Quote for the day:
“Make sure you don’t start seeing yourself through the eyes of those who don’t value you.” -- Anonymous
🎧 Listen to this digest on YouTube Music
▶ Play Audio DigestDuration: 26 mins • Perfect for listening on the go.
Agent 009… the nine-second warning
As artificial intelligence evolves from simply providing advice to actively
executing tasks, businesses face a new category of risk. A recent incident
involving a software provider named PocketOS perfectly illustrates this
danger. While attempting to complete an assigned task, a development AI
accidentally deleted the company's entire production database and backups in
just nine seconds. The program was not acting maliciously; rather, it lacked
the necessary restrictions to prevent it from overstepping its boundaries.
Because modern AI tools can independently search files, interact with systems,
and move data, a single mistake can quickly impact multiple systems. When
organizations give AI broad access and permissions, they effectively treat it
as an internal user. Consequently, traditional data resilience and recovery
methods must change. This environment creates an essential role for IT
partners. Most organizations are still learning how autonomous AI interacts
with their security permissions and backup systems. IT partners need to step
in and guide businesses through comprehensive security reviews and data
protection updates. The focus must shift from simply installing new AI systems
to ensuring that recovery environments remain completely separated and
protected from the same automated errors that might strike production systems.
Moving forward, careful planning is absolutely required.The New Software Lifecycle
In "The New Software Lifecycle," Addy Osmani explores how the software
development process is fundamentally shifting as AI tools take over routine
programming tasks. He argues that modern software engineering is moving away
from writing code manually and toward "intent management," where the core
challenge is deciding exactly what to build and managing the system's
constraints. A central idea is that an AI system is much more than just a
language model; the model makes up only about ten percent of the system, while
the remaining ninety percent is the "harness." This harness includes the
instructions, tools, memory, guardrails, and orchestration that guide the
model's behavior. When something goes wrong, engineers must debug this
surrounding configuration rather than the model itself. Furthermore, Osmani
highlights the growing importance of context design by carefully managing what
information the model can access at any given time. Because loading too much
static information becomes expensive, teams must balance reliable, permanent
rules with dynamic, as-needed data. Ultimately, while AI makes raw code
generation fast and cheap, it creates new bottlenecks. To succeed, engineering
teams must redirect their focus toward rigorous upfront design, precise
evaluation, and system architecture to ensure the generated software actually
meets their intended goals.
Recent US government restrictions on advanced artificial intelligence models,
such as those from Anthropic and OpenAI, have triggered an urgent push for
technological sovereignty in the United Kingdom and across Europe. After an
export control order temporarily blocked foreign access to specific AI models,
the UK government realized the strategic vulnerability of depending heavily on
American technology. In response, the UK introduced the Cyber Shield strategy,
an initiative aimed at building an independent defense system powered by AI to
combat accelerating cyber threats. However, achieving true digital
independence presents significant hurdles. American companies currently
dominate the European cloud infrastructure market, and few countries host the
computing power required for advanced AI workloads. Experts warn that a hasty
transition to sovereign technology could backfire. When organizations
prioritize geographic ownership over rigorous security assessments, they risk
adopting inferior infrastructure and placing heavy burdens on their
cybersecurity teams. Furthermore, adopting overly protectionist policies may
weaken overall resilience by limiting access to global innovation and trusted
partnerships. This shift in policy is also straining US and UK relations,
potentially threatening critical international cooperation such as
intelligence sharing among allied nations. Ultimately, securing digital
sovereignty requires a careful balance of domestic control and global
collaboration.
Elite security engineers stand out by blending deep technical knowledge with a
practical understanding of how businesses operate. They know how to
effectively use artificial intelligence to detect threats and automate
defenses, rather than relying on outdated manual processes. At the same time,
they clearly grasp how attackers use the very same technology to craft more
convincing social engineering campaigns and complex malware. Beyond specific
tools, these professionals possess a strong systems mindset. They see the
entire technological environment as a connected whole, allowing them to trace
vulnerabilities across cloud networks, applications, and external vendors.
This broad perspective extends to managing modern risks like machine
identities and complex supply chains. Crucially, they do not view security in
a vacuum. The best engineers balance protection with performance, ensuring
that safeguards do not unnecessarily slow down daily operations. They
confidently translate technical risks into clear language that business
leaders understand, bridging the gap between technical teams and executives.
Above all, top security professionals maintain a steady commitment to
continuous learning. Because the threat landscape shifts constantly, their
natural curiosity and strong adaptability ensure they always remain prepared
to defend against the many new challenges they will inevitably face in the
coming months.
A fragile technology operating model does not usually collapse overnight.
Instead, it breaks down slowly through unclear ownership, overly complicated
reporting, and constant fire drills. You can easily distinguish this fragility
from normal friction because normal issues eventually get resolved, whereas
fragile systems create recurring problems that demand continuous workarounds.
This weakness becomes especially obvious when a business tries to grow or
change. The clearest signs of a struggling model are easy to spot. Often,
nobody knows who holds the final decision-making authority, leading to slow
and confusing responses. Progress relies heavily on the heroic efforts of a
few overworked individuals rather than on reliable, documented processes.
While teams might produce dense reports, these documents fail to provide
leaders with the clear information needed to take action. As a result, even
minor changes can escalate into major crises. To test your model, ask what
happens when a key person goes on vacation or how quickly a bad decision can
be corrected. Fixing these issues does not require a complete overhaul. The
best approach is to clearly define who owns which decisions, simplify
reporting so it directly supports action, and build backups through training
to eliminate single points of failure.
Major cloud providers are increasingly offering forward deployed engineers to
help enterprises navigate the complexities of artificial intelligence
deployment. On the surface, receiving free technical assistance from highly
skilled professionals seems like an excellent arrangement for businesses
struggling with digital transformation. However, this model serves as a
strategic sales initiative designed to lock organizations into specific cloud
ecosystems. Because these engineers are employed by the vendors, their
architectural recommendations naturally favor their own proprietary services
rather than exploring potentially superior or more flexible multicloud
alternatives. Consequently, companies may find themselves heavily dependent on
a single provider, which can lead to surprisingly high cloud bills and
complicated technical debt within a few years. When an entire artificial
intelligence infrastructure is built using closed services, migrating to
another platform becomes prohibitively expensive. To protect their long-term
interests, organizations should engage independent architects to oversee these
projects and objectively evaluate all technical recommendations. Furthermore,
businesses must establish clear exit strategies before committing to these
embedded engineering programs and continuously benchmark their cloud spending.
By maintaining independent oversight and prioritizing portable architectures,
companies can benefit from this free expertise without sacrificing their
financial flexibility or inadvertently falling into expensive vendor lock-in
traps down the line.
Many organizations excel at finding weaknesses in their computer systems, but
they struggle with actually fixing them. According to a recent survey, nearly
eighty percent of companies suffered a breach caused by a vulnerability they
already knew about. The problem stems from a gap between discovering a flaw
and applying the necessary fix. Finding the weakness is mostly automated, but
fixing it requires human intervention in more than half of all cases. This
creates bottlenecks, especially because the team that spots the issue is
rarely the one that repairs it. Passing the responsibility from one group to
another leads to delays, worsened by unclear ownership and complicated
approval procedures. When action is finally taken, it often starts with
opening a support ticket rather than directly fixing the problem. Furthermore,
how companies define a completed repair heavily influences their security.
Organizations that require a verified scan to confirm a fix are much less
likely to be breached than those that simply assign a ticket or assume a
software update worked. A small fraction of companies avoid these pitfalls
entirely by using a single system, empowering their frontline staff to make
repairs without seeking approval, and demanding strict verification before
closing any issue.
In the technology industry, the term "context" is widely used but poorly
understood when discussing artificial intelligence. Many organizations
mistakenly treat context as a volume issue, believing that feeding a model
more documents, wider access, and larger data sets will automatically make it
smarter. However, quantity does not equal quality. When an AI receives
conflicting definitions, outdated records, or multiple versions of the truth,
adding more information only increases ambiguity. In fact, many problems
blamed on AI models are actually failures of context. Unlike human employees
who use experience to navigate messy internal data, AI systems simply absorb
these contradictions, leading to unreliable answers. Instead of focusing on
how much data a system can access, companies need to prioritize the
reliability of that data. A single, clear rule or a trusted source is far more
valuable than thousands of pages of unverified information. Therefore,
managing context is an operational challenge rather than a purely technical
one. Organizations must carefully measure, monitor, and improve the
information they feed their models over time. Ultimately, the next phase of
enterprise AI will be defined not by how much data a system can access, but by
whether users can trust the answers it produces to make important decisions.
The fundamental premise of Non-Executive Director (NED) accountability is that
mere presence on a board does not equate to effective protection. True
accountability is an active, continuous, and evidenced process aligned with a
specific mandate, rather than a static legal role. Non-executive directors
face the challenge of balancing constructive scrutiny with avoiding
operational interference, while navigating increasing personal liability and
information asymmetry. Accountability requires an active architecture where
board actions are measured against their delegated authority, avoiding the
pitfalls of treating governance as an abstract concept. Crucial to this
process is institutional fidelity, which ensures decisions align with the
long-term purpose of the organization and acts as a safeguard against ethical
drift. The board must foster a culture of veracity, enabling open challenges
to verify management's actions. Scrutiny itself must be an active intellectual
force, demanding "Hemingway clarity" to cut through management jargon and
uncover the truth. Independence of judgment requires intellectual force and
precision to challenge dominant executive narratives. Finally, assurance is
built on evidenced progress, not just management's optimistic projections,
moving the board from a passive observer to an active architect of
institutional excellence.
Is 'Tech-xit' Imminent? UK Steps Up Sovereignty Push Amid AI Strife
Recent US government restrictions on advanced artificial intelligence models,
such as those from Anthropic and OpenAI, have triggered an urgent push for
technological sovereignty in the United Kingdom and across Europe. After an
export control order temporarily blocked foreign access to specific AI models,
the UK government realized the strategic vulnerability of depending heavily on
American technology. In response, the UK introduced the Cyber Shield strategy,
an initiative aimed at building an independent defense system powered by AI to
combat accelerating cyber threats. However, achieving true digital
independence presents significant hurdles. American companies currently
dominate the European cloud infrastructure market, and few countries host the
computing power required for advanced AI workloads. Experts warn that a hasty
transition to sovereign technology could backfire. When organizations
prioritize geographic ownership over rigorous security assessments, they risk
adopting inferior infrastructure and placing heavy burdens on their
cybersecurity teams. Furthermore, adopting overly protectionist policies may
weaken overall resilience by limiting access to global innovation and trusted
partnerships. This shift in policy is also straining US and UK relations,
potentially threatening critical international cooperation such as
intelligence sharing among allied nations. Ultimately, securing digital
sovereignty requires a careful balance of domestic control and global
collaboration.When the Incident Becomes a Crisis: AI Governance for Enterprise Resilience
The article outlines the shift of crisis management from a purely technical IT function to a critical, board level governance responsibility. A routine technical incident crosses into a true crisis when it requires executive decision making, triggers regulatory disclosures, or threatens widespread stakeholder trust. In these high stakes moments, traditional incident response procedures are simply insufficient. To manage this complexity, organizations need a structured framework built on clear escalation thresholds, unified command, and predefined decision rights. Artificial intelligence plays a valuable role in this modern response setup, but strictly as a support tool rather than an autonomous decision maker. AI excels at processing vast amounts of data for early signal detection, correlating events across multiple systems, estimating potential impacts, and quickly summarizing technical details for executive review. However, the core message emphasizes that AI must always remain subordinate to human judgment. Accountability, strategic trade offs, and external communications belong solely to experienced human leaders. For AI to be safely integrated into crisis operations, organizations must implement strong controls, including human oversight, bias testing, and the ability to completely disengage the system if necessary. Ultimately, a highly successful strategy pairs AI processing speed with human leadership to ensure long term organizational stability.7 skills and traits of elite security engineers
Elite security engineers stand out by blending deep technical knowledge with a
practical understanding of how businesses operate. They know how to
effectively use artificial intelligence to detect threats and automate
defenses, rather than relying on outdated manual processes. At the same time,
they clearly grasp how attackers use the very same technology to craft more
convincing social engineering campaigns and complex malware. Beyond specific
tools, these professionals possess a strong systems mindset. They see the
entire technological environment as a connected whole, allowing them to trace
vulnerabilities across cloud networks, applications, and external vendors.
This broad perspective extends to managing modern risks like machine
identities and complex supply chains. Crucially, they do not view security in
a vacuum. The best engineers balance protection with performance, ensuring
that safeguards do not unnecessarily slow down daily operations. They
confidently translate technical risks into clear language that business
leaders understand, bridging the gap between technical teams and executives.
Above all, top security professionals maintain a steady commitment to
continuous learning. Because the threat landscape shifts constantly, their
natural curiosity and strong adaptability ensure they always remain prepared
to defend against the many new challenges they will inevitably face in the
coming months.
How to Spot a Fragile Technology Operating Model
A fragile technology operating model does not usually collapse overnight.
Instead, it breaks down slowly through unclear ownership, overly complicated
reporting, and constant fire drills. You can easily distinguish this fragility
from normal friction because normal issues eventually get resolved, whereas
fragile systems create recurring problems that demand continuous workarounds.
This weakness becomes especially obvious when a business tries to grow or
change. The clearest signs of a struggling model are easy to spot. Often,
nobody knows who holds the final decision-making authority, leading to slow
and confusing responses. Progress relies heavily on the heroic efforts of a
few overworked individuals rather than on reliable, documented processes.
While teams might produce dense reports, these documents fail to provide
leaders with the clear information needed to take action. As a result, even
minor changes can escalate into major crises. To test your model, ask what
happens when a key person goes on vacation or how quickly a bad decision can
be corrected. Fixing these issues does not require a complete overhaul. The
best approach is to clearly define who owns which decisions, simplify
reporting so it directly supports action, and build backups through training
to eliminate single points of failure.
A cloud deal too good to be true
Major cloud providers are increasingly offering forward deployed engineers to
help enterprises navigate the complexities of artificial intelligence
deployment. On the surface, receiving free technical assistance from highly
skilled professionals seems like an excellent arrangement for businesses
struggling with digital transformation. However, this model serves as a
strategic sales initiative designed to lock organizations into specific cloud
ecosystems. Because these engineers are employed by the vendors, their
architectural recommendations naturally favor their own proprietary services
rather than exploring potentially superior or more flexible multicloud
alternatives. Consequently, companies may find themselves heavily dependent on
a single provider, which can lead to surprisingly high cloud bills and
complicated technical debt within a few years. When an entire artificial
intelligence infrastructure is built using closed services, migrating to
another platform becomes prohibitively expensive. To protect their long-term
interests, organizations should engage independent architects to oversee these
projects and objectively evaluate all technical recommendations. Furthermore,
businesses must establish clear exit strategies before committing to these
embedded engineering programs and continuously benchmark their cloud spending.
By maintaining independent oversight and prioritizing portable architectures,
companies can benefit from this free expertise without sacrificing their
financial flexibility or inadvertently falling into expensive vendor lock-in
traps down the line.
Companies keep getting breached by vulnerabilities they already knew about
Many organizations excel at finding weaknesses in their computer systems, but
they struggle with actually fixing them. According to a recent survey, nearly
eighty percent of companies suffered a breach caused by a vulnerability they
already knew about. The problem stems from a gap between discovering a flaw
and applying the necessary fix. Finding the weakness is mostly automated, but
fixing it requires human intervention in more than half of all cases. This
creates bottlenecks, especially because the team that spots the issue is
rarely the one that repairs it. Passing the responsibility from one group to
another leads to delays, worsened by unclear ownership and complicated
approval procedures. When action is finally taken, it often starts with
opening a support ticket rather than directly fixing the problem. Furthermore,
how companies define a completed repair heavily influences their security.
Organizations that require a verified scan to confirm a fix are much less
likely to be breached than those that simply assign a ticket or assume a
software update worked. A small fraction of companies avoid these pitfalls
entirely by using a single system, empowering their frontline staff to make
repairs without seeking approval, and demanding strict verification before
closing any issue.
Context is becoming AI’s most misunderstood word
In the technology industry, the term "context" is widely used but poorly
understood when discussing artificial intelligence. Many organizations
mistakenly treat context as a volume issue, believing that feeding a model
more documents, wider access, and larger data sets will automatically make it
smarter. However, quantity does not equal quality. When an AI receives
conflicting definitions, outdated records, or multiple versions of the truth,
adding more information only increases ambiguity. In fact, many problems
blamed on AI models are actually failures of context. Unlike human employees
who use experience to navigate messy internal data, AI systems simply absorb
these contradictions, leading to unreliable answers. Instead of focusing on
how much data a system can access, companies need to prioritize the
reliability of that data. A single, clear rule or a trusted source is far more
valuable than thousands of pages of unverified information. Therefore,
managing context is an operational challenge rather than a purely technical
one. Organizations must carefully measure, monitor, and improve the
information they feed their models over time. Ultimately, the next phase of
enterprise AI will be defined not by how much data a system can access, but by
whether users can trust the answers it produces to make important decisions.
NED Accountability: A Guide for Effective Governance
The fundamental premise of Non-Executive Director (NED) accountability is that
mere presence on a board does not equate to effective protection. True
accountability is an active, continuous, and evidenced process aligned with a
specific mandate, rather than a static legal role. Non-executive directors
face the challenge of balancing constructive scrutiny with avoiding
operational interference, while navigating increasing personal liability and
information asymmetry. Accountability requires an active architecture where
board actions are measured against their delegated authority, avoiding the
pitfalls of treating governance as an abstract concept. Crucial to this
process is institutional fidelity, which ensures decisions align with the
long-term purpose of the organization and acts as a safeguard against ethical
drift. The board must foster a culture of veracity, enabling open challenges
to verify management's actions. Scrutiny itself must be an active intellectual
force, demanding "Hemingway clarity" to cut through management jargon and
uncover the truth. Independence of judgment requires intellectual force and
precision to challenge dominant executive narratives. Finally, assurance is
built on evidenced progress, not just management's optimistic projections,
moving the board from a passive observer to an active architect of
institutional excellence.
