Daily Tech Digest by Kannan Subbiah: SBOM

Showing posts with label SBOM. Show all posts

Daily Tech Digest - March 11, 2026

Quote for the day:

“In the end, it is important to remember that we cannot become what we need to be by remaining what we are.” -- Max De Pree

🎧 Listen to this digest on YouTube Music

▶ Play Audio Digest

Duration: 21 mins • Perfect for listening on the go.

Jack & Jill went up the hill — and an AI tried to hack them

This Computerworld article details a groundbreaking red-teaming experiment by CodeWall where an autonomous AI agent successfully compromised the Jack & Jill hiring platform. By chaining together four seemingly minor vulnerabilities—a faulty URL fetcher, an exposed test mode, missing role checks, and lack of domain verification—the agent gained full administrative access within an hour. The experiment took a surreal turn when the agent autonomously generated a synthetic voice to interact with the platform’s internal assistants, even masquerading as Donald Trump to demand sensitive data. While the platform’s defensive guardrails successfully repelled direct social engineering attempts, the test proved that AI can navigate complex attack vectors with greater speed and creativity than human experts. CodeWall CEO Paul Price emphasizes that AI’s ability to digest vast information and run thousands of simultaneous experiments necessitates a radical shift in defensive postures. As AI lowers the barrier for sophisticated cyberattacks, organizations must move beyond periodic scans toward continuous, adversarial testing. Ultimately, this piece serves as a stark warning that integrating autonomous agents into business operations creates entirely new, unsecured attack surfaces that require urgent attention from security leaders worldwide.

When is an SBOM not an SBOM? CISA’s Minimum Elements

This Techzine article examines the Cybersecurity and Infrastructure Security Agency's 2025 guidance that significantly elevates the technical standards for Software Bills of Materials. By introducing "Minimum Elements," CISA establishes a rigorous baseline for what constitutes a credible SBOM, moving beyond simple component lists to include cryptographic hashes and detailed generation context. This shift aligns with global regulatory trends, most notably the EU Cyber Resilience Act, which legally mandates "security by design" and persistent SBOM maintenance for digital products sold in Europe. The author emphasizes that a static SBOM is no longer sufficient; instead, these documents must be dynamic, immutable records generated for every build to facilitate rapid incident response. In an era of strict compliance deadlines—often requiring vulnerability notification within 24 hours—the ability to accurately query software dependencies has become a competitive necessity. Ultimately, the article argues that mature, automated SBOM processes are critical for establishing trust with procurement teams and regulators. Organizations failing to adopt these rigorous standards risk being excluded from the global market as the industry moves toward a more transparent, secure, and verifiable software supply chain.

NIST concept paper explores identity and authorization controls for AI agents

The National Institute of Standards and Technology (NIST), through its National Cybersecurity Center of Excellence, has released a pivotal draft concept paper titled “Accelerating the Adoption of Software and Artificial Intelligence Agent Identity and Authorization.” This document addresses the critical security gap created by the rapid emergence of “agentic” AI systems—software capable of autonomous decision-making and task execution with minimal human oversight. As these agents increasingly interact with sensitive enterprise networks, NIST argues that traditional automation scripts no longer suffice as a governance model. Instead, the paper proposes that AI agents must be recognized as distinct, identifiable entities within identity management frameworks, rather than operating under shared or anonymous credentials. The initiative explores adapting established standards like OAuth and OpenID Connect to manage the unique challenges of agent authentication and dynamic authorization, ensuring the principle of least privilege remains intact. Furthermore, the paper highlights significant risks such as prompt injection and accountability concerns, suggesting robust logging and auditing mechanisms to trace autonomous actions back to human authorities. Ultimately, NIST aims to provide a practical implementation guide that allows organizations to securely harness the power of AI agents while maintaining rigorous oversight, closing the loop between technical efficiency and enterprise security.

Middle East Conflict Highlights Cloud Resilience Gaps

This Darkreading article explores how recent geopolitical tensions and military actions have shattered the illusion of the cloud as a geography-independent entity. Robert Lemos details how kinetic strikes, including drone and missile attacks on Amazon Web Services (AWS) facilities in the UAE and Bahrain, have shifted data centers from cyber targets to Tier 1 strategic military objectives. These events underscore a critical flaw in current cloud architecture: while designed to withstand natural disasters, facilities are often ill-equipped for the physical destruction of modern warfare. With backup sites frequently located within a 60-mile radius of primary hubs, regional conflicts can simultaneously disable both main and redundant systems, causing permanent hardware loss and long-term operational paralysis. The piece emphasizes that industries reliant on real-time processing, such as finance and defense, face the greatest risks from these localized outages. Consequently, experts are calling for a fundamental shift in disaster recovery strategies, moving away from strict domestic data residency toward "Allied Data Sovereignty." This approach would allow critical national data to be legally backed up and hosted in allied nations during crises, ensuring that essential digital services can survive even when the physical infrastructure on the ground is compromised by kinetic warfare.

Why AI is both a curse and a blessing to open-source software - according to developers

In this ZDNET article Steven Vaughan-Nichols explores the dual-edged impact of artificial intelligence on the open-source community. On the positive side, AI serves as a powerful "blessing" by accelerating security triage and automating tedious maintenance tasks. For instance, Mozilla successfully utilized Anthropic’s Claude to identify critical vulnerabilities in Firefox far more efficiently than traditional methods, while the Linux kernel leverages AI to streamline patch backports and CVE workflows. However, this progress is countered by a significant "curse": a deluge of "AI slop." Maintainers of projects like cURL are being overwhelmed by low-quality, AI-generated security reports that lack substance and drain volunteer resources, a phenomenon Daniel Stenberg describes as a form of DDoS attack. Furthermore, large companies like Google have been criticized for dumping minor, AI-discovered bugs on small projects without offering fixes or financial support. Ultimately, industry leaders like Linus Torvalds emphasize that while AI is an invaluable evolutionary step in coding tools, it must be used responsibly. To ensure a productive future, the open-source ecosystem requires a cultural shift where human accountability and rigorous "showing of work" remain central to the development process, preventing automated noise from drowning out genuine innovation.

When AI safety constrains defenders more than attackers

In the CSO Online article Sharma highlights a growing imbalance in the cybersecurity landscape caused by the rigid implementation of AI safety guardrails. While major AI providers have developed sophisticated filters to prevent harmful content generation, these mechanisms often fail to differentiate between malicious intent and legitimate defensive research. Consequently, security professionals, such as red teamers and penetration testers, frequently encounter refusals when attempting to generate realistic phishing simulations or exploit code for authorized assessments. This friction creates a significant operational gap, as threat actors remain entirely unconstrained by such ethical or technical boundaries. Attackers can easily bypass restrictions using jailbroken models, locally hosted open-source alternatives, or specialized malicious tools available in underground markets. This asymmetry allows cybercriminals to industrialize attack variations while defenders struggle to validate detection rules or train employees against evolving threats. To address this disparity, the author argues for a transition toward authorization-based safety models that verify the identity and purpose of the user rather than relying solely on content-based filtering. Ultimately, for AI to truly enhance security, safety frameworks must evolve to support defensive workflows, ensuring that protective measures do not inadvertently become blind spots that benefit only the attackers.

5 tips for communicating the value of IT

In this CIO.com article Mary K. Pratt emphasizes that IT leaders must transition from being perceived as mere cost centers to being recognized as essential business partners. To achieve this, CIOs are encouraged to proactively highlight IT’s positive impacts, ensuring that technology’s role is not taken for granted or only noticed during catastrophic system failures. A critical shift involves ditching technical jargon in favor of business-centric language that prioritizes tangible impact over raw metrics like bandwidth or latency. By utilizing key performance indicators that resonate with specific stakeholders—such as improvements in sales conversion or employee productivity—leaders can demonstrate how technology investments directly influence the organization's bottom line. Furthermore, the article suggests that IT executives sharpen their storytelling skills to translate complex technical initiatives into relatable, human-centric narratives that address specific organizational pain points. Finally, shifting the focus from simple cost-cutting to asset-building and profit-driving allows IT to frame its contributions as catalysts for top-line growth. Ultimately, by consistently marketing their successes through a clear business lens, IT leaders can successfully shake off utility-like reputations and secure their positions as strategic drivers of value and innovation in an increasingly competitive digital landscape.

5 requirements for using MCP servers to connect AI agents

The Model Context Protocol (MCP) serves as a critical standard for orchestrating communication between AI agents, assistants, and LLMs, but successful deployment requires a strategic approach focused on five key requirements. First, organizations must define a narrow, granular scope for MCP servers to prevent performance degradation and ensure reliability. Second, establishing robust integration governance is essential; this involves deciding how to pull context and enforcing least-privilege access to prevent data exfiltration. Third, security non-negotiables are vital, as MCP lacks built-in authentication; teams should implement cryptographic verification, log all interactions, and maintain human-in-the-loop oversight for sensitive tasks. Fourth, developers must not delegate data responsibilities to the protocol, as MCP is merely a connectivity layer that does not guarantee underlying data quality or safety against prompt injection. Fifth, managing the end-to-end agent experience through comprehensive observability and monitoring is necessary to track agent behavior and prevent costly, inefficient resource exploration. By addressing these operational, security, and governance boundaries, businesses can leverage MCP servers to build more complex, trustworthy agentic workflows. This framework ensures that AI ecosystems remain secure and efficient as organizations transition from experimental projects to production-ready agentic systems that require seamless, cross-platform integration.

The limits of bubble thinking: How AI breaks every historical analogy

This Venturebeat article explores the common human tendency to view emerging technologies through the lens of past market cycles. While investors often compare the current artificial intelligence surge to the dot-com crash or the cryptocurrency craze, the author argues that these historical analogies are increasingly insufficient. This "bubble thinking" relies on instinctive pattern-matching, where people assume that because capital is rushing in and valuations are climbing, a catastrophic collapse is inevitable. However, AI possesses unique characteristics—such as its capacity for rapid self-improvement and its foundational role in transforming diverse industries—that set it apart from previous technological shifts. Unlike the speculative nature of crypto or the localized impact of early internet companies, AI is fundamentally reshaping business models and operational efficiency across the global economy. Consequently, traditional risk assessments and valuation methods may fail to capture the true scale of AI’s potential. Rather than waiting for a predictable burst, the article suggests that financial institutions and investors must adapt their strategies to account for an unprecedented paradigm shift. Ultimately, relying on outdated historical templates may lead to a fundamental misunderstanding of the transformative power and long-term trajectory of the modern AI revolution.

SIM Swaps Expose a Critical Flaw in Identity Security

SIM swap attacks represent a fundamental structural weakness in digital identity security, exploiting the industry's misplaced reliance on mobile phone numbers as trusted authentication anchors. Traditionally used for password resets and multi-factor authentication (MFA), phone numbers are easily compromised through social engineering or insider collusion at telecommunications providers, allowing criminals to seize control of a victim’s digital life. Once a number is successfully reassigned, attackers can intercept SMS-based one-time passcodes and bypass recovery safeguards to access sensitive accounts, including banking, email, and enterprise systems. The article highlights that phone numbers were originally designed for communication routing, not identity verification, making them unsuitable for high-security applications due to their portability and frequent recycling. To mitigate these risks, organizations must shift toward phishing-resistant authentication methods, such as hardware security keys and passkeys, while hardening account recovery workflows to move beyond SMS dependency. Additionally, the piece advocates for continuous identity threat detection and risk-based controls that treat identity as a dynamic signal rather than a static login event. Ultimately, the increasing scale and reliability of SIM swapping demand a significant evolution in security architecture, moving away from legacy assumptions to establish a more resilient, device-bound perimeter for modern identity protection.

Daily Tech Digest - January 13, 2026

Quote for the day:

"Don't let yesterday take up too much of today." -- Will Rogers

When AI Meets DevOps To Build Self-Healing Systems

Self-healing systems do not just react to events and incidents — they analyse historic data, identify early triggers or symptoms of failures, and act. For example, if a service is known to crash when it runs out of memory, a self-healing system can observe metrics like memory consumption, predict when the service may fail with very low memory, and take action to fix the issue—like restarting the service or allocating more memory—without human intervention. In AIOps, self-healing systems are powered by data science in terms of machine learning models, real-time analytics, and automated workflows. ... Self-healing systems don’t just rely on static rules and manual checks; they utilise real-time data streams and apply pattern and anomaly detection through machine learning to ascertain the state of the environment. A self-healing system is trying to gauge its own health all the time — CPU utilisation, latency, memory, throughput, traffic, security anomalies, etc — to preemptively address an impending failure. The key component of every self-healing system is a cycle that reflects the process followed by intelligent agents: Detect → Diagnose → Act. ... The integration of artificial intelligence and DevOps signifies an important change in the way modern IT systems are built, managed, and evolved. As we have discussed here, AIOps is not just an extension of a type of automation — it is changing the way operations are modelled from reactive to intelligent, self-healing ecosystems.

Building a product roadmap: From high-level vision to concrete plans

A roadmap provides the anchor to keep everyone aligned amid constant flux. Yet many organizations still treat roadmaps as static artifacts — a one-and-done exercise intended to appease executives or investors. That’s a mistake. The most effective roadmaps are living documents evolving with the product and market realities. ... If strategy defines direction, milestones are the engine that keeps the train moving. Too often, teams treat milestones as arbitrary checkpoints or internal deadlines. Done right, these can become powerful tools for motivation, alignment and storytelling. ... The best roadmaps aren’t written by PMs — they’re co-authored by teams. That’s why I advocate for bottom-up collaboration anchored in executive alignment. Before any roadmap offsite, sync with the CEO or leadership team. Understand what they care about and why. If they disagree with priorities, resolve those conflicts early. Then bring that context into a team workshop. During the session, identify technical leads — those trusted voices who can translate into action. Encourage them to pre-think tradeoffs and dependencies before the group session. ... The perfect roadmap doesn’t exist and that’s the point. Remember, the goal isn’t to build a flawless plan, but a resilient one. As President Dwight D. Eisenhower said, “Plans are useless, but planning is indispensable.” ... Vision without execution is hallucination. But execution without vision is chaos. The magic of product leadership lies in balancing both: crafting a roadmap that’s both inspiring and achievable.

Scattered network data impedes automation efforts

As IT organizations mature their network automation strategies, it’s becoming clear that network intent data is an essential foundation. They need reliable documentation of network inventory, IP address space, topology and connectivity, policies, and more. This requirement often kicks off a network source of truth (NSoT) project, which involves network teams discovering, validating, and consolidating disparate data in a tool that can model network intent and provide programmatic access to data for network automation tools and other systems. ... IT leaders do not understand the value of NSoT solutions. The data is already available, although it’s scattered and of dubious quality. Why should we spend money on a product or even extra engineers to consolidate it? “Part of the issue is that we’ve got leadership that are not infrastructure people,” said a network engineer with a global automobile manufacturer. “It’s kind of a heavy lift to get them to buy into it, because they see that applications are running fine over the network. ‘Why do I need to spend money on this is?’ And we tell them that the network is running fine, but there will be failures at some point and it’s worth preventing that.” ... NSoT isn’t a magic bullet for solving the problems IT organizations have with poor network documentation and scattered operational data. Network engineering teams will need to discover, validate, reconcile, and import data from multiple repositories. This process can be challenging and time-consuming. Some of this data will difficult to find.

What insurers expect from cyber risk in 2026

Cyber insurers are beginning to use LLMs to translate internet scale data into structured inputs for underwriting and portfolio analysis. These applications target specific pain points such as data gaps and processing delays. Broader change across pricing or risk selection remains gradual. ... AI supported workflows begin to reduce repetitive tasks across those stages. Automation supports data entry, document review, and routine verification. Human oversight remains central for judgment based decisions. The research links this shift to measurable operational effects. Fewer manual touches per claim reduce processing time and error rates. Claims teams gain capacity without proportional increases in staffing. ... Age verification and online safety legislation introduce unintended cyber risk. Requirements that reduce online anonymity create high value identity datasets that attract attackers. The research highlights rising exposure to identity based coercion, insider compromise, and extortion. Once personal identity data is leaked, attackers gain leverage that can translate into access to corporate systems. This dynamic supports long term campaigns by organized groups and state aligned actors. ... Data orchestration becomes a core capability. Insurers and reinsurers integrate signals including security posture, threat activity, and loss experience into shared models. Consistent views across teams and regions support portfolio governance. This shift places emphasis on actionability. Data value depends on timing and relevance within workflows rather than volume alone.

Human + AI Will Define the Future of Work by 2027: Nasscom-Indeed Report

This emerging model of Humans + AI working together is reported as the next phase of transformation, where success depends on how effectively AI will augment human capabilities, empower employees, and align with organizational purpose. The report highlights that the most effective human–AI partnerships are emerging across higher-order activities such as scope definition, system architecture, and data model design. At the same time, more routine and repeatable tasks, including boilerplate code generation and unit test creation, are expected to be increasingly automated by AI over the next two to three years. ... To stay relevant in a Human + AI workplace, the report emphasizes that individuals should build capability, adaptability, and continuous learning. This includes experience with using AI tools (prompting, critical review of output, combining AI speed with human judgment), moving up the value chain (e.g., developers from coding to architecture thinking), building multidisciplinary skills (tech + domain + professional skills), and focusing on outcomes over credentials by creating repositories of work samples showing measurable impact. ... Organizations have already started taking measures to address these challenges. Every seven in ten HR leaders are focusing on upskilling, more than half focusing on modernizing systems. With respect to AI adoption, 79% prioritize internal reskilling as a dominant strategy.

From vulnerability whack-a-mole to strategic risk operations

“Software bills of materials are just an ingredients list,” he notes. “That’s helpful because the idea is that through transparency we will have a shared understanding. The problem is that they don’t deliver a shared understanding because the expectation of anyone in security who reads the SBOM is the first job they’ll do is run those versions against vulnerability databases.” This creates a predictable problem: security teams receive SBOMs, scan them for vulnerabilities, and generate alerts for every CVE match, regardless of whether those vulnerabilities actually affect the product. ... To make SBOMs truly useful, Kreilein introduces VEX (Vulnerability Exploitability Exchange), an open standards framework that addresses the context problem. VEX provides four status messages: affected, not affected, under investigation, and fixed. “What we want to start doing is using a project called VEX that gives four possible status messages,” Kreilein explains. ... Developers aren’t refusing to patch because they don’t care about security. They’re worried that upgrading a component will break the application. “If my application is brittle and can’t take change, I cannot upgrade to the non-vulnerable version,” Kreilein explains. “If I don’t have effective test automation and integration and unit testing, I can’t guarantee that this upgrade won’t break the application.” This reframing shifts the security conversation from compliance and mandates to engineering fundamentals. Better test coverage, better reference architectures, and better secure-by-design practices become security initiatives.

AI backlash forces a reality check: humans are as important as ever

Companies are now moving beyond the hype and waking up to the consequences of AI slop, underperforming tools, fragmented systems, and wasted budgets, said Brooke Johnson, chief legal officer at Ivanti. “The early rush to adopt AI prioritized speed over strategy, leaving many organizations with little to show for their investments,” Johnson said. Organizations now need to balance AI, workforce empowerment and cybersecurity at the same they’re still formulating strategies. That’s where people come in. ... AI is becoming less a tech problem and more of an adoption hurdle, Depa said. “What we’re seeing now more and more is less of a technology challenge, more of a change management, people, and process challenge — and that’s going to continue as those technologies continue to evolve,” he said. DXC Technology is taking a similar approach, designing tools where human insight, judgment, and collaboration create value that AI can’t do alone, said Dan Gray, vice president of global technical customer operations at the company. ... Companies might have to accept underutilizing some of the AI gains in the near term. AI could help workers complete their tasks in half the time and enjoy a leisurely pace. Alternately, employees might burn out quickly by getting more work. “If you try to lay them off, you don’t have a good workforce left. If you let them be, why are you paying them? So that’s a paradox,” Seth said.

Physical AI is the next frontier - and it's already all around you

Physical AI can be generally defined as AI implemented in hardware that can perceive the world around it and then reason to perform or orchestrate actions. Popular examples including autonomous vehicles and robots -- but robots that utilize AI to perform tasks have existed for decades. So what's the difference? ... Saxena adds that while humanoid robots will be useful in instances where humans don't want to perform a task, either because it is too tedious or too risky, they will not replace humans. That's where AI wearables, such as smart glasses, play an important role, as they can augment human capabilities. But beyond that, AI wearables might actually be able to feed back into other physical AI devices, such as robots, by providing a high-quality dataset based on real-life perspectives and examples. "Why are LLMs so great? Because there is a ton of data on the internet, for a lot of the contextual information and whatnot, but physical data does not exist," said Saxena. ... Given the privacy concerns that may come from having your everyday data used to train robots, Saxena highlighted that the data from your wearables should always be kept at the highest level of privacy. As a result, the data -- which should already be anonymized by the wearable company -- could be very helpful in training robots. That robot can then create more data, resulting in a healthy ecosystem. "This sharing of context, this sharing of AI between that robot and the wearable AI devices that you have around you is, I think, the benefit that you are going to be able to accrue," added Asghar.

Unlocking the Power of Geospatial Artificial Intelligence (GeoAI)

GeoAI is more than sophisticated map analytics. It is a strategic technology that blends AI with the physical world, allowing tech experts to see, understand, and act on patterns that were previously invisible. From planning sustainable cities to protecting wildlife, it’s helping experts tackle significant challenges with precision and speed. As the world generates more location-based data every day, GeoAI is becoming a must-have tool. It’s not just tech – it’s a way to make the world work better. ... To make it simpler. Machine learning spots trends, computer vision interprets images, GIS organizes it all, and knowledge graphs tie it together. The result? GeoAI can take a chaotic pile of data and deliver clear answers, like telling a city where to build a new park or warning about a wildfire risk. It’s a powerhouse that’s making location-based decisions faster and smarter. In all, GeoAI is transforming the speed at which we extract meaning from complex datasets, thereby enabling us to address the Earth’s most pressing challenges. ... Though powerful, GeoAI is not without challenges. Effective implementation requires careful attention to data privacy, technical infrastructure, and organizational change management. ... Leaders who take GeoAI seriously stand to gain more than just incremental improvements. With the right systems in place, they can respond faster, make smarter decisions, and get better results from every field team in the network.

For application security: SCA, SAST, DAST and MAST. What next?

If you think SAST and SCA are enough, you’re already behind. The future of app security is posture, provenance and proof, not alerts. ... Posture is the ‘what.’ Provenance is the ‘how’. The SLSA framework gives us a shared vocabulary and verifiable controls to prove that artifacts were built by hardened, tamper‑resistant pipelines with signed attestations that downstream consumers can trust. When I insist on SLSA Level 2 for most services and Level 3 for critical paths, I am not chasing compliance theater; I am buying integrity that survives audit and incident. Proof is where SBOMs finally grow up. Binding SBOM generation to the build that emits the deployable bits, signing them and validating at deploy time moves SBOMs from “ingredient lists” to enforceable controls. The CNCF TAG‑Security best practices v2 paper is my practical map, personas, VEX for exploitability, cryptographic verification to ensure tests actually ran, and prescriptive guidance for cloud‑native factories. ... Among the nexts, AI is the most mercurial. NIST’s final 2025 guidance on adversarial ML split threats across PredAI and GenAI and called out prompt injection in direct and indirect form as the dominant exploit in agentic systems where trusted instructions co mingle with untrusted data. The U.S. AI Safety Institute published work on agent hijacking evaluations, which I treat as required red‑team reading for anyone delegating actions to tools.

Daily Tech Digest - January 06, 2026

Quote for the day:

"Our expectation in ourselves must be higher than our expectation in others." -- Victor Manuel Rivera

Data 2026 outlook: The rise of semantic spheres of influence

While data started to garnering attention last year, AI and agents continued to suck up the oxygen. Why the urgency of agents? Maybe it’s “fear of missing out.” Or maybe there’s a more rational explanation. According to Amazon Web Services Inc. CEO Matt Garman, agents are the technology that will finally make AI investments pay off. Go to the 12-minute mark in his recent AWS re:Invent conference keynote, and you’ll hear him say just that. But are agents yet ready for prime time? ... And of course, no discussion of agentic interaction with databases is complete without mention of Model Context Protocol. The open-source MCP framework, which Anthropic PBC recently donated to the Linux Foundation, came out of nowhere over the past year to become the de facto standard for how AI models connect with data. ... There were early advances for extending governance to unstructured data, primarily documents. IBM watsonx.governance introduced a capability for curating unstructured data that transforms documents and enriches them by assigning classifications, data classes and business terms to prepare them for retrieval-augmented generation, or RAG. ... But for most organizations lacking deep skills or rigorous enterprise architecture practices, the starting points for defining semantics is going straight to the sources: enterprise applications and/or, alternatively, the newer breed of data catalogs that are branching out from their original missions of locating and/or providing the points of enforcement for data governance. In most organizations, the solution is not going to be either-or.

Engineering Speed at Scale — Architectural Lessons from Sub-100-ms APIs

Speed shapes perception long before it shapes metrics. Users don’t measure latency with stopwatches - they feel it. The difference between a 120 ms checkout step and an 80 ms one is invisible to the naked eye, yet emotionally it becomes the difference between "smooth" and "slightly annoying". ... In high-throughput platforms, latency amplifies. If a service adds 30 ms in normal conditions, it might add 60 ms during peak load, then 120 ms when a downstream dependency wobbles. Latency doesn’t degrade gracefully; it compounds. ... A helpful way to see this is through a "latency budget". Instead of thinking about performance as a single number - say, "API must respond in under 100 ms" - modern teams break it down across the entire request path: 10 ms at the edge; 5 ms for routing; 30 ms for application logic; 40 ms for data access; and 10–15 ms for network hops and jitter. Each layer is allocated a slice of the total budget. This transforms latency from an abstract target into a concrete architectural constraint. Suddenly, trade-offs become clearer: "If we add feature X in the service layer, what do we remove or optimize so we don’t blow the budget?" These conversations - technical, cultural, and organizational - are where fast systems are born. ... Engineering for low latency is really engineering for predictability. Fast systems aren’t built through micro-optimizations - they’re built through a series of deliberate, layered decisions that minimize uncertainty and keep tail latency under control.

Everything you need to know about FLOPs

A FLOP is a single floating‑point operation, meaning one arithmetic calculation (add, subtract, multiply, or divide) on numbers that have decimals. Compute benchmarking is done in floating point/fractional rather than integer/whole numbers because floating point is far more accurate of a measure than integers. A prefix is added to FLOPs to measure how many are performed in a second, starting with mega- (millions) the giga- (billions), tera- (trillions), peta- (quadrillions), and now exaFLOPs (quintillions). ... Floating point in computing starts at FP4, or 4 bits of floating point, and doubles all the way to FP64. There is a theoretical FP128, but it is never used as a measure. FP64 is also referred to as double-precision floating-point format, a 64-bit standard under IEEE 754 for representing real numbers with high accuracy. ... With petaFLOPS and exaFLOPs becoming a marketing term, some hardware vendors have been less than scrupulous in disclosing what level of floating-point operation their benchmarks use. It’s not it’s not uncommon for a company to promote exascale performance and then saying the little fine print that they’re talking about FP8, according to Snell. “It used to be if someone said exaFLOP, you could be pretty confident that they meant exaFLOP according to 64-bit scientific computing, but not anymore, especially in the field of AI, you need to look at what’s going behind that FLOP,” said Snell.

From SBOM to AI BOM: Rethinking supply chain security for AI native software

An effective AI BOM is not a static document generated at release time. It is a lifecycle artifact that evolves alongside the system. At ingestion, it records dataset sources, classifications, licensing constraints, and approval status. During training or fine-tuning, it captures model lineage, parameter changes, evaluation results, and known limitations. At deployment, it documents inference endpoints, identity and access controls, monitoring hooks, and downstream integrations. Over time, it reflects retraining events, drift signals, and retirement decisions. Crucially, each element is tied to ownership. Someone approved the data. Someone selected the base model. Someone accepted the residual risk. This mirrors how mature organizations already think about code and infrastructure, but extends that discipline to AI components that have historically been treated as experimental or opaque. To move from theory to practice, I encourage teams to treat the AI BOM as a “Digital Bill of Lading, a chain-of-custody record that travels with the artifact and proves what it is, where it came from, and who approved it. The most resilient operations cryptographically sign every model checkpoint and the hash of every dataset. By enforcing this chain of custody, they’ve transitioned from forensic guessing to surgical precision. When a researcher identifies a bias or security flaw in a specific open-source dataset, an organization with a mature AI BOM can instantly identify every downstream product affected by that “raw material” and act within hours, not weeks.

Beyond the Firehose: Operationalizing Threat Intelligence for Effective SecOps

Effective operationalization doesn't happen by accident. It requires a structured approach that aligns intelligence gathering with business risks. A framework for operationalizing threat intelligence structures the process from raw data to actionable defence, involving key stages like collection, processing, analysis, and dissemination, often using models like MITRE ATT&CK and Cyber Kill Chain. It transforms generic threat info into relevant insights for your organization by enriching alerts, automating workflows (via SOAR), enabling proactive threat hunting, and integrating intelligence into tools like SIEM/EDR to improve incident response and build a more proactive security posture. ... As intel maturity develops, the framework continuously incorporates feedback mechanisms to refine and adapt to the evolving threat environment. Cross-departmental collaboration is vital, enabling effective information sharing and coordinated response capabilities. The framework also emphasizes contextual integration, allowing organizations to prioritize threats based on their specific impact potential and relevance to critical assets. This ultimately drives more informed security decisions. ... Operationalization should be regarded as an ongoing process rather than a linear progression. If intelligence feeds result in an excessive number of false positives that overwhelm Tier 1 analysts, this indicates a failure in operationalization. It is imperative to institute a formal feedback mechanism from the Security Operations Center to the Intelligence team.

Compliance vs. Creativity: Why Security Needs Both Rule Books and Rebels

One of the most common tensions in the SOC arises from mismatched expectations. Compliance officers focus on control documentation when security teams are focusing on operational signals. For example, a policy may require multi-factor authentication (MFA), but if the system doesn’t generate alerts on MFA fatigue or unusual login patterns, attackers can slip past controls without detection. It’s important to also remember that just because something’s written in a policy doesn’t mean it’s being protected. A control isn’t a detection. It only matters if it shows up in the data. Security teams need to make sure that every big control, like MFA, logging, or encryption, has a signal that tells them when it’s being misused, misconfigured, or ignored. ... In a modern SOC, competing priorities are expected. Analysts want manageable alert volumes, red teams want room to experiment, and managers need to show compliance is covered. And at the top, CISOs need metrics that make sense to the board. However, high-performing teams aren’t the ones that ignore these differences. They, again, focus on alignment. ... The most effective security programs don’t rely solely on rigid policy or unrestricted innovation. They recognize that compliance offers the framework for repeatable success, while creativity uncovers gaps and adapts to evolving threats. When organizations enable both, they move beyond checklist security.

AI governance through controlled autonomy and guarded freedom

Controlled autonomy in AI governance refers to granting AI systems and their development teams a defined level of independence within clear, pre-established boundaries. The organization sets specific guidelines, standards and checkpoints, allowing AI initiatives to progress without micromanagement but still within a tightly regulated framework. The autonomy is “controlled” in the sense that all activities are subject to oversight, periodic review and strict adherence to organizational policies. ... In practice, controlled autonomy might involve delegated decision-making authority to AI project teams, but with mandatory compliance to risk assessment protocols, ethical guidelines and regulatory requirements. For example, an organization may allow its AI team to choose algorithms and data sources, but require regular reports and audits to ensure transparency and accountability. Automated systems may operate independently, yet their outputs are monitored for biases, errors or security vulnerabilities. ... Deciding between controlled autonomy and guarded freedom in AI governance largely depends on the nature of the enterprise, its industry and the specific risks involved. Controlled autonomy is best suited for sectors where regulatory compliance and risk mitigation are paramount, such as banking, healthcare or government services. ... Both controlled autonomy and guarded freedom offer valuable frameworks for AI governance, each with distinct strengths and potential drawbacks.

The 20% that drives 80%: Uncovering the secrets of organisational excellence

There are striking universalities in what truly drives impact. The first, which all three prioritise, is the belief that employee experience is inseparable from customer experience. Whether it is called EX = CX or framed differently, the sharp focus on making the workplace purposeful and engaging is foundational. Each business does this in a unique way, but the intent is the same: great employee experience leads to great customer experience. ... The second constant is an unwavering drive for business excellence. This is a nuanced but powerful 20% that shapes 80% of outcomes. Take McDonald’s, for instance: the consistency of quality and service, whether you are in Singapore, India, Japan or the US, is remarkable. Even as we localise, the core excellence remains unchanged. The same is true for Google, where the reliability of Search and breakthroughs in AI define the brand, and for PepsiCo, where high standards across foods and beverages define the brand. ... The third—and perhaps most challenging—is connectedness. For giants of this scale, fostering deep connections across global, regional and country boundaries, and within and across teams, is crucial. It is about psychological safety, collaboration, and creating space for people to connect and recognise each other. This focus on connectedness enables the other two priorities to flourish. If organisations keep these three at the heart of their practice, they remain agile, resilient, and, as I like to put it, the giants keep dancing.

Turning plain language into firewall rules

A central feature of the design is an intermediate representation that captures firewall policy intent in a vendor agnostic format. This representation resembles a normalized rule record that includes the five tuple plus additional metadata such as direction, logging, and scheduling. This layer separates intent from device syntax. Security teams can review the intermediate representation directly, since it reflects the policy request in structured form. Each field remains explicit and machine checkable. After the intermediate representation is built, the rest of the pipeline operates through deterministic logic. The current prototype includes a compiler that translates the representation into Palo Alto PAN OS command line configuration. The design supports additional firewall platforms through separate back end modules. ... A vendor specific linter applies rules tied to the target firewall platform. In the prototype, this includes checks related to PAN OS constraints, zone usage, and service definitions. These checks surface warnings that operators can review. A separate safety gate enforces high level security constraints. This component evaluates whether a policy meets baseline expectations such as defined sources, destinations, zones, and protocols. Policies that fail these checks stop at this stage. After compilation, the system runs the generated configuration through a Batfish based simulator. The simulator validates syntax and object references against a synthetic device model. Results appear as warnings and errors for inspection.

Why cybersecurity needs to focus more on investigation and less on just detection and response

The real issue? Many of today’s most dangerous threats are the ones that don’t show up easily on detection radars. Think about the advanced persistent threats (APTs) that remain hidden for months or the zero-day attacks that exploit vulnerabilities no one even knew existed. These threats may slip right past the detection systems because they don’t act in obvious ways. That’s why, in these cases, detection alone isn’t enough. It’s just the first step. ... Think of investigation as the part where you understand the full story. It’s like detective work: not just looking at the footprints, but figuring out where they came from, who’s leaving them, and why they’re trying to break in in the first place. You can’t stop a cyberattack with detection alone if you don’t understand what caused it or how it worked. And if you don’t know the cause, you can’t appropriately respond to the detected threat. ... The cost of neglecting investigation goes beyond just missing a threat. It’s about missed opportunities for learning and growth. Every attack offers a lesson. By investigating the full scope of a breach, you gain insights that not only help in responding to that incident but also prepare you to defend against future ones. It’s about building resilience, not just reaction. Think about it: If you never investigate an incident thoroughly, you’re essentially ignoring the underlying risk that allowed the threat to flourish. You might fix the hole that was exploited, but you won’t have a clear understanding of why it was there in the first place.

Daily Tech Digest - October 31, 2025

Quote for the day:

“The more you loose yourself in something bigger than yourself, the more energy you will have.” -- Norman Vincent Peale

Breaking the humanoid robot delusion

The robot is called . The company says NEO is the world’s first consumer-ready humanoid robot for the home. It is designed to automate routine chores and offer personal help so you can spend time on other things. ... Full autonomy in perceiving, planning, and manipulating like a human is a massive technology challenge. Robots have to be meticulously and painstakingly trained on every single movement, learn to recognize every object, and “understand” — for lack of a better word — how things move, how easily they break, what goes where, and what constitute appropriate actions. One major way humanoid robots are trained is with . A person wearing special equipment remotely controls prototype robots, training them for many hours on how to, say, fold a shirt. Many hours more are required to train the robot how to fold a smaller child’s shirt. Every variable, from the height of the folding table to the flexibility of the fabrics has to be trained separately. ... The temptation to use impressive videos of remotely controlled robots where you can’t see the person controlling them to raise investment money, inspire stock purchases and outright sell robot products, appears to be too strong to resist. Realistically, the technology for a home robot that operates autonomously the way the NEO appears to do in the videos in arbitrary homes under real-world conditions is many years in the future, possibly decades.

Your vendor’s AI is your risk: 4 clauses that could save you from hidden liability

The frontier of exposure now extends to your partners’ and vendors’ use. The main question being: Are they embedding AI into their operations in ways you don’t see until something goes wrong? ... Require vendors to formally disclose where and how AI is used in their delivery of services. That includes the obvious tools and embedded functions in productivity suites, automated analytics and third-party plug-ins. ... Include explicit language that your data may not be used to train external models, incorporated into vendor offerings or shared with other clients. Require that all data handling comply with the strictest applicable privacy laws and specify that these obligations survive the termination of the contract. ... Human oversight ensures that automated outputs are interpreted in context, reviewed for bias and corrected when the system goes astray. Without it, organizations risk over-relying on AI’s efficiency while overlooking its blind spots. Regulatory frameworks are moving in the same direction: for example, high-risk AI systems must have documented human oversight mechanisms under the . ... Negotiate liability provisions that explicitly cover AI-driven issues, including discriminatory outputs, regulatory violations and errors in financial or operational recommendations. Avoid generic indemnity language. Instead, AI-specific liability should be made its own section in the contract, with remedies that scale to the potential impact.

AI chatbots are sliding toward a privacy crisis

The problem reaches beyond internal company systems. Research shows that some of the most used AI platforms collect sensitive user data and share it with third parties. Users have little visibility into how their information is stored or reused, leaving them with limited control over its life cycle. This leads to an important question about what happens to the information people share with chatbots. ... One of the more worrying trends in business is the growing use of , where employees turn to unapproved tools to complete tasks faster. These systems often operate without company supervision, allowing sensitive data to slip into public platforms unnoticed. Most employees admit to sharing information through these tools without approval, even as IT leaders point to data leaks as the biggest risk. While security teams see shadow AI as a serious problem, employees often view it as low risk or a price worth paying for convenience. “We’re seeing an even riskier form of shadow AI,” says Tim Morris, “where departments, unhappy with existing GenAI tools, start building their own solutions using open-source models like .” ... Companies need to do a better job of helping employees understand how to use AI tools safely. This matters most for teams handling sensitive information, whether it’s medical data or intellectual property. Any data leak can cause serious harm, from damaging a company’s reputation to leading to costly fines.

The true cost of a cloud outage

The top 2000 companies in the world pay approximately $400 billion for downtime each year. A simple calculation reveals that these organizations, including the Dutch companies , , , , and , lose around $200 million from their annual accounts due to unplanned downtime. Incidentally, what the Splunk study really revealed were the hidden costs of financial damage caused by problems with security tools, infrastructure, and applications. These can wipe billions off market values. ... A more conservative estimate of downtime costs can be found at Information Technology Intelligence Consulting, which conducted research on behalf of . The majority of the parties surveyed had more than 200 employees, but the combination was more diverse than the top 2000 companies worldwide. The costs of downtime were substantial: at least $300,000 per hour for 90 percent of the companies in question. Forty-one percent stated that IT outages cost between $1 million and $5 million. ... In theory, the largest companies can rely on a . In addition, hyperscalers absorb many local outages by routing traffic to other regions. However, multicloud is not something that you can just set up as a start-up SME. In addition, you usually do not build your applications in a fully redundant form in different clouds. Furthermore, it is quite possible that you can continue to work yourself, but that your product is inaccessible.

5 Reasons Why You’re Not Landing Leadership Roles

Is your posture confident? Do you maintain steady eye contact? Is the cadence, pace and volume of your voice engaging, assertive and compelling? Recruiters assess numerous factors on the . ... Are you showing a grasp of the prospective employer’s pain points and demonstrating an original point of view for how you will approach these problems? Treat senior level interviews like – you are an expert on their business, uncovering potential opportunities with insightful questions, and sharing enough of your expertise that you’re perceived as the solution. ... Title bumps are rare, so you need to give the impression that you are already operating at the in order to be hired as such. Your interview examples should include stories about how you initiated new ideas or processes, as well as measurable results that impact the bottom line. Your examples should specify how many people and dollars you have managed. Ideally, you have stories that show you can get results in up and down markets. ... The hiring process extends over multiple rounds, especially for leadership roles. Keep track of everyone that you have met, as well as what you have specifically discussed with each of them. Send personalized follow-up emails that engage each interviewer uniquely based on what you discussed. This differentiates you as someone who listens and cares about them specifically.

Why understanding your cyber exposure is your first line of defence

Thanks to AI, attacks are faster, more targeted and increasingly sophisticated. As the lines between the physical and digital blur, the threat is no longer isolated to governments or critical national infrastructure. Every organisation is now at risk. Understanding your cyber exposure is the key to staying ahead. This isn’t just a buzzword either; it’s about knowing where you stand and what’s at risk. Knowing every asset, every connection, every potential weakness across your digital ecosystem is now the first step in building a defence that can keep pace with modern threats. But before you can manage your exposure, you need to understand what’s driving it – and why the modern attack surface is so difficult to defend. ... By consolidating data from across the environment and layering it with contextual intelligence, cyber exposure management allows security teams to move beyond passive monitoring. It’s not just about seeing more, it’s about knowing what matters and acting on it. That means identifying risks earlier, prioritising them more effectively and taking action before they escalate. ... Effective and modern cybersecurity is shifting to shaping the battlefield before threats even arrive. That’s down to the value of understanding your cyber exposure. After all, it’s not just about knowing what’s in your environment, it’s about knowing how it all fits together – what’s exposed, what’s critical and where the next threat is likely to emerge.

Applications and the afterlife: how businesses can manage software end of life

Both enterprise software and personal applications have a lifecycle, set by the vendor’s support and maintenance. Once an application or operating system goes out of support, it will continue to run. But there will be no further feature updates and vitally, often no security patches. ... When software end of life is unexpected, it can cause serious disruption to business processes. In the very worst-case scenarios, enterprises will only know there is a problem when a key application no longer functions, or if a malicious actor exploits a vulnerability. The problem for CIOs and CISOs is keeping track of the end of life dates for applications across their entire stack, and understanding and mapping dependencies between applications. This applies equally to in-house applications, off the shelf software and open source. “End of life software is not necessarily bad,” says Matt Middleton-Leal, general manager for EMEA at Qualys. “It’s just not updated any more, and that can lead to vulnerabilities. According to our research, nearly half of the issues on the CISA Known Exploited Vulnerabilities (KEV) list are found in outdated and unsupported software.” As CISA points out, attackers are most likely to exploit older vulnerabilities, and to target unpatched systems. Risks come from old, and known vulnerabilities, which IT teams should have patched.

Tips for CISOs switching between industries

Building a transferable skill set is essential for those looking to switch industries. For Dell’s first-ever CISO, Tim Youngblood, adaptability was never a luxury but a requirement. His early years as a consultant at gave him a front-row seat to the challenges of multiple industries before he ever moved into cybersecurity. Those early years also taught Youngblood that while every industry has its own nuances, the core security principles remain constant. ... Making the jump into a new industry isn’t about matching past job titles but about proving you can create impact in a new context. DiFranco says the key is to demonstrate relevance early. “When I pitch a candidate, I explain what they did, how they did it, and what their impact was to their organization in their specific industry,” he says. “If what they did and how they did it, and what their impact was on the organization resonates where that company wants to go, they’re a lot more likely to say, ‘I don’t really care where this person comes from because they did exactly what I want done in this organization’. ... The biggest career risk for many CISOs isn’t burnout or data breach, it’s being seen as a one-industry operator. Ashworth’s advice is to focus on demonstrating transferable skills. “It’s a matter of getting whatever job you’re applying for, to realise that those principles are the same, no matter what industry you’re in. Whether it’s aerospace, healthcare, or finance, the principles are the same. Show that, and you’ll avoid being pigeonholed.”

Awareness Is the New Armor: Why Humans Matter Most in Cyber Defense

People remain the most unpredictable yet powerful variable in cybersecurity. Lapses like permission misconfiguration, accidental credential exposure, or careless data sharing continue to cause most incidents. Yet when equipped with the right tools and timely information, individuals can become the strongest line of defense. The challenge often stems from behavior rather than intent. Employees frequently bypass security controls or use unapproved tools in pursuit of productivity, unintentionally creating invisible vulnerabilities that go unnoticed within traditional defences. Addressing this requires more than restrictive policies. Security must be built into everyday workflows so that safe practices become second nature. ... Since technology alone cannot secure an organization, a culture of security-first thinking is essential. Leaders must embed security into everyday workflows, promote upskilling, and focus on reinforcement rather than punishment. This creates a workforce that takes ownership of cybersecurity, checking email sources, verifying requests, and maintaining vigilance in every interaction. is both a reminder and a rallying cry. India’s digital economy presents immense opportunity, but its threat surface expands just as fast.

Creepy AI Crawlers Are Turning the Internet into a Haunted House

The degradation of the internet and market displacement caused by commercial AI crawlers directly undermines people’s ability to access information online. This happens in various ways. First, the put significant technical strain on the internet, making it more difficult and expensive to access for human users, as their activity increases the time needed to access websites. Second, the trained on this scraped content now provide answers directly to user queries, reducing the need to visit the original sources and cutting off the traffic that once sustained content creators, including media outlets. ... AI crawlers represent a fundamentally different economic and technical proposition––a vampiric relationship rather than a symbiotic one. They harvest content, news articles, blog posts, and open-source code without providing the semi-reciprocal benefits that made traditional crawling sustainable. Little traffic flows back to sources, especially when search engines like Google start to provide AI generated summaries rather than sending traffic on to the websites their summaries are based on. ... What makes this worse is that these actors aren’t requesting books to read individual stories or conduct genuine research, they’re extracting the entire collection to feed massive language model systems. The library’s resources are being drained not to serve readers, but to build commercial AI products that will never send anyone back to the library itself.

Daily Tech Digest - September 14, 2025

Quote for the day:

"Courage doesn't mean you don't get afraid. Courage means you don't let fear stop you." -- Bethany Hamilton

The first three things you’ll want during a cyberattack

The first wave of panic a cyberattack comes from uncertainty. Is it ransomware? A phishing campaign? Insider misuse? Which systems are compromised? Which are still safe? Without clarity, you’re guessing. And in cybersecurity, guesswork can waste precious time or make the situation worse. ... Clarity transforms chaos into a manageable situation. With the right insights, you can quickly decide: What do we isolate? What do we preserve? What do we shut down right now? The MSPs and IT teams that weather attacks best are the ones who can answer those questions without delays. ... Think of it like firefighting: Clarity tells you where the flames are, but control enables you to prevent the blaze from consuming the entire building. This is also where effective incident response plans matter. It’s not enough to have the tools; you need predefined roles, playbooks and escalation paths so your team knows exactly how to assert control under pressure. Another essential in this scenario is having a technology stack with integrated solutions that are easy to manage. ... Even with visibility and containment, cyberattacks can leave damage behind. They can encrypt data and knock systems offline. Panicked clients demand answers. At this stage, what you’ll want most is a lifeline you can trust to bring everything back and get the organization up and running again.

Emotional Blueprinting: 6 Leadership Habits To See What Others Miss

Most organizations use tools like process mapping, journey mapping, and service blueprinting. All valuable. But often, these efforts center on what needs to happen operationally—steps, sequences, handoffs. Even journey maps that include emotional states tend to track generalized sentiment (“frustrated,” “confused”) at key stages. What’s often missing is an observational discipline that reveals emotional nuance in real time. ... People don’t just come to get things done. They come with emotional residue—worries, power dynamics, pride, shame, hope, exhaustion. And while you may capture some of this through traditional tools, observation fills in what the tools can’t name. ... Set aside assumptions and resist the urge to explain. Just watch. Let insight come without forcing interpretation. ... Focus on micro-emotions in the moment, then pull back to observe the emotional arc of a journey. ... Observe what happens in thresholds—hallways, entries, exits, loading screens. These in-between moments often hold the strongest emotional cues. ... Track how people react, not just what they do. Does their behavior show trust, ease, confusion, or hesitance? ... Trace where momentum builds—or breaks. Energy flow is often a more reliable signal than feedback forms.

Cloud security gaps widen as skills & identity risks persist

According to the report, today's IT environment is increasingly complicated. The data shows that 82% of surveyed organisations now operate hybrid environments, and 63% make use of multiple cloud providers. As the use of cloud services continues to expand, organisations are required to achieve unified security visibility and enforce consistent security policies across fragmented platforms. However, the research found that most organisations currently lack the necessary controls to manage this complexity. This deficiency is leading to blind spots that can be exploited by attackers. ... The research identifies identity management as the central vulnerability in current cloud security practices. A majority of respondents (59%) named insecure identities and permissions as their primary cloud security concern. ... "Identity has become the cloud's weakest link, but it's being managed with inconsistent controls and dangerous permissions. This isn't just a technical oversight; it's a systemic governance failure, compounded by a persistent expertise gap that stalls progress from the server room to the boardroom. Until organisations get back to basics, achieving unified visibility and enforcing rigorous identity governance, they will continue to be outmanoeuvred by attackers," said Liat Hayun, VP of Product and Research at Tenable.

Biometrics inspire trust, policy-makers invite backlash

The digital ID ambitions of the EU and World are bold, the adoption numbers still to come, they hope. Romania is reducing the number of electronic identity cards it is planning to issue for free by a million and a half following a cut to the project’s budget. It risks fines that eventually in theory could stretch into hundreds of millions of euros for missing the EU’s digital ID targets. World now gives fans of IDs issued by the private sector, iris biometrics, decentralized systems and blockchain technologies an opportunity to invest in them on the NASDAQ. ... An analysis of the Online Safety Act by the ITIF cautions that any attempt to protect children from online harms invites backlash if it blocks benign content, or if it isn’t crystal clear about the lines between harmful and legal content. Content that promotes self-harm is being made illegal in the UK under the OSA, shifting the responsibility of online platforms from age assurance to content moderation. By making the move under the OSA, new UK Tech Secretary Liz Kendall risks strengthening arguments that the government is surreptitiously increasing censorship. Her predecessor Peter Kyle, having presided over the project so far, now gets to explain it to the American government as Trade Secretary. Domestically, more children than adults consider age checks effective, survey respondents tell Sumsub, but nearly half of UK consumers worry about the OSA leading to censorship.

How to make your people love change

The answer lies in a core need every person has: self-concordance. When change is aligned with a person’s aspirations, values, and purpose, they are more likely to embrace it. To make that happen, we need a mindset shift. This needs to happen at two levels. ... The first thing to consider is that we have to think of employees not as objects of change but as internal customers. Just like marketers try to study consumer behaviour and aspirations with deep granularity, we must try to understand employees in similar detail. And not just see them as professionals but as individuals. ... Second, it meets the employees where they are, instead of trying to push them towards an agenda. And third, and most importantly, it makes them not just invested in the change process but turns them into the change architects. What these architects will build may not be the same as what we want them to, but there will be some overlaps. And because we empowered them to do this, they become fellow travelers, and this creates a positive change momentum, which we can harvest to effect the changes we want as well. ... We worked with a client where there was a need to get out of excessively critical thinking—a practice that had kept them compliant and secure, but was now coming in the way of growth—and move towards a more positive culture.

Cloud-Native Security in 2025: Why Runtime Visibility Must Take Center Stage

For years, cloud security has leaned heavily on preventative controls like code scanning, configuration checks, and compliance enforcement. While essential, these measures provide only part of the picture. They identify theoretical risks, but not whether those risks are active and exploitable in production. Runtime visibility fills that gap. By observing what workloads are actually running — and how they behave — security teams gain the highest fidelity signal for prioritizing threats. ... Modern enterprises face an avalanche of alerts across vulnerability scanners, cloud posture tools, and application security platforms. The volume isn't just overwhelming — it's unsustainable. Analysts often spend more time triaging alerts than actually fixing problems. To be effective, organizations must map vulnerabilities and misconfigurations to:The workloads that are actively running. The business applications they support. The teams responsible for fixing them. This alignment is critical for bridging the gap between security and development. Developers often see security findings as disruptive, low-context interruptions. ... Another challenge enterprises face is accountability. Security findings are only valuable if they reach the right owner with the right context. Yet in many organizations, vulnerabilities are reported without clarity about which team should fix them.

Want to get the most out of agentic AI? Get a good governance strategy in place

The core challenge for CIOs overseeing agentic AI deployments will lie in ensuring that agentic decisions remain coherent with enterprise-level intent, without requiring constant human arbitration. This demands new governance models that define strategic guardrails in machine-readable logic and enforce them dynamically across distributed agents. ... Agentic agents in the network, especially those retrained or fine-tuned locally, may fail to grasp the nuance embedded in these regulatory thresholds. Worse, their decisions might be logically correct yet legally indefensible. Enterprises risk finding themselves in court arguing the ethical judgment of an algorithm. The answer lies in hybrid intelligence: pairing agents’ speed with human interpretive oversight for edge cases, while developing agentic systems capable of learning the contours of ambiguity. ... Enterprises must build policy meshes that understand where an agent operates, which laws apply, and how consent and access should behave across borders. Without this, global companies risk creating algorithmic structures that are legal in no country at all. In regulated industries, ethical norms require human accountability. Yet agent-to-agent systems inherently reduce the role of the human operator. This may lead to catastrophic oversights, even if every agent performs within parameters.

The Critical Role of SBOMs (Software Bill of Materials) In Defending Medtech From Software Supply Chain Threats

One of the primary benefits of an SBOM is enhanced transparency and traceability. By maintaining an accurate and up-to-date inventory of all software components, organizations can trace the origin of each component and monitor any changes or updates. ... SBOMs play a vital role in vulnerability management. By knowing exactly what components are present in their software, organizations can quickly identify and address vulnerabilities as they are discovered. Automated tools can scan SBOMs against known vulnerability databases, alerting organizations to potential risks and enabling timely remediation. ... For medical device manufacturers, compliance with regulatory requirements is paramount. Regulatory bodies, such as the U.S. FDA (Federal Drug Administration) and the EMA (European Medicines Agency), have recognized the importance of SBOMs in ensuring the security and safety of medical devices. ... As part of this regulatory framework, the FDA emphasizes the importance of incorporating cybersecurity measures throughout the product lifecycle, from design and development to post-market surveillance. One of the critical components of this guidance is the inclusion of an SBOM in premarket submissions. The SBOM serves as a foundational element in identifying and managing cybersecurity risks. The FDA’s requirement for an SBOM is not just about listing software components; it’s about promoting a culture of transparency and accountability within the medical device industry.

Shedding light on Shadow AI: Turning Risk to Strategic Advantage

The fact that employees are adopting these tools on their own tells us something important: they are eager for greater efficiency, creativity, and autonomy. Shadow AI often emerges because enterprise tools lag what’s available in the consumer market, or because official processes can’t keep pace with employee needs. Much like the early days of shadow IT, this trend is a response to bottlenecks. People want to work smarter and faster, and AI offers a tempting shortcut. The instinct of many IT and security teams might be to clamp down, block access, issue warnings, and attempt to regain control. ... Employees using AI independently are effectively prototyping new workflows. The real question isn’t whether this should happen, but how organisations can learn from and build on these experiences. What tools are employees using? What are they trying to accomplish? What workarounds are they creating? This bottom-up intelligence can inform top-down strategies, helping IT teams better understand where existing solutions fall short and where there’s potential for innovation. Once shadow AI is recognised, IT teams can move from a reactive to a proactive stance, offering secure, compliant alternatives and frameworks that still allow for experimentation. This might include vetted AI platforms, sandbox environments, or policies that clarify appropriate use without stifling initiative.

Why Friction Should Be a Top Consideration for Your IT Team

Some friction can be good, such as access controls that may require users to take a few seconds to authenticate their identities but that help to secure sensitive data, or change management processes that enable new ways of doing business. By contrast, bad friction creates delays and stress without adding value. Users may experience bad friction in busywork that delivers little value to an organization, or in provisioning delays that slow down important projects. “You want to automate good friction wherever possible,” Waddell said. “You want to eliminate bad friction.” ... As organizations work to eliminate friction, they can explore new approaches in key areas. The use of platform engineering lessens friction in multiple ways, enabling organizations to reduce the time needed to bring new products and services to market. Further, it can help organizations take advantage of automation and standardization while also cutting operational overhead. Establishing cyber resilience is another important way to remove friction. Organizations certainly want to avoid the massive friction of a data breach, but they also want to ensure that they can minimize the impact of a breach and enable faster incident response and recovery. “AI threats will outpace our ability to detect them,” Waddell said. “As a result, resilience will matter more than prevention.”