Daily Tech Digest by Kannan Subbiah: Sustainability

Showing posts with label Sustainability. Show all posts

Daily Tech Digest - April 01, 2026

Quote for the day:

"If you automate chaos, you simply get faster chaos. Governance is the art of organizing the 'why' before the 'how'." — Adapted from Digital Transformation principles

🎧 Listen to this digest on YouTube Music

▶ Play Audio Digest

Duration: 21 mins • Perfect for listening on the go.

Why Culture Cracks During Digital Transformation

is frequently heralded as a panacea for modern business efficiency, yet argues that these initiatives often falter because leaders prioritize technological implementation over cultural integrity. When organizations undergo rapid digital shifts, the "cracks" in culture emerge from a fundamental misalignment between new tools and the human experience. Employees often face heightened anxiety regarding job security and skill relevance, leading to a pervasive sense of uncertainty that stifles productivity. Gostick emphasizes that the failure is rarely technical; instead, it stems from a lack of transparent communication and psychological safety. Leaders who focus solely on ROI and software integration neglect the emotional toll of change, resulting in disengagement and burnout. To prevent cultural collapse, management must actively bridge the gap by fostering an environment of gratitude and clear purpose. This necessitates involving team members in the transition process and ensuring that digital tools enhance, rather than replace, human connection. Ultimately, the article posits that culture acts as the essential operating system for any technological upgrade. Without a resilient foundation of trust and recognition, even the most sophisticated digital strategy is destined to fail, proving that people remain the most critical component of successful corporate evolution.

Most AI strategies will collapse without infrastructure discipline: Sesh Tirumala

In an interview with Express Computer, Sesh Tirumala, CIO of Western Digital, warns that most are destined for failure without rigorous infrastructure discipline and alignment with business outcomes. Rather than focusing solely on advanced models, Tirumala emphasizes that AI readiness depends on a foundational architecture encompassing security, resilience, , scalable compute platforms, and a trusted data backbone. He argues that AI essentially acts as an amplifier; therefore, applying it to a weak foundation only industrializes existing inconsistencies. To achieve scalable value, organizations must shift from fragmented experimentation to disciplined execution, ensuring that data is connected and governed end-to-end. Beyond technical requirements, Tirumala highlights that the true challenge lies in organizational readiness and change management. Leaders must be willing to redesign workflows and invest in human capital, as AI transformation is fundamentally a people-centric evolution supported by technology. The evolving role of the CIO is thus to transition from a technical manager to a transformation leader who integrates intelligence into every business decision. Ultimately, infrastructure discipline separates successful enterprise-scale deployments from those stuck in perpetual pilot phases, making a robust foundation the most critical determinant of whether AI delivers real, sustained value.

IoT Device Management: Provisioning, Monitoring and Lifecycle Control

IoT Device Management serves as the critical operational backbone for large-scale connected ecosystems, ensuring that devices remain secure, functional, and efficient from initial deployment through decommissioning. As projects scale from limited pilots to millions of endpoints, organizations utilize these processes to centralize control over distributed assets, bridging the gap between physical hardware and cloud services. The management lifecycle encompasses four primary stages: secure provisioning to establish device identity, continuous monitoring for telemetry and health diagnostics, remote maintenance via over-the-air (OTA) updates, and responsible retirement. These capabilities offer significant benefits, including enhanced security through credential management, reduced operational costs via remote troubleshooting, and accelerated innovation cycles. However, the field faces substantial challenges, such as maintaining interoperability across heterogeneous hardware, managing power-constrained battery devices, and supporting hardware over extended lifespans often exceeding a decade. Looking forward, the industry is evolving with the adoption of eSIM and iSIM technologies for more flexible connectivity, alongside a shift toward zero-trust security architectures and AI-driven predictive maintenance. Ultimately, robust device management is indispensable for mitigating security risks and ensuring the long-term reliability of IoT investments across diverse sectors, including smart utilities, industrial manufacturing, and mission-critical healthcare systems.

Enterprises demand cloud value

According to David Linthicum’s analysis of the Flexera 2026 State of the Cloud Report, enterprise cloud strategies are undergoing a fundamental shift from simple cost-cutting toward a focus on measurable business value and ROI. After years of grappling with unpredictable billing and wasted resources—estimated at 29% of current spending—organizations are maturing by establishing Cloud Centers of Excellence (CCOEs) and dedicated to ensure centralized accountability. This trend is further accelerated by the rapid adoption of , which has seen extensive usage grow to 45% of organizations. While AI offers immense opportunities for innovation, it introduces complex, usage-based pricing models that demand early and rigorous governance to prevent financial sprawl. To maximize cloud investments, the article recommends doubling down on centralized governance, integrating AI oversight into existing frameworks, and treating FinOps as a continuous operational discipline rather than a one-time project. Ultimately, the industry is moving past the chaotic early days of cloud adoption into an era where every dollar spent must demonstrate a tangible return. By aligning technical innovation with strategic business goals, mature enterprises are finally extracting the true value that cloud and AI technologies originally promised, turning potential liabilities into competitive advantages.

The external pressures redefining cybersecurity risk

In his analysis of the evolving threat landscape, John Bruggeman identifies three external pressures fundamentally redefining modern cybersecurity risk: geopolitical instability, the rapid advancement of artificial intelligence, and systemic third-party vulnerabilities. Geopolitical tensions are no longer localized; instead, battle-tested techniques from conflict zones frequently spill over into global networks, particularly endangering operational technology (OT) and critical infrastructure. Simultaneously, AI has triggered a high-stakes arms race, lowering entry barriers for attackers while expanding organizational attack surfaces through internal tool adoption and potential data leakage. Finally, the concept of "cyber inequity" highlights that an organization’s security is often only as robust as its weakest vendor, with over 35% of breaches originating within partner networks. To navigate these challenges, Bruggeman advocates for elevating OT security to board-level oversight and establishing dedicated AI Risk Councils to govern internal innovation. Rather than aiming for absolute prevention, successful leaders must prioritize resilience and proactive incident response planning, operating under the assumption that external partners will eventually be compromised. By integrating these strategies, organizations can better withstand pressures that originate far beyond their immediate control, shifting from a reactive posture to one of coordinated defense and long-term business continuity.

Failure As a Means to Build Resilient Software Systems: A Conversation with Lorin Hochstein

In this InfoQ podcast, host Michael Stiefel interviews reliability expert Lorin Hochstein to explore how software failures serve as critical learning tools for architects. Hochstein distinguishes between "robustness," which targets anticipated failure patterns, and "resilience," the ability of a system to adapt to "unknown unknowns." A central theme is "," which posits that as systems become more reliable, they inevitably grow more complex, often leading to failure modes triggered by the very mechanisms intended to protect them. Hochstein argues that synthetic testing tools like Chaos Monkey are useful but cannot replicate the unpredictable confluence of events found in real-world outages. He emphasizes a "no-blame" culture, asserting that operators are rational actors who make the best possible decisions with available information. Therefore, humans are not the "weak link" but the primary source of resilience, constantly adjusting to maintain stability in evolving socio-technical systems. The discussion highlights that because software is never truly static, architects must embrace storytelling and incident reviews to understand the "drift" between original design assumptions and current operational realities. Ultimately, building resilient systems requires moving beyond binary uptime metrics to cultivate an organizational capacity for handling the inevitable surprises of modern, complex computing environments.

How AI has suddenly become much more useful to open-source developers

The ZDNET article "Maybe open source needs AI" explores the growing necessity of artificial intelligence in managing the vast landscape of open-source software. With millions of critical projects relying on a single maintainer, the ecosystem faces significant risks from burnout or loss of leadership. Fortunately, AI coding tools have evolved from producing unreliable "slop" to generating high-quality security reports and sophisticated code improvements. Industry leaders, including Linux kernel maintainer Greg Kroah-Hartman, highlight a recent shift where AI-generated contributions have become genuinely useful for triaging vulnerabilities and modernizing legacy codebases. However, this transition is not without friction. Legal complexities regarding copyright and derivative works are emerging, exemplified by disputes over AI-driven library rewrites. Furthermore, maintainers are often overwhelmed by a flood of low-quality, AI-generated pull requests that can paradoxically increase their workload or even force projects to shut down. Despite these hurdles, organizations like the Linux Foundation are deploying AI resources to assist overworked developers. The article concludes that while AI offers a potential lifeline for neglected projects and a productivity boost for experts, careful implementation and oversight are essential to navigate the legal and technical challenges inherent in this new era of software development.

Axios NPM Package Compromised in Precision Attack

The , a cornerstone of the JavaScript ecosystem with over 400 million monthly downloads, recently fell victim to a highly sophisticated "precision attack" that underscores the evolving threats to the software supply chain. Security researchers identified malicious versions—specifically 1.14.1 and 0.30.4—which were published following the compromise of a lead maintainer’s account. These versions introduced a malicious dependency called "plain-crypto-js," which stealthily installed a cross-platform remote-access Trojan (RAT) capable of targeting Windows, Linux, and macOS environments. Attributed by Google to the North Korean threat actor UNC1069, the campaign exhibited remarkable operational tradecraft, including pre-staged dependencies and advanced anti-forensic techniques where the malware deleted itself and restored original configuration files to evade detection. Unlike typical broad-spectrum attacks, this incident focused on machine profiling and environment fingerprinting, suggesting a strategic goal of initial access brokerage or targeted espionage. Although the malicious versions were active for only a few hours before being removed by NPM, the breach highlights a significant escalation in supply chain exploitation, marking the first time a top-ten npm package has been successfully compromised by North Korean actors. Organizations are urged to verify dependencies immediately as the silent, traceless nature of the infection poses a fundamental risk to developer environments.

Financial groups lay out a plan to fight AI identity attacks

The rapid advancement of generative AI has significantly lowered the cost of creating deepfakes, leading to a dramatic surge in sophisticated identity fraud targeting financial institutions. A joint report from the American Bankers Association, the Better Identity Coalition, and the Financial Services Sector Coordinating Council highlights that deepfake incidents in the fintech sector rose by 700% in 2023, with projected annual losses reaching $40 billion by 2027. To combat these AI-driven threats, the groups have proposed a comprehensive plan focused on four primary initiatives. First, they advocate for improved identity verification through the adoption of mobile driver's licenses and expanding access to government databases like the Social Security Administration's eCBSV system. Second, the report urges a shift toward phishing-resistant authentication methods, such as FIDO security keys and passkeys, to replace vulnerable legacy systems. Third, it emphasizes the necessity of international cooperation to establish unified standards for digital identity and wallet interoperability. Finally, the plan calls for robust public education campaigns to raise awareness about deepfake risks and modern security tools. By modernizing identity infrastructure and fostering collaboration between government and industry, policymakers can better protect the national economy from the escalating dangers posed by automated AI exploitation.

Beyond PUE: Rethinking how data center sustainability is measured

The article "Beyond PUE: Rethinking How Data Center Sustainability is Measured" emphasizes the growing necessity to evolve beyond the traditional Power Usage Effectiveness (PUE) metric in evaluating the environmental impact of data centers. While PUE has historically served as the industry standard for measuring energy efficiency by comparing total facility power to actual IT load, it fails to account for critical sustainability factors such as carbon emissions, water consumption, and the origin of the energy used. As the data center sector expands, particularly under the pressure of AI and high-density computing, a more holistic approach is required to reflect true operational sustainability. The article advocates for the adoption of multi-dimensional KPIs, including Water Usage Effectiveness (WUE), Carbon Usage Effectiveness (CUE), and Energy Reuse Factor (ERF), to provide a more comprehensive view of resource management. Furthermore, it highlights the importance of Lifecycle Assessment (LCA) to address "embodied carbon"—the emissions generated during the construction and hardware manufacturing phases—rather than just operational efficiency. By shifting the focus from simple power ratios to integrated metrics like 24/7 carbon-free energy matching and circular economy principles, the industry can better align its rapid growth with global climate targets and responsible resource stewardship.

Daily Tech Digest - March 09, 2026

Quote for the day:

"A positive attitude will not solve all your problems. But it will annoy enough people to make it worth the effort" -- Herm Albright

Is AI Killing Sustainability?

This article examines the paradoxical relationship between the rapid growth of artificial intelligence and environmental goals. On one hand, AI's massive computational needs are driving a surge in energy consumption, with global spending projected to reach $2.52 trillion this year. This expansion is fueling an exponential rise in data center power requirements, potentially consuming as much electricity as 22% of U.S. households by 2028. However, the author argues that AI also serves as a critical tool for boosting sustainability. By analyzing vast datasets, AI can optimize supply chains, automate waste management, and enhance energy efficiency in buildings by up to 30%. The piece provides six strategic tips for organizations to utilize AI for greenhouse gas reduction, including predictive environmental risk monitoring, accurate emission reporting, and improved renewable energy integration. Despite these benefits, a tension exists between corporate "green" ambitions and financial constraints, often leading to a "lite green" approach where cost-cutting takes priority over true environmental innovation. Ultimately, while AI's infrastructure poses a significant threat to climate targets, its potential to identify high-ROI decarbonization opportunities offers a path toward reconciling technological advancement with ecological preservation, provided that organizations move beyond superficial commitments toward mature, outcome-driven strategies.

PQC roadmap remains hazy as vendors race for early advantage

The transition to post-quantum cryptography (PQC) is evolving from a theoretical concern into an urgent operational risk, prompting major security vendors to race for early market advantages. As mainstream players like Palo Alto Networks, Cisco, and IBM join specialized firms, the focus has shifted toward structured readiness offerings centered on discovery, inventory, and migration planning. A significant hurdle for organizations remains the lack of visibility into cryptographic sprawl across infrastructure, making it difficult to identify vulnerabilities in legacy algorithms like RSA. The urgency is further fueled by the “harvest now, decrypt later” threat model, where adversaries collect encrypted data today for future decryption by capable quantum computers. While NIST has finalized several PQC standards, experts suggest that the expected moment of cryptographic compromise could arrive as early as 2029, making immediate preparation essential. Despite the marketing push, some observers question whether these PQC offerings represent a new category of security tools or simply a necessary enforcement of long-overdue security hygiene, such as comprehensive asset mapping and certificate tracking. Ultimately, the migration to quantum-safe environments requires a phased approach and a commitment to crypto-agility, ensuring that enterprises can adapt to evolving cryptographic standards before legacy systems become insurmountable liabilities in a post-quantum world.

Tech Debt “For Later” Crashed Production 5 Years Later

This Devrim Ozcay’s article critiques the pervasive hype surrounding AI in DevOps, specifically addressing the gap between marketing promises and production realities. The author argues that while "autonomous remediation" and "predictive incident detection" are often touted as revolutionary, they frequently fail in complex, high-stakes environments. These tools often rely on simple logic or pattern matching, and general-purpose models like ChatGPT can be dangerous during active incidents by providing confident but entirely incorrect root cause hypotheses. Instead of relying on AI for critical judgment, the article suggests leveraging it for "assembly" tasks that alleviate the mechanical burden on engineers. This includes filtering log noise, reconstructing incident timelines from disparate sources, and drafting initial postmortem reports. By automating these time-consuming, repetitive processes, teams can reduce the duration of post-incident documentation from hours to minutes. Ultimately, the article advocates for a balanced approach where AI handles the data organization while human engineers retain sole responsibility for interpretation and decision-making. This shift allows practitioners to focus on high-leverage problem-solving rather than tedious transcription, ensuring that incident response remains both efficient and reliable without succumbing to the unrealistic expectations often presented at tech conferences.

What Is Sampling in LLMs and How Does It Relate to Ethics?

This article explores the technical mechanisms behind how AI models choose their words and the subsequent moral responsibilities of developers. Sampling is the process by which an LLM selects the next token from a probability distribution. Techniques such as temperature, Top-K, and Top-P (nucleus sampling) are used to balance creativity with accuracy. Higher temperature settings introduce more randomness, which can foster innovation but also increases the likelihood of "hallucinations" or the generation of biased and harmful content. Conversely, lower settings make the model more deterministic and reliable for factual tasks but can lead to repetitive and uninspired responses. From an ethical standpoint, the choice of sampling strategy is never neutral. It requires a delicate balance between providing a diverse range of perspectives and ensuring the safety and truthfulness of the output. The author emphasizes that organizations must transparently define their sampling parameters to mitigate risks like misinformation. Ultimately, ethical AI development hinges on understanding these technical levers, as they directly influence how a model perceives and interacts with human values, necessitating a cautious approach to model tuning that prioritizes user safety and informational integrity.

AI Won't Fix Cybersecurity, But It Could Rebalance It

The article explores the nuanced role of artificial intelligence in cybersecurity, debunking the myth that it serves as a total panacea while highlighting its potential to rebalance the long-standing asymmetric advantage held by attackers. Traditionally, cybercriminals have enjoyed a lower barrier to entry and a higher success rate because defenders must be perfect across every surface, whereas attackers only need to succeed once. With the advent of generative AI, malicious actors are leveraging the technology to craft sophisticated phishing campaigns, automate vulnerability discovery, and democratize complex malware creation. Conversely, AI empowers defenders by automating routine monitoring, identifying anomalous patterns at machine speed, and bridging the significant talent gap within the industry. This technological shift creates a perpetual arms race where AI functions as a force multiplier for both sides. Rather than eliminating threats, AI recalibrates the battlefield, allowing security teams to process vast datasets and respond to incidents with unprecedented agility. However, the human element remains indispensable; strategic oversight and critical thinking are essential to guide AI tools. Ultimately, while AI will not "fix" the inherent vulnerabilities of digital infrastructure, it offers a vital mechanism to shift the strategic advantage back toward those safeguarding the digital frontier.

AI Is Not Here to Replace People, It’s Here to Replace Waiting

In this insightful interview, Aliaksei Tulia, the Chief Technical Officer at CoinsPaid, argues that the true purpose of artificial intelligence in the financial sector is not to displace human judgment but to eliminate the friction of waiting. Tulia emphasizes that AI acts as a powerful catalyst for efficiency and speed within the digital payment ecosystem by automating repetitive, high-volume tasks that traditionally create operational bottlenecks. By handling routine duties such as document summarization, log scanning, and boilerplate coding, AI allows for a significant compression of cycle times while maintaining necessary human oversight. The article highlights how CoinsPaid integrates these intelligent tools to enhance consistency and visibility, ensuring that the platform remains robust without sacrificing control. Furthermore, the discussion explores the essential division of labor where technology manages data-heavy routine processes, freeing professionals to focus on high-level strategic decisions, complex problem-solving, and improving the overall customer experience. This pragmatic approach represents a shift where AI handles the disciplined "first pass," allowing people to dedicate their expertise to tasks requiring creativity and accountability. Ultimately, Tulia envisions a future where AI-driven automation defines industry standards, proving that the technology’s primary value lies in its ability to streamline operations for a global audience.

Dynamic UI for dynamic AI: Inside the emerging A2UI model

The article "Dynamic UI for Dynamic AI: Inside the Emerging A2UI Model" explores the transformative shift from traditional graphical user interfaces to Agent-to-User Interfaces. As AI agents become increasingly autonomous, the standard chat-based "command line" is no longer sufficient for managing complex workflows. A2UI represents a fundamental paradigm shift where the interface is dynamically generated by the AI to match the specific context and requirements of a task. Unlike static SaaS platforms with fixed menus, A2UI allows agents to create ephemeral, highly functional components—such as interactive charts, data tables, or specialized dashboards—on demand. This movement is powered by advancements like Vercel’s AI SDK and features like Anthropic’s Artifacts, which allow for real-time rendering of code and UI. The goal is to bridge the gap between human intent and machine execution by providing a rich, interactive medium that transcends simple text responses. By embracing generative UI, developers are enabling a more fluid collaboration where the software adapts to the user, rather than the user being forced to navigate rigid software structures. This evolution signals the end of "one-size-fits-all" application design, ushering in a future where every interaction produces a bespoke, temporary interface tailored specifically to the immediate problem.

AI Use at Work Is Causing “Brain Fry,” Researchers Find, Especially Among High Performers

The Futurism article "AI Use at Work Is Causing 'Brain Fry'" highlights a concerning trend where artificial intelligence, despite its promises of productivity, is significantly damaging employee mental health. A study of 1,500 workers conducted by Boston Consulting Group and the University of California, Riverside, introduced the term "AI brain fry" to describe the cognitive exhaustion resulting from excessive interaction with AI tools. Approximately 14 percent of employees—predominantly high performers in fields like software development and finance—reported symptoms such as mental "static," brain fog, and headaches. This fatigue is largely driven by information overload, rapid task-switching, and the constant, draining necessity of overseeing multiple AI agents. Rather than lightening the load, these tools often force users to work harder to manage the technology than to solve actual problems. The consequences are severe for both individuals and organizations; the research found a 33 percent increase in decision fatigue and a higher likelihood of employees quitting their jobs. Ultimately, the piece argues that while AI is marketed as a way to supercharge efficiency, it often acts as a "burnout machine" that compromises cognitive capacity and leads to costly errors or paralysis in professional environments.

Submarine cables move to the center of critical infrastructure security debate

The article examines the escalating strategic significance of submarine cables, which facilitate the vast majority of international data traffic but are increasingly vulnerable to geopolitical tensions and physical threats. A new sector report highlights how high-profile incidents, such as the 2024 Baltic Sea cable severing, have transitioned these underwater assets from ignored infrastructure into critical security priorities. Beyond intentional sabotage or "grey-zone" activities, the industry faces significant resilience challenges, including an annual average of two hundred cable faults primarily caused by commercial fishing and anchoring. This vulnerability is exacerbated by a critical shortage of specialized repair vessels and experienced personnel, complicating rapid incident response. Furthermore, the shift in ownership dynamics, where cloud hyperscalers are now primary investors, creates commercial friction with traditional operators while reshaping infrastructure architecture. Technological advancements, particularly AI-driven distributed acoustic sensing, are transforming cables into active monitoring tools, yet technical solutions alone remain insufficient. The report concludes that long-term security depends on improved international coordination and unified governance frameworks between governments and private entities. Ultimately, protecting these vital conduits requires a holistic approach that integrates technical controls, organizational readiness, and cross-border cooperation to match the scale of modern digital dependency and evolving global risks.

How DevOps Broke Accessibility

In this article on DevOps Digest, the author explores the unintended consequences that the rapid adoption of DevOps practices has had on web accessibility. While DevOps has revolutionized software development by emphasizing speed, continuous integration, and frequent deployments, these very priorities have often sidelined the inclusive design and rigorous accessibility testing required for users with disabilities. The shift-left mentality, which aims to catch bugs early, frequently fails to incorporate accessibility checks into the automated pipeline, leading to a "move fast and break things" culture that disproportionately affects those relying on assistive technologies. Furthermore, the reliance on automated testing tools—which can only detect about 30% of accessibility issues—creates a false sense of security among development teams. This technical debt accumulates quickly in fast-paced environments, making retroactive fixes costly and complex. The article argues that for DevOps to truly succeed, accessibility must be integrated as a core pillar of the development lifecycle, rather than being treated as an afterthought. Ultimately, the piece calls for a cultural shift where developers and stakeholders prioritize human-centric design alongside technical efficiency to ensure the digital world remains open and equitable for every user regardless of their physical or cognitive abilities.

Daily Tech Digest - February 12, 2026

Quote for the day:

"Do not follow where the path may lead. Go instead where there is no path and leave a trail." -- Muriel Strode

The hard part of purple teaming starts after detection

Imagine you’re driving, and you see the car ahead braking suddenly. Awareness helps, but it’s your immediate reaction that avoids the collision. Insurance plans don’t matter at that moment. Nor do compliance reports or dashboards. Only vigilance and rehearsal matter. Cyber resilience works the same way. You can’t build the instinct required to act by running one simulation a year. You build it through repetition. Through testing how specific scenarios unfold. Through examining not only how adversaries get in, but also how they move, escalate, evade, and exfiltrate. This is the heart of real purple teaming. ... AI can accelerate analysis, but it can’t replace intuition, design, or the judgment required to act. If the organization hasn’t rehearsed what to do when the signal appears, AI only accelerates the moment when everyone realises they don’t know what happens next. This is why so much testing today only addresses opportunistic attacks. It cleans up the low-hanging fruit. ... The standard testing model traps everyone involved: One-off tests create false confidence; Scopes limit imagination. Time pressure eliminates depth; Commercial structures discourage collaboration; Tooling gives the illusion of capability; and Compliance encourages the appearance of rigour instead of the reality of it. This is why purple teaming often becomes “jump out, stabilize, pull the chute, roll on landing.” But what about the hard scenarios? What about partial deployments? What about complex failures? That’s where resilience is built.

State AI regulations could leave CIOs with unusable systems

Numerous states are considering AI regulations for systems used in medical care, insurance, human resources, finance and other critical areas. ... Despite the growing regulatory risk, businesses appear unwilling to slow AI deployments. "Moving away from AI with the regulation is not going to be an option for us," Juttiyavar said. He said AI is already deeply embedded in how organizations operate and is essential for speed and competitiveness. ... If CIOs establish strong internal frameworks for AI deployment, "that helps you react better to legislative change" and anticipate new requirements, Kourinian said. Still, regulatory shifts can leave companies with systems that are technically sound but legally unusable, said Peter Cassat, a partner at CM Law. To manage that risk, Cassat advises CIOs to negotiate "change of law" provisions in vendor contracts that provide termination rights if regulations make continued use of a system impossible or impractical. But such provisions do not eliminate the risk of sunk costs. "If it's a SaaS provider and you've signed a three-year term, they don't want to necessarily let you walk for free either," Cassat said. Beyond legal exposure, CIOs must also anticipate public and political reaction to AI and biometric tools. "The CIO absolutely has the responsibility to understand how this technology could be perceived -- not just internally, but by the public and lawmakers," said Mark Moccia, an analyst at Forrester Research.

Your dev team isn’t a cost center — it’s about to become a multiplier

If you treat AI as a pathway to eliminate developer headcount, sure, you’ll capture some cost savings in the short term. But you’ll miss the bigger opportunity entirely. You’ll be the bank executive in 1975 who saw ATMs and thought, “Great, we can close branches and fire tellers.” Meanwhile, your competitors have automated the mundane teller tasks and are opening new branches to sell higher-end services to more people. The 1.4-1.6x productivity improvement that GDPval documented isn’t about doing the same work with fewer people. It’s about doing vastly more work with the same people. That new product idea you had that was 10x too expensive to develop? It’s now possible. That customer experience improvement that could drive loyalty that you didn’t have the headcount for? It’s on the table. The technical debt you’ve been accumulating? You can start to pay it down. ... What struck me about Werner’s final keynote wasn’t the content, it was the intent. This was Werner’s last time at that podium. He could have done a victory lap through AWS’s greatest hits. Instead, he spent his time outlining a framework of success for the next generation of developers. For those of us leading technology organizations, the framework is both validating and challenging. Validating because these traits aren’t new. They have always separated good developers from great ones. Challenging because AI amplifies everything, including the gaps in our capabilities.

Cloud teams are hitting maturity walls in governance, security, and AI use

Migration activity remains heavy across enterprises, especially for data platforms. At the same time, downtime tolerance is limited. Nearly half of respondents said their organizations can accept only one to six hours of downtime for cutover during migration. That combination creates pressure to migrate at speed while keeping data integrity intact. In regulated environments, that pressure extends to audit evidence and compliance validation, which often needs to be produced in parallel with migration execution. ... Cloud-native managed database adoption is also high. More than half of respondents reported using managed cloud databases, and a third reported using SaaS-based database services. Only 10% reported operating self-hosted databases. This shift toward managed services reduces operational burden on infrastructure teams, but it increases reliance on identity governance, network segmentation, and application-layer security controls. It also creates stronger dependency on cloud provider logging and access models. ... Development stacks also reflect this shift. Python was reported as a primary language, with Java close behind. These languages remain central to AI workflows, data engineering, and enterprise application back ends. Machine learning adoption is also widespread since organizations reported actively training ML models. Many of these pipelines are now part of production environments, making operational continuity a priority.

MIT's new fine-tuning method lets LLMs learn new skills without losing old ones

To build truly adaptive AI, the industry needs to solve "continual learning," allowing systems to accumulate knowledge much like humans do throughout their careers. The most effective way for models to learn is through "on-policy learning.” In this approach, the model learns from data it generates itself allowing it to correct its own errors and reasoning processes. This stands in contrast to learning by simply mimicking static datasets. ... The standard alternative is supervised fine-tuning (SFT), where the model is trained on a fixed dataset of expert demonstrations. While SFT provides clear ground truth, it is inherently "off-policy." Because the model is just mimicking data rather than learning from its own attempts, it often fails to generalize to out-of-distribution examples and suffers heavily from catastrophic forgetting. SDFT seeks to bridge this gap: enabling the benefits of on-policy learning using only prerecorded demonstrations, without needing a reward function. ... For teams considering SDFT, the practical tradeoffs come down to model size and compute. The technique requires models with strong enough in-context learning to act as their own teachers — currently around 4 billion parameters with newer architectures like Qwen 3, though Shenfeld expects 1 billion-parameter models to work soon. It demands roughly 2.5 times the compute of standard fine-tuning, but is best suited for organizations that need a single model to accumulate multiple skills over time, particularly in domains where defining a reward function for reinforcement learning is difficult or impossible.

The Illusion of Zero Trust in Modern Data Architectures

Modern data stacks stretch far beyond a single system. Data flows from SaaS tools into ingestion pipelines, through transformation layers, into warehouses, lakes, feature stores, and analytics tools. Each hop introduces a new identity, a new permission model, and a new surface area for implicit trust. Not to mention, niches like healthcare data storage are a completely different beast. Whatever the system may be, teams may enforce strict access at the perimeter while internal services freely exchange data with long-lived credentials and broad scopes. This is where the illusion forms. Zero Trust is declared because no user gets blanket access, yet services trust other services almost entirely. Tokens are reused, roles are overprovisioned, and data products inherit permissions they were never meant to have. The architecture technically verifies everything, but conceptually trusts too much. ... Data rarely stays where Zero Trust policies are strongest. Warehouses enforce row-level security, masking, and role-based access, but data doesn’t live exclusively in warehouses. Extracts are generated, snapshots are shared, and datasets are copied into downstream systems for performance or convenience. Each copy weakens the original trust guarantees and problems worse than increasing cloud costs come to fruition. Once data leaves its source, context is often stripped away.

Top Cyber Industry Defenses Spike CO2 Emissions

Though rarely discussed, like any other technologies, cybersecurity protections carry their own costs to the planet. Programs run on electricity. Servers demand water. Devices are built from natural resources and eventually get thrown out. ... "CISOs can help or make the situation worse [when it comes to] sustainability, depending on the way they write security rules," he says. "And that's why we started a study: to enable the CISO to be part of the sustainability process of his or her company, and to find actionable ways to reduce CO2 consumption while at the same time not adding more risks." ... "We collect a lot of logs, not exactly always knowing why, and the retention period is a huge cost in terms of infrastructure, and also CO2," Billois says. "So at some point, you can revisit your log collection, and log retention, and if there are no legal issues, you can think about compressing them to reduce their volume. It's something that is, I would say, quite easy to do. ... All of that said, unfortunately, the biggest cyber polluter, by far, is also the most difficult to scale back without incurring risk. Some companies can swap underutilized physical infrastructure for virtualized backups, which eat less power, if they're not already doing that; but there are few other great ways to make cyber resilience more efficient. "You can reduce CO2 [from backups] very easily: you stop buying two servers, or you stop having a duplicate of all your data," Billois says.

Five ways quantum technology could shape everyday life

There is growing promise of quantum technology’s ability to solve problems that today’s systems struggle to overcome, or cannot even begin to tackle, with implications for industry, national security and everyday life. ... In healthcare, faster drug discovery could bring quicker response to outbreaks and epidemics, personalised medicine and insight into previously inscrutable biological interactions. Quantum simulation of how materials behave could lead to new high efficiency energy materials, catalysts, alloys and polymers. ... In medicine, quantum sensors could improve diagnostic capabilities via more sensitive, quicker and noninvasive imaging modes. In environmental monitoring, these sensors could track delicate shifts beneath the Earth’s surface, offer early warnings of seismic activity, or detect trace pollutants in air and water with exceptional accuracy. ... Airlines and rail networks could automatically reconfigure to avoid cascading delays, while energy providers might balance renewable generation, storage and consumption with far greater precision. Banks could use quantum computers to evaluate numerous market scenarios in parallel, informing the management of investment portfolios. ... While still at an early stage of development, quantum algorithms might accelerate a subset of AI called machine learning (where algorithms improve with experience), help simulate complex systems, or optimise AI architectures more efficiently.

Nokia predicts huge WAN traffic growth, but experts question assumptions

“Consumer- and enterprise-generated AI traffic imposes a substantial impact on the wide-area network (WAN) by adding AI workloads processed by data centers across the WAN. AI traffic does not stay inside one data center; it moves across edge, metro, core, and cloud infrastructure, driving dense lateral flows and new capacity demands,” the report says. An explosion in agentic AI applications further fuels growth “by inducing extra machine-to-machine (M2M) traffic in the background,” Nokia predicts. “AI traffic isn’t just creating more demand inside data centers; it’s driving a sustained surge of traffic between them. AI inferencing traffic—both user-initiated and agentic-AI-induced M2M—moving over inter-data-center links grows at a 20.3% CAGR through 2034.” ... Global enterprise and industrial traffic, including fixed wireless access, will also steadily rise over the next decade, “as more operations, machines, and workers become digitally connected,” Nokia predicts. “Pervasive automation, high-resolution video, AI-driven analytics, and remote access to industrial systems,” will drive traffic growth. “Factory lines are streaming machine vision data to the cloud. AI copilots are assisting personnel in real time. Field teams are using AR instead of manuals. Robots are coordinating across sites,” the Nokia report says. “Industrial systems are continuously sending telemetry over the WAN instead of keeping it on-site. This shift makes wide-area connectivity part of the core production workflow.”

The death of reactive IT: How predictive engineering will redefine cloud performance in 10 years

Reactive monitoring fails not because tools are inadequate, but because the underlying assumption that failures are detectable after they occur no longer holds true. Modern distributed systems have reached a level of interdependence that produces non-linear failure propagation. A minor slowdown in a storage subsystem can exponentially increase tail latencies across an API gateway. ... Predictive engineering is not marketing jargon. It is a sophisticated engineering discipline that combines statistical forecasting, machine learning, causal inference, simulation modeling and autonomous control systems. ... Predictive engineering will usher in a new operational era where outages become statistical anomalies rather than weekly realities. Systems will no longer wait for degradation, they will preempt it. War rooms will disappear, replaced by continuous optimization loops. Cloud platforms will behave like self-regulating ecosystems, balancing resources, traffic and workloads with anticipatory intelligence. ... In distributed networks, routing will adapt in real time to avoid predicted congestion. Databases will adjust indexing strategies before query slowdowns accumulate. The long-term trajectory is unmistakable: autonomous cloud operations. Predictive engineering is not merely the next chapter in observability, it is the foundation of fully self-healing, self-optimizing digital infrastructure.

Daily Tech Digest - January 29, 2026

Quote for the day:

"Great leaders start by leading themselves and to do that you need to know who you are" -- @GordonTredgold

Digital sovereignty feels good, but is it really?

There are no European equivalents of the American hyperscalers, let alone national ones. Although OVHcloud, Intermax, and BIT can be proposed as alternative managed locations for Azure, AWS, or Google Cloud, they are not comparable to those services. They lack the same huge ecosystem of partners, are less scalable, and are simply less user-friendly, especially when adopting new services. The reality is that many software packages also accompany the move to the cloud with a departure from on-premises. ... It is as much a ‘start’ of a digital migration as it is an end. Good luck transferring a system with deep AWS integrations to another location (even another public cloud). Although cloud-native principles would allow the same containerized workloads to run elsewhere, that has no bearing on the licenses purchased, compatibility and availability of applications, scalability, or ease of use. A self-built variant inside one’s own data center requires new expertise and almost assuredly a larger IT team. ... In some areas, European alternatives will be perfectly capable of replacing American software. However, there is no guarantee that a secure, consistent, and mature offering will be available in every area, from networking to AI inferencing and from CRM solutions to server hardware. The reality is not only that IT players from the US are prominent, but that the software ecosystem is globally integrated. Those who limit their choices must be prepared to encounter problems.

Operational data: Giving AI agents the senses to succeed

Agents need continuous streams of telemetry, logs, events, and metrics across the entire technology stack. This isn't batch processing; it is live data flowing from applications, infrastructure, security tools, and cloud platforms. When a security agent detects anomalous behavior, it needs to see what is happening right now, not what happened an hour ago ... Raw data streams aren't enough. Agents need the ability to correlate information across domains instantly. A spike in failed login attempts means nothing in isolation. But correlate it with a recent infrastructure change and unusual network traffic, and suddenly you have a confirmed security incident. This context separates signal from noise. ... The data infrastructure required for successful agentic AI has been on the "we should do that someday" list for years. In traditional analytics, poor data quality results in slower insights. Frustrating, but not catastrophic. ... Sophisticated organizations are moving beyond raw data collection to delivering data that arrives enriched with context. Relationships between systems, dependencies across services, and the business impact of technical components must be embedded in the data workflow. This ensures agents spend less time discovering context and more time acting on it. ... "Can our agents sense what is actually happening in our environment accurately, continuously, and with full context?" If the answer is no, get ready for agentic chaos. The good news is that this infrastructure isn't just valuable for AI agents.

Identity, Data Security Converging Into Trouble for Security Teams: Report

Adversaries are shifting their focus from individual credentials to identity orchestration, federation trust, and misconfigured automation, it continued. Since access to critical data stores starts with identity, unified visibility across identity and data security is required to detect misconfigurations, reduce blind spots, and respond faster. That shift, experts warned, dramatically increases the potential impact of identity failures. ... AI automation is often a chain of agents, Schrader explained. “Each agent is a non-human identity that needs lifecycle governance, and each step accesses, transforms, or hands off data,” he said. “That means a mistake in identity governance — over-permissioned agent, weak token control, missing attestation — immediately becomes a data security incident — at machine speed and at scale — because the workflow keeps executing and propagating access and data downstream.” “As AI automation runs continuously, authorization becomes a live control system, not a quarterly review,” he continued. “Agent chains amplify failures. One over-permissioned non-human identity can propagate access and data downstream like workflow-shaped lateral movement. Non-human identities sprawl fast via APIs and OAuth. Data risk also shifts dynamically as agents transform and enrich outputs.” ... “Risk multiplies with automation,” he told TechNewsWorld. “A compromised service identity can cause automated data exfiltration, model poisoning, or large-scale misconfiguration in seconds, which is far faster than manual attacks.”

Why your AI agents need a trust layer before it’s too late

While traditional ML pipelines require human oversight at every step — data validation, model training, deployment and monitoring — modern agentic AI systems enable autonomous orchestration of complex workflows involving multiple specialized agents. But with this autonomy comes a critical question: How do we trust these agents? ... DNS transformed the internet by mapping human-readable names to IP addresses. ANS does something similar for AI agents, but with a crucial addition: it maps agent names to their cryptographic identity, their capabilities and their trust level. Here’s how it works in practice. Instead of agents communicating through hardcoded endpoints like “http://10.0.1.45:8080,” they use self-describing names like “a2a://concept-drift-detector.drift-detection.research-lab.v2.prod.” This naming convention immediately tells you the protocol (agent-to-agent), the function (drift detection), the provider (research-lab), the version (v2) and the environment (production). But the real innovation lies beneath this naming layer. ... The technical implementation leverages what’s called a zero-trust architecture. Every agent interaction requires mutual authentication using mTLS with agent-specific certificates. Unlike traditional service mesh mTLS, which only proves service identity, ANS mTLS includes capability attestation in the certificate extensions. An agent doesn’t just prove “I am agent X” — it proves “I am agent X and I have the verified capability to retrain models.” ... The broader implications extend beyond just ML operations.

3 things cost-optimized CIOs should focus on to achieve maximum value

For Lenovo CIO Art Hu, optimization involves managing a funnel of business-focused ideas. His company’s portfolio-based approach to AI includes over 1,000 registered projects across all business areas. Hu has established a policy for AI exploration and optimization that allows thousands of flowers to bloom before focusing on value. “It’s important I don’t over-prioritize on quality initially, because we have so many projects,” he says. ... “There’s a technology thing, where you probably need multiple types of models and tools to work together,” he says. “So Microsoft or OpenAI on their own probably won’t do very well. However, when you combine Databricks, Microsoft, and your agents, then you get a solution.” ... But another key area is revenue growth management. Schildhouse’s team has developed an in-house diagnostic and predictive tool to help employees make pricing decisions quicker. They tracked usage to ensure the technology was effective, and the tool was scaled globally. This success has sponsored AI-powered developments in related areas, such as promotion and calendar optimization technology. “Scale is important at a company the size and breadth of Colgate-Palmolive, because one-off solutions in individual markets aren’t going to drive that value we need,” she says. “I travel around to our key markets, and it’s nice to be in India or Brazil and have the teams show how they’re using these tools, and how it’s making a difference on the ground.”

Gauging the real impact of AI agents

Enterprises aren’t totally sold on AI, but they’re increasingly buying into AI agents. Not the cloud-hosted models we hear so much about, but smaller, distributed models that fit into IT as it has been used by enterprises for decades. Given this, you surely wonder how it’s going. Are agents paying back? Yes. How do they impact hosting, networking, operations? That’s complicated. ... There’s a singular important difference between an AI agent component and an ordinary software component. Software is explicit in its use of data. The programming includes data identification. AI is implicit in its data use; the model was trained on data, and there may well be some API linkage to databases that aren’t obvious to the user of the model. It’s also often true that when an agentic component is used, it’s determined that additional data resources are needed. Are all these resources in the same place? Probably not. ... As agents evolve into real-time applications, this requires they also be proximate to the real-time system they support (a factory or warehouse), so the data center, the users, and any real-time process pieces all pull at the source of hosting to optimize latency. Obviously, they can’t all be moved into one place, so the network has to make a broad and efficient set of connections. That efficiency demands QoS guarantees on latency as well as on availability. It’s in the area of availability, with a secondary focus on QoS attributes like latency, that the most agent-experienced enterprises see potential new service opportunities.

OT–IT Cybersecurity: Navigating The New Frontier Of Risk

IT systems managing data and corporate services and OT systems managing physical operations like energy, manufacturing, transportation, and utilities were formerly distinct worlds, but they are now intricately linked. ... Organizations can no longer treat IT and OT as distinct security areas as long as this interconnection persists. Instead, they must embrace comprehensive strategies that integrate protection, visibility, and risk management in both domains. ... It is evident to attackers that OT systems are valuable targets. Data, electricity grids, pipelines, industrial facilities, and public safety are all at risk from breaches that formerly affected traditional IT settings and increasingly spread to physical process networks. According to recent incident statistics, an increasing number of firms report breaches that affect both IT and OT systems; this is indicative of adversaries taking use of legacy vulnerabilities and interconnected routes. ... The dynamic threat environment created by contemporary OT-IT convergence is incompatible with traditional perimeter defenses and flat network trusts. In order to prevent threats from moving laterally both within and between IT/OT ecosystems, zero trust designs place a strong emphasis on segmentation, stringent access control, and continuous authentication. ... OT cybersecurity is an organizational issue rather than just a technological one. IT security leaders and OT teams have always worked in distinct silos with different goals and cultures.

SolarWinds, again: Critical RCE bugs reopen old wounds for enterprise security teams

SolarWinds is yet again disclosing security vulnerabilities in one of its widely-used products. The company has released updates to patch six critical authentication bypass and remote command execution vulnerabilities in its Web Help Desk (WHD) IT software. ... The four critical bugs are typically very reliable to exploit due to their deserialization and authentication logic flaws, noted Ryan Emmons, security researcher at Rapid7. “For attackers, that’s good news, because it means avoiding lots of bespoke exploit development work like you’d see with other less reliable bug classes.” Instead, attackers can use a standardized malicious payload across many vulnerable targets, Emmons noted. “If exploitation is successful, the attackers gain full control of the software and all the information stored by it, along with the potential ability to move laterally into other systems.” Meanwhile, the high-severity vulnerability CVE-2025-40536 would allow threat actors to bypass security controls and gain access to certain functionalities that should be restricted only to authenticated users. ... While this incident is bad news, the good news is it’s not the same error, he noted. ... Vendors must get down past the symptom layer and address the root cause of vulnerabilities in programming logic, he said, pointing out, “they plug the hole, but don’t figure out why they keep having holes.”

Policy to purpose: How HR can design sustainable scale in DPI

“In DPI, the human impact is immediate and profound: our systems touch citizens, markets, and national platforms every single day,” Anand says. The proximity to public outcomes, he notes, heightens expectations across the organisation. Employees are no longer insulated from the downstream effects of their work. “Employees increasingly recognise that their choices—technical, operational, and ethical—directly influence outcomes for millions,” he says. ... “The opportunity is to reframe governance as an enabler of meaningful, durable impact rather than a constraint,” he says. Systems that millions rely on require deep technical excellence and responsible design—work that appeals to professionals who value longevity over novelty. ... As DPI platforms scale and regulatory attention intensifies, Anand believes HR must rethink what agility really means. “As scale and scrutiny intensify, HR must design organisations where agility is achieved through clarity and discipline,” he says. Flexibility, in this framing, is not ad hoc. It must be institutionalised—across workforce models, talent mobility and capability development—within clearly articulated guardrails. ... “The role of HR will evolve from custodians of policy to architects of sustainable scale,” Anand says. In DPI contexts, that means ensuring growth, governance and human potential advance together, rather than pulling against one another.

Adversity Isn’t a Setback. It’s the Advantage That Separates Real Entrepreneurs

The entrepreneurs who endure are not defined by how fast they scale when conditions are ideal. They are defined by how they respond when conditions turn hostile. When capital dries up. When reputations are challenged. When markets shift and expectations falter. When systems resist them. ... The paradox is that entrepreneurs who face sustained adversity early often become the most capable operators later. They learn to conserve resources. They read people accurately. They pivot without panic. They make decisions grounded in reality rather than optimism. Resilience is not taught. It is earned through determination, risk and adversity. History shows time and time again that those who prevailed were often those who were hit with life’s toughest issues, but kept getting back up, adapting and keeping on their path ahead. ... Every entrepreneurial journey eventually reaches the same point. Something breaks. A deal collapses. A partner lets you down. A market turns. A personal crisis collides with professional pressure. Sometimes it is a mistake. Sometimes it is failure. Sometimes it is a disaster or trauma with no clear explanation and no easy way through. At that moment, the question is no longer about intelligence, credentials, or ambition. It is about response. Do you take the hit and adapt, or does it flatten you? Do you get back up and keep moving, or do you stay down and explain why this time was different? Does adversity sharpen your determination, or does it quietly drain your belief?

Daily Tech Digest - January 21, 2026

Quote for the day:

"People ask the difference between a leader and a boss. The leader works in the open, and the boss in covert." -- Theodore Roosevelt

Why the future of security starts with who, not where

Traditional security assumed one thing: “If someone is inside the network, they can be trusted.” That assumption worked when offices were closed environments and systems lived behind a single controlled gateway. But as Microsoft highlights in its Digital Defense Report, attackers have moved almost entirely toward identity-based attacks because stealing credentials offers far more access than exploiting firewalls. In other words, attackers stopped trying to break in. They simply started logging in. ... Zero trust isn’t about paranoia. It’s about verification. Never trust, always verify only works if identity sits at the center of every access decision. That’s why CISA’s zero trust maturity model outlines identity as the foundation on which all other zero trust pillars rest — including network segmentation, data security, device posture and automation. ... When identity becomes the perimeter, it can’t be an afterthought. It needs to be treated like core infrastructure. ... Organizations that invest in strong identity foundations won’t just improve security — they’ll improve operations, compliance, resilience and trust. Because when identity is solid, everything else becomes clearer: who can access what, who is responsible for what and where risk actually lives. The companies that struggle will be the ones trying to secure a world that no longer exists — a perimeter that disappeared years ago.

Designing Consent Under India's DPDP Act: Why UX Is Now A Legal Compliance

The request for consent must be either accompanied by or preceded by a notice. The notice must specifically contain three things: personal data and purpose for which it is being collected; the manner in which he or she may withdraw consent or make grievance; and the manner in which the complaint may be made to the board. ... “Free” consent also requires interfaces to avoid deceptive nudges or coercive UI design. Consider a consent banner implemented with a large “Accept All” button as the primary call-to-action button while the “Reject” option is kept hidden behind a secondary link that opens multiple additional screens. This creates an asymmetric interaction cost where acceptance requires a single click and refusal demands several steps. If consent is obtained through such interface, it cannot be regarded as voluntary or valid. ... A defensible consent record must capture the full interaction such as which notice version was shown, what purposes were disclosed, language of the notice and the action of the user (click, toggle, checkbox). The standard operational logs might be disposed after 30 or 90 days but the consent logs cannot follow the same cycle. Section 6(10) implicitly states that consent records must be retained as long as the data is being processed for the purposes shown in the notice. If the personal data was collected in 2024 and is still being processed in 2028, the Fiduciary must produce the 2024 consent logs as evidence.

The AI Skills Gap Is Not What Companies Think It Is

Employers often say they cannot find enough AI engineers or people with deep model expertise to keep pace with AI adoption. We can see that in job descriptions. Many blend responsibilities across model development, data engineering, analytics, and production deployment into a single role. These positions are meant to accelerate progress by reducing handoffs and simplifying ownership. And in an ideal world, the workforce would be ready for this. ... So when companies say they are struggling to fill the AI skills gap, what they are often missing is not raw technical ability. They are missing people who can operate inside imperfect environments and still move AI work forward. Most organizations do not need more model builders. ... For professionals trying to position themselves, the signal is similar. Career advantage increasingly comes from showing end-to-end exposure, not mastery of every AI tool. Experience with data pipelines, deployment constraints, and being able to monitor systems matter. Being good at stakeholder communication remains an important skill. The AI skills gap is not a shortage of talent. It is a shortage of alignment between what companies need and what they are actually hiring for. It’s also an opportunity for companies to understand what it really means, and finally close the gap. Professionals can also capitalize on this opportunity by demonstrating end-to-end, applied AI experience.

DevOps Didn’t Fail — We Just Finally Gave it the Tools it Deserved

Ask an Ops person what DevOps success looks like, and you’ll hear something very close to what Charity is advocating: Developers who care deeply about reliability, performance, and behavior in production. Ask security teams and you’ll get a different answer. For them, success is when everyone shares responsibility for security, when “shift left” actually shifts something besides PowerPoint slides. Ask developers, and many will tell you DevOps succeeded when it removed friction. When it let them automate the non-coding work so they could, you know, actually write code. Platform engineers will talk about internal developer platforms, golden paths, and guardrails that let teams move faster without blowing themselves up. SREs, data scientists, and release engineers all bring their own definitions to the table. That’s not a bug in DevOps. That’s the thing. DevOps has always been slippery. It resists clean definitions. It refuses to sit still long enough for a standards body to nail it down. At its core, DevOps was never about a single outcome. It was about breaking down silos, increasing communication, and getting more people aligned around delivering value. Success, in that sense, was always going to be plural, not singular. Charity is absolutely right about one thing that sits at the heart of her argument: Feedback loops matter. If developers don’t see what happens to their code in the wild, they can’t get better at building resilient systems.

The sovereign algorithm – India’s DPDP act and the trilemma of innovation, rights, and sovereignty

At its core, the DPDP Act functions as a sophisticated product of governance engineering. Its architecture is a deliberate departure from punitive, post facto regulation towards a proactive, principles based model designed to shape behavior and technological design from the ground up. Foundational principles such as purpose limitation, data minimization, and storage restriction are embedded as mandatory design constraints, compelling a fundamental rethink of how digital services are conceived and built. ... The true test of this legislative architecture will be its performance in the real world, measured across a matrix of tangible and intangible metrics that will determine its ultimate success or failure. The initial eighteen month grace period for most rules constitutes a critical nationwide integration phase, a live stress test of the framework’s viability and the ecosystem’s adaptability. ... Geopolitically, the framework positions India as a normative leader for the developing world. It articulates a distinct third path between the United States’ predominantly market oriented approach and China’s model of state controlled cyber sovereignty. India’s alternative, which embeds individual rights within a democratic structure while reserving state authority for defined public interests, presents a compelling model for nations across the Global South navigating their own digital transitions.

Everyone Knows How to Model. So Why Doesn’t Anything Get Modeled?

One of the main reasons modeling feels difficult is not lack of competence, but lack of shared direction. There is no common understanding of what should be modeled, how it should be modeled, or for what purpose. In other words, there is no shared content framework or clear work plan. When it is missing, everyone defaults to their own perspective and experience. ... From the outside, it looks like architecture work is happening. In reality, there is discussion, theorizing, and a growing set of scattered diagrams, but little that forms a coherent, usable whole. At that point, modeling starts to feel heavy—not because it is technically difficult, but because the work lacks direction, a shared way of describing things, and clear boundaries. ... To be fair, tools do matter. A bad or poorly introduced tool can make modeling unnecessarily painful. An overly heavy tool kills motivation; one that is too lightweight does not support managing complexity. And if the tool rollout was left half-done, it is no surprise the work feels clumsy. At the same time, a good tool only enables better modeling—it does not automatically create it. The right tool can lower the threshold for producing and maintaining content, make relationships easier to see, and support reuse. ... Most architecture initiatives don’t fail because modeling is hard. They fail because no one has clearly decided what the modeling is for. ... These are not technical modeling problems. They are leadership and operating-model problems.

ChatGPT Health Raises Big Security, Safety Concerns

ChatGPT Health's announcement touches on how conversations and files in ChatGPT as a whole are "encrypted by default at rest and in transit" and that there are some data controls such as multifactor authentication, but the specifics on how exactly health data will be protected on a technical and regulatory level was not clear. However, the announcement specifies that OpenAI partners with network health data firm b.well to enable access to medical records. ... While many security tentpoles remain in place, healthcare data must be held to the highest possible standard. It does not appear that ChatGPT Health conversations are end-to-end encrypted. Regulatory consumer protections are also unclear. Dark Reading asked OpenAI whether ChatGPT Health had to adhere to any HIPAA or regulatory protections for the consumer beyond OpenAI's own policies, and the spokesperson mentioned the coinciding announcement of OpenAI for Healthcare, which is OpenAI's product for healthcare organizations which do need to meet HIPAA requirements. ... even with privacy protections and promises, data breaches will happen and companies will generally comply with legal processes such as subpoenas and warrants as they come up. "If you give your data to any third party, you are inevitably giving up some control over it and people should be extremely cautious about doing that when it's their personal health information," she says.

From static workflows to intelligent automation: Architecting the self-driving enterprise

We often assume fragility only applies to bad code, but it also applies to our dependencies. Even the vanguard of the industry isn’t immune. In September 2024, OpenAI’s official newsroom account on X (formerly Twitter) was hijacked by scammers promoting a crypto token. Think about the irony: The company building the most sophisticated intelligence in human history was momentarily compromised not by a failure of their neural networks, but by the fragility of a third-party platform. This is the fragility tax in action. When you build your enterprise on deterministic connections to external platforms you don’t control, you inherit their vulnerabilities. ... Whenever we present this self-driving enterprise concept to clients, the immediate reaction is “You want an LLM to talk to our customers?” This is a valid fear. But the answer isn’t to ban AI; it is to architect confidence-based routing. We don’t hand over the keys blindly. We build governance directly into the code. In this pattern, the AI assesses its own confidence level before acting. This brings us back to the importance of verification. Why do we need humans in the loop? Because trusted endpoints don’t always stay trusted. Revisiting the security incident I mentioned earlier: If you had a fully autonomous sentient loop that automatically acted upon every post from a verified partner account, your enterprise would be at risk. A deterministic bot says: Signal comes from a trusted source -> execute.

AI is rewriting the sustainability playbook

At first, greenops was mostly finops with a greener badge. Reduce waste, right-size instances, shut down idle resources, clean up zombie storage, and optimize data transfer. Those actions absolutely help, and many teams delivered real improvements by making energy and emissions a visible part of engineering decisions. ... Greenops was designed for incremental efficiency in a world where optimization could keep pace with growth. AI breaks that assumption. You can right-size your cloud instances all day long, but if your AI footprint grows by an order of magnitude, efficiency gains get swallowed by volume. It’s the classic rebound effect: When something (AI) becomes easier and more valuable, we do more of it, and total consumption climbs. ... Enterprises are simultaneously declaring sustainability leadership while budgeting for dramatically more compute, storage, networking, and always-on AI services. They tell stakeholders, “We’re reducing our footprint,” while telling internal teams, “Instrument everything, vectorize everything, add copilots everywhere, train custom models, and don’t fall behind.” This is hypocrisy and a governance failure. ... Greenops isn’t dead, but it is being stress-tested by a wave of AI demand that was not part of its original playbook. Optimization alone won’t save you if your consumption curve is vertical. Rather than treat greenness as just a brand attribute, enterprises that succeed will recognize greenops as an engineering and governance discipline, especially for AI

Your AI strategy is just another form of technical debt

Modern software development has become riddled with indeterminable processes and long development chains. AI should be able to fix this problem, but it’s not actually doing so. Instead, chances are your current AI strategy is saddling your organisation with even more technical debt. The problem is fairly straightforward. As software development matures, longer and longer chains are being created from when a piece of software is envisioned until it’s delivered. Some of this is due to poor management practices, and some of it is unavoidable as programs become more complex. ... These tools can’t talk to each other, though; after all, they have just one purpose, and talking isn’t one of them. The results of all this, from the perspective of maintaining a coherent value chain, are pretty grim. Results are no longer predictable. Worse yet, they are not testable or reproducible. It’s just a set of random work. Coherence is missing, and lots of ends are left dangling. ... If this wasn’t bad enough, using all these different, single-purpose tools adds another problem, namely that you’re fragmenting all your data. Because these tools don’t talk to each other, you’re putting all the things your organisation knows into near-impenetrable silos. This further weakens your value chain as your workers, human and especially AI, need that data to function. ... Bolting AI onto existing systems won’t work. AIs aren’t human, and you can’t replace them one for one, or even five for one. It doesn’t work.