Daily Tech Digest by Kannan Subbiah: blockchain

Showing posts with label blockchain. Show all posts

Daily Tech Digest - May 19, 2026.

Quote for the day:

“When you connect to the silence within you, that is when you can make sense of the disturbance going on around you.” -- Stephen Richards

🎧 Listen to this digest on YouTube Music

▶ Play Audio Digest

Duration: 21 mins • Perfect for listening on the go.

Why the best security investment a board can make in 2026 isn’t another tool

In this insightful opinion article, cybersecurity expert Jason Martin argues that the most valuable technological investment a corporate board can make is not purchasing another security tool, but rather achieving comprehensive environmental visibility. Traditionally, organizations respond to threats by adding specialized protection platforms, creating a heavily fragmented infrastructure where tools generate massive data but fail to provide unified context. Cybercriminals successfully exploit these operational seams, utilizing legitimate trust relationships or unmonitored human and machine credentials, including automated service accounts, API keys, and emerging AI agents, to bypass siloed defenses entirely without triggering network alerts. True visibility transcends raw logs and complex dashboards; it requires a complete, foundational map of all assets, user permissions, and systemic dependencies, enabling defense teams to reconstruct security incidents in minutes rather than weeks. This dangerous gap between overwhelming technical data and actual operational understanding is further exacerbated by rapid corporate AI adoption, which creates automated connections far faster than governance protocols can track. Therefore, Martin advises boards to shift away from merely asking if they are protected. Instead, corporate leadership must critically ask what their defense teams can actually see, establishing a complete inventory baseline before adding more top-tier detection layers. Drawing this definitive organizational blueprint builds the necessary foundation for absolute, long-term cyber resilience.

CI/CD Was Built for Deterministic Software — Agents Just Broke the Model

The article argues that traditional continuous integration and continuous delivery or CI/CD pipelines, which were built under the assumption of deterministic software repeatability where identical inputs yield identical results, are being disrupted by the rise of agentic artificial intelligence. Because AI agents introduce variance as a core feature by dynamically reasoning, selecting tools, and altering behaviors based on shifting contexts, the conventional binary testing framework of green or red dashboards is no longer sufficient. Instead, DevOps teams must shift to statistical testing methodologies involving comprehensive evaluation sets, scenario libraries, and drift detection. Furthermore, operational management becomes significantly more complex; rolling back systems shifts from reverting a stable binary to unraveling an unpredictable, interconnected chain of decisions and tool interactions. Provenance and observability must also evolve to track prompts, policy configurations, and behavioral intent rather than basic system error codes. Ultimately, traditional deployment models are not entirely obsolete, but they must expand through platform engineering to provide shared governance, simulation environments, and robust guardrails. This extension ensures that autonomous agents can be safely deployed, monitored, and kept within specified organizational boundaries, transforming the ultimate goal of modern DevOps pipelines from merely shipping software to definitively proving and verifying acceptable autonomous behavior.

Why blockchain will be vital for the next generation of biometrics

In this article, Thomas Berndorfer, the CEO of Connecting Software, discusses how blockchain technology will become vital for protecting next generation digital identity and biometric verification systems against sophisticated artificial intelligence driven document manipulation. This pressing cyber threat was underscored by a massive banking scandal in Australia, where sophisticated fraudsters leveraged advanced tools to subtly modify legitimate income records and fraudulently secure billions in loans. Berndorfer emphasizes that while modern biometric passports incorporate strong protections, secondary documentation used for identity verification, such as housing contracts and pay stubs, remains highly susceptible to subtle, undetectable alterations. To effectively mitigate this vulnerability, incorporating a decentralized public blockchain enables issuing organizations to lock digital files with an immutable cryptographic hash, known colloquially as a blockchain seal. Any subsequent modification to the original file yields a completely mismatched hash value, instantly exposing unauthorized tampering to third party verifiers while preserving user privacy by only exposing the hash rather than sensitive underlying personal data. However, the author cautions that blockchain is not a standalone solution; it requires initial issuer sealing at source, cannot identify precisely what information was changed, and fails to differentiate between harmless filename updates and dangerous fraudulent text alterations.

Expanding the Narrative of Business Continuity History

In the article "Expanding the Narrative of Business Continuity History" published in the Disaster Recovery Journal, Samuel McKnight argues that the business continuity and resilience profession possesses a much deeper historical foundation than standard narratives suggest. While traditional accounts trace the discipline’s origins to mainframe computing in the 1960s, followed by programmatic advancements surrounding IT disaster recovery, 9/11, and COVID-19, McKnight uncovers century-old roots through a personal investigation into his great-grandfather’s vintage steel desk. Manufactured by the General Fireproofing Company around 1930, the heirloom led him to a 1924 trade catalogue that passionately advocated for proactively protecting paper business records from devastating urban fires, such as the 1906 San Francisco conflagration. McKnight highlights how this early twentieth-century value proposition, which treated vital documents as the "very breath" of an enterprise's existence, closely mirrors contemporary business continuity management and operational resilience strategies. Ultimately, the author emphasizes that reconstructing this rich history provides modern practitioners with a profound sense of purpose and vocational grounding. It demonstrates that the core mandate of organizational preparedness is not a novel concept but a multi-generational legacy, which continually adapts its protective methods to mitigate systemic vulnerabilities as technology and corporate infrastructure evolve over time.

What is a data architect? Skills, salaries, and how to become a data framework master

The article provides a comprehensive overview contrasting virtual and physical firewalls within modern, dynamic network architectures. Virtual firewalls are software-based security solutions operating on shared compute infrastructure, such as hypervisors, public cloud platforms, and container environments. By decoupling security features from dedicated hardware, they offer programmatic deployment agility, horizontal scaling, and crucial east-west visibility to inspect lateral traffic moving within an environment. However, because they are CPU-bound, virtual instances can experience performance bottlenecks during compute-intensive tasks like high-volume TLS inspection. Conversely, physical firewalls are dedicated hardware appliances built with purpose-designed processors like ASICs. Installed at fixed perimeters, local data centers, or branch offices, they deliver highly predictable, hardware-accelerated throughput for north-south traffic. They remain indispensable for air-gapped systems or strict data sovereignty regulations, though their fixed capacity requires longer procurement and cannot natively follow workloads into public clouds. Ultimately, the article emphasizes that neither solution is universally superior. Instead, most organizations benefit by blending both into a unified hybrid mesh architecture managed through a centralized interface. This holistic approach utilizes physical appliances at high-bandwidth boundaries while deploying virtual firewalls inside cloud infrastructure, ensuring consistent security policies, preventing dangerous policy drift, and reducing management costs across the global network fabric.

Capabilities-Driven Application Modernization: Business Value at Every Step

The article by Melissa Roberts explores how organizations can transition application modernization from strategy to practice using a deliberate, data-driven framework. Rather than rebuilding every application blindly, which often leads to costly failures, companies should use a business capability model paired with a capability heatmap to assess the value, performance, and risk of their operations. Business capabilities are categorized into strategic, core, and supporting layers to help prioritize investments where technology genuinely differentiates the business. Furthermore, the framework requires aligning domains to these capabilities, creating a cross-functional structure that breaks down technical silos. Following Conway's Law, this alignment ensures technical architectures match internal communication patterns, promoting the use of bounded contexts to minimize accidental complexity and avoid monolithic coupling. A domain heatmap visually points executives toward critical, underperforming capabilities that need higher investment, while protecting adequately performing areas from unnecessary spending. Companies often fail when they neglect to connect distinctive capabilities with their corresponding problem domains and underlying technologies. Ultimately, establishing this capability-driven alignment ensures stakeholders realize clear business outcomes, maximizing return on investment while preventing organizations from hemorrhageing capital on redundant or non-essential application modernization initiatives.

Beyond Crisis Management: Why Scenario Planning Must Become a Regular Operating Discipline

The article argues that traditional scenario planning, once treated as a static, annual ritual dominated by hypothetical workshops, is no longer sufficient in an era marked by deep geopolitical fragmentation and supply chain shocks. Modern scenario planning must instead evolve into a continuous, data-driven operating rhythm deeply embedded across core functions like procurement, treasury, logistics, and technology. The strategic focus has shifted from trying to predict exact future outcomes to building collective agility that minimizes organizational paralysis during abrupt changes. To bridge the gap between boardroom discussions and execution, successful multinational enterprises now utilize trigger-based escalation frameworks. By anchoring abstract scenarios to specific, measurable indicators—such as freight thresholds, inventory buffer levels, or shipping delays—organizations can automatically execute predetermined actions before a crisis fully materializes. Furthermore, corporate leadership and investors are reframing resilience as a vital commercial asset, moving scenario mapping into capital allocation and strategic investment decisions. Ultimately, building a resilient enterprise requires cultivating an internal culture that normalizes uncomfortable conversations, encourages leaders to challenge deep-seated assumptions, and treats risk functions not as passive compliance units, but as strategic interpreters of systemic uncertainty.

Bridging Gaps in SOC Maturity Using Detection Engineering and Automation

The DZone article asserts that true Security Operations Center (SOC) maturity requires maintaining a stable, continuous feedback loop where threat detection and response are systematically governed, measured, and optimized. Organizations frequently suffer from uneven operational maturity, where a massive accumulation of raw logs outpaces data normalization capabilities and overwhelms analysts with alert noise. To close these gaps, the article advocates treating detection engineering as a robust control plane. Rather than relying on brittle, static alerts, teams should treat detections as portable, version-controlled software artifacts—such as Sigma rules—backed by explicit telemetry contracts. This systematic structure cleanly separates rule defects from underlying data quality failures. Automation further scales this cycle by introducing programmatic, pre-deployment quality gates and standardizing responses via frameworks like OpenC2, STIX, and TAXII. Instead of using automation to aggressively suppress noisy alerts—which frequently masks the root causes of risks—mature automation enforces behavioral consistency, quality thresholds, and precise telemetry validation before accelerating execution. Ultimately, shifting to an artifact-driven model protects system transparency, prevents operational debt, and alleviates downstream queue pressure. This structural evolution successfully transitions analyst workloads away from repetitive manual triage and allows them to focus on high-value, threat-informed threat hunting and investigation.

Context architecture is replacing RAG as agentic AI pushes enterprise retrieval to its limits

The VentureBeat article outlines a structural transition in enterprise AI infrastructure, where traditional Retrieval-Augmented Generation (RAG) pipelines are being replaced by context architectures. Standard RAG frameworks, which pre-load data into pipelines before model execution, are failing because autonomous AI agents generate vastly larger, continuous data requests than human users. This scale mismatch leaves data scattered and stale. Enterprise buyers are shifting toward custom, hybrid retrieval stacks that flip the paradigm, enabling agents to dynamically pull live, governed, low-latency context at runtime using Model Context Protocol (MCP) tool calls. In response to these market demands, companies like Redis have introduced platforms like Redis Iris. This context and memory platform provides real-time data integration, short- and long-term state tracking, and semantic interfaces while utilizing highly cost-effective storage technologies like Redis Flex to run data on flash. Analyst and market data confirm that retrieval optimization has overtaken evaluation as the top enterprise investment priority. Ultimately, the successful scaling of agentic AI depends on implementing these unified context layers to ensure data is fresh, secure, and cost-efficient, allowing multiple specialized agents to interact simultaneously without causing backend system strain or governance risks.

Can EU AI Act actually regulate models like Mythos?

The Silicon Republic article explores the regulatory challenges surrounding frontier AI models, focusing on Anthropic's powerful "Mythos" system. Discovered as an unintentional byproduct of coding and autonomy improvements, Mythos has triggered global security discussions due to its defensive capabilities and potential systemic cyber risks. This disruption has heavily strained start-ups and SMEs, which face immense pressure to constantly patch digital products and services. Joseph Stephens, director of resilience at Ireland's National Cyber Security Centre (NCSC), emphasizes that individual states have limited power to block independent, US-based rollouts. Consequently, the EU and member nations are seeking a highly coordinated regulatory framework. While the EU AI Act includes provisions designed to mitigate systemic dangers and offensive cyber capabilities, its practical application remains restricted by geographical bounds. Legal expert Dr. TJ McIntyre notes that the extraterritorial regulation of models like Mythos is only possible if the systems or their outputs are directly sold within the European Union. If Anthropic uses geo-restricting measures to block availability inside the bloc, enforcement under the Act becomes deeply uncertain. Ultimately, while the AI Act represents a groundbreaking attempt to police advanced software marketplaces safely, officials acknowledge that governments cannot entirely regulate their way out of accelerating technological advancements.

Daily Tech Digest - May 10, 2026

Quote for the day:

"Disengagement is a failure of biology — not motivation. Our brains are hardwired to avoid anything we think will fail. Change the environment. The biology follows." -- Gordon Tredgold

🎧 Listen to this digest on YouTube Music

▶ Play Audio Digest

Duration: 14 mins • Perfect for listening on the go.

Intent-based chaos testing is designed for when AI behaves confidently — and wrongly

The VentureBeat article by Sayali Patil addresses a critical reliability gap in autonomous AI systems, where agents often perform with high confidence but produce fundamentally incorrect outcomes. Traditional observability metrics like uptime and latency fail to capture these silent failures because the systems appear operationally healthy while being behaviorally compromised. To combat this, Patil introduces intent-based chaos testing, a framework focused on measuring deviation from intended behavioral boundaries rather than simple success or failure. Central to this approach is the intent deviation score, which quantifies how far an agent's actions drift from its baseline purpose. The testing methodology follows a rigorous four-phase structure: starting with single tool degradation to test adaptation, followed by context poisoning to challenge data integrity and escalation logic. The third phase examines multi-agent interference to surface emergent conflicts from overlapping autonomous entities, while the final phase utilizes composite failures to simulate the complex entropy of actual production environments. By intentionally injecting chaos into behavioral logic rather than just infrastructure, enterprise architects can identify dangerous blast radii before deployment. This paradigm shift ensures that AI agents remain aligned with human intent even when facing real-world unpredictability, ultimately transforming how organizations validate the trustworthiness and safety of their sophisticated, agentic AI infrastructure.

Unlocking Cloud Modernization: Strategies Every CIO Needs for Agility, Security, and Scale

The article "Unlocking Cloud Modernization: Strategies Every CIO Needs for Agility, Security, and Scale" emphasizes that in 2026, cloud modernization has transitioned from a secondary long-term goal to a critical business priority. As enterprises accelerate their adoption of artificial intelligence and data automation, traditional IT infrastructures often struggle to provide the necessary speed, scalability, and operational resilience. To address these mounting limitations, CIOs are urged to implement strategic transformation roadmaps that reshape legacy environments into agile, secure, and AI-ready ecosystems. Key strategies highlighted include adopting hybrid and multi-cloud architectures to avoid vendor lock-in, incrementally modernizing legacy applications through containerization, and strengthening security via Zero Trust models. Furthermore, the article stresses the importance of automating complex operations using Infrastructure as Code and optimizing expenditures through FinOps practices. Effective modernization not only reduces technical debt and infrastructure complexity but also significantly enhances innovation cycles. By prioritizing business-aligned strategies and building AI-supporting architectures, organizations can better respond to market shifts and deliver superior digital experiences to customers. Ultimately, a phased approach allows leaders to balance innovation with stability, ensuring that modernization supports long-term digital growth while maintaining robust governance across increasingly distributed and multi-faceted cloud environments.

The CIO succession gap nobody admits

In the insightful article "The CIO succession gap nobody admits," Scott Smeester explores a critical leadership crisis where many seasoned CIOs find themselves unable to leave their roles because they lack a viable internal successor. This "succession gap" primarily stems from the "architect trap," where CIOs promote deputies based on technical brilliance and operational reliability rather than the requisite executive leadership skills. Consequently, these trusted deputies often excel at managing complex platforms but struggle with broader P&L ownership, boardroom politics, and high-stakes financial negotiations. To bridge this divide, Smeester proposes three proactive design choices for modern IT leadership. First, CIOs should grant deputies authority over specific decision domains, such as vendor escalations, to build genuine professional judgment. Second, they must stop shielding high-potential talent from conflict, allowing them to defend budgets and strategies against peer executives. Finally, the board must be introduced to these deputies early through substantive presentations to build credibility long before a vacancy occurs. Failing to address this gap results in stalled digital transformations, expensive external hires, and the loss of talented staff who feel overlooked. Ultimately, a true succession plan is not just a list of names but a deliberate developmental pipeline that prepares future leaders to step into the boardroom with confidence and authority.

Cyber Regulation Made Us More Auditable. Did It Make Us More Defensible?

In his article, Thian Chin explores the critical disconnect between cybersecurity auditability and actual defensibility, arguing that while decades of regulation and frameworks like ISO 27001 have successfully "raised the floor" for organizational governance, they have failed to guarantee operational resilience. Chin highlights a systemic issue where the industry prioritizes documenting the existence of controls over verifying their effectiveness against real-world adversaries. Evidence from threat-led testing programs like the Bank of England’s CBEST reveals that even heavily supervised financial institutions often succumb to foundational hygiene failures, such as unpatched systems and weak identity management, despite being certified as compliant. This gap persists because traditional assurance models reward countable artifacts rather than actual security outcomes, leading to "audit fatigue" and a false sense of safety. To address this, Chin advocates for a transition toward outcome-based and threat-informed regulatory architectures, such as the UK’s Cyber Assessment Framework (CAF) and the EU’s DORA. These modern approaches treat certification merely as a baseline rather than the ultimate proof of security. Ultimately, the article challenges practitioners and regulators to stop confusing the documentation of a control with the successful defense of a system, insisting that future cyber regulation must demand rigorous evidence that security measures can withstand genuine adversarial pressure.

TCLBANKER Banking Trojan Targets Financial Platforms via WhatsApp and Outlook Worms

TCLBANKER is a sophisticated Brazilian banking trojan recently identified by Elastic Security Labs, representing a significant evolution of the Maverick and SORVEPOTEL malware families. Targeting approximately 59 financial, fintech, and cryptocurrency platforms, the malware is primarily distributed via trojanized MSI installers disguised as legitimate Logitech software through DLL side-loading techniques. At its core, the threat employs a multi-modular architecture featuring a full-featured banking trojan and a self-propagating worm component. The banking module monitors browser activities using UI Automation to detect financial sessions, while the worm leverages hijacked WhatsApp Web sessions and Microsoft Outlook accounts to spread malicious payloads to thousands of contacts. This distribution model is particularly effective as it originates from trusted accounts, bypassing traditional email gateways and reputation-based security defenses. Furthermore, TCLBANKER exhibits advanced anti-analysis techniques, including environment-gated decryption that ensures the payload only executes on systems matching specific Brazilian locale fingerprints. If analysis tools or debuggers are detected, the malware fails to decrypt, effectively shielding its operations from security researchers. By utilizing real-time social engineering through WPF-based full-screen overlays and WebSocket-driven command loops, the operators can manipulate victims and facilitate fraudulent transactions while remaining hidden. This maturation of Brazilian crimeware highlights a growing trend of adopting sophisticated techniques once reserved for advanced persistent threats.

The Best Risk Mitigation Strategy in Data? A Single Source of Truth

Jeremy Arendt’s article on O’Reilly Radar posits that establishing a "Single Source of Truth" (SSOT) serves as the preeminent strategy for mitigating modern organizational data risks. In today’s increasingly complex digital landscape, information is frequently scattered across disparate systems, creating isolated data silos that foster inconsistency, internal friction, and "multiple versions of reality." Arendt argues that these silos introduce significant operational and strategic hazards, as different departments often rely on conflicting metrics to drive their decision-making processes. By implementing an SSOT, organizations can ensure that every stakeholder accesses a unified, high-fidelity dataset, effectively eliminating discrepancies that undermine executive trust. This centralization is not merely a storage solution; it is a fundamental governance framework that simplifies regulatory compliance, enhances cybersecurity, and guarantees long-term data integrity. Furthermore, a single source of truth serves as a critical prerequisite for successful artificial intelligence and machine learning initiatives, providing the reliable, high-quality data foundation necessary for accurate model training and deployment. Ultimately, this architectural approach reduces technical debt and operational overhead while fostering a corporate culture of transparency. By prioritizing a consolidated data platform, companies can shield themselves from the financial and reputational dangers of misinformation, ensuring their strategic maneuvers are grounded in verified facts rather than fragmented interpretations.

Boards Are Falling Short on Cybersecurity

The article "Boards Are Falling Short on Cybersecurity" examines why corporate boards, despite increased investment and focus, are struggling to effectively govern and mitigate cyber risks. According to the research, which includes interviews with over 75 directors, three primary factors drive this deficiency. First, there is a pervasive lack of cybersecurity expertise among board members; a study revealed that only a tiny fraction of directors on cybersecurity committees possess formal training or relevant practical experience. Second, while boards are enthusiastic about artificial intelligence, their conversations typically prioritize strategic gains like operational efficiency while neglecting the significant security vulnerabilities AI introduces, such as automated malware generation. Third, boards often conflate regulatory compliance with actual security, spending excessive time on box checking and dashboards that offer marginal value in protecting against sophisticated threats. To address these gaps, the authors suggest that boards must shift from a reactive to a proactive stance, integrating cybersecurity into the very foundation of product development and brand strategy. By treating security as a core business driver rather than a back-office bureaucratic hurdle, organizations can better protect their reputations and operational integrity in an era where cybercrime losses continue to escalate sharply year over year. Finally, the authors emphasize that FBI data reveals a surge in losses, underscoring the need for improved oversight.

Giving Up Should Never Be An Option: Why Persistence Is The Ultimate Key To Success

The article "Giving Up Should Never Be An Option: Why Persistence Is The Ultimate Key To Success" centers on a transformative personal narrative that illustrates the critical role of endurance in achieving professional milestones. The author recounts a grueling experience as a door-to-door salesperson, facing six consecutive days of rejection and failure amidst harsh, snowy conditions. Rather than yielding to the urge to quit, the author approached the seventh day with renewed focus and a meticulously planned strategy. After knocking on nearly one hundred doors without success, the final attempt of the evening resulted in a breakthrough sale that fundamentally shifted their career trajectory. This pivotal moment proved that persistence, rather than raw talent alone, acts as the ultimate catalyst for progress. The experience served as a foundational training ground, eventually leading to rapid promotions, increased confidence, and significant corporate benefits. By reflecting on this "seventh day," the author argues that many individuals abandon their goals when they are mere inches away from a breakthrough. The core message serves as a powerful mantra for modern business leaders: success becomes an inevitability when one commits unwavering belief and effort to their objectives, especially when circumstances are at their absolute worst.

Anthropic's Claude Mythos: how can security leaders prepare?

Anthropic’s release of the Claude Mythos Preview System Card has signaled a transformative shift in the cybersecurity landscape, compelling security leaders to rethink their defensive strategies. This advanced AI model demonstrates a sophisticated ability to autonomously identify software vulnerabilities and develop exploit chains, significantly lowering the barrier for cyberattacks. According to the article, the cost of weaponizing exploits has plummeted to mere dollars, while the timeline from discovery to exploitation has collapsed from days to hours. To prepare for this accelerated threat environment, Melissa Bischoping argues that security professionals must prioritize wall-to-wall visibility across all cloud, on-premise, and remote endpoints. The piece emphasizes that manual remediation workflows are no longer sufficient; instead, organizations should adopt real-time threat exposure management and maintain continuous, SBOM-grade inventories to keep pace with AI-driven discovery cycles. Furthermore, the summary underscores that while Mythos enhances offensive capabilities, traditional hygiene—specifically the "Essential Eight" controls like multi-factor authentication and rigorous patching—remains effective against even the most powerful frontier models if implemented with precision. Ultimately, the article serves as a call to action for leaders to close the exposure-to-remediation loop before adversaries can leverage AI to exploit emerging zero-day vulnerabilities, shifting from predictive models to real-time verification and rapid response.

How the evolution of blockchain is changing our ideas about trust

The article "How the evolution of blockchain is changing our ideas about trust" by Viraj Nair explores the transformation of trust mechanisms from the 2008 financial crisis to the modern era. Initially, Satoshi Nakamoto’s Bitcoin white paper introduced a radical alternative to failing central institutions by engineering trust through a "proof of work" consensus model, which favored decentralized network validation over delegated institutional authority. However, this first generation was energy-intensive, leading to a second evolution: "proof of stake." Popularized by Ethereum’s 2022 transition, this model drastically reduced energy consumption but shifted influence toward asset ownership. A third phase, "proof of authority," has since emerged, utilizing pre-approved, reputable validators to prioritize speed and accountability for real-world applications like supply chains and government transactions in Brazil and the UAE. Far from eliminating the need for trust, blockchain technology has reconfigured it into a more nuanced framework. While it began as a way to bypass traditional intermediaries, its current trajectory suggests a hybrid future where trust is distributed across a collaborative ecosystem of banks, technology firms, and governments. Ultimately, the evolution of blockchain demonstrates that while the methods of verification change, the fundamental necessity of trust remains, now bolstered by unprecedented traceability and auditability.

Daily Tech Digest - October 23, 2025

Quote for the day:

“The more you loose yourself in something bigger than yourself, the more energy you will have.” -- Norman Vincent Peale

Leadership lessons from NetForm founder Karen Stephenson

is a hot buzzword encouraging individuals to integrate and create with each other, but the simplest way to integrate and create is in the mind of one person — if they’re willing to push forward and do it. Even further, what can an integrated team of diverse minds accomplish when they co-create? ... In the age of AI, humans will need to focus on what humans do well. At the moment, at least, that’s making novel connections, thinking by analogy and creating the new. Our single-field approach to learning, qualifications and career ladders makes it hard for us to compete with machines that are often smarter than we are in any given discipline. For that creative spark and to excel at what messy, forgetful, slow, imperfect humans do best, we need to work, think and live differently. In fact, the founders of five of the largest companies in the world are (or were) — mentally diverse people skilled in multiple disciplines — Bill Gates, Steve Jobs, Warren Buffett, Larry Page and Jeff Bezos. They learn because they’re curious and want to solve problems, not for a career ladder. It’s easier than ever, today, to learn with AI and online materials and to collaborate with tech and humans around the world. All you need to do is open inward to your talents and desires, explore, collect and fuse.

Why cloud and AI projects take longer and how to fix the holdups

In the case of , the problem is that senior management thinks that the cloud is always cheaper, that you can always cut costs by moving to the cloud. This is despite the recent stories on “,” or moving cloud applications back into the data center. In the case of cloud projects, most enterprise IT organizations now understand how to assess a cloud project for cost/benefit, so most of the cases where impossible cost savings are promised are caught in the planning phase. For AI, both senior management and line department management have high expectations with respect to the technology, and in the latter case may also have some experience with AI in the form of as-a-service generative AI models available online. About a quarter of these proposals quickly run afoul of governance policies because of problems with data security, and half of this group dies at this point. For the remaining proposals, there is a whole set of problems that emerge. Most enterprises admit that they really don’t understand what AI can do, which obviously makes it hard to frame a realistic AI project. The biggest gap identified is between an AI business goal and a specific path leading to it. One CIO calls the projects offered by user organizations as “invitations to AI fishing trips” because the goal is usually set in business terms, and these would actually require a project simply to identify how the stated goal could be achieved.

Who pays when a multi-billion-dollar data center goes down?

While the is looking at everything from to drought, there are a handful of risks where it feels the industry isn't adequately preparing. “The big thing that isn't getting on people's radars in a growing way is ," Hayhow says “Looking at this through the lens of the data center owner or developer, it's often very difficult. “It's a bit of an unspoken conversation that the equipment in the white space belongs to the customer. Often you don't have custody over it, you don't have visibility over it, and it’s highly proprietary. But the value of it is growing.” Per square meter of white space, the Lockton partner suggests that the value of the equipment five years from now will be exponentially larger than the value of the equipment five years ago, as more data centers invest in expensive GPUs and other equipment for AI use cases. “Leases have become clearer in terms of placing responsibility for damage to customer equipment more squarely on the shoulders of the owner, developer,” Hayhow says. “We're having that conversation in the US, where the halls are larger, the value of the equipment is greater, and some of the hyperscale customers are being much more prescriptive in terms of wanting to address the topic of damage to our equipment … if you lose 20 megawatts worth of racks of , the lead time to get those replaced, unless you're building elsewhere, is quite significant.”

AI Agents Need Security Training – Just Like Your Employees

“It may not be as candid as what humans would do during those sessions, but AI agents used by your workforce do need to be trained. They need to understand what your company policies are, including what is acceptable behavior, what data they're allowed to access, what actions they're allowed to take,” Maneval explained. ... “Most AI tools are just trained to do the same thing over and over and so it means decisions are based on assumptions from limited information,” she explained to Infosecurity. “Additionally, most AI tools solve real problems but also create real risks and each solve different problems and creates different risks.” While some cybersecurity experts argue that auditing AI tools is no different to auditing any other software or application, Maneval disagrees. ... Maneval’s said her “rule of thumb” is that whether you’re dealing with traditional machine learning algorithms, generative AI applications of AI agents, “treat them like any other employees.” This not only means that AI-powered agents should be trained on security policies but should also be forced to respect security controls that the staff have to respect, such as role-based access controls (RBAC). “You should look at how you treat your humans and apply those same controls to the AI. You probably do a background check before anyone is hired. Do the same thing with your AI agent. ..."

Why must CISOs slay a cyber dragon to earn business respect?

Why should a security leader need to experience a major cyber incident to earn business colleagues’ respect? Jeff Pollard, VP and principal analyst at Forrester, says this enterprise perception problem is “just part of human nature. If we don’t see the bad thing happening, we don’t appreciate all of the things that were done to prevent that bad thing from happening.” Of course, if an attack turns into an incident and defense goes poorly, “it can easily turn from a hero moment to a scapegoat moment,” Pollard says. Oberlaender, who now works as a cybersecurity consultant, is among those who believe hard-earned experience should be rewarded, but that’s not what he’s seeing in the market today. ... CISOs “feel that they need to fight off an attack to show value, but there are many other successes they can do and show,” says Erik Avakian, technical counselor at Info-Tech Research Group. “Building KPIs is a powerful way to show their value.” ... Chris Jackson, a senior cybersecurity specialist with tech education vendor Pluralsight, reinforces the frustration that many enterprise CISOs feel about the lack of appropriate respect from their colleagues and bosses. “CISOs are a lot like pro sports coaches. It doesn’t matter how well they performed during the season or how many games they won. If they don’t win the championship, it’s seen as a failure, and the coach is often the first to go,” Jackson says.

The next cyber crisis may start in someone else’s supply chain

Organizations have improved oversight of their direct partners, but few can see beyond the first layer. This limited view leaves blind spots that attackers can exploit, particularly through third-party software or service providers. “We’re in a new generation of risk, one where cyber, geopolitical, technology, political risk, and other factors are converging and reshaping the landscape. The impact on markets and operations is unfolding faster than many organizations can keep up,” said Jim Wetekamp, CEO of Riskonnect. ... Third-party and nth-party risks continue to expose companies to disruption. Most organizations have business continuity plans for supplier disruptions, but their monitoring often stops at direct partners. Only a small fraction can monitor risks across multiple tiers of their supply chain, and some cannot track their critical technology providers at all. Organizations still underestimate how dependent they are on third parties and continue to rely on paper-based continuity plans that offer a false sense of security. ... More companies now have a chief risk officer, but funding for technology and tools has barely moved. Most risk leaders say their budgets have stayed the same even as they are asked to cover more ground. Many are turning to automation and specialized software to do more with what they already have.

Boardroom to War Room: Translating AI-Driven Cyber Risk into Action

Great CISOs today combine strategic leadership, financial knowledge, technological skills, and empathy to turn cybersecurity from a burden on operations into a strong enabler. This change happens faster with artificial intelligence. AI has a lot of potential, but it also makes things more uncertain. It can do things like forecast threats and automate orchestration. CISOs need to see AI problems as more than just technological problems; they need to see them as business risks that need clear communication, openness, and quick response. ... Not storytelling, but data and graphics win over executives. Suggested metrics include: Predictive accuracy - The percentage of risks that AI flagged before a breach compared to the percentage of threats that AI flagged after it happened; Speed of reaction - The average time it took for AI-enabled confinement to work compared to manual reaction; False positive rate - Tech teams employed AI to improve alerts and cut down on alert fatigue from X to Y; Third-party model risk - The number of outside model calls that were looked at and accepted; Visual callout suggestion - A mock-up of a dashboard that illustrates AI risk KPIs, a trendline of predictive value, and a drop in incidences. ... Change from being an IT responder who reacts to problems to a strategic AI-enabled risk leader. Take ownership of your AI risk story, keep an eye on third-party models, provide your board clear information, and make sure your war room functions quickly.

Govt. faces questions about why US AWS outage disrupted UK tax office and banking firms

“The narrative of bigger is better and biggest is best has been shown for the lie it always has been,” Owen Sayers, an independent security architect and data protection specialist with a long history of working in the public sector, told Computer Weekly. “The proponents of hyperscale cloud will always say they have the best engineers, the most staff and the greatest pool of resources, but bigger is not always better – and certainly not when countries rely on those commodity global services for their own national security, safety and operations. “Nationally important services must be recognised as best delivered under national control, and as a minimum, the government should be knocking on AWS’s door today and asking if they can in fact deliver a service that guarantees UK uptime,” he said. “Because the evidence from this week’s outage suggests that they cannot.” ... “In light of today’s major outage at Amazon Web Services … why has not designated Amazon Web Services or any other major technology firm as a CTP for the purposes of the Critical Third Parties Regime,” asked Hillier, in the letter. “[And] how soon can we expect firms to be brought into this regime?” Hillier also asked HM Treasury for clarification about whether or not it is concerned about the fact that “seemingly key parts of our IT infrastructure are hosted abroad” given the outage originated from a US-based AWS datacentre region but impacted the activities of Lloyds Bank and also HMRC.

Quantum work, federated learning and privacy: Emerging frontiers in blockchain research

It is possible to have a future in which the field of could serve as the foundation for . The future is alluring; quantum algorithms can provide solutions to the issues that classical computers find difficult and the method may be more effective and resistant to brute-force attacks. The danger, however, is significant: when quantum computers are sufficiently robust, existing encryption standards can be compromised. ... Federated learning is another upcoming element of blockchain studies, a machine learning model training technique that avoids data centralisation. Federated learning enables various devices or nodes to feed into a standard model instead of storing sensitive data in a central server inaccessible to third parties. ... The issue of privacy is of specific importance today due to the increased regulatory pressure on exchanges and cryptocurrency companies. A compromise between user privacy and regulatory openness could prove to be the key to success. Studies of privacy-saving instruments provide a competitive advantage to blockchain developers and for exchanges interested in increasing their influence on the global economy. ... The decade of blockchain research to come will not be characterised by fast transactions or cheaper costs. It will redraw the borders of trust, calculation, and privacy in digitally based economies.

Ransomware groups surge as automation cuts attack time to 18 mins

The ransomware group LockBit has recently introduced "LockBit 5.0", reportedly incorporating artificial intelligence for attack randomisation and enhanced targeting options, with a focus on regaining its previous position atop the ransomware ecosystem. Medusa, by contrast, was noted to have fallen behind due in part to lacking widespread automated and customisable features, despite previous activity levels. ReliaQuest's analysis predicts the rise of new groups through the lens of its three-factor model, specifically naming "The Gentlemen" and "DragonForce" as likely to become major threats due to their adoption of advanced technical capabilities. The Gentlemen, for instance, has listed over 30 victims on its data-leak site within its first month of activity, underpinned by automation, prioritised encryption, and endpoint discovery for rapid lateral movement. Conversely, groups such as "Chaos" and "Nova" are likely to remain minor players, lacking the integral features associated with higher victim counts and affiliate recruitment. ... RaaS groups now use automation to reduce breakout times to as little as 18 minutes, making manual intervention too slow. Implement automated containment and response plays to keep pace with attackers. These workflows should automatically isolate hosts, block malicious files, and disable compromised accounts quickly after a critical detection, containing the threat before ransomware can be deployed.

Daily Tech Digest - October 22, 2025

Quote for the day:

"Good content isn't about good storytelling. It's about telling a true story well." -- Ann Handley

When yesterday’s code becomes today’s threat

A striking new supply chain attack is sending shockwaves through the developer community: a worm-style campaign dubbed “” has compromised at least 187 npm packages, including the that has 2 million hits weekly, and spreading to other maintainers' packages. The malicious payload modifies package manifests, injects malicious files, repackages, and republishes — thereby infecting downstream projects. This incident underscores a harsh reality: even code released weeks, months, or even years ago can become dangerous once a dependency in its chain has been compromised. ... Sign your code: All packages/releases should use cryptographic signing. This allows users to verify the origin and integrity of what they are installing. Verify signatures before use: When pulling in dependencies, CI/CD pipelines, and even local dev setups, include a step to check that the signature matches a trusted publisher and that the code wasn’t tampered with. SBOMs are your map of exposure: If you have a for your project(s), you can query it for compromised packages. Find which versions/packages have been modified — even retroactively — so you can patch, remove, or isolate them. Continuous monitoring of risk posture: It's not enough to secure when you ship. You need alerts when any dependency or component’s risk changes: new vulnerabilities, suspicious behavior, misuse of credentials, or signs that a trusted package may have been modified after release.

Cloud Sovereignty: Feature. Bug. Feature. Repeat!

isn’t just a buzzword anymore, argues Kushwaha. “It’s a real concern for businesses across the world. The pattern is clear. The cloud isn’t a one-size-fits-all solution anymore. Companies are starting to realise that sometimes control, cost, and compliance matter more than convenience.” ... Cloud sovereignty is increasingly critical due to the evolving geopolitical scenario, government and industry-specific regulations, and vendor lock-ins with heavy reliance on . The concept has gained momentum and will continue to do so because technology has become pervasive and critical for running a state/country and any misuse by foreign actors can cause major repercussions, the way Bavishi sees it. Prof. Bhatt captures that true digital sovereignty is a distant dream and achieving this requires a robust ecosystem for decades. This isn’t counterintuitive; it’s evolution, as Kushwaha epitomises. “The cloud’s original promise was one of freedom. Today, when it comes to the cloud, freedom means more control. Businesses investing heavily in digital futures can’t afford to ignore the fine print in hyperscaler contracts or the reach of foreign laws. Sovereignty is the foundation for building safely in a fragmented world.” ... Organisations have recognised the risks of digital dependencies and are looking for better options. There is no turning back, Karlitschek underlines.

Securing AI to Benefit from AI

As organizations begin to integrate AI into defensive workflows, identity security becomes the foundation for trust. Every model, script, or autonomous agent operating in a production environment now represents a new identity — one capable of accessing data, issuing commands, and influencing defensive outcomes. If those identities aren't properly governed, the tools meant to strengthen security can quietly become sources of risk. The emergence of make this especially important. These systems don't just analyze; they may act without human intervention. They triage alerts, enrich context, or trigger response playbooks under delegated authority from human operators. ... AI systems are capable of assisting human practitioners like an intern that never sleeps. However, it is critical for security teams to differentiate what to automate from what to augment. Some tasks benefit from full automation, especially those that are repeatable, measurable, and low-risk if an error occurs. ... , , and are prime candidates for automation. These are data-heavy, pattern-driven processes where consistency outperforms creativity. By contrast, , attribution, and response decisions rely on context that AI cannot fully grasp. Here, AI should assist by surfacing indicators, suggesting next steps, or summarizing findings while practitioners retain decision authority. Finding that balance requires maturity in process design.

The Unkillable Threat: How Attackers Turned Blockchain Into Bulletproof Malware Infrastructure

When EtherHiding emerged in September 2023 as part of the CLEARFAKE campaign, it introduced a chilling reality: attackers no longer need vulnerable servers or hackable domains. They’ve found something far better—a global, decentralized infrastructure that literally cannot be shut down. ... When victims visit the infected page, the loader queries a smart contract on or using a read-only function call. ... Forget everything you know about disrupting cybercrime infrastructure. There is no command-and-control server to raid. No hosting provider to subpoena. No DNS to poison. The malicious code exists simultaneously everywhere and nowhere, distributed across thousands of blockchain nodes worldwide. As long as Ethereum or BNB Smart Chain operates—and they’re not going anywhere—the malware persists. Traditional law enforcement tactics, honed over decades of fighting cybercrime, suddenly encounter an immovable object. You cannot arrest a blockchain. You cannot seize a smart contract. You cannot compel a decentralized network to comply. ... The read-only nature of payload retrieval is perhaps the most insidious feature. When the loader queries the smart contract, it uses functions that don’t create transactions or blockchain records.

New 'Markovian Thinking' technique unlocks a path to million-token AI reasoning

Researchers at have proposed a new technique that makes large language models (LLMs) vastly more efficient when performing complex reasoning. Called Markovian Thinking, the approach allows LLMs to engage in lengthy reasoning without incurring the prohibitive computational costs that currently limit such tasks. The team’s implementation, an environment named , structures the reasoning chain into fixed-size chunks, breaking the scaling problem that plagues very long LLM responses. Initial estimates show that for a 1.5B parameter model, this method can cut the costs of training by more than two-thirds compared to standard approaches. ... The researchers compared this to models trained with the standard . Their findings indicate that the model trained with Delethink could reason up to 24,000 tokens, and matched or surpassed a LongCoT model trained with the same 24,000-token budget on math benchmarks. On other tasks like coding and PhD-level questions, Delethink also matched or slightly beat its LongCoT counterpart. “Overall, these results indicate that Delethink uses its thinking tokens as effectively as LongCoT-RL with reduced compute,” the researchers write. The benefits become even more pronounced when scaling beyond the training budget.

The dazzling appeal of the neoclouds

While their purpose-built design gives them an advantage for AI workloads, neoclouds also bring complexities and trade-offs. Enterprises need to understand where these platforms excel and plan how to integrate them most effectively into broader cloud strategies. Let’s explore why this buzzword demands your attention and how to stay ahead in this new era of cloud computing. ... Neoclouds, unburdened by the need to support everything, are outpacing hyperscalers in areas like agility, pricing, and speed of deployment for AI workloads. A shortage of GPUs and data center capacity also benefits neocloud providers, which are smaller and nimbler, allowing them to scale quickly and meet growing demand more effectively. This agility has made them increasingly attractive to AI researchers, startups, and enterprises transitioning to AI-powered technologies. ... Neoclouds are transforming cloud computing by offering purpose-built, cost-effective infrastructure for AI workloads. Their price advantages will challenge traditional cloud providers’ market share, reshape the industry, and change enterprise perceptions, fueled by their expected rapid growth. As enterprises find themselves at the crossroads of innovation and infrastructure, they must carefully assess how neoclouds can fit into their broader architectural strategies.

Wi-Fi 8 is coming — and it’s going to make AI a lot faster

Unlike previous generations of Wi-Fi that competed on peak throughput numbers, Wi-Fi 8 prioritizes consistent performance under challenging conditions. The specification introduces coordinated multi-access point features, dynamic spectrum management, and hardware-accelerated telemetry designed for AI workloads at the network edge. ... A core part of the Wi-Fi 8 architecture is an approach known as (UHR). This architectural philosophy targets the 99th percentile user experience rather than best-case scenarios. The innovation addresses AI application requirements that demand symmetric bandwidth, consistent sub-5-millisecond latency and reliable uplink performance. ... Wi-Fi 8 introduces (ELR) mode specifically for IoT devices. This feature uses lower data rates with more robust coding to extend coverage. The tradeoff accepts reduced throughput for dramatically improved range. ELR operates by increasing symbol duration and using lower-order modulation. This improves the link budget for battery-powered sensors, smart home devices and outdoor IoT deployments. ... Wi-Fi 8 enhances roaming to maintain sub-millisecond handoff latency. The specification includes improved (FILS) and introduces coordinated roaming decisions across the infrastructure. Access points share client context information before handoff.

Life, death, and online identity: What happens to your online accounts after death?

Today, we lack the tools (protocols) and the regulations to enable digital estate management at scale. Law and regulation can force a change in behavior by large providers. However, lacking effective protocols to establish a mechanism to identify the decedent’s chosen individuals who will manage their digital estate, every service will have to design their own path. This creates an exceptional burden on individuals planning their digital estate, and on individuals who manage the digital estates of the deceased. ... When we set out to write this paper, we wanted to influence the large technology and social media platforms, politicians, regulators, estate planners, and others who can help change the status quo. Further, we hoped to influence standards development organizations, such as the and the Internet Engineering Task Force (IETF), and their members. As standards developers in the realm of identity, we have an obligation to the people we serve to consider identity from birth to death and beyond, to ensure every human receives the respect they deserve in life and in death. Additionally, we wrote the planning guide to help individuals plan for their own digital estate. By giving people the tools to help describe, document, and manage their digital estates proactively, we can raise more awareness and provide tools to help protect individuals at one of the most vulnerable moments of their lives.

5 steps to help CIOs land a board seat

Serving on a board isn’t an extension of an operational role. One issue CIOs face is not understanding the difference between executive management and governance, Stadolnik says. “They’re there to advise, not audit or lead the current company’s CIO,” he adds. In the boardroom, the mandate is to provide strategy, governance, and oversight, not execution. That shift, Stadolnik says, can be jarring for tech leaders who’ve spent their careers driving operational results. ... “There were some broad risk areas where having strong technical leadership was valuable, but it was hard for boards to carve out a full seat just for that, which is why having CIO-plus roles was very beneficial,” says Cullivan. The issue of access is another uphill battle for CIOs. As Payne found, the network effect can play a huge role in seeking a board role. But not every IT leader has the right kind of network that can open the door to these opportunities. ... Boards expect directors to bring scope across business disciplines and issues, not just depth in one functional area. Stadolnik encourages CIOs to utilize their strategic orientation, results focus, and collaborative and influence skills to set themselves up for additional responsibilities like procurement, supply chain, shared services, and others. “It’s those executive leadership capabilities that will unlock broader roles,” he says. Experience in those broader roles bolsters a CIO’s board résumé and credibility.

Microservices Without Meltdown: 7 Pragmatic Patterns That Stick

A good sniff test: can we describe the service’s job in one short sentence, and does a single team wake up if it misbehaves? If not, we’ve drawn mural art, not an interface. Start with a small handful of services you can name plainly—orders, payments, catalog—then pressure-test them with real flows. When a request spans three services just to answer a simple question, that’s a hint we’ve sliced too thin or coupled too often. ... Microservices live and die by their contracts. We like contracts that are explicit, versioned, and backwards-friendly. “Backwards-friendly” means old clients keep working for a while when we add fields or new behaviors. For HTTP APIs, plus consistent error formats makes a huge difference. ... We need timeouts and retries that fit our service behavior, or we’ll turn small hiccups into big outages. For east-west traffic, a or smart gateway helps us nudge traffic safely and set per-route policies. We’re fans of explicit settings instead of magical defaults. ... Each service owns its tables; cross-service read needs go through APIs or asynchronous replication. When a write spans multiple services, aim for a sequence of local commits with compensating actions instead of distributed locks. Yes, we’re describing sagas without the capes: do the smallest thing, record it durably, then trigger the next hop.

Daily Tech Digest - October 17, 2025

Quote for the day:

"Listen with curiosity, speak with honesty act with integrity." -- Roy T Bennett

AI Agents Transform Enterprise Application Development

There's now discussion about the and the need to supervise or manage AI agent developers - calling for and infrastructure changes. New products, services and partnerships announced in the past few weeks support this trend. ... Enterprises were cautious about entrusting public models and agents with intellectual property. But the partnership with could make models more trustworthy. "Enterprises are looking for AI they can actually trust with their code, their data and their day-to-day operations," said Mike Krieger, chief product officer at Anthropic. ... Embedding agentic AI within the fabric of enterprise architecture enables organizations to unlock transformative agility, reduce cognitive load and accelerate innovation - without compromising trust, compliance or control - says an report titled "Architecting secure enterprise AI agents with MCP." Developers adopted globally recognized models such as , or , and as paths to improve the software development and maintenance processes. ... Enterprises must be prepared to implement radical process and infrastructure changes to successfully adopt AI agents in software delivery. AI agents must be managed by a central governance framework to enable complete visibility into agents, agent performance monitoring and security.

There’s no such thing as quantum incident response – and that changes everything

CISOs are directing attention to have added to the corporate risk register. It belongs there. But the problem to be solved is not a quick fix, despite what some snake oil salesmen might be pushing. There is no simple configuration checkbox on or or where you “turn on” () and then you’re good to go. ... Without significant engagement from developers, QA teams and product owners, the quantum decryption risk will remain in play. You cannot transfer this risk by adding more policy coverage. The entire cyber insurance industry itself is in a bit of an existential doubt situation regarding whether cybersecurity can reasonably be insured against, given the systemic impacts of that cascade across entire industries. ...The moment when a comes into existence won’t arrive with fanfare or bombast. Hence, the idea of the . But by then, it will be too late for incident response. What you should do Monday morning: Start that . Figure out what needs protecting for the long term versus what has a shorter shelf life. In the world of DNS, we have () that declares how long a resolver can cache a response. Think of a “PQC TTL” for your sensitive data, because not everything needs 30-year protection.

Hackers Use Blockchain to Hide Malware in Plain Sight

At least two hacking groups are using public blockchains to conceal and control malware in ways that make their operations nearly impossible to dismantle, shows research from Google's Threat Intelligence Group. ... The technique, known as , embeds malicious instructions in blockchain smart contracts rather than traditional servers. Since the blockchain is decentralized and immutable, attackers gain what the researchers call a "bulletproof" infrastructure. The development signals an "escalation in the threat landscape," said , consulting leader at , which is part of . Hackers have found a method "resistant to law enforcement takedowns" that and can be "easily modified for new campaigns." ... The group over time expanded its architecture from a single smart contract to a three-tier system mimicking a software "." This allows rapid updates without touching the compromised sites. One contract acts as a router, another fingerprints the victim's system and a third holds encrypted payload data and decryption keys. A single blockchain transaction, costing as little as a dollar in network fees, can change lure URLs or encryption keys across thousands of infected sites. The researchers said the threat actor used social engineering tricks like fake Cloudflare verification or Chrome update prompts to persuade victims to run malicious commands.

Everyone’s adopting AI, few are managing the risk

Across industries, many organizations are caught in what calls the “.” Teams are active, frameworks are updated, and risks are logged, but progress fades after early success. When boards include risk oversight as a standing agenda item and align on shared performance goals, activity becomes consistent and forward-looking. When governance and ownership are unclear, adoption slows and collaboration fades. ... Many enterprises are adopting or updating risk frameworks, but implementation depth varies. The typical organization maps its controls to several frameworks, while leading firms embed thousands of requirements into daily operations. The report warns that “surface compliance” is common. Breadth without depth leaves gaps that only appear during audits or disruptions. Mature programs treat frameworks as living systems that evolve with business and regulatory change. ... The findings show that many organizations are investing heavily in risk management and AI, but maturity depends less on technology and more on integration. Advanced organizations use governance to connect teams and turn data into foresight. AuditBoard’s research suggests that as AI becomes more embedded in enterprise systems, risk leaders will need to move beyond activity and focus on consistency. Those that do will be better positioned to anticipate change and turn risk management into a strategic advantage.

A mini-CrowdStrike moment? Windows 11 update cripples dev environments

The , (), addressed security issues in Windows operating systems (OSes), but also appears to have blocked Windows’ ability to talk within itself. Localhost allows apps and services to communicate internally without using internet or external network access. Developers use the function to develop, test, and debug websites and apps locally on a Windows machine before releasing them to the public. ... When localhost stops working, entire application development environments can be impacted or “even grind to a halt,” causing internal processes and services to fail and stop communicating, he pointed out. This means developers are unable to test or run web applications locally. This issue is really about “denial of service,” where tools and processes dependent on internal loopback services break, he noted. Developers can’t debug locally, and automated testing processes can fail. At the same time, IT departments are left to troubleshoot, field an influx of service tickets, roll back patches, and look for workarounds. “This bug is definitely disruptive enough to cause delays, lost productivity, and frustration across teams,” said Avakian. ... This type of issue underscores the importance of quality control and thorough testing by third-party suppliers and vendors before releasing updates to commercial markets, he said. Not doing so can have significant downstream impacts and “erode trust” in the update process while making teams more cautious about patching.

How Banks of Every Size Can Put AI to Work, and Take Back Control

For smaller banks and credit unions, the AI conversation begins with math. They want the same digital responsiveness as larger competitors but can’t afford the infrastructure or staffing that traditionally make that possible. The promise of AI, especially low-code and automated implementation, changes that equation. What once required teams of engineers months of coding can now be deployed out-of-the-box, configured and pushed live in a day. That shift finally brings digital innovation within reach for smaller institutions that had long been priced out of it. But even when self-service tools are available, many institutions still rely on outside help for routine changes or maintenance. For these players, the first question is whether they’re willing or able to take product dev work inhouse, even with "AI inside"; the next question is whether they can find partners that can meet them on their own terms. ... For mid-sized players, the AI opportunity centers on reclaiming control. These institutions typically have strong internal teams and clear strategic ideas, yet they remain bound by vendor SLAs that slow innovation. The gap between what they can envision and what they can deliver is wide. AI-driven orchestration tools, especially those that let internal teams configure and launch digital products directly, can help close that gap. By removing layers of technical dependency, mid-sized institutions can move from periodic rollouts to something closer to iterative improvement.

Why your AI is failing — and how a smarter data architecture can fix it

Traditional enterprises operate four separate, incompatible technology stacks, each optimized for different computing eras, not for AI reasoning capabilities. ... When you try to deploy AI across these fragmented stacks, chaos follows. The same business data gets replicated across systems with different formats and validation rules. Semantic relationships between business entities get lost during integration. Context critical for intelligent decision-making gets stripped away to optimize for system performance. AI systems receive technically clean datasets that are semantically impoverished and contextually devoid of meaning. ... As organizations begin shaping their enterprise general intelligence (EGI) architecture, critical operational intelligence remains trapped in disconnected silos. Engineering designs live in PLM systems, isolated from the ERP bill of materials. Quality metrics sit locked in MES platforms with no linkage to supplier performance data. Process parameters exist independently of equipment maintenance records. ... Enterprises solving the data architecture challenge gain sustainable competitive advantages. AI deployment timelines are measured in weeks rather than months. Decision accuracy reaches enterprise-grade reliability. Intelligence scales across all business domains. Innovation accelerates as AI creates new capabilities rather than just automating existing processes.

Under the hood of AI agents: A technical guide to the next frontier of gen AI

With agents, authorization works in two directions. First, of course, users require authorization to run the agents they’ve created. But as the agent is acting on the user’s behalf, it will usually require its own authorization to access networked resources. There are a few different ways to approach the problem of authorization. One is with an access delegation algorithm like OAuth, which essentially plumbs the authorization process through the agentic system. ... Agents also need to remember their prior interactions with their clients. If last week I told the restaurant booking agent what type of food I like, I don’t want to have to tell it again this week. The same goes for my price tolerance, the sort of ambiance I’m looking for, and so on. Long-term memory allows the agent to look up what it needs to know about prior conversations with the user. Agents don’t typically create long-term memories themselves, however. Instead, after a session is complete, the whole conversation passes to a separate AI model, which creates new long-term memories or updates existing ones. ... Agents are a new kind of software system, and they require new ways to think about observing, monitoring and auditing their behavior. Some of the questions we ask will look familiar: Whether the agents are running fast enough, how much they’re costing, how many tool calls they’re making and whether users are happy.

Data Is the New Advantage – If You Can Hold On To It

Proprietary data has emerged as one of the most valuable assets for enterprises—and increasingly, the expectation is that data must be stored indefinitely, ready to fuel future models, insights, and innovations as the technology continues to evolve. ... Globally, data architects, managers, and protectors are in uncharted territory. The arrival of generative AI has proven just how unpredictable and fast-moving technological leaps can be – and if there’s one thing the past few years have taught us, it’s that we can’t know what comes next. The only way to prepare is to ensure proprietary data is not just stored but preserved indefinitely. Tomorrow’s breakthroughs – whether in AI, analytics, or some other yet-unimagined technology – will depend on the depth and quality of the data you have today, and how well you can utilize the storage technologies of your choice to serve your data usage and workflow needs. ... The lesson is clear: don’t get left behind, because your competitors are learning these lessons as well. The enterprises that thrive in this next era of digital innovation will be those that recognize the enduring value of their data. That means keeping it all and planning to keep it forever. By embracing hybrid storage strategies that combine the strengths of tape, cloud, and on-premises systems, organizations can rise to the challenge of exponential growth, protect themselves from evolving threats, and ensure they are ready for whatever comes next. In the age of AI, your competitive advantage won’t just come from your technology stack.

Why women are leading the next chapter of data centers

Working her way up through finance and operations into large-scale digital infrastructure, Xiao’s career reflects a steady ascent across disciplines, including senior roles as president of Chindata Group and CFO at Shanghai Wangsu. These roles sharpened her ability to translate high-level strategy into expansion, particularly in the demanding data center sector. ... Today, she shapes ’s commercial playbook, which includes setting capital priorities, driving cost-efficient delivery models, and embedding resilience and sustainability into every development decision. In mission-critical industries like data centers, repeatability is a challenge. Every market has unique variables – land, power, water, regulatory frameworks, contractor ecosystems, and community engagement. ... For the next wave of talent, building credibility in the data center industry requires more than technical expertise. Engaging in forums, networks, and industry resources not only earns recognition and respect but also broadens knowledge and sharpens perspective. ... Peer networks within hyperscaler and operator communities, Xiao notes, are invaluable for exchanging insights and challenging assumptions. “Industry conferences, cross-company working groups, government-industry task forces, and ecosystem media engagements all matter. And for bench strength, I value partnerships with local technology innovators and digital twin or AI firms that help us run safer, greener facilities,” Xiao explains.