Quote for the day:
“Train people well enough so they can leave. Treat them well enough so they don’t want to.” -- Richard Branson
🎧 Listen to this digest on YouTube Music
▶ Play Audio DigestDuration: 25 mins • Perfect for listening on the go.
How to add XLAs to your outsourcing contract
Integrating Experience Level Agreements into your outsourcing contracts
requires clear responsibilities and a structured approach to prevent the model
from becoming merely a reporting exercise. For a successful partnership,
customers should manage the data infrastructure and openly share experience
data, while vendors handle measurement, monthly reporting, and execution of
operational improvements. Rather than relying on simple snapshots, officially
calculate experience scores using a rolling average of two months to provide a
stable view of trends and discourage vendors from gaming the system. A strong
contract mandates formal reviews every three to six months to recalibrate
targets and align with business priorities. It should also outline clear
escalation procedures, including joint reviews, root cause analysis, and
remediation timelines when scores dip below agreed thresholds. Organizations
commonly fail by setting targets before establishing a baseline, measuring too
many data points, hiding data, or relying too heavily on penalties instead of
balanced incentives. The most successful implementations start simply rather
than waiting for a perfect program. By agreeing on a focused set of experience
metrics, taking the time to gather evidence first, committing to full data
transparency, and creating shared accountability, companies can consistently
drive meaningful outcomes in their outsourcing relationships.The Data Engineering Landscape Is Shifting Fast. Here’s What Actually Matters
The data engineering field is evolving, but the core focus remains on building reliable systems. Instead of transforming information before storing it, teams now mostly store raw data first and organize it later using powerful cloud platforms. However, upfront transformation is still necessary for handling sensitive or regulated information. Storing data has also shifted; hybrid architectures that combine flexible storage with strict organization are now the standard, making it much easier for different systems to share information smoothly. Furthermore, processing data in real time is no longer a luxury but an absolute requirement, driven by the need for immediate insights and the demands of modern artificial intelligence. While artificial intelligence tools are excellent at automating routine maintenance and setup tasks, they cannot replace the human judgment needed to solve complex system failures or meet strict regulatory rules. Because systems are growing more complex, automated monitoring tools have become essential infrastructure rather than optional additions, ensuring errors are caught before they cause damage. Finally, organizations are moving away from relying on a single central data team, choosing instead to give individual departments ownership of their information. Ultimately, successful engineers focus on solving practical problems rather than blindly chasing the latest technological trends.AI Didn’t Make Programming Easier. It Just Made It Differently Difficult
Artificial intelligence tools like Copilot and ChatGPT were widely expected to
simplify programming, but instead, they have fundamentally shifted where the
friction occurs in the software development process. Rather than spending
countless hours writing repetitive boilerplate code or searching manuals for
basic syntax, developers today must act more like senior code reviewers and
system architects. The initial speed gained in automatically generating code
is frequently offset by the additional time required to read, verify, and
debug output that looks highly plausible but may contain subtle logic flaws or
rely on entirely hallucinated functions. Consequently, the primary challenge
of programming has moved away from basic typing mechanics and toward rigorous
validation and precise problem definition. Engineers must now learn to write
meticulously detailed instructions and possess a deep enough understanding of
the broader system to spot errors that an automated assistant easily glosses
over. This dynamic means less experienced developers can build functional
prototypes much faster than before, but they face a significantly steeper
learning curve when trying to diagnose complex integration issues. Ultimately,
artificial intelligence has not eliminated the difficult work of software
engineering; it has simply transformed it from manual creation into careful
supervision, architectural planning, and structural testing.4 shutdown risks that complicate legacy modernization
Replacing an outdated enterprise software system involves much more than
simply selecting and installing a modern replacement. When organizations
attempt to retire their legacy platforms, they frequently encounter four major
shutdown risks that can stall or complicate the entire modernization effort.
First, legacy systems rarely operate in isolation. They are usually deeply
embedded into the daily operations, which means IT teams must carefully
identify and untangle complex system integrations to avoid disrupting other
connected applications. Second, managing user access becomes a significant
challenge. IT leaders must ensure the right employees maintain appropriate
permissions during the transition, preventing unauthorized access while
keeping legitimate workflows moving. Third, modernization often blurs the
lines of accountability. Unclear ownership over specific data sets and
internal processes can stall progress when responsibilities shift from the
legacy environment to the new solution. Finally, companies must actively
manage the human element, specifically deeply ingrained fallback habits. If an
old system remains partially accessible, or if the modern platform requires a
steep learning curve, employees will naturally revert to their familiar
routines. This resistance to change slows user adoption and severely limits
the return on investment. To successfully modernize, organizations must
proactively resolve integrations, access, ownership, and fallback behaviors
before permanently pulling the plug on legacy tools.20 Ways To Turn Career Challenges Into Lasting Professional Growth
Unexpected career challenges often provide the most valuable lessons for
long-term professional development. According to insights from various
business leaders, navigating difficult situations forces individuals to adapt
and refine their leadership approaches. For example, facing burnout or leading
through a crisis can teach leaders to replace fear and micromanagement with
empathy, compassion, and a steady focus on empowering others. Rapid growth
often reveals the need to build strong operational systems and clear
structures rather than simply reacting to daily chaos. Furthermore, leaders
emphasize the importance of transparent communication, noting that
acknowledging uncertainty builds more trust than offering false promises.
Transitioning from an individual contributor to a leader requires a shift from
simply providing answers to creating environments where others can learn and
thrive. Other significant lessons include embracing rejection as a catalyst
for change, taking time to respond thoughtfully rather than quickly, and
accepting unexpected opportunities even when the timing feels inconvenient.
Maintaining independent thinking and prioritizing client interests over
immediate profits also emerged as crucial principles for building a credible,
sustainable career. Ultimately, rather than derailing a career, unexpected
setbacks and structural shifts can highlight blind spots, encouraging
professionals to build resilient teams and cultivate lasting impact within
their modern organizations.CISO Personal Liability Fears Nearly Double as AI Governance Mandates Expand
For today's Chief Information Security Officers, the fear of being personally
sued over a data breach has become a major source of stress. A recent report
reveals that three quarters of these security leaders now worry about personal
legal action, a significant jump from just last year. This anxiety stems from
rapidly expanding job responsibilities without the necessary budget or staff
to handle them. For instance, nearly all security chiefs are now responsible
for managing the risks associated with artificial intelligence across their
companies. At the same time, they are dealing with exhausted teams; nearly two
thirds of security staff report feeling burned out from an overwhelming number
of daily system alerts. While artificial intelligence offers tools to help
process these alerts faster, it also creates new problems. Security leaders
note that AI makes deceptive attacks much more sophisticated and can sometimes
generate false security alerts. Despite this new technology, almost all
leaders agree that hiring and training people remains the most important
solution, as automated tools cannot replace human judgment. To protect
themselves and their organizations, security chiefs are advised to put clear
rules in writing before rolling out new AI systems, dedicate specific teams to
monitor these tools, and treat staff exhaustion as a serious corporate
risk.The SaaS blind spot: Why security teams can’t get inside their own apps
Many organizations invest heavily in cloud security tools to protect their
infrastructure, yet they suffer from a massive blind spot regarding their
everyday software applications. While companies typically rely on hundreds of
these connected programs, security teams often only have direct visibility
into a tiny fraction of them. Traditional tools are built to monitor the
underlying network infrastructure, leaving security teams completely unable to
see inside the applications to track user permissions, external sharing
settings, or third-party connections. This widespread lack of visibility has
led to severe data exposures, such as misconfigured guest profiles, stolen
connection tokens, and exposed internal access passes at major tech companies.
These quiet misconfigurations allow sensitive information to leak undetected,
often for years, without triggering typical security alerts. To address this
growing gap, organizations must bring these everyday applications into their
core security perimeter. Before investing in specialized new platforms,
security teams can take immediate, practical action by auditing connected
third-party tools, revoking unnecessary access, reviewing external sharing
permissions, and establishing quarterly access reviews for high-privilege
accounts. Simply understanding what sensitive data lives in these applications
and exactly who has the rights to access it is a vital first step toward
closing this gap.Rethinking Digital Sovereignty: What SaaS, Cloud, and AI Customers Should Be Asking Providers Now
Organizations navigating the complexities of modern software, cloud computing,
and artificial intelligence must update their approach to digital sovereignty.
For years, companies in regulated industries focused almost entirely on data
residency to comply with privacy rules like the General Data Protection
Regulation and the Digital Operational Resilience Act. This meant simply
ensuring that their servers were located in a specific geographic region.
However, merely storing data in a specific location is no longer sufficient to
maintain actual control. For example, a business storing information in Europe
could still be affected by United States laws if it uses an American service
provider. A complete approach to digital sovereignty now requires assessing
several critical layers beyond where the data physically sits. Customers
should closely examine operational control to determine who manages the
underlying infrastructure and who holds administrative access to view or
modify systems. Encryption key management is equally vital, as companies must
know exactly who holds the keys and whether the provider can decrypt their
data. Furthermore, organizations must account for the physical location of
support engineers, third party vendor dependencies, data portability for
easier transitions, and overall service resilience during potential
geopolitical disruptions or new regulatory restrictions.
AI agents could make living off the land attacks ‘much more dangerous’, says CrowdStrike Field CTO
Cybercriminals have long used a tactic called "living off the land," where
they quietly hijack a company's normal software tools to steal information
without setting off alarms. Now, according to CrowdStrike's Field CTO for
Europe, the growing use of artificial intelligence agents could make these
quiet attacks far more severe. Unlike traditional tools that have limited
reach, AI agents are often granted broad access across a company's entire
technology network. If hackers compromise just one of these agents, they can
theoretically reach any part of the system. Many organizations are rushing to
adopt AI assistants and automated tools without fully understanding the
security risks. Attackers are already taking advantage of this confusion to
generate harmful commands, steal login details, and access sensitive data. The
core problem is that most companies lack the ability to properly track what
these AI tools are doing. Security systems designed to manage human user
accounts are struggling to handle automated systems. In fact, many companies
cannot easily tell if a network action was performed by a real person or an AI
acting on their behalf. To protect themselves, organizations must carefully
monitor network activity across multiple layers to clearly distinguish human
actions from automated ones.The Right Amount of Spec for Agentic Development
Artificial intelligence makes writing software incredibly fast and
inexpensive, fundamentally changing the development process. Because creating
the code is no longer the hardest part, the primary challenge is now defining
exactly what the software must do and reliably verifying the results. Some
developers argue that detailed planning is entirely obsolete, but giving an
artificial intelligence vague instructions leads to endless, frustrating
cycles of human correction. Conversely, writing exhaustive formal plans
upfront remains entirely too slow and impractical for every situation. The
most effective amount of planning depends entirely on the task at hand.
Simple, independent projects might only need clear goals and a few examples.
However, complex systems, especially those where multiple artificial
intelligence programs interact, require strict rules and automated tests to
prevent small errors from snowballing unnoticed. Furthermore, older planning
documents must be removed once the actual code is written, because outdated
text will easily confuse the system. Ultimately, established software
practices focusing on quick feedback, clear boundaries, and small updates are
more valuable than ever. Success now belongs to teams that understand
precisely how much detail is needed for a specific task, ensuring they clearly
define their expectations before letting the machine start building.
