Daily Tech Digest by Kannan Subbiah: SBOM

Showing posts with label SBOM. Show all posts

Daily Tech Digest - May 25, 2026

Quote for the day:

“Do the thing you fear to do and keep on doing it… that is the quickest way yet discovered to conquer fear.” -- Dale Carnegie

🎧 Listen to this digest on YouTube Music

▶ Play Audio Digest

Duration: 19 mins • Perfect for listening on the go.

The Lifecycle Crisis: Managing the Birth, Life, and Death of AI Agents

The rapid proliferation of AI agents has triggered a hidden cybersecurity vulnerability known as the lifecycle crisis, where modern enterprises are increasingly surrounded by automated "zombie" identities. While standard corporate protocols ensure meticulous offboarding for departing human employees, discontinued AI agents are rarely deprovisioned with the same discipline. Instead, these autonomous systems quietly persist in production environments long after their initial business cases fade or their human creators change roles, continuously interacting with internal networks using lingering privileges and forgotten API tokens. This creates an unmanaged parallel workforce running entirely unsupervised, presenting a highly attractive target for malicious exploiters and hackers. To mitigate these compounding risks, companies must shift from chaotic identity sprawl to an active governance framework built around intelligence-driven control. Security teams need to establish organizational muscle memory that treats automated credentials with strict administrative rigor. Implementing a mature lifecycle framework requires discovering rogue scripts, mapping clear operational ownership, conducting regular validation audits, and configuring automatic expiration timelines based on real-time business needs and justifications. Securing today's digital infrastructure demands proactive engineering that successfully guarantees a controlled birth, a closely monitored life, and a verifiable death for every single agent deployed across the network.

Unlocking intelligence with access control

In this article, Jack Sargent of Genetec explains how physical access control systems within corporate environments are evolving from simple door locking mechanisms into vital sources of strategic operational intelligence. Rather than operating as reactive tools that security teams review only after an incident occurs, modern access platforms utilize centralized multi-site data and automated workflows to quickly detect and flag anomalous security patterns, like off-hours entry attempts or repeated access failures. Beyond mitigating traditional physical risks, unified setups aggregate continuous data regarding building occupancy and daily traffic flows. Corporate leaders can share these insights with facilities departments to optimize layouts, substantially reduce avoidable overhead expenses, and refine real world resource allocation. Modern architectures also tightly align physical hardware with digital identity lifecycle management, enabling structured, role based permissions that update automatically whenever employees shift operational roles or leave the company. Because physical systems are increasingly interconnected with enterprise IT networks, these advanced platforms prioritize cybersecurity by embedding robust authentication controls, encrypted communication protocols, and continuous device health monitoring. Ultimately, by supporting flexible, incremental deployment choices across on-premises, cloud, or hybrid environments, modern access control serves as a secure, data driven foundation that simplifies compliance reporting and unifies cross functional business workflows.

8 IT modernization traps CIOs must avoid

The CIO article highlights eight critical pitfalls that technology leaders frequently stumble into when upgrading their corporate systems for a modern world. First, simply stacking flashy new technologies onto complex, messy legacy infrastructure backfires, creating expensive integration and security headaches instead of real enterprise value. Leaders also routinely underestimate organizational culture, treating modernization as an isolated technical project rather than a shared, cross-functional journey. Similarly, viewing cloud migration as a final destination, instead of just a baseline for ongoing evolution, stalls real progress—a costly mistake many companies are now repeating by rushing into artificial intelligence adoption without securing data permissions or establishing strict governance models. Another major blind spot is assuming a technical refresh automatically cleans up bad data, which only winds up reinforcing existing silos. Beyond software and databases, teams often carry an emotional debt from past failed projects that breeds quiet skepticism, a hurdle requiring honest internal dialogue to clear. Finally, failing to tie tech spending to concrete business value like productivity, and treating transformation as an all-inclusive big bang replacement rather than a gradual process, leaves projects vulnerable. To succeed, CIOs should view modernizing infrastructure like evolving a vibrant city, upgrading different neighborhoods incrementally over time by listening closely to the frontline staff who deal with daily bottlenecks.

Zero trust in OT moves beyond identity as industrial operators prioritize visibility, segmentation, operational resilience

As industrial networks become increasingly interconnected, the old assumption that internal users, devices, and networks are inherently safe is fast dissolving. However, applying enterprise-style zero trust models to operational technology (OT) environments poses an immediate hurdle: legacy assets like PLCs, sensors, and historians were never designed to execute multi-factor authentication or present cryptographic certificates. Consequently, cybersecurity professionals are shifting their focus away from strict identity verification at the front door toward continuous asset discovery, deep visibility, and functional network segmentation, such as the classic zones and conduits approach outlined in IEC 62443. Instead of forcing heavy software updates onto fragile systems, operators establish device identities externally through behavioral baselines, passive network fingerprinting, and rigorous privileged access management. This behavior-driven approach proves especially vital during credential theft, as it successfully detects anomalies based on unexpected activity rather than relying solely on login validity. Although global frameworks like NIS2 and NIST SP 800-82 provide solid guidance, achieving true resilience requires overcoming internal friction from plant teams concerned with physical safety and operational uptime. By reframing zero trust as an engineering discipline tied directly to avoiding unplanned downtime, industrial operators can successfully balance safety, continuous availability, and strict security outcomes across their complex critical infrastructure.

AI agents are quietly generating chaos engineering failures enterprises don’t track yet

In this VentureBeat article, automation expert Sayali Patil highlights an unmonitored class of production incidents sparked by autonomous AI agents that current corporate postmortem frameworks completely fail to track. While many enterprises deploy agentic AI to handle system anomalies by independently scaling resources or restarting clusters, these software actions frequently lack a crucial human safeguard: the holistic judgment call of a real engineer. When an agent acts with an incomplete context window, its seemingly correct remediation can inadvertently trigger catastrophic, cascading infrastructure failures across unseen downstream dependencies. Because traditional incident tracking systems categorize these disruptions as ordinary server or network events, the underlying AI trigger remains entirely invisible. Patil argues that automated remediations are inherently chaos engineering events, emphasizing that companies must unify the separate silos of AI orchestration and chaos practices. To mitigate this risk, the author proposes a resilience budget model, a live accounting ledger fueled by real-time signals like SLO burn rates, dependency saturation, and performance latency trends. This framework serves as a strict governance gateway that temporarily halts or escalates an agent's permissions whenever a system's real-time absorption capacity drops below a safe baseline, ensuring humans step in during ambiguous states. Ultimately, operating autonomous software safely at scale requires treating every automated action as a deliberate chaos injection and establishing reliable human circuit breakers.

How to Test Ransomware Recovery Without Reinfecting Your Environment

In this Hacker News expert insight piece, Subramani Rao from Acronis addresses the high-pressure challenges managed service providers face when attempting ransomware recovery across complex multi-tenant environments. He cautions that traditional backup verification methods are no longer sufficient because contemporary attackers actively compromise identity infrastructure and embed dormant persistence mechanisms. Consequently, simply restoring immutable backups risks reintroducing hidden malware back into production. To safely test recovery capabilities without triggering accidental reinfection, the article outlines a rigorous eight-step operational methodology. This framework emphasizes establishing completely isolated clean-room testing environments, simulating sophisticated, multi-stage attack scenarios that mirror lateral threat movement, and validating full-system infrastructure architectures rather than focusing solely on individual file restoration. Crucially, the blueprint prioritizes the early recovery of core identity systems like Active Directory and Domain Name Systems, while leveraging security telemetry to accurately isolate the last known uncompromised restore point. Ultimately, the piece advocates for the structural integration of backup systems with endpoint detection and response tools to replace standard operational guesswork with precise analytics. Furthermore, conducting regular, well-documented disaster recovery drills is highlighted as a modern necessity for regulatory compliance under frameworks like NIS 2, providing the verifiable readiness evidence that corporate compliance audits and cyber insurance underwriters increasingly demand.

Caught Off Guard: Securing AI After It Hits Production

As corporate teams race to push artificial intelligence projects out of the experimental phase and straight into production, security departments are finding themselves completely blindsided and trapped in a reactive mode. Historically, defense is most effective when integrated early into the software development lifecycle, but the breakneck speed of the current AI hype cycle has largely left security professionals out of the initial loop. To regain their footing and effectively secure these rapid deployments, defense teams must shift from panicked tactics to proactive strategies. According to Joshua Goldfarb, this transition relies heavily on engaging application owners through data-driven discussions that map specific monetary risks rather than abstract concepts. Furthermore, organizations must cultivate agility to navigate hybrid cloud complexities and design mature operational workflows capable of absorbing new AI alerts. Because large portions of artificial intelligence systems are built on top of existing application and API technology stacks, future-proofing current defensive architecture allows teams to simply plug in specialized AI protections later. Finally, maintaining rigorous security hygiene through continuous scanning and establishing runtime contextual awareness are vital steps for identifying real-time anomalies. By prioritizing these combined measures, enterprises can successfully transform a sudden operational surprise into a manageable, highly resilient security framework.

Weaponizing SBOMs: A Practical Guide for Security Practitioners

In her Security Magazine article, cybersecurity expert Pam Nigro shifts the traditional perspective on Software Bills of Materials (SBOMs), transforming them from tedious regulatory compliance checkboxes into powerful defensive weapons. Attackers routinely benefit from a massive asymmetric advantage, needing only a single overlooked flaw to infiltrate a network, whereas defenders must perfectly secure every single digital asset. To effectively level this playing field, Nigro describes SBOMs as an organizational "Rosetta Stone" that maps out exactly what hidden components reside inside a company's software ecosystem. By turning guesswork into absolute technical precision, teams can replace frantic, late-night vendor panic with rapid, database-driven threat hunting when major exploits occur. Operationalizing these inventories within automated build pipelines allows enterprise engineering teams to ruthlessly eliminate software bloat, root out ancient end-of-life packages, and objectively verify security patches before harmful regressions can happen. To establish a mature program over a structured ninety-day timeline, practitioners should track specific metrics like overall asset coverage, remediation speeds, and the systematic reduction of duplicate libraries. Furthermore, incorporating Vulnerability Exploitability eXchange (VEX) frameworks clears out distracting false positives. Ultimately, transforming these blind black boxes into actionable operational blueprints empowers modern security leaders to completely abandon constant, reactive firefighting and confidently stay several steps ahead of malicious adversaries.

Boston Consulting: 2 Futures Every CIO Should Prepare For

A recent report by the Boston Consulting Group’s Henderson Institute urges tech leaders to prepare for two sharply contrasting future scenarios that are expected to diverge between 2027 and 2035: "AI abundance" and "digital Darwinism." While both paths rely on an identical underlying technology stack, featuring ubiquitous agentic AI, advanced robotics, and quantum computing, they differ significantly in their approach to governance and systemic risk. In the AI abundance model, a series of catastrophic cyberattacks in the early 2030s prompts severe, mandatory global regulation, turning proprietary tech and data into cheap commodities while prioritizing trust and collaborative ecosystems. Conversely, digital Darwinism presents a highly competitive, unregulated race to the bottom where governments actively court tech giants with minimal restrictions to maximize immediate commercial and medical breakthroughs, ultimately leaving society ill-equipped when systemic downsides inevitably surface. BCG stresses that CIOs cannot afford to build long-term strategies around a single, predictable timeline. To navigate either outcome successfully over the next two years, IT executives must proactively shift their operating postures. This requires deploying highly modular computing architectures, designing robust trust infrastructure, redesigning workforce models for human-machine collaboration, embedding climate risk assessments into capital allocation, and prioritizing early quantum literacy before these advanced competencies become absolute corporate necessities.

The AI Governance Gap Is Bigger Than We Think

The article, written by Alan Shimel on Security Boulevard, explores the “illusion of mastery” in AI governance, drawing insights from JFrog's 2026 Software Supply Chain Security State of the Union report. While a staggering 97% of organizations claim to have AI governance frameworks in place, the data exposes an alarming disconnect between perceived and actual control. Specifically, 53% of organizations source models from repositories with known malicious payloads, and 18% lack governance over IDEs and Model Context Protocol (MCP) servers integrated directly into developer workflows. Shimel emphasizes that the software supply chain has expanded far beyond traditional code or open-source dependencies; it now includes foundation models, autonomous agents, and AI-powered extensions. This shift transforms the cybersecurity battle from protecting code to managing trust. Furthermore, the report shows that nearly half of respondents find reviewing and hardening AI-generated code to be a massive drain on resources, meaning AI often shifts workloads rather than reducing them. Ultimately, static policy documents fail to secure dynamic AI ecosystems. The article underscores that real governance must be actively enforced within development platforms and operational pipelines, where human decisions, software engineering, and autonomous systems intersect, rather than merely existing on paper.

Daily Tech Digest - March 11, 2026

Quote for the day:

“In the end, it is important to remember that we cannot become what we need to be by remaining what we are.” -- Max De Pree

🎧 Listen to this digest on YouTube Music

▶ Play Audio Digest

Duration: 21 mins • Perfect for listening on the go.

Jack & Jill went up the hill — and an AI tried to hack them

This Computerworld article details a groundbreaking red-teaming experiment by CodeWall where an autonomous AI agent successfully compromised the Jack & Jill hiring platform. By chaining together four seemingly minor vulnerabilities—a faulty URL fetcher, an exposed test mode, missing role checks, and lack of domain verification—the agent gained full administrative access within an hour. The experiment took a surreal turn when the agent autonomously generated a synthetic voice to interact with the platform’s internal assistants, even masquerading as Donald Trump to demand sensitive data. While the platform’s defensive guardrails successfully repelled direct social engineering attempts, the test proved that AI can navigate complex attack vectors with greater speed and creativity than human experts. CodeWall CEO Paul Price emphasizes that AI’s ability to digest vast information and run thousands of simultaneous experiments necessitates a radical shift in defensive postures. As AI lowers the barrier for sophisticated cyberattacks, organizations must move beyond periodic scans toward continuous, adversarial testing. Ultimately, this piece serves as a stark warning that integrating autonomous agents into business operations creates entirely new, unsecured attack surfaces that require urgent attention from security leaders worldwide.

When is an SBOM not an SBOM? CISA’s Minimum Elements

This Techzine article examines the Cybersecurity and Infrastructure Security Agency's 2025 guidance that significantly elevates the technical standards for Software Bills of Materials. By introducing "Minimum Elements," CISA establishes a rigorous baseline for what constitutes a credible SBOM, moving beyond simple component lists to include cryptographic hashes and detailed generation context. This shift aligns with global regulatory trends, most notably the EU Cyber Resilience Act, which legally mandates "security by design" and persistent SBOM maintenance for digital products sold in Europe. The author emphasizes that a static SBOM is no longer sufficient; instead, these documents must be dynamic, immutable records generated for every build to facilitate rapid incident response. In an era of strict compliance deadlines—often requiring vulnerability notification within 24 hours—the ability to accurately query software dependencies has become a competitive necessity. Ultimately, the article argues that mature, automated SBOM processes are critical for establishing trust with procurement teams and regulators. Organizations failing to adopt these rigorous standards risk being excluded from the global market as the industry moves toward a more transparent, secure, and verifiable software supply chain.

NIST concept paper explores identity and authorization controls for AI agents

The National Institute of Standards and Technology (NIST), through its National Cybersecurity Center of Excellence, has released a pivotal draft concept paper titled “Accelerating the Adoption of Software and Artificial Intelligence Agent Identity and Authorization.” This document addresses the critical security gap created by the rapid emergence of “agentic” AI systems—software capable of autonomous decision-making and task execution with minimal human oversight. As these agents increasingly interact with sensitive enterprise networks, NIST argues that traditional automation scripts no longer suffice as a governance model. Instead, the paper proposes that AI agents must be recognized as distinct, identifiable entities within identity management frameworks, rather than operating under shared or anonymous credentials. The initiative explores adapting established standards like OAuth and OpenID Connect to manage the unique challenges of agent authentication and dynamic authorization, ensuring the principle of least privilege remains intact. Furthermore, the paper highlights significant risks such as prompt injection and accountability concerns, suggesting robust logging and auditing mechanisms to trace autonomous actions back to human authorities. Ultimately, NIST aims to provide a practical implementation guide that allows organizations to securely harness the power of AI agents while maintaining rigorous oversight, closing the loop between technical efficiency and enterprise security.

Middle East Conflict Highlights Cloud Resilience Gaps

This Darkreading article explores how recent geopolitical tensions and military actions have shattered the illusion of the cloud as a geography-independent entity. Robert Lemos details how kinetic strikes, including drone and missile attacks on Amazon Web Services (AWS) facilities in the UAE and Bahrain, have shifted data centers from cyber targets to Tier 1 strategic military objectives. These events underscore a critical flaw in current cloud architecture: while designed to withstand natural disasters, facilities are often ill-equipped for the physical destruction of modern warfare. With backup sites frequently located within a 60-mile radius of primary hubs, regional conflicts can simultaneously disable both main and redundant systems, causing permanent hardware loss and long-term operational paralysis. The piece emphasizes that industries reliant on real-time processing, such as finance and defense, face the greatest risks from these localized outages. Consequently, experts are calling for a fundamental shift in disaster recovery strategies, moving away from strict domestic data residency toward "Allied Data Sovereignty." This approach would allow critical national data to be legally backed up and hosted in allied nations during crises, ensuring that essential digital services can survive even when the physical infrastructure on the ground is compromised by kinetic warfare.

Why AI is both a curse and a blessing to open-source software - according to developers

In this ZDNET article Steven Vaughan-Nichols explores the dual-edged impact of artificial intelligence on the open-source community. On the positive side, AI serves as a powerful "blessing" by accelerating security triage and automating tedious maintenance tasks. For instance, Mozilla successfully utilized Anthropic’s Claude to identify critical vulnerabilities in Firefox far more efficiently than traditional methods, while the Linux kernel leverages AI to streamline patch backports and CVE workflows. However, this progress is countered by a significant "curse": a deluge of "AI slop." Maintainers of projects like cURL are being overwhelmed by low-quality, AI-generated security reports that lack substance and drain volunteer resources, a phenomenon Daniel Stenberg describes as a form of DDoS attack. Furthermore, large companies like Google have been criticized for dumping minor, AI-discovered bugs on small projects without offering fixes or financial support. Ultimately, industry leaders like Linus Torvalds emphasize that while AI is an invaluable evolutionary step in coding tools, it must be used responsibly. To ensure a productive future, the open-source ecosystem requires a cultural shift where human accountability and rigorous "showing of work" remain central to the development process, preventing automated noise from drowning out genuine innovation.

When AI safety constrains defenders more than attackers

In the CSO Online article Sharma highlights a growing imbalance in the cybersecurity landscape caused by the rigid implementation of AI safety guardrails. While major AI providers have developed sophisticated filters to prevent harmful content generation, these mechanisms often fail to differentiate between malicious intent and legitimate defensive research. Consequently, security professionals, such as red teamers and penetration testers, frequently encounter refusals when attempting to generate realistic phishing simulations or exploit code for authorized assessments. This friction creates a significant operational gap, as threat actors remain entirely unconstrained by such ethical or technical boundaries. Attackers can easily bypass restrictions using jailbroken models, locally hosted open-source alternatives, or specialized malicious tools available in underground markets. This asymmetry allows cybercriminals to industrialize attack variations while defenders struggle to validate detection rules or train employees against evolving threats. To address this disparity, the author argues for a transition toward authorization-based safety models that verify the identity and purpose of the user rather than relying solely on content-based filtering. Ultimately, for AI to truly enhance security, safety frameworks must evolve to support defensive workflows, ensuring that protective measures do not inadvertently become blind spots that benefit only the attackers.

5 tips for communicating the value of IT

In this CIO.com article Mary K. Pratt emphasizes that IT leaders must transition from being perceived as mere cost centers to being recognized as essential business partners. To achieve this, CIOs are encouraged to proactively highlight IT’s positive impacts, ensuring that technology’s role is not taken for granted or only noticed during catastrophic system failures. A critical shift involves ditching technical jargon in favor of business-centric language that prioritizes tangible impact over raw metrics like bandwidth or latency. By utilizing key performance indicators that resonate with specific stakeholders—such as improvements in sales conversion or employee productivity—leaders can demonstrate how technology investments directly influence the organization's bottom line. Furthermore, the article suggests that IT executives sharpen their storytelling skills to translate complex technical initiatives into relatable, human-centric narratives that address specific organizational pain points. Finally, shifting the focus from simple cost-cutting to asset-building and profit-driving allows IT to frame its contributions as catalysts for top-line growth. Ultimately, by consistently marketing their successes through a clear business lens, IT leaders can successfully shake off utility-like reputations and secure their positions as strategic drivers of value and innovation in an increasingly competitive digital landscape.

5 requirements for using MCP servers to connect AI agents

The Model Context Protocol (MCP) serves as a critical standard for orchestrating communication between AI agents, assistants, and LLMs, but successful deployment requires a strategic approach focused on five key requirements. First, organizations must define a narrow, granular scope for MCP servers to prevent performance degradation and ensure reliability. Second, establishing robust integration governance is essential; this involves deciding how to pull context and enforcing least-privilege access to prevent data exfiltration. Third, security non-negotiables are vital, as MCP lacks built-in authentication; teams should implement cryptographic verification, log all interactions, and maintain human-in-the-loop oversight for sensitive tasks. Fourth, developers must not delegate data responsibilities to the protocol, as MCP is merely a connectivity layer that does not guarantee underlying data quality or safety against prompt injection. Fifth, managing the end-to-end agent experience through comprehensive observability and monitoring is necessary to track agent behavior and prevent costly, inefficient resource exploration. By addressing these operational, security, and governance boundaries, businesses can leverage MCP servers to build more complex, trustworthy agentic workflows. This framework ensures that AI ecosystems remain secure and efficient as organizations transition from experimental projects to production-ready agentic systems that require seamless, cross-platform integration.

The limits of bubble thinking: How AI breaks every historical analogy

This Venturebeat article explores the common human tendency to view emerging technologies through the lens of past market cycles. While investors often compare the current artificial intelligence surge to the dot-com crash or the cryptocurrency craze, the author argues that these historical analogies are increasingly insufficient. This "bubble thinking" relies on instinctive pattern-matching, where people assume that because capital is rushing in and valuations are climbing, a catastrophic collapse is inevitable. However, AI possesses unique characteristics—such as its capacity for rapid self-improvement and its foundational role in transforming diverse industries—that set it apart from previous technological shifts. Unlike the speculative nature of crypto or the localized impact of early internet companies, AI is fundamentally reshaping business models and operational efficiency across the global economy. Consequently, traditional risk assessments and valuation methods may fail to capture the true scale of AI’s potential. Rather than waiting for a predictable burst, the article suggests that financial institutions and investors must adapt their strategies to account for an unprecedented paradigm shift. Ultimately, relying on outdated historical templates may lead to a fundamental misunderstanding of the transformative power and long-term trajectory of the modern AI revolution.

SIM Swaps Expose a Critical Flaw in Identity Security

SIM swap attacks represent a fundamental structural weakness in digital identity security, exploiting the industry's misplaced reliance on mobile phone numbers as trusted authentication anchors. Traditionally used for password resets and multi-factor authentication (MFA), phone numbers are easily compromised through social engineering or insider collusion at telecommunications providers, allowing criminals to seize control of a victim’s digital life. Once a number is successfully reassigned, attackers can intercept SMS-based one-time passcodes and bypass recovery safeguards to access sensitive accounts, including banking, email, and enterprise systems. The article highlights that phone numbers were originally designed for communication routing, not identity verification, making them unsuitable for high-security applications due to their portability and frequent recycling. To mitigate these risks, organizations must shift toward phishing-resistant authentication methods, such as hardware security keys and passkeys, while hardening account recovery workflows to move beyond SMS dependency. Additionally, the piece advocates for continuous identity threat detection and risk-based controls that treat identity as a dynamic signal rather than a static login event. Ultimately, the increasing scale and reliability of SIM swapping demand a significant evolution in security architecture, moving away from legacy assumptions to establish a more resilient, device-bound perimeter for modern identity protection.

Daily Tech Digest - January 13, 2026

Quote for the day:

"Don't let yesterday take up too much of today." -- Will Rogers

When AI Meets DevOps To Build Self-Healing Systems

Self-healing systems do not just react to events and incidents — they analyse historic data, identify early triggers or symptoms of failures, and act. For example, if a service is known to crash when it runs out of memory, a self-healing system can observe metrics like memory consumption, predict when the service may fail with very low memory, and take action to fix the issue—like restarting the service or allocating more memory—without human intervention. In AIOps, self-healing systems are powered by data science in terms of machine learning models, real-time analytics, and automated workflows. ... Self-healing systems don’t just rely on static rules and manual checks; they utilise real-time data streams and apply pattern and anomaly detection through machine learning to ascertain the state of the environment. A self-healing system is trying to gauge its own health all the time — CPU utilisation, latency, memory, throughput, traffic, security anomalies, etc — to preemptively address an impending failure. The key component of every self-healing system is a cycle that reflects the process followed by intelligent agents: Detect → Diagnose → Act. ... The integration of artificial intelligence and DevOps signifies an important change in the way modern IT systems are built, managed, and evolved. As we have discussed here, AIOps is not just an extension of a type of automation — it is changing the way operations are modelled from reactive to intelligent, self-healing ecosystems.

Building a product roadmap: From high-level vision to concrete plans

A roadmap provides the anchor to keep everyone aligned amid constant flux. Yet many organizations still treat roadmaps as static artifacts — a one-and-done exercise intended to appease executives or investors. That’s a mistake. The most effective roadmaps are living documents evolving with the product and market realities. ... If strategy defines direction, milestones are the engine that keeps the train moving. Too often, teams treat milestones as arbitrary checkpoints or internal deadlines. Done right, these can become powerful tools for motivation, alignment and storytelling. ... The best roadmaps aren’t written by PMs — they’re co-authored by teams. That’s why I advocate for bottom-up collaboration anchored in executive alignment. Before any roadmap offsite, sync with the CEO or leadership team. Understand what they care about and why. If they disagree with priorities, resolve those conflicts early. Then bring that context into a team workshop. During the session, identify technical leads — those trusted voices who can translate into action. Encourage them to pre-think tradeoffs and dependencies before the group session. ... The perfect roadmap doesn’t exist and that’s the point. Remember, the goal isn’t to build a flawless plan, but a resilient one. As President Dwight D. Eisenhower said, “Plans are useless, but planning is indispensable.” ... Vision without execution is hallucination. But execution without vision is chaos. The magic of product leadership lies in balancing both: crafting a roadmap that’s both inspiring and achievable.

Scattered network data impedes automation efforts

As IT organizations mature their network automation strategies, it’s becoming clear that network intent data is an essential foundation. They need reliable documentation of network inventory, IP address space, topology and connectivity, policies, and more. This requirement often kicks off a network source of truth (NSoT) project, which involves network teams discovering, validating, and consolidating disparate data in a tool that can model network intent and provide programmatic access to data for network automation tools and other systems. ... IT leaders do not understand the value of NSoT solutions. The data is already available, although it’s scattered and of dubious quality. Why should we spend money on a product or even extra engineers to consolidate it? “Part of the issue is that we’ve got leadership that are not infrastructure people,” said a network engineer with a global automobile manufacturer. “It’s kind of a heavy lift to get them to buy into it, because they see that applications are running fine over the network. ‘Why do I need to spend money on this is?’ And we tell them that the network is running fine, but there will be failures at some point and it’s worth preventing that.” ... NSoT isn’t a magic bullet for solving the problems IT organizations have with poor network documentation and scattered operational data. Network engineering teams will need to discover, validate, reconcile, and import data from multiple repositories. This process can be challenging and time-consuming. Some of this data will difficult to find.

What insurers expect from cyber risk in 2026

Cyber insurers are beginning to use LLMs to translate internet scale data into structured inputs for underwriting and portfolio analysis. These applications target specific pain points such as data gaps and processing delays. Broader change across pricing or risk selection remains gradual. ... AI supported workflows begin to reduce repetitive tasks across those stages. Automation supports data entry, document review, and routine verification. Human oversight remains central for judgment based decisions. The research links this shift to measurable operational effects. Fewer manual touches per claim reduce processing time and error rates. Claims teams gain capacity without proportional increases in staffing. ... Age verification and online safety legislation introduce unintended cyber risk. Requirements that reduce online anonymity create high value identity datasets that attract attackers. The research highlights rising exposure to identity based coercion, insider compromise, and extortion. Once personal identity data is leaked, attackers gain leverage that can translate into access to corporate systems. This dynamic supports long term campaigns by organized groups and state aligned actors. ... Data orchestration becomes a core capability. Insurers and reinsurers integrate signals including security posture, threat activity, and loss experience into shared models. Consistent views across teams and regions support portfolio governance. This shift places emphasis on actionability. Data value depends on timing and relevance within workflows rather than volume alone.

Human + AI Will Define the Future of Work by 2027: Nasscom-Indeed Report

This emerging model of Humans + AI working together is reported as the next phase of transformation, where success depends on how effectively AI will augment human capabilities, empower employees, and align with organizational purpose. The report highlights that the most effective human–AI partnerships are emerging across higher-order activities such as scope definition, system architecture, and data model design. At the same time, more routine and repeatable tasks, including boilerplate code generation and unit test creation, are expected to be increasingly automated by AI over the next two to three years. ... To stay relevant in a Human + AI workplace, the report emphasizes that individuals should build capability, adaptability, and continuous learning. This includes experience with using AI tools (prompting, critical review of output, combining AI speed with human judgment), moving up the value chain (e.g., developers from coding to architecture thinking), building multidisciplinary skills (tech + domain + professional skills), and focusing on outcomes over credentials by creating repositories of work samples showing measurable impact. ... Organizations have already started taking measures to address these challenges. Every seven in ten HR leaders are focusing on upskilling, more than half focusing on modernizing systems. With respect to AI adoption, 79% prioritize internal reskilling as a dominant strategy.

From vulnerability whack-a-mole to strategic risk operations

“Software bills of materials are just an ingredients list,” he notes. “That’s helpful because the idea is that through transparency we will have a shared understanding. The problem is that they don’t deliver a shared understanding because the expectation of anyone in security who reads the SBOM is the first job they’ll do is run those versions against vulnerability databases.” This creates a predictable problem: security teams receive SBOMs, scan them for vulnerabilities, and generate alerts for every CVE match, regardless of whether those vulnerabilities actually affect the product. ... To make SBOMs truly useful, Kreilein introduces VEX (Vulnerability Exploitability Exchange), an open standards framework that addresses the context problem. VEX provides four status messages: affected, not affected, under investigation, and fixed. “What we want to start doing is using a project called VEX that gives four possible status messages,” Kreilein explains. ... Developers aren’t refusing to patch because they don’t care about security. They’re worried that upgrading a component will break the application. “If my application is brittle and can’t take change, I cannot upgrade to the non-vulnerable version,” Kreilein explains. “If I don’t have effective test automation and integration and unit testing, I can’t guarantee that this upgrade won’t break the application.” This reframing shifts the security conversation from compliance and mandates to engineering fundamentals. Better test coverage, better reference architectures, and better secure-by-design practices become security initiatives.

AI backlash forces a reality check: humans are as important as ever

Companies are now moving beyond the hype and waking up to the consequences of AI slop, underperforming tools, fragmented systems, and wasted budgets, said Brooke Johnson, chief legal officer at Ivanti. “The early rush to adopt AI prioritized speed over strategy, leaving many organizations with little to show for their investments,” Johnson said. Organizations now need to balance AI, workforce empowerment and cybersecurity at the same they’re still formulating strategies. That’s where people come in. ... AI is becoming less a tech problem and more of an adoption hurdle, Depa said. “What we’re seeing now more and more is less of a technology challenge, more of a change management, people, and process challenge — and that’s going to continue as those technologies continue to evolve,” he said. DXC Technology is taking a similar approach, designing tools where human insight, judgment, and collaboration create value that AI can’t do alone, said Dan Gray, vice president of global technical customer operations at the company. ... Companies might have to accept underutilizing some of the AI gains in the near term. AI could help workers complete their tasks in half the time and enjoy a leisurely pace. Alternately, employees might burn out quickly by getting more work. “If you try to lay them off, you don’t have a good workforce left. If you let them be, why are you paying them? So that’s a paradox,” Seth said.

Physical AI is the next frontier - and it's already all around you

Physical AI can be generally defined as AI implemented in hardware that can perceive the world around it and then reason to perform or orchestrate actions. Popular examples including autonomous vehicles and robots -- but robots that utilize AI to perform tasks have existed for decades. So what's the difference? ... Saxena adds that while humanoid robots will be useful in instances where humans don't want to perform a task, either because it is too tedious or too risky, they will not replace humans. That's where AI wearables, such as smart glasses, play an important role, as they can augment human capabilities. But beyond that, AI wearables might actually be able to feed back into other physical AI devices, such as robots, by providing a high-quality dataset based on real-life perspectives and examples. "Why are LLMs so great? Because there is a ton of data on the internet, for a lot of the contextual information and whatnot, but physical data does not exist," said Saxena. ... Given the privacy concerns that may come from having your everyday data used to train robots, Saxena highlighted that the data from your wearables should always be kept at the highest level of privacy. As a result, the data -- which should already be anonymized by the wearable company -- could be very helpful in training robots. That robot can then create more data, resulting in a healthy ecosystem. "This sharing of context, this sharing of AI between that robot and the wearable AI devices that you have around you is, I think, the benefit that you are going to be able to accrue," added Asghar.

Unlocking the Power of Geospatial Artificial Intelligence (GeoAI)

GeoAI is more than sophisticated map analytics. It is a strategic technology that blends AI with the physical world, allowing tech experts to see, understand, and act on patterns that were previously invisible. From planning sustainable cities to protecting wildlife, it’s helping experts tackle significant challenges with precision and speed. As the world generates more location-based data every day, GeoAI is becoming a must-have tool. It’s not just tech – it’s a way to make the world work better. ... To make it simpler. Machine learning spots trends, computer vision interprets images, GIS organizes it all, and knowledge graphs tie it together. The result? GeoAI can take a chaotic pile of data and deliver clear answers, like telling a city where to build a new park or warning about a wildfire risk. It’s a powerhouse that’s making location-based decisions faster and smarter. In all, GeoAI is transforming the speed at which we extract meaning from complex datasets, thereby enabling us to address the Earth’s most pressing challenges. ... Though powerful, GeoAI is not without challenges. Effective implementation requires careful attention to data privacy, technical infrastructure, and organizational change management. ... Leaders who take GeoAI seriously stand to gain more than just incremental improvements. With the right systems in place, they can respond faster, make smarter decisions, and get better results from every field team in the network.

For application security: SCA, SAST, DAST and MAST. What next?

If you think SAST and SCA are enough, you’re already behind. The future of app security is posture, provenance and proof, not alerts. ... Posture is the ‘what.’ Provenance is the ‘how’. The SLSA framework gives us a shared vocabulary and verifiable controls to prove that artifacts were built by hardened, tamper‑resistant pipelines with signed attestations that downstream consumers can trust. When I insist on SLSA Level 2 for most services and Level 3 for critical paths, I am not chasing compliance theater; I am buying integrity that survives audit and incident. Proof is where SBOMs finally grow up. Binding SBOM generation to the build that emits the deployable bits, signing them and validating at deploy time moves SBOMs from “ingredient lists” to enforceable controls. The CNCF TAG‑Security best practices v2 paper is my practical map, personas, VEX for exploitability, cryptographic verification to ensure tests actually ran, and prescriptive guidance for cloud‑native factories. ... Among the nexts, AI is the most mercurial. NIST’s final 2025 guidance on adversarial ML split threats across PredAI and GenAI and called out prompt injection in direct and indirect form as the dominant exploit in agentic systems where trusted instructions co mingle with untrusted data. The U.S. AI Safety Institute published work on agent hijacking evaluations, which I treat as required red‑team reading for anyone delegating actions to tools.

Daily Tech Digest - January 06, 2026

Quote for the day:

"Our expectation in ourselves must be higher than our expectation in others." -- Victor Manuel Rivera

Data 2026 outlook: The rise of semantic spheres of influence

While data started to garnering attention last year, AI and agents continued to suck up the oxygen. Why the urgency of agents? Maybe it’s “fear of missing out.” Or maybe there’s a more rational explanation. According to Amazon Web Services Inc. CEO Matt Garman, agents are the technology that will finally make AI investments pay off. Go to the 12-minute mark in his recent AWS re:Invent conference keynote, and you’ll hear him say just that. But are agents yet ready for prime time? ... And of course, no discussion of agentic interaction with databases is complete without mention of Model Context Protocol. The open-source MCP framework, which Anthropic PBC recently donated to the Linux Foundation, came out of nowhere over the past year to become the de facto standard for how AI models connect with data. ... There were early advances for extending governance to unstructured data, primarily documents. IBM watsonx.governance introduced a capability for curating unstructured data that transforms documents and enriches them by assigning classifications, data classes and business terms to prepare them for retrieval-augmented generation, or RAG. ... But for most organizations lacking deep skills or rigorous enterprise architecture practices, the starting points for defining semantics is going straight to the sources: enterprise applications and/or, alternatively, the newer breed of data catalogs that are branching out from their original missions of locating and/or providing the points of enforcement for data governance. In most organizations, the solution is not going to be either-or.

Engineering Speed at Scale — Architectural Lessons from Sub-100-ms APIs

Speed shapes perception long before it shapes metrics. Users don’t measure latency with stopwatches - they feel it. The difference between a 120 ms checkout step and an 80 ms one is invisible to the naked eye, yet emotionally it becomes the difference between "smooth" and "slightly annoying". ... In high-throughput platforms, latency amplifies. If a service adds 30 ms in normal conditions, it might add 60 ms during peak load, then 120 ms when a downstream dependency wobbles. Latency doesn’t degrade gracefully; it compounds. ... A helpful way to see this is through a "latency budget". Instead of thinking about performance as a single number - say, "API must respond in under 100 ms" - modern teams break it down across the entire request path: 10 ms at the edge; 5 ms for routing; 30 ms for application logic; 40 ms for data access; and 10–15 ms for network hops and jitter. Each layer is allocated a slice of the total budget. This transforms latency from an abstract target into a concrete architectural constraint. Suddenly, trade-offs become clearer: "If we add feature X in the service layer, what do we remove or optimize so we don’t blow the budget?" These conversations - technical, cultural, and organizational - are where fast systems are born. ... Engineering for low latency is really engineering for predictability. Fast systems aren’t built through micro-optimizations - they’re built through a series of deliberate, layered decisions that minimize uncertainty and keep tail latency under control.

Everything you need to know about FLOPs

A FLOP is a single floating‑point operation, meaning one arithmetic calculation (add, subtract, multiply, or divide) on numbers that have decimals. Compute benchmarking is done in floating point/fractional rather than integer/whole numbers because floating point is far more accurate of a measure than integers. A prefix is added to FLOPs to measure how many are performed in a second, starting with mega- (millions) the giga- (billions), tera- (trillions), peta- (quadrillions), and now exaFLOPs (quintillions). ... Floating point in computing starts at FP4, or 4 bits of floating point, and doubles all the way to FP64. There is a theoretical FP128, but it is never used as a measure. FP64 is also referred to as double-precision floating-point format, a 64-bit standard under IEEE 754 for representing real numbers with high accuracy. ... With petaFLOPS and exaFLOPs becoming a marketing term, some hardware vendors have been less than scrupulous in disclosing what level of floating-point operation their benchmarks use. It’s not it’s not uncommon for a company to promote exascale performance and then saying the little fine print that they’re talking about FP8, according to Snell. “It used to be if someone said exaFLOP, you could be pretty confident that they meant exaFLOP according to 64-bit scientific computing, but not anymore, especially in the field of AI, you need to look at what’s going behind that FLOP,” said Snell.

From SBOM to AI BOM: Rethinking supply chain security for AI native software

An effective AI BOM is not a static document generated at release time. It is a lifecycle artifact that evolves alongside the system. At ingestion, it records dataset sources, classifications, licensing constraints, and approval status. During training or fine-tuning, it captures model lineage, parameter changes, evaluation results, and known limitations. At deployment, it documents inference endpoints, identity and access controls, monitoring hooks, and downstream integrations. Over time, it reflects retraining events, drift signals, and retirement decisions. Crucially, each element is tied to ownership. Someone approved the data. Someone selected the base model. Someone accepted the residual risk. This mirrors how mature organizations already think about code and infrastructure, but extends that discipline to AI components that have historically been treated as experimental or opaque. To move from theory to practice, I encourage teams to treat the AI BOM as a “Digital Bill of Lading, a chain-of-custody record that travels with the artifact and proves what it is, where it came from, and who approved it. The most resilient operations cryptographically sign every model checkpoint and the hash of every dataset. By enforcing this chain of custody, they’ve transitioned from forensic guessing to surgical precision. When a researcher identifies a bias or security flaw in a specific open-source dataset, an organization with a mature AI BOM can instantly identify every downstream product affected by that “raw material” and act within hours, not weeks.

Beyond the Firehose: Operationalizing Threat Intelligence for Effective SecOps

Effective operationalization doesn't happen by accident. It requires a structured approach that aligns intelligence gathering with business risks. A framework for operationalizing threat intelligence structures the process from raw data to actionable defence, involving key stages like collection, processing, analysis, and dissemination, often using models like MITRE ATT&CK and Cyber Kill Chain. It transforms generic threat info into relevant insights for your organization by enriching alerts, automating workflows (via SOAR), enabling proactive threat hunting, and integrating intelligence into tools like SIEM/EDR to improve incident response and build a more proactive security posture. ... As intel maturity develops, the framework continuously incorporates feedback mechanisms to refine and adapt to the evolving threat environment. Cross-departmental collaboration is vital, enabling effective information sharing and coordinated response capabilities. The framework also emphasizes contextual integration, allowing organizations to prioritize threats based on their specific impact potential and relevance to critical assets. This ultimately drives more informed security decisions. ... Operationalization should be regarded as an ongoing process rather than a linear progression. If intelligence feeds result in an excessive number of false positives that overwhelm Tier 1 analysts, this indicates a failure in operationalization. It is imperative to institute a formal feedback mechanism from the Security Operations Center to the Intelligence team.

Compliance vs. Creativity: Why Security Needs Both Rule Books and Rebels

One of the most common tensions in the SOC arises from mismatched expectations. Compliance officers focus on control documentation when security teams are focusing on operational signals. For example, a policy may require multi-factor authentication (MFA), but if the system doesn’t generate alerts on MFA fatigue or unusual login patterns, attackers can slip past controls without detection. It’s important to also remember that just because something’s written in a policy doesn’t mean it’s being protected. A control isn’t a detection. It only matters if it shows up in the data. Security teams need to make sure that every big control, like MFA, logging, or encryption, has a signal that tells them when it’s being misused, misconfigured, or ignored. ... In a modern SOC, competing priorities are expected. Analysts want manageable alert volumes, red teams want room to experiment, and managers need to show compliance is covered. And at the top, CISOs need metrics that make sense to the board. However, high-performing teams aren’t the ones that ignore these differences. They, again, focus on alignment. ... The most effective security programs don’t rely solely on rigid policy or unrestricted innovation. They recognize that compliance offers the framework for repeatable success, while creativity uncovers gaps and adapts to evolving threats. When organizations enable both, they move beyond checklist security.

AI governance through controlled autonomy and guarded freedom

Controlled autonomy in AI governance refers to granting AI systems and their development teams a defined level of independence within clear, pre-established boundaries. The organization sets specific guidelines, standards and checkpoints, allowing AI initiatives to progress without micromanagement but still within a tightly regulated framework. The autonomy is “controlled” in the sense that all activities are subject to oversight, periodic review and strict adherence to organizational policies. ... In practice, controlled autonomy might involve delegated decision-making authority to AI project teams, but with mandatory compliance to risk assessment protocols, ethical guidelines and regulatory requirements. For example, an organization may allow its AI team to choose algorithms and data sources, but require regular reports and audits to ensure transparency and accountability. Automated systems may operate independently, yet their outputs are monitored for biases, errors or security vulnerabilities. ... Deciding between controlled autonomy and guarded freedom in AI governance largely depends on the nature of the enterprise, its industry and the specific risks involved. Controlled autonomy is best suited for sectors where regulatory compliance and risk mitigation are paramount, such as banking, healthcare or government services. ... Both controlled autonomy and guarded freedom offer valuable frameworks for AI governance, each with distinct strengths and potential drawbacks.

The 20% that drives 80%: Uncovering the secrets of organisational excellence

There are striking universalities in what truly drives impact. The first, which all three prioritise, is the belief that employee experience is inseparable from customer experience. Whether it is called EX = CX or framed differently, the sharp focus on making the workplace purposeful and engaging is foundational. Each business does this in a unique way, but the intent is the same: great employee experience leads to great customer experience. ... The second constant is an unwavering drive for business excellence. This is a nuanced but powerful 20% that shapes 80% of outcomes. Take McDonald’s, for instance: the consistency of quality and service, whether you are in Singapore, India, Japan or the US, is remarkable. Even as we localise, the core excellence remains unchanged. The same is true for Google, where the reliability of Search and breakthroughs in AI define the brand, and for PepsiCo, where high standards across foods and beverages define the brand. ... The third—and perhaps most challenging—is connectedness. For giants of this scale, fostering deep connections across global, regional and country boundaries, and within and across teams, is crucial. It is about psychological safety, collaboration, and creating space for people to connect and recognise each other. This focus on connectedness enables the other two priorities to flourish. If organisations keep these three at the heart of their practice, they remain agile, resilient, and, as I like to put it, the giants keep dancing.

Turning plain language into firewall rules

A central feature of the design is an intermediate representation that captures firewall policy intent in a vendor agnostic format. This representation resembles a normalized rule record that includes the five tuple plus additional metadata such as direction, logging, and scheduling. This layer separates intent from device syntax. Security teams can review the intermediate representation directly, since it reflects the policy request in structured form. Each field remains explicit and machine checkable. After the intermediate representation is built, the rest of the pipeline operates through deterministic logic. The current prototype includes a compiler that translates the representation into Palo Alto PAN OS command line configuration. The design supports additional firewall platforms through separate back end modules. ... A vendor specific linter applies rules tied to the target firewall platform. In the prototype, this includes checks related to PAN OS constraints, zone usage, and service definitions. These checks surface warnings that operators can review. A separate safety gate enforces high level security constraints. This component evaluates whether a policy meets baseline expectations such as defined sources, destinations, zones, and protocols. Policies that fail these checks stop at this stage. After compilation, the system runs the generated configuration through a Batfish based simulator. The simulator validates syntax and object references against a synthetic device model. Results appear as warnings and errors for inspection.

Why cybersecurity needs to focus more on investigation and less on just detection and response

The real issue? Many of today’s most dangerous threats are the ones that don’t show up easily on detection radars. Think about the advanced persistent threats (APTs) that remain hidden for months or the zero-day attacks that exploit vulnerabilities no one even knew existed. These threats may slip right past the detection systems because they don’t act in obvious ways. That’s why, in these cases, detection alone isn’t enough. It’s just the first step. ... Think of investigation as the part where you understand the full story. It’s like detective work: not just looking at the footprints, but figuring out where they came from, who’s leaving them, and why they’re trying to break in in the first place. You can’t stop a cyberattack with detection alone if you don’t understand what caused it or how it worked. And if you don’t know the cause, you can’t appropriately respond to the detected threat. ... The cost of neglecting investigation goes beyond just missing a threat. It’s about missed opportunities for learning and growth. Every attack offers a lesson. By investigating the full scope of a breach, you gain insights that not only help in responding to that incident but also prepare you to defend against future ones. It’s about building resilience, not just reaction. Think about it: If you never investigate an incident thoroughly, you’re essentially ignoring the underlying risk that allowed the threat to flourish. You might fix the hole that was exploited, but you won’t have a clear understanding of why it was there in the first place.

Daily Tech Digest - October 31, 2025

Quote for the day:

“The more you loose yourself in something bigger than yourself, the more energy you will have.” -- Norman Vincent Peale

Breaking the humanoid robot delusion

The robot is called . The company says NEO is the world’s first consumer-ready humanoid robot for the home. It is designed to automate routine chores and offer personal help so you can spend time on other things. ... Full autonomy in perceiving, planning, and manipulating like a human is a massive technology challenge. Robots have to be meticulously and painstakingly trained on every single movement, learn to recognize every object, and “understand” — for lack of a better word — how things move, how easily they break, what goes where, and what constitute appropriate actions. One major way humanoid robots are trained is with . A person wearing special equipment remotely controls prototype robots, training them for many hours on how to, say, fold a shirt. Many hours more are required to train the robot how to fold a smaller child’s shirt. Every variable, from the height of the folding table to the flexibility of the fabrics has to be trained separately. ... The temptation to use impressive videos of remotely controlled robots where you can’t see the person controlling them to raise investment money, inspire stock purchases and outright sell robot products, appears to be too strong to resist. Realistically, the technology for a home robot that operates autonomously the way the NEO appears to do in the videos in arbitrary homes under real-world conditions is many years in the future, possibly decades.

Your vendor’s AI is your risk: 4 clauses that could save you from hidden liability

The frontier of exposure now extends to your partners’ and vendors’ use. The main question being: Are they embedding AI into their operations in ways you don’t see until something goes wrong? ... Require vendors to formally disclose where and how AI is used in their delivery of services. That includes the obvious tools and embedded functions in productivity suites, automated analytics and third-party plug-ins. ... Include explicit language that your data may not be used to train external models, incorporated into vendor offerings or shared with other clients. Require that all data handling comply with the strictest applicable privacy laws and specify that these obligations survive the termination of the contract. ... Human oversight ensures that automated outputs are interpreted in context, reviewed for bias and corrected when the system goes astray. Without it, organizations risk over-relying on AI’s efficiency while overlooking its blind spots. Regulatory frameworks are moving in the same direction: for example, high-risk AI systems must have documented human oversight mechanisms under the . ... Negotiate liability provisions that explicitly cover AI-driven issues, including discriminatory outputs, regulatory violations and errors in financial or operational recommendations. Avoid generic indemnity language. Instead, AI-specific liability should be made its own section in the contract, with remedies that scale to the potential impact.

AI chatbots are sliding toward a privacy crisis

The problem reaches beyond internal company systems. Research shows that some of the most used AI platforms collect sensitive user data and share it with third parties. Users have little visibility into how their information is stored or reused, leaving them with limited control over its life cycle. This leads to an important question about what happens to the information people share with chatbots. ... One of the more worrying trends in business is the growing use of , where employees turn to unapproved tools to complete tasks faster. These systems often operate without company supervision, allowing sensitive data to slip into public platforms unnoticed. Most employees admit to sharing information through these tools without approval, even as IT leaders point to data leaks as the biggest risk. While security teams see shadow AI as a serious problem, employees often view it as low risk or a price worth paying for convenience. “We’re seeing an even riskier form of shadow AI,” says Tim Morris, “where departments, unhappy with existing GenAI tools, start building their own solutions using open-source models like .” ... Companies need to do a better job of helping employees understand how to use AI tools safely. This matters most for teams handling sensitive information, whether it’s medical data or intellectual property. Any data leak can cause serious harm, from damaging a company’s reputation to leading to costly fines.

The true cost of a cloud outage

The top 2000 companies in the world pay approximately $400 billion for downtime each year. A simple calculation reveals that these organizations, including the Dutch companies , , , , and , lose around $200 million from their annual accounts due to unplanned downtime. Incidentally, what the Splunk study really revealed were the hidden costs of financial damage caused by problems with security tools, infrastructure, and applications. These can wipe billions off market values. ... A more conservative estimate of downtime costs can be found at Information Technology Intelligence Consulting, which conducted research on behalf of . The majority of the parties surveyed had more than 200 employees, but the combination was more diverse than the top 2000 companies worldwide. The costs of downtime were substantial: at least $300,000 per hour for 90 percent of the companies in question. Forty-one percent stated that IT outages cost between $1 million and $5 million. ... In theory, the largest companies can rely on a . In addition, hyperscalers absorb many local outages by routing traffic to other regions. However, multicloud is not something that you can just set up as a start-up SME. In addition, you usually do not build your applications in a fully redundant form in different clouds. Furthermore, it is quite possible that you can continue to work yourself, but that your product is inaccessible.

5 Reasons Why You’re Not Landing Leadership Roles

Is your posture confident? Do you maintain steady eye contact? Is the cadence, pace and volume of your voice engaging, assertive and compelling? Recruiters assess numerous factors on the . ... Are you showing a grasp of the prospective employer’s pain points and demonstrating an original point of view for how you will approach these problems? Treat senior level interviews like – you are an expert on their business, uncovering potential opportunities with insightful questions, and sharing enough of your expertise that you’re perceived as the solution. ... Title bumps are rare, so you need to give the impression that you are already operating at the in order to be hired as such. Your interview examples should include stories about how you initiated new ideas or processes, as well as measurable results that impact the bottom line. Your examples should specify how many people and dollars you have managed. Ideally, you have stories that show you can get results in up and down markets. ... The hiring process extends over multiple rounds, especially for leadership roles. Keep track of everyone that you have met, as well as what you have specifically discussed with each of them. Send personalized follow-up emails that engage each interviewer uniquely based on what you discussed. This differentiates you as someone who listens and cares about them specifically.

Why understanding your cyber exposure is your first line of defence

Thanks to AI, attacks are faster, more targeted and increasingly sophisticated. As the lines between the physical and digital blur, the threat is no longer isolated to governments or critical national infrastructure. Every organisation is now at risk. Understanding your cyber exposure is the key to staying ahead. This isn’t just a buzzword either; it’s about knowing where you stand and what’s at risk. Knowing every asset, every connection, every potential weakness across your digital ecosystem is now the first step in building a defence that can keep pace with modern threats. But before you can manage your exposure, you need to understand what’s driving it – and why the modern attack surface is so difficult to defend. ... By consolidating data from across the environment and layering it with contextual intelligence, cyber exposure management allows security teams to move beyond passive monitoring. It’s not just about seeing more, it’s about knowing what matters and acting on it. That means identifying risks earlier, prioritising them more effectively and taking action before they escalate. ... Effective and modern cybersecurity is shifting to shaping the battlefield before threats even arrive. That’s down to the value of understanding your cyber exposure. After all, it’s not just about knowing what’s in your environment, it’s about knowing how it all fits together – what’s exposed, what’s critical and where the next threat is likely to emerge.

Applications and the afterlife: how businesses can manage software end of life

Both enterprise software and personal applications have a lifecycle, set by the vendor’s support and maintenance. Once an application or operating system goes out of support, it will continue to run. But there will be no further feature updates and vitally, often no security patches. ... When software end of life is unexpected, it can cause serious disruption to business processes. In the very worst-case scenarios, enterprises will only know there is a problem when a key application no longer functions, or if a malicious actor exploits a vulnerability. The problem for CIOs and CISOs is keeping track of the end of life dates for applications across their entire stack, and understanding and mapping dependencies between applications. This applies equally to in-house applications, off the shelf software and open source. “End of life software is not necessarily bad,” says Matt Middleton-Leal, general manager for EMEA at Qualys. “It’s just not updated any more, and that can lead to vulnerabilities. According to our research, nearly half of the issues on the CISA Known Exploited Vulnerabilities (KEV) list are found in outdated and unsupported software.” As CISA points out, attackers are most likely to exploit older vulnerabilities, and to target unpatched systems. Risks come from old, and known vulnerabilities, which IT teams should have patched.

Tips for CISOs switching between industries

Building a transferable skill set is essential for those looking to switch industries. For Dell’s first-ever CISO, Tim Youngblood, adaptability was never a luxury but a requirement. His early years as a consultant at gave him a front-row seat to the challenges of multiple industries before he ever moved into cybersecurity. Those early years also taught Youngblood that while every industry has its own nuances, the core security principles remain constant. ... Making the jump into a new industry isn’t about matching past job titles but about proving you can create impact in a new context. DiFranco says the key is to demonstrate relevance early. “When I pitch a candidate, I explain what they did, how they did it, and what their impact was to their organization in their specific industry,” he says. “If what they did and how they did it, and what their impact was on the organization resonates where that company wants to go, they’re a lot more likely to say, ‘I don’t really care where this person comes from because they did exactly what I want done in this organization’. ... The biggest career risk for many CISOs isn’t burnout or data breach, it’s being seen as a one-industry operator. Ashworth’s advice is to focus on demonstrating transferable skills. “It’s a matter of getting whatever job you’re applying for, to realise that those principles are the same, no matter what industry you’re in. Whether it’s aerospace, healthcare, or finance, the principles are the same. Show that, and you’ll avoid being pigeonholed.”

Awareness Is the New Armor: Why Humans Matter Most in Cyber Defense

People remain the most unpredictable yet powerful variable in cybersecurity. Lapses like permission misconfiguration, accidental credential exposure, or careless data sharing continue to cause most incidents. Yet when equipped with the right tools and timely information, individuals can become the strongest line of defense. The challenge often stems from behavior rather than intent. Employees frequently bypass security controls or use unapproved tools in pursuit of productivity, unintentionally creating invisible vulnerabilities that go unnoticed within traditional defences. Addressing this requires more than restrictive policies. Security must be built into everyday workflows so that safe practices become second nature. ... Since technology alone cannot secure an organization, a culture of security-first thinking is essential. Leaders must embed security into everyday workflows, promote upskilling, and focus on reinforcement rather than punishment. This creates a workforce that takes ownership of cybersecurity, checking email sources, verifying requests, and maintaining vigilance in every interaction. is both a reminder and a rallying cry. India’s digital economy presents immense opportunity, but its threat surface expands just as fast.

Creepy AI Crawlers Are Turning the Internet into a Haunted House

The degradation of the internet and market displacement caused by commercial AI crawlers directly undermines people’s ability to access information online. This happens in various ways. First, the put significant technical strain on the internet, making it more difficult and expensive to access for human users, as their activity increases the time needed to access websites. Second, the trained on this scraped content now provide answers directly to user queries, reducing the need to visit the original sources and cutting off the traffic that once sustained content creators, including media outlets. ... AI crawlers represent a fundamentally different economic and technical proposition––a vampiric relationship rather than a symbiotic one. They harvest content, news articles, blog posts, and open-source code without providing the semi-reciprocal benefits that made traditional crawling sustainable. Little traffic flows back to sources, especially when search engines like Google start to provide AI generated summaries rather than sending traffic on to the websites their summaries are based on. ... What makes this worse is that these actors aren’t requesting books to read individual stories or conduct genuine research, they’re extracting the entire collection to feed massive language model systems. The library’s resources are being drained not to serve readers, but to build commercial AI products that will never send anyone back to the library itself.