arguing that the industry's reliance on massive data harvesting inherently threatens individual security. He advocated for a paradigm shift toward "privacy-first AI," where processing occurs locally on user devices or through end-to-end encrypted frameworks to ensure that personal information remains inaccessible to service providers. Unlike the advertising-driven models of Silicon Valley giants, Yen highlighted Proton’s commitment to a subscription-based business model, which avoids the ethical pitfalls of monetizing user data. He also explored the "privacy paradox," observing that while users value their data, they often succumb to the convenience of free platforms. To counter this, Proton is expanding its ecosystem with tools like encrypted email and small language models designed specifically for security. Ultimately, Yen emphasized that the future of the digital economy hinges on stricter regulatory enforcement and the adoption of decentralized technologies that empower users with absolute control over their information, rather than treating them as products to be sold.

Outsourcing contracts weren't built for AI. CIOs are renegotiating now

The rapid advancement of generative artificial intelligence is necessitating a major overhaul of IT outsourcing agreements, as traditional contracts centered on headcount and billable hours prove incompatible with AI-driven efficiency. This InformationWeek article explains that while service providers promise productivity gains of up to 70%, legacy full-time equivalent (FTE) models fail to account for this increased output, leading CIOs to aggressively renegotiate for outcome-based pricing. This shift allows organizations to pay for specific results rather than human time, yet it introduces significant legal complexities. Key concerns include data sovereignty—where proprietary data might inadvertently train a provider's large language model—and intellectual property risks regarding the ownership of AI-generated code. Furthermore, the ability of AI to automate routine tasks is prompting some enterprises to bring previously outsourced functions back in-house, as smaller internal teams can now manage workloads that once required massive offshore cohorts. To navigate these challenges, technical leaders are implementing "gain-sharing" frameworks and rigorous governance standards to manage risks like AI hallucinations and liability. Ultimately, CIOs are assuming a more central role in procurement to ensure that vendor incentives align with genuine innovation and that the financial benefits of automation are captured by the enterprise.

Bad bots make up 40% of internet traffic

The "2026 Thales Bad Bot Report: Bad Bots in the Agentic Age" reveals a transformative shift in internet traffic, where automated activity now accounts for 53% of all web interactions, surpassing human traffic for the second consecutive year. Malicious "bad bots" alone comprise 40% of global traffic, highlighting a growing threat landscape. A critical finding is the 12.5x surge in AI-driven bot attacks, fueled by the rapid adoption of agentic AI which blurs the lines between legitimate and harmful automation. These advanced bots are increasingly targeting APIs, with 27% of attacks now bypassing traditional interfaces to exploit backend logic directly at machine speed. The financial services sector remains the most vulnerable, suffering 24% of all bot attacks and nearly half of all account takeover incidents. Thales experts, including Tim Chang, emphasize that the primary security challenge has evolved from simple bot identification to the complex analysis of behavioral intent. As AI agents emerge as a new traffic category, organizations must transition to proactive, intent-based defenses that can distinguish between helpful AI agents and malicious automation. This machine-driven era necessitates deeper visibility into API traffic and identity systems to maintain trust and security across modern digital infrastructures.

Incentive drift: Why transformation fails even when everything looks green

In the article "Incentive Drift: Why Transformation Fails Even When Everything Looks Green," Mehdi Kadaoui explores the paradoxical failure of IT transformations that appear successful on paper. The central challenge is "incentive drift"—the structural separation of authority from accountability that leads organizations to optimize for project delivery rather than business value. This drift manifests through several destructive patterns: the "ownership vacuum," where strategy and execution are disconnected; the "budgetary firewall," which isolates capital spending from operational costs; and "language capture," where success definitions are subtly redefined to ensure "green" status. Kadaoui argues that "collective amnesia" often follows, as organizations quietly lower their expectations to avoid acknowledging failure. To resolve this, he proposes making drift "structurally expensive" through three key mechanisms. First, a "value prenup" requires operational leaders to explicitly own and sign off on intended outcomes before development begins. Second, a "cost mirror" forces transparency across budget ledgers. Finally, a "semantic anchor" ensures original goals are read aloud in every governance meeting to prevent meaning erosion. By grounding digital transformation in rigid accountability and linguistic clarity, leadership can ensure that technological outputs translate into genuine, durable enterprise value.

How to Be a Great Data Steward: 6 Core Skills to Build

The article "Core Data Stewardship Skills to Build" emphasizes that effective data stewardship requires a unique blend of technical proficiency, business acumen, and interpersonal skills. High-performing stewards act as "purple people," bridging the gap between IT and business by translating complex technical standards into actionable business practices. Key operational activities include identifying and documenting Critical Data Elements (CDEs), aligning them with precise business terms, and performing data profiling to identify quality issues. Beyond basic documentation, stewards must master data classification to ensure regulatory compliance with frameworks like GDPR or HIPAA. Analytical thinking is essential for interpreting patterns and uncovering root causes of data inconsistencies, while strong communication skills enable stewards to foster a collaborative, data-driven culture. Furthermore, literacy in adjacent domains such as metadata management, master data management (MDM), and the use of modern data catalogs is vital. Ultimately, the role is outcome-driven; stewards do not just manage data for its own sake but focus on ensuring data health to drive measurable organizational value. By combining attention to detail with strategic consistency, data stewards serve as the essential operational guardians who transform raw data into a reliable, high-quality strategic asset for their organizations.

Researchers unearth industrial sabotage malware that predated Stuxnet by 5 years

Researchers from SentinelOne recently uncovered a sophisticated malware framework, dubbed "Fast16," that predates the infamous Stuxnet worm by five years. Active as early as 2005, this discovery shifts the timeline of state-sponsored industrial sabotage, proving that nation-states were deploying cyberweapons against physical infrastructure much earlier than previously understood. Unlike typical espionage tools designed for data theft, Fast16 was engineered for strategic sabotage by targeting high-precision floating-point arithmetic operations within engineering modeling software. By corrupting the logic of the Floating Point Unit (FPU), the malware produced subtly altered outputs in complex simulations, potentially leading to catastrophic real-world failures. The researchers identified three specific targeted engineering programs, including one previously associated with Iran’s AMAD nuclear program and another widely used in Chinese structural design. The modular nature of Fast16, which utilizes encrypted Lua bytecode, underscores its advanced design and national importance. This finding highlights a historical precedent for cyberattacks on critical workloads in fields such as advanced physics and nuclear research. Ultimately, Fast16 serves as a significant harbinger for modern industrial sabotage, demonstrating that the transition from strategic espionage to physical disruption in cyberspace was already in full swing two decades ago, long before Stuxnet gained global notoriety.

How AI Is Transforming Business Continuity and Crisis Response

Charlie Burgess’s article, "How AI Is Transforming Business Continuity and Crisis Response," explores the pivotal role of artificial intelligence in navigating the complexities of modern digital and physical risks. As businesses face increasingly non-linear threats, from supply chain disruptions to cyber incidents, the abundance of generated data often leads to information overload. AI addresses this by acting as a sophisticated data analysis tool that parses vast information streams to identify hidden patterns and suppress low-priority noise. This allows crisis teams to focus on critical alerts and early warning signs. Furthermore, AI enhances situational awareness and coordination by correlating disparate system inputs and surfacing standardized playbook responses. During active incidents, technologies like AI-powered cameras provide real-time visibility, aiding in personnel safety and evacuation efforts. Beyond immediate response, AI suggests optimized recovery paths and strategic resource allocation, fostering long-term operational resilience. Ultimately, the integration of AI is not intended to replace human judgment but to empower decision-makers with actionable insights and agility. By bridging the gap between data collection and decisive action, AI transforms business continuity from a reactive necessity into a proactive, evidence-based strategic asset that safeguards both personnel and organizational stability in an unpredictable global landscape.

Europe Gliding Toward Mandatory Online Age Verification

The European Commission is accelerating its push toward mandatory online age verification, driven by the Digital Services Act's requirements to protect minors from harmful content. Central to this initiative is a new age assurance framework and a "technically ready" open-source mobile app designed to allow users to prove they are over a certain age using national identity documents without disclosing their full identity. However, this transition faces intense scrutiny. Security researchers recently identified significant vulnerabilities in the commission's prototype app, labeling it "easily hackable." Furthermore, privacy advocates, such as representatives from Tuta, warn that centralized age verification creates a lucrative "gold mine" for hackers, potentially exacerbating risks like phishing and identity theft. Despite these concerns, European officials like Henna Virkkunen emphasize that the DSA demands concrete action over mere terms of service, particularly following allegations that platforms like Meta have failed to adequately exclude children under thirteen. As several European nations consider raising minimum age requirements for social media, the commission continues to advocate for "robust and non-discriminatory" verification tools that can be integrated into national digital wallets, insisting that ongoing security testing will eventually yield a reliable solution for safeguarding the digital environment for children.

CodeGuardian: A Model Context Protocol Server for AI-Assisted Code Quality Analysis and Security Scanning

"CodeGuardian: A Model Context Protocol Server for AI-Assisted Code Quality Analysis and Security Scanning" introduces a breakthrough tool designed to integrate enterprise-grade security and quality checks directly into AI-powered development environments. Authored by Madhvesh Kumar and Deepika Singh, the article details how CodeGuardian leverages the Model Context Protocol (MCP) to extend coding assistants with eleven specialized analysis tools. This integration eliminates the friction of context-switching by allowing developers to execute security scans, identify hardcoded secrets across multiple layers, and generate compliant Software Bill of Materials (SBOM) using simple natural language prompts. Unlike traditional static analysis tools that merely flag issues, CodeGuardian provides context-aware, "drop-in" code remediations tailored to a project's specific framework and style. A core feature is its cross-layer security reporting, which aggregates findings into a single risk score, exposing systemic vulnerabilities that isolated scanners often miss. By shifting security "left" into the immediate coding workflow, the tool empowers developers to build more resilient software while maintaining high delivery velocity. Ultimately, CodeGuardian represents a pivot toward "agentic" security, where AI assistants act as proactive guardians of code integrity throughout the development lifecycle, effectively bridging the gap between rapid feature delivery and robust organizational compliance.

Daily Tech Digest - April 18, 2026

Quote for the day:

"Vision isn’t a starting point. It’s what you create every day through your actions." -- Gordon Tregold

🎧 Listen to this digest on YouTube Music

▶ Play Audio Digest

Duration: 21 mins • Perfect for listening on the go.

The 10 skills every modern integration architect must master

The article "The 10 skills every modern integration architect must master" highlights the fundamental shift of enterprise integration from a back-end technical role to a vital strategic capability. Author Sadia Tahseen argues that modern integration architects must transition from traditional middleware specialists into multifaceted leaders who act as the "digital nervous system" of the enterprise. The ten essential competencies include adopting a long-term platform mindset over isolated project thinking and mastering alongside cloud-native capabilities. Architects must prioritize and event-driven designs to decouple systems effectively, while utilizing canonical data modeling and robust governance to ensure scalability. Security-by-design, business-centric observability, and planning for continuous change are also crucial for maintaining resilience in volatile SaaS environments. Furthermore, integrating DevOps automation, gaining deep business domain expertise, and exerting enterprise-wide leadership allow architects to bridge the gap between technical execution and business priorities. Ultimately, those who master these diverse skills—ranging from coding to strategic influence—enable their organizations to adapt quickly and harness the full power of modern technology investments. By moving beyond simple app connectivity to complex workflow design, these professionals ensure that integration platforms remain scalable, secure, and ready for the emerging era of AI-driven transformation.

Nobody told legal about your RAG pipeline -- why that's a problem

The widespread adoption of Retrieval-Augmented Generation (RAG) as the standard architecture for enterprise AI has created a significant governance gap, as engineering teams prioritize performance while legal and compliance departments remain largely disconnected from the process. Although legal teams may approve AI vendors, they often lack oversight of the actual data pipelines and , leading to a state where RAG systems are "unowned" and unaudited. This structural misalignment is problematic because regulators like the SEC and FTC increasingly demand granular traceability, requiring organizations to prove the origin and handling of underlying content. Traditional legal concepts, such as document custodians and chain of custody, do not easily translate to the world of embeddings and vector retrieval, making e-discovery and compliance audits exceptionally difficult. Furthermore, specific technical processes like pose severe risks; when data is embedded into model weights, it cannot be selectively deleted, potentially violating "" mandates under regulations like GDPR. To mitigate these risks, companies must move beyond simple accuracy and establish a comprehensive "retrieval trail" that includes source versions, model prompts, and human review steps. Without this integrated approach to AI governance, the "ragged edges" of these pipelines could lead to significant legal and regulatory surprises.

Lakehouse Tower of Babel: Handling Identifier Resolution Rules Across Database Engines

The article "Lakehouse Tower of Babel" explores a critical interoperability gap in modern , where diverse compute engines like Spark, Snowflake, and Trino interact with shared data formats such as Apache Iceberg. Although open table formats successfully standardize data and metadata, they fail to align the fundamental SQL identifier resolution and catalog naming rules across different database platforms. This "Tower of Babel" effect arises because engines vary significantly in their handling of casing; for instance, Spark is case-preserving, while Trino normalizes identifiers to lowercase, and Flink enforces strict case-sensitivity. Such inconsistencies often lead to situations where tables or columns become invisible or unqueryable when accessed by a different tool, resulting in significant pipeline reliability challenges. To mitigate these interoperability failures, the author recommends that organizations enforce a strict, uniform naming convention—specifically using lowercase characters with underscores—and treat identifier normalization as a formal part of their data contracts. Additionally, architects should proactively adjust engine-specific configuration settings and implement cross-stack validation via automated CI jobs to guarantee end-to-end portability. Ultimately, a seamless lakehouse experience requires more than just unified storage; it demands a reconciliation of the underlying philosophical divides in how various engines resolve and interpret SQL identifiers within shared catalogs.

Google’s Merkle Certificate Push Signals a Rethink of Digital Trust

Google’s initiative to advance Merkle Tree Certificates (MTCs) through the IETF’s PLANTS working group represents a foundational shift in digital trust architectures, moving away from traditional X.509 certificate chains toward an inclusion-based validation model. As the tech industry prepares for the post-quantum cryptography (PQC) era, existing Public Key Infrastructure (PKI) faces significant scaling challenges because quantum-resistant algorithms produce much larger signatures. These larger certificates increase TLS handshake overhead, heighten bandwidth demands, and cause noticeable latency across content delivery networks and mobile clients. MTCs address these issues by replacing linear chains with compact Merkle proofs anchored in signed trees, significantly reducing transmission overhead while maintaining high security. This evolution aligns with modern Certificate Transparency ecosystems and necessitates a broader "crypto-agility" within organizations, as the transition is an architectural migration rather than a simple algorithm swap. By shifting to this high-velocity, inclusion-based model, Google and its partners aim to ensure that security and system performance remain aligned in a world of shrinking certificate lifetimes and tightening revocation timelines. Ultimately, this rethink of digital trust ensures that distributed systems can scale efficiently while remaining resilient against future quantum threats, provided enterprises move beyond simple inventories to understand their deeper cryptographic dependencies.

DevOps Playbook for the Agentic Era

represents a transformative shift from traditional automation to autonomous software engineering, where AI agents act as intelligent collaborators rather than mere scripted tools. This Microsoft DevBlog article outlines the core principles and strategic evolution required to integrate these agents into the modern DevOps lifecycle. It emphasizes that robust DevOps foundations—including automated testing and infrastructure as code—are essential prerequisites, as agents amplify both healthy and broken practices. The strategic direction focuses on evolving the engineer's role from a code producer to a system designer and quality steward who orchestrates autonomous teams. Key practices include adopting specification-driven development, where structured requirements replace ad hoc prompts, and treating repositories as machine-readable interfaces with explicit skill profiles. Furthermore, the article highlights the necessity of active verifier pipelines that validate agent output against architectural standards and security constraints to mitigate risks like hallucinations and prompt injection. By progressing through a four-level maturity model, organizations can transition from reactive AI assistance to optimized, agent-native operations. Ultimately, Agentic DevOps seeks to redefine productivity by offloading cognitive overhead to specialized agents, allowing human teams to focus on high-value innovation while maintaining rigorous governance and system reliability in cloud-native environments.

Digital infrastructure shifts from spend to measurable value

In 2026, digital infrastructure strategy has pivoted from broad, ambitious spending to a disciplined focus on measurable business value and operational efficiency. As budgets tighten, organizations are moving away from parallel, uncoordinated modernization initiatives toward a maturing mindset that treats technology as a rigorous economic system. CIOs are now prioritizing "execution discipline" by consolidating platforms to eliminate tool sprawl, automating manual workflows, and implementing robust financial governance like FinOps to curb cloud cost leakage. This lean approach emphasizes extracting maximum value from existing assets and funding only those projects that demonstrate clear returns within six to twelve months. Critical foundations such as security, resilience, and data quality remain non-negotiable, but they are increasingly justified through risk mitigation and AI-readiness rather than sheer capacity expansion. The shift reflects a transition from digital ambition to digital justification, where success is defined by how intelligently infrastructure supports resilience and outcome-led growth. Ultimately, the winners in this era are not the companies launching the most projects, but those building governable, observable, and high-performing systems that minimize complexity while maximizing impact. Precision in decision-making and the ability to prove near-term ROI have become the primary benchmarks for modern enterprise leadership in a constrained environment.

The autonomous SOC: A dangerous illusion as firms shift to human-led AI security

In the article "The autonomous SOC: A dangerous illusion as firms shift to human-led AI security," author Moe Ibrahim argues that while a fully automated Security Operations Center is a tempting solution for talent shortages, it remains a fundamentally flawed concept. The core issue is that cybersecurity is not merely an execution problem but a complex decision-making challenge that demands nuanced organizational context. Ibrahim highlights that total autonomy risks significant business disruption, as algorithms lack the situational awareness to distinguish between a malicious threat and a critical business process. Consequently, the industry is pivoting toward a "human-on-the-loop" model, where human experts act as orchestrators who define policies and maintain oversight while AI manages scale and speed. This collaborative approach prioritizes transparency through three essential pillars: explainability, reversibility, and traceability. As organizations transition into "agentic enterprises" with AI agents across various departments, the need for human governance becomes even more critical to manage cross-functional risks. Ultimately, the future of security lies in empowering human analysts with machine intelligence rather than replacing them, ensuring that responses are not only fast but also accurate and accountable. This disciplined integration of capabilities avoids the dangerous pitfalls of unchecked automation and ensures long-term operational resilience.

The Golden Rule of Big Memory: Persistence Is Not Harmful

In the Communications of the ACM article "The Golden Rule of Big Memory: Persistence is Not Harmful," authors Yu Hua, Xue Liu, and Ion Stoica argue for a fundamental paradigm shift in how modern computer systems manage data. The authors propose that persistence should be embraced as the "Golden Rule"—a first-class design principle—rather than an auxiliary feature relegated to slower storage layers. Historically, system architects have viewed persistence as a "harmful" overhead that introduces significant latency and complicates memory management. However, the piece contends that this perspective is outdated in the era of byte-addressable non-volatile memory (NVM) and memory disaggregation. By integrating persistence directly into the memory hierarchy through innovative techniques like speculative and deterministic persistence, the authors demonstrate that systems can achieve DRAM-like performance without sacrificing durability. This holistic approach effectively flattens the traditional memory-storage wall, creating a unified pool that eliminates the bottlenecks of data movement and serialization. Ultimately, the authors conclude that making persistence a primary architectural goal is not only harmless but essential for the future of data-intensive applications. This shift simplifies full-stack software development and provides a robust, high-performance foundation for next-generation AI services, cloud-native databases, and large-scale distributed systems.

When Geopolitics Writes Your Compliance Roadmap

In the article "When Geopolitics Writes Your Compliance Roadmap," Jack Poller examines how shifting global power dynamics are fundamentally altering the cybersecurity regulatory landscape. Drawing from the NCC Group’s Global Cyber Policy Radar, the author argues that the era of reactive regulation is ending as three primary forces reshape compliance strategies: , integrated , and increased board-level legal accountability. Digital sovereignty is leading to a fragmented technology stack characterized by data localization mandates and strict supply chain controls. Meanwhile, AI security is increasingly embedded within existing frameworks rather than through standalone legislation, requiring organizations to apply rigorous security standards to AI systems as part of their broader resilience efforts. Crucially, regulations like DORA and NIS2 are transforming board responsibility from a vague goal into a strict legal obligation, often carrying personal liability for executives. Additionally, the normalization of state-sponsored offensive cyber operations adds a new layer of complexity to corporate defense strategies. To survive this volatile environment, organizations must move beyond traditional checklists and adopt evidence-led resilience programs that align cyber risk with geopolitical realities. Those failing to integrate these external pressures into their compliance roadmaps risk being left behind in an increasingly fractured and litigious digital world.

Microservices Without Tears: A Practical DevOps Playbook

"Microservices Without Tears: A Practical DevOps Playbook" serves as a strategic manual for organizations transitioning from monolithic systems to distributed architectures. The article posits that while microservices offer significant benefits like team autonomy and independent deployment cycles, they also act as an amplifier for both good and bad engineering habits. To avoid the operational "tears" associated with increased complexity, the author advocates for a foundation built on robust automation and clear organizational ownership. Central to this playbook is the emphasis on "right-sizing" service boundaries through domain-driven design, ensuring that teams are accountable for a service's entire lifecycle—from development to on-call support. Technically, the guide champions "boring" but reliable CI/CD pipelines and minimal Kubernetes manifests that prioritize essential health checks and resource limits. Furthermore, it highlights the necessity of observability, recommending the use of correlation IDs and "golden signals" to maintain system visibility. By standardizing communication through versioned APIs and adopting a "you build it, you run it" philosophy, teams can successfully manage the overhead of distributed systems. Ultimately, the post argues that architectural flexibility must be balanced with disciplined operational standards to ensure long-term resilience and speed without sacrificing system stability.

Daily Tech Digest - April 11, 2026

Quote for the day:

"To accomplish great things, we must not only act, but also dream, not only plan, but also believe." -- Anatole France

🎧 Listen to this digest on YouTube Music

▶ Play Audio Digest

Duration: 18 mins • Perfect for listening on the go.

AI agents aren’t failing. The coordination layer is failing

The article "AI agents aren't failing—the coordination layer is failing" asserts that the primary bottleneck in scaling AI is not the performance of individual agents, but rather the absence of a sophisticated "coordination layer." As organizations transition to multi-agent environments, relying on direct agent-to-agent communication creates quadratic complexity that leads to race conditions, outdated context, and cascading failures. To solve these issues, the author introduces the "Event Spine" pattern, a centralized architectural foundation using ordered event streams. This approach enables agents to maintain a shared state without direct queries, significantly reducing latency and redundant processing. Implementing this infrastructure reportedly slashed end-to-end latency from 2.4 seconds to 180 milliseconds and reduced CPU utilization by 36 percent. The article concludes that multi-agent AI is effectively a distributed system requiring the same explicit coordination frameworks that the industry found essential for microservices. Enterprises must invest in this "spine" now to prevent agent proliferation from turning into unmanageable chaos. By focusing on the infrastructure connecting these agents, developers can ensure that their AI systems work as a cohesive unit rather than a collection of competing, inefficient silos that are prone to failure at scale.

Agents don’t know what good looks like. And that’s exactly the problem.

In this O’Reilly Radar article, reflects on a discussion between Neal Ford and Sam Newman regarding the inherent limitations of agentic AI in software architecture. The central thesis is that while AI agents are exceptionally skilled at generating code and executing local tasks, they lack a fundamental understanding of what "good" looks like in a global architectural context. Agents typically optimize for immediate task completion, often neglecting long-term maintainability, systemic scalability, and the subtle trade-offs essential to sound design. This creates a significant risk where automated efficiency leads to architectural erosion and technical debt if left unchecked. Mezzalira argues that the solution lies not in making agents "smarter" in isolation, but in establishing robust human-led governance and automated guardrails that define and enforce quality standards. As agents handle more routine coding duties, the role of the human developer must evolve from a "T-shaped" specialist into a "Comb-shaped" professional who possesses both deep technical expertise and the broad systemic vision required to orchestrate these tools effectively. Ultimately, the article emphasizes that the true value of human engineers in the AI era is their unique ability to maintain architectural integrity and provide the contextual judgment that machines currently cannot replicate.

Understanding tokenization and consumption in LLMs

The article "Understanding and Consumption in LLMs" explains the fundamental role of tokenization in how large language models (LLMs) interpret user input and calculate costs. Tokenization involves breaking text into smaller subunits, such as word fragments or punctuation, allowing models to process diverse languages and complex syntax efficiently. This granular approach is critical because LLMs generate responses iteratively, token by token, and billing is typically based on the total sum of tokens in both the prompt and the resulting output. The author compares leading platforms like ChatGPT, Claude Cowork, and GitHub Copilot, noting that while they share core principles, their specific tokenization algorithms and pricing structures vary. For instance, ChatGPT uses for general efficiency, whereas GitHub Copilot is optimized for programming syntax. To manage costs and improve performance, the article suggests best practices for prompt engineering, such as using concise language, avoiding redundancy, and breaking complex tasks into smaller segments. Ultimately, a deep understanding of token consumption enables professionals to optimize their AI workflows, predict expenses accurately, and select the most appropriate platform for their specific organizational needs, whether for general content generation or specialized software development.

Data Centres Without the Compute

The article "Data Centres Without the Compute" explores a paradigm shift in data center architecture, moving away from traditional server-centric designs where compute, memory, and storage are tightly coupled. Stuart Dee argues that modern workloads, especially AI and real-time analytics, have exposed memory as a dominant constraint rather than compute. This shift is facilitated by advancements in photonics and the Innovative Optical and Wireless Network (IOWN), which dissolves physical boundaries through end-to-end optical paths. By replacing traditional electronic switching with all-optical networking, latency and energy consumption are significantly reduced, enabling memory disaggregation at scale. Consequently, data centers can evolve into specialized, software-defined environments where memory resides in dense, energy-efficient arrays that are accessed remotely by compute-heavy facilities. This "data-centric infrastructure" allows for dynamic resource composition across metropolitan distances, transforming the network into a memory backplane. Ultimately, the article suggests that the future of digital infrastructure lies in decoupling resources, allowing memory to be located where power and cooling are optimal while compute remains closer to users. This transition marks the end of the locality assumption, paving the way for a federated model where data centers serve as modular components within a broader optical system.

What Every Business Leader Needs to Understand About Sovereign AI

Sovereign AI is emerging as a critical strategic imperative for business leaders, transcending its role as a mere technical requirement to become a fundamental pillar of long-term resilience and competitive advantage. According to insights from Dataversity, sovereignty should be viewed as an offensive strategy rather than a defensive posture, enabling organizations to build robust compliance frameworks and mitigate significant risks such as reputational damage and legal fines. While many companies currently focus sovereignty efforts on data and infrastructure, a key shift involves extending this control to the intelligence layer—the AI models themselves—where crucial decision-making occurs. A hybrid sovereignty approach is recommended, balancing internal control over sensitive assets with external partnerships to foster innovation while avoiding vendor lock-in. By 2030, the global market for sovereign AI is projected to reach $600 billion, highlighting its potential to unlock new market opportunities and scale. For leaders, treating sovereignty as a structural necessity rather than discretionary spend is essential for ensuring AI accuracy and reliability. This proactive "sovereignty-by-design" methodology ultimately transforms regulatory compliance into business superiority, allowing enterprises to navigate a complex, fragmented global landscape while maintaining absolute ownership of their most valuable digital intelligence and future innovation.

Turning Military Experience Into Cyber Advantage

The blog post "Turning Military Experience Into Cyber Advantage" by Chetan Anand explores how the discipline and operational expertise of veterans translate into a strategic asset for the cybersecurity industry. Anand argues that cybersecurity should be viewed not merely as a technical IT function, but as enterprise risk management conducted within a digital battlespace—a concept inherently familiar to military personnel. Key attributes such as risk assessment, situational awareness, and structured decision-making under pressure map directly onto roles in security operations, threat modeling, and incident response. Furthermore, the article highlights the growing demand for military leadership in Governance, Risk, and Compliance (GRC) roles, where integrity and accountability are paramount. Veterans are encouraged to overcome common misconceptions, such as the necessity of coding skills, and focus on articulating their experience in business terms rather than military jargon. By prioritizing a problem-solving mindset and leveraging mentorship programs like ISACA’s, transitioning service members can bridge the gap between their tactical background and civilian career requirements. Ultimately, the piece positions military service as a foundational training ground for the rigorous demands of modern cyber defense, provided veterans effectively translate their unique skills into organizational value and business outcomes.

The Hidden ROI of Visibility: Better Decisions, Better Behavior, Better Security

In his article for SecurityWeek, Joshua Goldfarb explores the "hidden ROI" of cybersecurity visibility, arguing that its fundamental value extends far beyond traditional compliance and auditing functions. Using a personal anecdote about how home security cameras deterred a hostile neighbor, Goldfarb illustrates that visibility serves as a powerful psychological deterrent. When users and technical teams know their actions are being recorded, they are significantly more likely to adhere to security policies and avoid risky behaviors like visiting restricted sites or installing unvetted software. Beyond behavioral changes, comprehensive visibility across network, endpoint, and application layers—including APIs and AI capabilities—fosters more collaborative, data-driven relationships between security departments and application owners. This objective approach effectively shifts internal discussions from subjective friction to actionable risk management. Furthermore, high-quality data enables more informed decision-making and precise risk assessments, both of which are critical in complex, modern hybrid-cloud environments. Although achieving total transparency is often resource-intensive, Goldfarb emphasizes that the resulting honesty, improved organizational culture, and strategic clarity provide a distinct competitive advantage. Ultimately, visibility transforms security from a reactive technical function into a proactive organizational catalyst that encourages integrity and operational excellence across the entire enterprise ecosystem.

Out of the Shadows: How CIOs Are Racing to Govern AI Tools

The rise of ""—the unauthorized deployment of artificial intelligence tools by employees—presents a critical challenge for contemporary CIOs. Unlike traditional shadow IT, these autonomous systems frequently process sensitive data and make consequential decisions without oversight from legal or security departments. Research indicates that while over 90% of employees admit to entering corporate information into AI tools without approval, more than half of organizations still lack a formal governance framework. This gap leads to significant financial liabilities, with shadow AI breaches costing enterprises an average of $4.63 million. To combat this, CIOs are moving beyond restrictive measures to establish proactive governance playbooks. These strategies include forming cross-functional AI committees, implementing real-time discovery tools, and classifying applications into sanctioned, restricted, and forbidden categories. Furthermore, experts suggest that organizations must leverage AI to monitor AI, using automated assessment pipelines to keep pace with rapid innovation. Ultimately, the goal is to create a "frictionless" official path for AI adoption that renders the shadow path obsolete. By balancing the velocity of innovation with robust security controls, leadership can protect intellectual property while empowering the workforce to utilize these transformative technologies safely and effectively within a transparent, structured environment.

Smartphones as Micro Data Centers: A Creative Edge Solution?

The article "Smartphones as Micro Data Centers: A Creative Edge Solution?" by Christopher Tozzi explores the revolutionary potential of pooling the resources of billions of mobile devices to create decentralized, miniature data centers. By clustering the CPU, memory, and storage of smartphones, organizations can deploy flexible, low-cost infrastructure capable of hosting diverse workloads. This innovative approach is particularly well-suited for edge computing and AI inference, as it places processing power closer to end-users to minimize latency and enhance real-time analysis. Furthermore, repurposing discarded handsets offers significant sustainability benefits by reducing e-waste and avoiding the capital-intensive construction of traditional facilities. However, several technical hurdles remain, including software compatibility issues arising from the ARM-based architecture of mobile chips versus conventional x86 servers. Additionally, the lack of dedicated, high-capacity GPUs and the absence of mature clustering software currently limits the ability to handle heavy AI acceleration or large-scale enterprise tasks. Despite these limitations, smartphone-based micro-data centers represent a creative and efficient shift in digital infrastructure. As the demand for localized computing continues to surge, this crowdsourced model provides a viable, sustainable pathway for scaling the internet's edge while maximizing the utility of existing global hardware resources.

Why India’s AI future needs both sovereign control and heritage depth

, CEO of Articul8, outlines a strategic vision for India’s AI future that balances sovereign security with cultural heritage. He argues that India must develop sovereign models to safeguard critical infrastructure and national security while simultaneously building heritage models that utilize the nation’s vast linguistic and historical knowledge. This dual approach ensures both protection and global influence, serving billions across diverse markets. For enterprises, the focus must shift from generic foundation models, which often fail in high-stakes industrial contexts, to domain-specific AI trained on deep institutional knowledge. These specialized models provide the accuracy and security required for regulated sectors like energy, manufacturing, and banking. Subramaniyan identifies data fragmentation and the rapid pace of technological change as primary bottlenecks, suggesting that platform partners can help organizations absorb this complexity. Ultimately, India’s unique position—characterized by rapid infrastructure expansion and a wealth of untapped cultural data—offers a once-in-a-generation opportunity to lead in the global AI landscape. By encoding local regulatory and business contexts into AI frameworks, India can move beyond simple pilot projects to large-scale, production-ready deployments that drive real economic value while preserving its unique intellectual legacy and ensuring digital sovereignty.

Daily Tech Digest - December 17, 2025

Quote for the day:

"Don't worry about being successful but work toward being significant and the success will naturally follow." -- Oprah Winfrey

5 key agenticops practices to start building now

“AI agents in production need a different playbook because, unlike traditional apps, their outputs vary, so teams must track outcomes like containment, cost per action, and escalation rates, not just uptime,” says , chairman and CEO of . ... Architects, devops engineers, and security leaders should collaborate on standards for and for the initial rollout of AI agents. But expect capabilities to evolve, especially as the number of AI agents scales. As the agent workforce grows, specialized tools and configurations may be needed. ... Devops teams will need to define the minimally required configurations and standards for , observability, and monitoring for the first AI agents deployed to production. Then, teams should monitor their vendor capabilities and review new tools as AI agent development becomes mainstream. ... Select tools and train on the concepts of , provenance, and data quality. These areas will be critical to up-skilling IT operations to support incident and problem management related to AI agents. ... Leaders should define a holistic model of operational metrics for AI agents, which can be implemented using third-party agents from SaaS vendors and proprietary ones developed in-house. ... ser feedback is essential operational data that shouldn’t be left out of scope in and incident management. This data not only helps to resolve issues with AI agents, but is critical for feeding back into AI agent language and reasoning models.

The great AI hype correction of 2025

The pendulum from hype to anti-hype can swing too far. It would be rash to dismiss this technology just because it has been oversold. The knee-jerk response when AI fails to live up to its hype is to say that progress has hit a wall. But that misunderstands how research and innovation in tech work. Progress has always moved in fits and starts. There are ways over, around, and under walls. Take a step back from the launch. It came hot on the heels of a series of remarkable models that OpenAI had shipped in the previous months, including o1 and o3 (first-of-their-kind reasoning models that introduced the industry to a whole new paradigm) and Sora 2, which raised the bar for video generation once again. That doesn’t sound like hitting a wall to me. ... Even an AGI evangelist like , chief scientist and cofounder at the AI startup Safe Superintelligence and former chief scientist and cofounder at OpenAI, now highlights the limitations of , a technology he had a huge hand in creating. LLMs are very good at learning how to do a lot of specific tasks, but they do not seem to learn the principles behind those tasks, Sutskever said in an interview with Dwarkesh Patel in November. It’s the difference between learning how to solve a thousand different algebra problems and learning how to solve any algebra problem. “The thing which I think is the most fundamental is that these models somehow just generalize dramatically worse than people,” Sutskever said.

The future of responsible AI: Balancing innovation with ethics

Trust begins with explainability. When teams understand the reasons for a model’s behavior — the reasons behind a certain code being generated, a certain test being selected, a certain dataset being prioritized — they can validate it and fix it. Explainability matters to customers as well. Research shows that when customers are clear on when and how AI is influencing decisions, they trust the brand more. This does not require sharing the proprietary model architectures; it simply requires transparency around AI in the flow of the decision making. Another emerging pillar of trust is the responsible use of . In sensitive privacy environments, companies are generating domain specific synthetic datasets for experimentation. The LLM (large language model) powered agents can be used in multi-agent pipelines to filter the outputs for regulatory compliance, thematic compliance and accuracy of structure — all of which help teams train/fine-tune the model without compromising data privacy. ... Responsible AI is no longer just the last step in the workflow. It’s becoming a blueprint for how teams build it, release it, and iterate on it. The future will belong to organizations that think of responsibility as a design choice, not a compliance checkbox. The goal is the same whether it’s about using synthetic data safely, validating generative code, or raising overall explainability in workflows: to create AI systems that people trust and that teams can depend on.

Thriving in the unknown future

To navigate this successfully, we understood that our first challenge was one of mindset. How could we maintain agility of thinking and resilience, while also meeting our customers anticipated needs of a specific defined product on target deadlines? Since a core of our offering is technological excellence, which ensures unmatched data accuracy, depth of insight and business predictions, how could we insist on this high level of authority, with the swirling changes all around us? We approach our work from a new point of view, and with a great deal of curiosity and imagination. ... With all the hype around AI, it is easy for our customers and our organizations to expect it to achieve… everything. But, as professionals building these tools, we know this is not the case. Many internal stakeholders and customers might not understand the difference between predictive analytics, machine learning, and generative AI, leading to misaligned expectations. ... Although our product, R&D, data science, project management and customer success teams are each independent, we work cross functionally to foster the ability for swift action and change, when needed. Engineers, data scientists and product managers work together for holistic problem-solving. These collaborations are less formalized, instituted per project or issue, so colleagues feel free to turn to each other for assistance and still can remain focused on individual projects.

Tokenization takes the lead in the fight for data security

Because tokenization preserves the structure and ordinality of the original data, it can still be used for modeling and analytics, turning protection into a business enabler. Take private health data governed by for example: tokenization means that data canbeused to build pricing models or for gene therapy research, while remaining compliant. "If your data is already protected, you can then proliferate the usage of data across the entire enterprise and have everybody creating more and more value out of the data," Raghu said. "Conversely, if you don’t have that, there’s a lot of reticence for enterprises today to have more people access it, or have more and more AI agents access their data. Ironically, they’re limiting the blast radius of innovation. The tokenization impact is massive, and there are many metrics you could use to measure that – operational impact, revenue impact, and obviously the peace of mind from a security standpoint." ... While conventional tokenization methods can involve some complexity and slow down operations, Databolt seamlessly integrates with encrypted data warehouses, allowing businesses to maintain robust security without slowing performance or operations. Tokenization occurs in the customer’s environment, removing the need to communicate with an external network to perform tokenization operations, which can also slow performance.

Enterprises to prioritize infrastructure modernization in 2026

The rise of AI has heightened the importance of IT modernization, as many organizations are still reliant on outdated, legacy infrastructure that is ill-equipped to handle modern workload requirements, says tech solutions provider World Wide Technologies (WWT). ... A move to modernize data center infrastructure has many organizations are looking at private cloud models, according to the WWT report: “The drive toward private cloud is fueled by several needs, with one primary driver being greater data security and privacy. Industries like finance and government, which handle sensitive information, often find private cloud architectures better suited for meeting strict compliance requirements. ... There is also a move to build up network and compute abilities at the edge, Anderson noted. “Customers are not going to be able to home run all that AI data to their data center and in real time get the answers they need. They will have to have edge compute, and to make that happen, it’s going to be agents sitting out there that are talking to other agents in your central cluster. It’s going to be a very, distributed hybrid architecture, and that will require a very high speed network,” Anderson said. ... Such modernization needs to take into consideration power and cooling needs much more than ever, Anderson said. “Most of our customers are not sitting there with a lot of excess data center power; rather, most people are out of power or need to be doing more power projects to prepare for the near future,” he said.

How researchers are teaching AI agents to ask for permission the right way

Under permissioning appeared mostly with highly sensitive information. Social Security numbers, bank account details, and child names fell into this category. Participants withheld Social Security numbers almost half the time, even in tasks where the number would be necessary. The researchers noted that people often stayed cautious when the data touched on financial or identity related matters. This tension between convenience and caution opens the door to new risks when such systems move from controlled studies into production environments. Brian Sathianathan, CTO at Iterate.ai, said the risk extends far beyond the model itself. “Arguably the biggest vulnerability isn’t so much the permission system itself but the infrastructure that it all runs on. ... Accuracy alone will not solve security concerns in sensitive fields. Sathianathan said organizations need to treat permission inference as protected infrastructure. “Mitigation here, in practice, means running permission inference behind your firewall and on your hardware. You should treat it like your SIEM where things are isolated, auditable, and never outsourced to shared infrastructure. You can’t let the permission system learn from unvetted data.” ... “The paper shows that collaborative filtering can predict user preferences with high accuracy, which is good, but the challenge for regulated industries is more in ensuring that compliance requirements take precedence over learned patterns even when users would prefer otherwise.”

Bank Tech Planning 2026: What’s Real and What’s Hype?

Cybersecurity issues underpin every aspect of modern banking. With digital channels, cloud platforms and open APIs, financial institutions are exposed to increasingly sophisticated attacks, including ransomware, phishing and systemic fraud. Strong cybersecurity frameworks protect customer data, ensure regulatory compliance, and maintain operational continuity. ... Legacy core systems constrain banks’ ability to innovate, integrate with partners, and scale efficiently. Cloud-native or hybrid-core architectures provide flexibility, reduce maintenance burdens, and accelerate product delivery. By decoupling core functions from hardware limitations, banks gain resilience and the agility to respond quickly to market changes. ... Real-time payment infrastructure allows immediate settlement of transactions, eliminating delays inherent in batch processing. This capability is critical for consumer expectations, B2B cash flow, and operational efficiency. It also supports modern business needs, such as instant payroll, vendor disbursement, and high-frequency transfers. ,,, Modern banks rely on consolidated data platforms and advanced analytics to make timely, informed decisions. Predictive modeling, fraud detection and customer insights depend on high-quality, integrated data. Analytics also enables proactive risk management, operational efficiency and personalized customer experiences.

Are You a Modern Professional?

An overreliance on tech that would crimp professional development and lead to job losses. As well as holding AI to a higher ROI. “More than 90% of professionals said they believe computers should be held to higher standards of accuracy than humans,” the report notes. “About 40% said AI outputs would need to be 100% accurate before they could be used without human review, meaning that it’s still critical that humans continue to review AI-generated outputs.” ... Professionals are involved across the AI landscape—as developers, providers, deployers and users—as defined by the EU AI Act. “While this provides opportunities, it also exposes professionals to risks at every stage—from biases, hallucinations, dependencies, misuse and more,” notes Dr Florence G’Sell, professor of private law at the Cyber Policy Center at Stanford University. “Opacity complicates the situation, as it makes assessing model performance difficult. To mitigate these risks, organizations could seek independent external assessment. But developers are reluctant to provide auditors access to data sources, model weights and code. This limits the ability to evaluate and ensure compliance with responsible AI principles.” ... Uncertain regulatory issues are already taking a toll on professionals, with more than 60% of enterprises in the Asia-Pacific experiencing moderate to significant disruption to their IT operations.

Why The Ability To Focus Will Be Crucial For Future Leaders

Focus has become a fundamental value, as noise and excess have taken over our daily routines. Every notification, interruption or sense of urgency activates our brain’s alert system, diverting energy from the prefrontal cortex, the region responsible for decision making, planning and strategic thinking. In the process, strategic vision gives way to the micro decisions of the day-to-day. This is what some neuroscientists call a "fragmented attention" state, in which the brain reacts more than it creates. For leaders, this means you become reactive rather than innovative. ... Leaders who learn to regulate their own mental operating system can gain a decisive advantage and the ability to sustain clarity amid chaos. You can start with intentional pauses throughout the day—simple practices such as deep breathing, brief walks or moments of silence. Equally important is noticing when your mind drifts and deliberately working to bring it back. ... Modern leaders often overvalue expression and undervalue absorption. Yet, from a neurobiological standpoint, silence is not the absence of thought; it’s the synchronization of neural rhythms. One study found that periods of intentional quiet—no input, no analysis, no output—can activate the prefrontal cortex and strengthen the brain’s capacity for integration. Put another way: The mind reorganizes fragments into coherence only when it’s not forced to produce. In a culture addicted to immediacy, mental silence, time to recover and intentional breaks become a competitive advantage.

Daily Tech Digest - December 11, 2025

Quote for the day:

"We become what we think about most of the time, and that's the strangest secret." -- Earl Nightingale

SEON Predicts Fraud’s Next Frontier: Entering the Age of Autonomous Attacks

AI has become a permanent part of the fraud landscape, but not in the way many expected. AI has transformed how we detect and prevent fraud, from adaptive risk scoring to , but full autonomy remains out of reach. Fraud detection still depends on human judgment, such as weighing intent, interpreting ambiguity, and understanding context that no model can fully replicate. Fraud prevention is a complex interplay of data, intent, and context, and that is where human reasoning continues to matter most. Analysts interpret ambiguity, weigh risk appetite, and understand social signals that no model can fully replicate. What AI can do is amplify that capability. ... The boundary between genuine and synthetic activity is blurring. can now simulate human interaction with high accuracy, including realistic typing rhythms, believable navigation flows, and that replicate natural variance. The traditional approach of searching for the red flags no longer works when those flags can be easily fabricated. The next evolution in fraud detection will come from . By modelling how real users act over time, and looking at their rhythms, routines, and inconsistencies, we can identify the subtle deviations that synthetic agents struggle to mimic. It is the behavioural equivalent of knowing a familiar face in a crowd. Trust comes from recognition, not reaction.

The Invisible Vault: Mastering Secrets Management in CI/CD Pipelines

In the high-speed world of modern software development, Continuous Integration and Continuous Deployment (CI/CD) pipelines are the engines of delivery. They automate the process of building, testing, and deploying code, allowing teams to ship faster and more reliably. But this automation introduces a critical challenge: How do you securely manage the "keys to the kingdom"—the API tokens, , , and that your applications and infrastructure require? ... A single misstep can expose your entire organization to a devastating data breach. Recent breaches in CI/CD platforms have shown how exposed organizations can be when secrets leak or pipelines are compromised. As pipelines scale, the complexity and risk grow with them. ... The cryptographic algorithms that currently secure nearly all digital communications (like and used in ) are vulnerable to being broken by a sufficiently powerful quantum computer. While such computers do not yet exist at scale, they represent a future threat that has immediate consequences due to "harvest now, decrypt later" attacks. ... Relevance to CI/CD Secrets Management: The primary risk is in the transport of secrets. The secure channel (TLS) established between your CI/CD runner and your Secrets Manager is the point of vulnerability. To future-proof your pipeline, you need to consider moving towards PQC-enabled protocols.

Experience Really Matters - But Now You're Fighting AI Hacks

Defenders traditionally rely on understanding the timing and ordering of events. The shows that AI-driven activity occurs in extremely rapid cycles. Reconnaissance, exploit refinement and privilege escalation can occur through repeated attempts that adjust based on feedback from the environment. This creates a workflow that resembles iterative code generation rather than a series of discrete intrusion stages. Professionals must now account for an adversary that can alter its approach within seconds and can test multiple variations of the same technique without the delays associated with human effort. ... The AI attacker moved across cloud systems, identity structures, application layers and internal services. It interacted fluidly with whatever surface was available. Professionals who have worked primarily within a single domain may now need broader familiarity with adjacent layers of the stack because AI-driven activity does not limit itself to the boundaries of established specializations. ... The workforce shortage in will continue, but the qualifications for advancement are shifting. Organizations will look for professionals who understand both the capabilities and the limitations of . Those who can read an AI-generated artifact, refine an automated detection workflow, or construct an updated threat model will be positioned for leadership roles.

Is vibe coding the new gateway to technical debt?

The big idea in AI-driven development is that now we can just build applications by describing them in plain English. The funny thing is, describing what an application does is one of the hardest parts of software development; it’s called requirements gathering. ... But now we are riding a vibe. A vibe, in this case, is an unwritten requirement. It is always changing—and with AI, we can keep manifesting these whims at a good clip. But while we are projecting our intentions into code that we don’t see, we are producing hidden effects that add up to masses of technical debt. Eventually, it will all come back to bite us. ... Sure, you can try using AI to fix the things that are breaking, but have you tried it? Have you ever been stuck with an AI assistant confidently running you and your code around in circles? Even with something like and integration (where the AI has access to the server and client-side outputs) it can so easily descend into a maddening cycle. In the end, you are mocked by your own unwillingness to roll up your sleeves and do some work. ... If I had to choose one thing that is the most compelling about , it would be the ability to quickly scale from nothing. The moment when I get a whole, functioning something based on not much more than an idea I described? That’s a real thrill. Weirdly, AI also makes me feel less alone at times; like there is another voice in the room.

How to Be a Great Data Steward: Responsibilities and Best Practices

Data is often described as “a critical organizational asset,” but without proper stewardship, it can become a liability rather than an asset. Poor data management leads to inaccurate reporting, compliance violations, and reputational damage. For example, a financial institution that fails to maintain accurate customer records risks incurring regulatory penalties and causing customer dissatisfaction. ... Effective is guided by several foundational principles: accountability, transparency, integrity, security, and ethical use. These principles ensure that data remains accurate, secure, and ethically managed across its lifecycle. ... Data stewards can be categorized into several types: , technical data stewards, , and . Each plays a unique role in maintaining data quality and compliance in conjunction with other data management professionals, technical teams, and business stakeholders. ... Data stewardship thrives on clarity. Every data steward should have well-defined responsibilities and authority levels, and each data stewardship team should have clear boundaries and expectations identified. This includes specifying who manages which datasets, who ensures compliance, and who handles data quality issues. Clear role definitions prevent duplication of effort and ensure accountability across the organization.

Time for CIOs to ratify an IT constitution

is simultaneously a massive value multiplier and a must-immediately-take-a-nap-boring topic for executives. For busy moderns, governance is as intellectually palatable as the stale cabbage on the table René Descartes once doubted. How do CIOs get key stakeholders to care passionately and appropriately about how IT decisions are made? ... Everyone agrees that one can’t have a totally centralized, my-way-or-the-highway dictatorship or a totally decentralized you-all-do-whatever-you-want, live-in-a-yurt digital commune. Has the stakeholder base become too numerous, too culturally disparate, and too attitudinally centrifugal to be governed at all? ... Has IT governance sunk to such a state of disrepair that a total rethink is necessary? I asked 30 CIOs and thought leaders what they thought about the current state of IT governance and possible paths forward. The for IT at a state college in the northeast argued that if the CEO, the board of directors, and the CIO were “doing their job, a constitution would not be necessary.” The CIO at a midsize, mid-Florida city argued that writing an effective IT constitution “would be like pushing water up a wall.” ... CIOs need to have a conversation regarding IT rights, privileges, duties, and responsibilities. Are they willing to do so? ... It appears that IT governance is not a hill that CIOs are willing to expend political capital on.

Flash storage prices are surging – why auto-tiering is now essential

Across industries and use cases, a consistent pattern emerges. The majority of data becomes cold shortly after it is created. It is written once, accessed briefly, then retained for long periods without meaningful activity. does not require low latency, high IOPS, expensive endurance ratings or premium, power-intensive performance tiers. It only needs to be stored reliably at the lowest reasonable cost. Yet during the years when was only marginally more expensive than , many organisations placed on flash systems simply because the price difference felt manageable. With today’s economics, that model can no longer scale. ... The rise in also helped drive flash adoption. Organisations sought faster backups, quicker restores, and higher snapshot retention. Flash delivered these benefits, but the economics are breaking under current pricing conditions. Today, the cost of flash-based backup appliances is rising, long-term retention on flash is becoming unsustainable, and maintaining deep histories on premium media no longer aligns with budget expectations. ... The current flash pricing crisis is more than a temporary spike. It signals a long-term shift in storage economics driven by accelerating AI demand, constrained supply chains, and global data growth. The all-flash mindset of the past decade is now colliding with financial realities that organisations can no longer ignore. Cold data should not be placed on expensive media.

AI, sustainability and talent gaps reshape industrial growth

A new study by , a company, in partnership with HFS Research, reveals a widening divide between industrial enterprises’ ambitions and their real-world readiness for AI, sustainability, and workforce transformation. Despite strong executive push towards modernization, skills shortages, legacy systems, and misaligned priorities continue to stall progress across key industrial segments. ... The findings lay bare the scale of transition ahead: while industries recognize AI and sustainability as foundational for future competitiveness, a lack of talent and weak integration strategies are slowing measurable impact. “Industrial leaders see AI, sustainability, and talent as top priorities, yet struggle to convert these ambitions into tangible results,” said , President and CEO at GlobalLogic. ... Although operational cost reduction is the top priority today, the study finds that within two years, AI adoption and operational optimization will dominate executive focus. The industrial sector is preparing for a shift from incremental improvements to deep automation and intelligence-led models. ... “Enterprises need to embed sustainability, talent, and technology transitions into both strategy and day-to-day operations,” said , . “Clear outcomes and messaging are essential to show current and future workforces that industrial organizations are shaping — not chasing — the sustainable, tech-driven future.”

When ransomware strikes, who takes the lead -- the CIO or CISO?

"[CIOs and CISOs] will probably have different priorities for when they want to do things; the CIO is going to be more concerned [about the] business side of keeping systems operational, whereas the CISO [wants to know] where is this critical data? Is it being exfiltrated? Having a good , planning that stuff out in advance [is necessary so both parties know] what steps they're supposed to take. "The best default to contain the attack is to pull internet connectivity. You don't want to restart a system [or] shut it down, because you can lose forensic evidence. That way, if they are exfiltrating any data, that access stops, so you can begin triaging how they got in and patch that hole up. ... the first three steps come down to confirm, contain and anchor. We want to confirm that blast radius, not hypothesize or theorize what it could be, but what is it really? You'd be surprised at how many teams burn their most valuable hour debating whether it's really ransomware. "Second, contain first, communicate second. I think there's a natural [tendency for] humans to send an all-hands email out, call an emergency meeting and even notify customers. What matters most is to triage and stop the bleeding, isolate those compromised systems and cripple the bad actor's lateral movement. ... "[The best way to contain a ransomware attack will be different for each organization depending on their architectures, controls and technology, but in general, isolate as completely as possible.

LLM vulnerability patching skills remain limited

Because the models rely on patterns they have learned, a shift in structure can break those patterns. The model may still spot something that looks like the original flaw, but the fix it proposes may no longer land in the right place. That is why a patch that looks reasonable can still fail the exploit test. The weakness remains reachable because the model addressed only part of the issue or chose the wrong line to modify. Another pattern surfaced. When a fix for an artificial variant did appear, it often came from only one model. Others failed on the same case. This shows that each artificial variant pushed the systems in different directions, and only one model at a time managed to guess a working repair. The lack of agreement across models signals that these variants exposed gaps in the patterns the systems depend on. ... and models landed behind that mark but contributed steady fixes in several scenarios. The spread shows that gains do not come from one vendor alone. The study also checked overlap. Authentic issues showed substantial agreement between models, while artificial issues showed far less. Only two issues across the entire set were patched by one model and not by any other. This suggests that combining several models adds limited coverage. ... Researchers plan to extend this work in several ways. One direction involves combining output from different or from repeated runs of the same model, giving the patching process a chance to compare options before settling on one.