Daily Tech Digest by Kannan Subbiah: business continuity

Showing posts with label business continuity. Show all posts

Daily Tech Digest - April 30, 2026

Quote for the day:

"You've got to get up every morning with determination if you're going to go to bed with satisfaction." --George Lorimer

🎧 Listen to this digest on YouTube Music

▶ Play Audio Digest

Duration: 15 mins • Perfect for listening on the go.

The dreaded IT audit: How to get through it and what to avoid

The article "The dreaded IT audit: how to get through it and what to avoid" from IT Pro encourages organizations to reframe the auditing process as a strategic business asset rather than a burdensome cost center. Successfully navigating an audit requires maintaining a comprehensive, up-to-date inventory of all technology assets—including those used by remote workforces—to ensure security, safety, and insurance compliance. Even startups should establish structured auditing processes, as these evaluations proactively identify vulnerabilities and optimize operational efficiency. To streamline the experience, the article recommends prioritizing high-risk areas, such as software licensing, and utilizing customized spot checks instead of repetitive, standardized reviews that may fail to uncover meaningful insights. Crucially, leaders must adopt an open-minded approach to findings; the goal is to engage in transparent discussions about discovered issues rather than becoming defensive. Key pitfalls to avoid include treating the audit as a one-time administrative hurdle, relying on outdated manual tracking methods, and ignoring the gathered data. Instead, organizations should leverage audit results to inform staff training and drive practical improvements. By viewing the audit as a strategic opportunity for growth, companies can significantly strengthen their cybersecurity posture and ensure long-term sustainability in a digital economy.

Privacy in the AI era is possible, says Proton's CEO, but one thing keeps him up at night

In a wide-ranging interview at the Semafor World Economy Summit, Proton CEO Andy Yen addressed the critical tension between the rapid advancement of artificial intelligence and the fundamental right to digital privacy. Yen voiced significant concerns regarding the current AI trajectory, arguing that the industry's reliance on massive data harvesting inherently threatens individual security. He advocated for a paradigm shift toward "privacy-first AI," where processing occurs locally on user devices or through end-to-end encrypted frameworks to ensure that personal information remains inaccessible to service providers. Unlike the advertising-driven models of Silicon Valley giants, Yen highlighted Proton’s commitment to a subscription-based business model, which avoids the ethical pitfalls of monetizing user data. He also explored the "privacy paradox," observing that while users value their data, they often succumb to the convenience of free platforms. To counter this, Proton is expanding its ecosystem with tools like encrypted email and small language models designed specifically for security. Ultimately, Yen emphasized that the future of the digital economy hinges on stricter regulatory enforcement and the adoption of decentralized technologies that empower users with absolute control over their information, rather than treating them as products to be sold.

Outsourcing contracts weren't built for AI. CIOs are renegotiating now

The rapid advancement of generative artificial intelligence is necessitating a major overhaul of IT outsourcing agreements, as traditional contracts centered on headcount and billable hours prove incompatible with AI-driven efficiency. This InformationWeek article explains that while service providers promise productivity gains of up to 70%, legacy full-time equivalent (FTE) models fail to account for this increased output, leading CIOs to aggressively renegotiate for outcome-based pricing. This shift allows organizations to pay for specific results rather than human time, yet it introduces significant legal complexities. Key concerns include data sovereignty—where proprietary data might inadvertently train a provider's large language model—and intellectual property risks regarding the ownership of AI-generated code. Furthermore, the ability of AI to automate routine tasks is prompting some enterprises to bring previously outsourced functions back in-house, as smaller internal teams can now manage workloads that once required massive offshore cohorts. To navigate these challenges, technical leaders are implementing "gain-sharing" frameworks and rigorous governance standards to manage risks like AI hallucinations and liability. Ultimately, CIOs are assuming a more central role in procurement to ensure that vendor incentives align with genuine innovation and that the financial benefits of automation are captured by the enterprise.

Bad bots make up 40% of internet traffic

The "2026 Thales Bad Bot Report: Bad Bots in the Agentic Age" reveals a transformative shift in internet traffic, where automated activity now accounts for 53% of all web interactions, surpassing human traffic for the second consecutive year. Malicious "bad bots" alone comprise 40% of global traffic, highlighting a growing threat landscape. A critical finding is the 12.5x surge in AI-driven bot attacks, fueled by the rapid adoption of agentic AI which blurs the lines between legitimate and harmful automation. These advanced bots are increasingly targeting APIs, with 27% of attacks now bypassing traditional interfaces to exploit backend logic directly at machine speed. The financial services sector remains the most vulnerable, suffering 24% of all bot attacks and nearly half of all account takeover incidents. Thales experts, including Tim Chang, emphasize that the primary security challenge has evolved from simple bot identification to the complex analysis of behavioral intent. As AI agents emerge as a new traffic category, organizations must transition to proactive, intent-based defenses that can distinguish between helpful AI agents and malicious automation. This machine-driven era necessitates deeper visibility into API traffic and identity systems to maintain trust and security across modern digital infrastructures.

Incentive drift: Why transformation fails even when everything looks green

In the article "Incentive Drift: Why Transformation Fails Even When Everything Looks Green," Mehdi Kadaoui explores the paradoxical failure of IT transformations that appear successful on paper. The central challenge is "incentive drift"—the structural separation of authority from accountability that leads organizations to optimize for project delivery rather than business value. This drift manifests through several destructive patterns: the "ownership vacuum," where strategy and execution are disconnected; the "budgetary firewall," which isolates capital spending from operational costs; and "language capture," where success definitions are subtly redefined to ensure "green" status. Kadaoui argues that "collective amnesia" often follows, as organizations quietly lower their expectations to avoid acknowledging failure. To resolve this, he proposes making drift "structurally expensive" through three key mechanisms. First, a "value prenup" requires operational leaders to explicitly own and sign off on intended outcomes before development begins. Second, a "cost mirror" forces transparency across budget ledgers. Finally, a "semantic anchor" ensures original goals are read aloud in every governance meeting to prevent meaning erosion. By grounding digital transformation in rigid accountability and linguistic clarity, leadership can ensure that technological outputs translate into genuine, durable enterprise value.

How to Be a Great Data Steward: 6 Core Skills to Build

The article "Core Data Stewardship Skills to Build" emphasizes that effective data stewardship requires a unique blend of technical proficiency, business acumen, and interpersonal skills. High-performing stewards act as "purple people," bridging the gap between IT and business by translating complex technical standards into actionable business practices. Key operational activities include identifying and documenting Critical Data Elements (CDEs), aligning them with precise business terms, and performing data profiling to identify quality issues. Beyond basic documentation, stewards must master data classification to ensure regulatory compliance with frameworks like GDPR or HIPAA. Analytical thinking is essential for interpreting patterns and uncovering root causes of data inconsistencies, while strong communication skills enable stewards to foster a collaborative, data-driven culture. Furthermore, literacy in adjacent domains such as metadata management, master data management (MDM), and the use of modern data catalogs is vital. Ultimately, the role is outcome-driven; stewards do not just manage data for its own sake but focus on ensuring data health to drive measurable organizational value. By combining attention to detail with strategic consistency, data stewards serve as the essential operational guardians who transform raw data into a reliable, high-quality strategic asset for their organizations.

Researchers unearth industrial sabotage malware that predated Stuxnet by 5 years

Researchers from SentinelOne recently uncovered a sophisticated malware framework, dubbed "Fast16," that predates the infamous Stuxnet worm by five years. Active as early as 2005, this discovery shifts the timeline of state-sponsored industrial sabotage, proving that nation-states were deploying cyberweapons against physical infrastructure much earlier than previously understood. Unlike typical espionage tools designed for data theft, Fast16 was engineered for strategic sabotage by targeting high-precision floating-point arithmetic operations within engineering modeling software. By corrupting the logic of the Floating Point Unit (FPU), the malware produced subtly altered outputs in complex simulations, potentially leading to catastrophic real-world failures. The researchers identified three specific targeted engineering programs, including one previously associated with Iran’s AMAD nuclear program and another widely used in Chinese structural design. The modular nature of Fast16, which utilizes encrypted Lua bytecode, underscores its advanced design and national importance. This finding highlights a historical precedent for cyberattacks on critical workloads in fields such as advanced physics and nuclear research. Ultimately, Fast16 serves as a significant harbinger for modern industrial sabotage, demonstrating that the transition from strategic espionage to physical disruption in cyberspace was already in full swing two decades ago, long before Stuxnet gained global notoriety.

How AI Is Transforming Business Continuity and Crisis Response

Charlie Burgess’s article, "How AI Is Transforming Business Continuity and Crisis Response," explores the pivotal role of artificial intelligence in navigating the complexities of modern digital and physical risks. As businesses face increasingly non-linear threats, from supply chain disruptions to cyber incidents, the abundance of generated data often leads to information overload. AI addresses this by acting as a sophisticated data analysis tool that parses vast information streams to identify hidden patterns and suppress low-priority noise. This allows crisis teams to focus on critical alerts and early warning signs. Furthermore, AI enhances situational awareness and coordination by correlating disparate system inputs and surfacing standardized playbook responses. During active incidents, technologies like AI-powered cameras provide real-time visibility, aiding in personnel safety and evacuation efforts. Beyond immediate response, AI suggests optimized recovery paths and strategic resource allocation, fostering long-term operational resilience. Ultimately, the integration of AI is not intended to replace human judgment but to empower decision-makers with actionable insights and agility. By bridging the gap between data collection and decisive action, AI transforms business continuity from a reactive necessity into a proactive, evidence-based strategic asset that safeguards both personnel and organizational stability in an unpredictable global landscape.

Europe Gliding Toward Mandatory Online Age Verification

The European Commission is accelerating its push toward mandatory online age verification, driven by the Digital Services Act's requirements to protect minors from harmful content. Central to this initiative is a new age assurance framework and a "technically ready" open-source mobile app designed to allow users to prove they are over a certain age using national identity documents without disclosing their full identity. However, this transition faces intense scrutiny. Security researchers recently identified significant vulnerabilities in the commission's prototype app, labeling it "easily hackable." Furthermore, privacy advocates, such as representatives from Tuta, warn that centralized age verification creates a lucrative "gold mine" for hackers, potentially exacerbating risks like phishing and identity theft. Despite these concerns, European officials like Henna Virkkunen emphasize that the DSA demands concrete action over mere terms of service, particularly following allegations that platforms like Meta have failed to adequately exclude children under thirteen. As several European nations consider raising minimum age requirements for social media, the commission continues to advocate for "robust and non-discriminatory" verification tools that can be integrated into national digital wallets, insisting that ongoing security testing will eventually yield a reliable solution for safeguarding the digital environment for children.

CodeGuardian: A Model Context Protocol Server for AI-Assisted Code Quality Analysis and Security Scanning

"CodeGuardian: A Model Context Protocol Server for AI-Assisted Code Quality Analysis and Security Scanning" introduces a breakthrough tool designed to integrate enterprise-grade security and quality checks directly into AI-powered development environments. Authored by Madhvesh Kumar and Deepika Singh, the article details how CodeGuardian leverages the Model Context Protocol (MCP) to extend coding assistants with eleven specialized analysis tools. This integration eliminates the friction of context-switching by allowing developers to execute security scans, identify hardcoded secrets across multiple layers, and generate compliant Software Bill of Materials (SBOM) using simple natural language prompts. Unlike traditional static analysis tools that merely flag issues, CodeGuardian provides context-aware, "drop-in" code remediations tailored to a project's specific framework and style. A core feature is its cross-layer security reporting, which aggregates findings into a single risk score, exposing systemic vulnerabilities that isolated scanners often miss. By shifting security "left" into the immediate coding workflow, the tool empowers developers to build more resilient software while maintaining high delivery velocity. Ultimately, CodeGuardian represents a pivot toward "agentic" security, where AI assistants act as proactive guardians of code integrity throughout the development lifecycle, effectively bridging the gap between rapid feature delivery and robust organizational compliance.

Daily Tech Digest - February 01, 2026

Quote for the day:

"Successful leadership requires positive self-regard fused with optimism about a desired outcome." -- Warren Bennis

Forget the chief AI officer - why your business needs this 'magician

There's a lot of debate about who should be responsible for ensuring the business makes the most out of generative AI. Some experts suggest the CIO should oversee this crucial role, while others believe the responsibility should lie with a chief data officer. Beyond these existing roles, other experts champion the chief AI officer (CAIO), a newcomer to the C-suite who oversees key considerations, including governance, security, and identification of potential use cases. ... Many people across other business units are confused about the different roles of technology and data teams. When Panayi joined Howden in August last year, he decided to head off that issue at the pass. ... "I think companies are missing a trick if they've not got someone ensuring that people are using things like Copilot and so on. These tools are new enough that we do need people to help with adoption," he said. "And at the moment, I don't think we can assume the narrative is correct that people using AI at home to help them book holidays is the same as how it can help them be more productive at work." ... "It's like he's a magician, showing people who have to deal with thousands of pages of stuff, how to get the answers they need quickly," he said, outlining how the director of productivity highlights the benefits of gen AI to the firm's brokers. "These people are not at the computer all day. They are out in the market, talking and making decisions."

Just Relying on Data Doesn’t Make You Data-driven — Advantage Solutions CDO

O’Hazo then draws a line between measurement and transformation. Success in data programs, she explains, is not only about performance indicators; it is also about whether the organization is starting to internalize the mindset behind them. “Success for me in this data and AI space is all about, ‘Are my stakeholders starting to actually speak some of my language?’” When stakeholders begin to “believe” and “trust,” she says, the shift becomes visible not only in outcomes but also in demand. The moment data starts becoming embedded in the business is the moment the need for the CDO office outgrows its capacity. ... She ties true data-driven maturity to operational efficiency and responsiveness: Accurate, timely information; Faster decision-making cycles; Quicker reactions to market conditions; and Lower effort to extract value from data. In her view, strong data foundations should reduce friction instead of creating new burdens. Speed, however, is not just about moving fast, it’s about winning the race to insight. “Once you have that foundation built, to get to the answer quickly, you have to be the first one there. If you’re not the first one there, you’ve lost.” ... As the conversation returns to the governance part of transformation, O’Hazo underscores that governance becomes sustainable only when people are comfortable using data and confident enough to surface risks early. For her, the true differentiator is not policy; it is talent and environment.

The Three Mindsets That Shape Your Life, Work And Fulfillment

Mission Mindset is goal-oriented but not outcome-obsessed. It begins with clarity about a specific, measurable and time-bound goal. Decades of research on goal-setting, including the work of Stanford psychologist Carol Dweck, shows that how we interpret challenges influences how we engage with them—and that mindset creates very different psychological worlds for people facing the same obstacles. Here's where most people go wrong. ... If mission provides direction, identity provides stability. Identity Mindset is rooted in a healthy, coherent self-image that does not rise and fall with every outcome. It answers a deeper question: Who am I when the going gets tough or disappointment abounds? Many people identify with their performance. Success feels like validation, and failure feels personal. That volatility makes progress emotionally expensive because every result threatens their self-worth. In contrast, PsychCentral broadly defines resilience as adapting well to adversity; individuals who are stable in how they see themselves are better able to regulate emotions, process setbacks and continue forward without losing themselves in the struggle. ... Agency Mindset is where actual momentum lives. It is the lived belief that you are the author of your life, not a character reacting to circumstances. Agency does not deny reality or minimize hardship. It refuses to play the victim, make excuses or place blame.

Why We Can’t Let AI Take the Wheel of Cyber Defense

When we talk about fully autonomous systems, we are talking about a loop: the AI takes in data, makes a decision, generates an output, and then immediately consumes that output to make the next decision. The entire chain relies heavily on the quality and integrity of that initial data. The problem is that very few organizations can guarantee their data is perfect from start to finish. Supply chains are messy and chaotic. We lose track of where data originated. Models drift away from accuracy over time. If you take human oversight out of that loop, you aren’t building a better system; you are creating a single point of systemic failure and disguising it as sophistication. ... There is no magical self-healing feature that puts everything back together elegantly. When a breach happens, it is people who rebuild. Engineers are the ones trying to deal with the damage and restoring services. Incident commanders are the ones making the tough calls based on imperfect information. AI can and absolutely should support those teams—it’s great at surfacing weak signals, prioritizing the flood of alerts, or suggesting possible actions. But the idea that AI will independently put the pieces back together after a major attack is a fantasy. ... So, how do we actually do this? First, make “human-in-the-loop” the default setting for any AI that can act on your systems or data. Automated containment can save your skin in the first few seconds of an attack, but every autonomous process needs guardrails.

Connecting the dots on the ‘attachment economy’

In the attention economy paradigm, human attention is a currency with monetary value that people “spend.” The more a company like Meta can get people to “spend” their attention on Instagram or Facebook, the more successful that company will be. ... Tristan Harris at the Center for Humane Technology coined the phrase “attachment economy,” which he criticizes as the “next evolution” of the extractive-tech model; that’s where companies use advanced technologies to commodify the human capacity to form attached bonds with other people and pets. In August, the idea began to gain traction in business and academic circles with a London School of Economics and Political Science blog post entitled, “Humans emotionally dependent on AI? Welcome to the attachment economy” by Dr. Aurélie Jean and Dr. Mark Esposito. ... The rise of attachment-forming tech is similar to the rise in subscriptions. While posting an article or YouTube video may get attention, getting people to subscribe to a channel or newsletter is better. It’s “sticky,” assuring not only attention now, but attention in the future as well. Likewise, the attachment economy is the “sticky” version of the attention economy. Unlike content subscription models, the attachment idea causes real harm. It threatens genuine human connection by providing an easier alternative, fostering addictive emotional dependencies on AI, and exploiting the vulnerabilities of people with mental health issues.

From monitoring blind spots to autonomous action: Rethinking observability in an Agentic AI world

AI-supported observability tools help teams not only understand system performance but also uncover the reasons behind issues. By linking signals across interconnected parts, these tools provide actionable insights and usually resolve problems automatically, reducing Mean Time to Resolution (MTTR) and cutting the risk of outages. ... AI-driven observability can trace service dependencies from start to finish, connect signals across third-party platforms, and spot early signs of unusual behavior. By examining traffic patterns, error rates, and configuration changes in real-time, observability helps teams identify emerging issues sooner, understand the potential impact quickly, and respond before full disruptions occur. While observability cannot prevent every third-party outage, it can greatly reduce uncertainty and response time, allowing solutions to be introduced sooner and helping rebuild customer trust. ... When AI-driven applications fail, teams often lack clear visibility into what went wrong, putting significant AI investments at risk. Slow or incorrect responses turn troubleshooting into guesswork, as teams struggle to understand agent interactions, find delays, or identify the responsible agent or tool. This lack of clarity slows down root-cause analysis, extends downtime, diverts engineering efforts from innovation, and can ultimately lead to lost revenue and customer trust. Observability addresses this challenge by providing complete visibility into AI application behavior.

Architecture Testing in the Age of Agentic AI: Why It Matters Now More Than Ever

Historically, architecture testing functioned as a safeguard against emergent complexity in distributed systems. Whenever an organization deployed a network of interdependent services, message buses, caches, and APIs, the potential for unforeseen interactions grew. Even before AI entered the picture, architects confronted the reality that large systems behave in ways no single engineer fully anticipates. ... Agentic systems challenge traditional testing practices in several fundamental ways. First, these systems are inherently non‑deterministic. A test that succeeds at 9:00 might fail just minutes later simply because the agent followed a different reasoning path. This creates a widening ‘verification gap,’ where deterministic enterprise systems and probabilistic, adaptive agents operate according to fundamentally different reliability expectations. Second, these agents operate within environments that are constantly shifting—APIs, user interfaces, databases, and document stores all evolve independently of the agent itself. Because agents are expected to detect these changes and adapt their behavior, long‑held architectural assumptions about stability and interface contracts become far more fragile. ... Third, agentic AI introduces a new level of emergent behavior. Operating through multi‑step reasoning loops and tool interactions, agents can develop strategies or intermediate actions that were never explicitly designed or anticipated. While emergence has always existed in complex distributed systems, with agents it becomes the rule rather than the exception.

Data Privacy Day warns AI, cloud outpacing governance

Kornfeld commented, "Data Privacy Day is a reminder that protecting sensitive information requires consistent discipline, not just policies. This discipline starts with infrastructure choices. As organizations continue to evaluate cloud-first strategies, many are also reassessing where their most critical data should live. For workloads that demand predictable performance, strong governance and clear ownership, on-site infrastructure continues to play an essential role in a sound privacy strategy." ... Russel said, "Data Privacy Day often prompts the usual reminders: update policies, refresh consent language, and train staff on security and resilience strategies. These are important steps, but increasingly they are simply the baseline. In 2026, the board-level question leaders should also be asking is: can we demonstrate control of personal data and sustain trust through disruption, whether it stems from a compromise, misconfiguration, insider error, or a supplier incident?" ... Russell commented that identity controls and response processes sit at the core of this shift as attackers continue to exploit account compromise to reach sensitive information in cloud environments. "Identity is a privacy fault line. In cloud environments, compromised identities are often the fastest route to sensitive data. Resilience means detecting abnormal access early, limiting blast radius, and recovering confidently when identity controls are bypassed."

Security teams are carrying more tools with less confidence

Security leaders express mixed views about the performance of their SIEM platforms. Most say their SIEM contributes to faster detection and response, yet only half describe that contribution as strong. Confidence in long-term scalability follows a similar pattern, with many teams expressing partial confidence as data volumes and monitoring demands continue to grow. Satisfaction with log management and security analytics tools mirrors this split. Teams that express higher satisfaction also report stronger alignment between their tooling and application environments. ... Threat detection represents the most common use of AI and machine learning within security operations. Fewer teams apply AI to incident triage, automated response, or anomaly detection. Despite this limited scope, security leaders consistently associate AI with reduced alert fatigue and improved signal quality. Many also prioritize AI capabilities when evaluating SIEM platforms, alongside real-time analytics. ... Security leaders frequently describe operational cost as a top pain point. Multiple point solutions contribute to overlapping capabilities, siloed data, and increased alert noise. Data that remains isolated across tools complicates threat analysis and slows investigations, particularly when teams attempt to reconstruct activity across cloud, identity, and application layers.

Integrating Financial Counterparty Risk into Your Business Continuity Plan

Vendor defaults and liquidity issues can disrupt operations in ways that ripple across departments and delay recovery. If a key financial partner fails, access to working capital, credit or critical services can disappear overnight. For example, if your leasing company collapses, essential equipment could be repossessed, or service agreements could lapse. ... Financial counterparties show up across many areas of your business. You depend on banks for credit facilities and insurers for risk transfer. Payment processors, brokers and pension custodians handle everything from daily cash flow to long-term employee benefits. Clearinghouses are also vital in structured markets, such as stocks and futures. They sit between buyers and sellers to ensure both sides honor their contracts, which reduces your exposure to failure during high-volume or high-volatility periods. ... Not all financial counterparties pose the same level of risk, but the warning signs often follow familiar patterns. Monitoring a few high-impact indicators can help you identify problems and take action before disruptions escalate. ... Industry standards are raising the bar on how you manage financial counterparties. Frameworks like ISO 22301 stress the need to include financial dependencies in your continuity and risk programs. These standards define how regulators and stakeholders expect you to identify, assess and respond to financial exposure. If you treat financial partners like background support, you risk missing vulnerabilities that could surface under pressure.

Daily Tech Digest - January 15, 2026

Quote for the day:

"You have to have your heart in the business and the business in your heart." -- An Wang

AI agents can talk — orchestration is what makes them work together

“Agent-to-agent communications is emerging as a really big deal,” ’s chief innovation officer told . “Because if you don't orchestrate it, you get misunderstandings, like people speaking foreign languages to each other. Those misunderstandings reduce the quality of actions and raise the specter of hallucinations, which could be security incidents or data leakage.” ... In another critical evolution in the agentic era, human evaluators will become designers, moving from human-in-the-loop to human-on-the-loop, according to Sanders. That is: They will begin designing agents to automate workflows. Agent builder platforms continue to innovate their , Sanders said, meaning nearly anyone can now stand up an agent using . “This will democratize , and the super skill will be the ability to express a goal, provide context and envision pitfalls, very similar to a good people manager today.” ... Organizations should begin “expeditious programs” to infuse agents across workflows, especially with highly repetitive work that poses bottlenecks. Likely at first, there will be a strong human-in-the-loop element to ensure quality and promote change management. “Serving as an evaluator will strengthen the understanding of how these systems work,” Sanders said, “and eventually enable all of us to operate upstream in agentic workflows instead of downstream.”

Integrating AI-Enhanced Microservices in SAFe 5.0 Framework

can be a game-changer for within SAFe. By optimizing decision analytics and enhancing value stream performance, AI simplifies, rather than complicates. I know what you’re thinking: AI tools can add complexity. One client put this to the test, and we found AI helped reduce the noise. It sliced through the data smog to identify hidden and automate mundane tasks like financial forecasting and risk management. ... Integrating decentralized AI models into SAFe’s can significantly enhance their autonomy. During a high-stakes project, we shifted from a centralized to a decentralized model, which allowed ARTs to self-optimize and adapt to shifting priorities seamlessly. It was like giving ARTs a brain of their own. Decentralized AI models reduce the bottlenecks you'd typically encounter in centralized systems. Think of the ARTs as small startups within the larger enterprise ecosystem, each capable of making swift, informed decisions. ... This isn’t just a tech enthusiast's dream—it's an emerging reality. The maturity of AI technologies spells a future where enterprises aren’t just keeping up; they’re setting the pace. So, if there’s a single, actionable insight to glean from my journey, it’s this: enterprises need to actively pursue cross-industry collaborations, invest in AI-powered microservices, and hone their Agile professionals’ skill sets.

Incorporating Geopolitical Risk Into Your IT Strategy

IT organizations know how to plan for unexpected outages, but even the most rigorously designed strategy is vulnerable to the shifting winds of geopolitics. and technology leaders need to know how their organizations will respond to geopolitical disruptions, and scenario planning needs to be a priority. ... "The IT department can treat geopolitical disruption as an expected operational variable rather than an unforeseen catastrophe. Good and tested enterprise risk management frameworks, investment in government affairs partnerships and ongoing board engagement should start to manage and prepare for this," Dixon said. CIOs need to do around the risks facing their enterprise, and evaluate how IT is teaming with business units, security teams and the CISO on a cohesive tech strategy that builds security, including artificial intelligence security, in from the ground up, said Sean Joyce ... "You're as strong as your weakest link," Joyce said. "As geopolitical risk becomes more prominent, you're going to see tools like cyber being leveraged by countries, particularly those that don't have stronger military or other capabilities. For some, it may be the only tool they can leverage." Physical infrastructure, geography and power supplies are also now areas of risk CIOs need to consider, and infrastructure strategy must align with sustainability, energy realities and geopolitical stability.

Six Architecture Challenges for Startups

The risk is not that the first version is imperfect; that is inevitable. The risk is that the team keeps layering new functionality on top of an accidental architecture. At some point, the cost of change becomes so high that every small modification feels dangerous. The architectural challenge is to intentionally decide where to accept debt and where to invest in structure. Startups need a minimal set of principles – for example, clear domain boundaries, basic , and a simple deployment model – that allow speed without locking the product into a dead end. ... If the product team is still validating pricing models, redefining the customer journey, or experimenting with different verticals, any rigid decomposition can turn into friction. Yet avoiding boundaries altogether leads to a “big ball of mud” that is equally hard to evolve. A practical approach is to use provisional boundaries based on current value streams – onboarding, transaction processing, analytics, etc. – and treat them as hypotheses. The challenge is not to find the perfect structure from day one, but to keep those boundaries explicit and adjustable as the evolves. ... Startups must make conscious decisions about where they are comfortable being tightly coupled to a provider and where they need portability. That requires viewing cloud services through a business lens: What is strategic IP, what is replaceable, and what is pure commodity? Aligning these categories with architectural choices is a non-trivial design challenge, not just a procurement decision.

Platform-as-a-Product: Declarative Infrastructure for Developer Velocity

Without centralized guardrails, teams often compensate by over-allocating resources "to be safe", leading to inconsistent environments and unnecessary cloud spend that is only discovered after deployment. ... What is missing is a developer-friendly abstraction that brings these related concerns together. Developers need a way to express intent (not only what infrastructure is required, but also how the application should be built, deployed, configured across environments, secured, and sized) without having to implement the mechanics of each underlying system. From a platform engineering perspective, this abstraction represents the core of an and can be implemented as a lightweight . ... The platform comprises several interconnected components. coordinate everything, pulling code from repositories, building and unit testing applications (with tests written by developers), checking security, creating cloud infrastructure with , and deploying to clusters with . The configuration controls all of this, telling each component what to do. The architecture clearly separates concerns: the CI pipeline handles code building, testing, and vulnerability scanning. CD pipeline handles deployment: creating cloud resources, updating Kubernetes, and configuring environments.

(Re)introducing Adaptive Business Continuity

is designed to provide a framework that delivers better outcomes when organizations deal with losses. The result may be a reduction in documentation (something I greatly favor) but that is not a stated goal. ... My experience over the years has led me to conclude that trying to define priorities for the resumption of services is wasted effort. Many activities can take place in parallel, and priorities will change when disasters occur. A perfect example is the governmental lockdowns and health authority mandates that followed the emergence of . The result is that demand for products and services changed drastically, upending previous priorities. Priorities may be defined following adaptive principles, but it is not at all a stated component of the Adaptive framework. ... For a number of reasons, I would like to see the word “plan” used a lot less within our profession. Seeing the word “strategy” in its place would be a step in the right direction. Strategy improvement is not, however, a key outcome of Adaptive BC efforts. There is some benefit to having clearly defined recovery strategies, but strategies only provide benefit to competent and empowered teams armed with the resources they need to carry out the mission. For this reason, I always emphasize the importance of focusing efforts on capabilities and consider plans and strategies as little more than supporting tools for any business continuity program. The improvement of strategies and/or plans is simply not an expected outcome of Adaptive BC work.

Exactly What To Automate With AI In 2026 For Faster Business Growth

Most founders automate the wrong things. They start with the flashy stuff, the complicated tools and fancy dashboards, while ignoring the repetitive tasks quietly draining their hours. But you need faster, cleaner growth by removing friction from the activities that actually grow your business. ... You shouldn't embark on a day's worth of admin tasks every time a new client says yes. It will only slow you down. Make it easy for them to pay, get a receipt, complete an onboarding form, and submit the required information. On your end, have the folders, follow-up emails, and team briefings set up without you lifting a finger. Question everything you currently do manually. There is no reason it couldn't be an AI agent handling the sequence. All the tools you pay for already have integrations with each other; You're just not using them. The goal is that you could sign client after client because onboarding takes minutes, not hours. ... AI-generated content is awful when you use it wrong. But that doesn't mean you shouldn't involve AI in your content production process. Content still matters in marketing, whether long-form articles, videos, or social media visuals. You need to be part of the conversation, but only with relevant, authentic material. You cannot outproduce everyone manually, so use automations and retain your human genius for the finishing touches. ... The more your life admin runs on autopilot, the more you free up time and energy for your business.

What is AI fuzzing? And what tools, threats and challenges generative AI brings

The way traditional fuzzing works is you generate a lot of different inputs to an application in an attempt to crash it. Since every application accepts inputs in different ways, that requires a lot of manual setups. Security testers would then run these tests against their companies’ software and systems to see where they might fail. ... Today, generative artificial intelligence has the potential to automate this previously manual process, coming up with more intelligent tests, and allowing more companies to do more testing of their systems. ... But there’s a third angle involved here. What if, instead of trying to break traditional software, the target was an AI-powered system? This creates unique challenges because are not predictable and can respond differently to the same input at different times. ... AI fuzzing can also help speed up the discovery of vulnerabilities, Roy says. “Traditionally, testing was always a function of how many days and weeks you had to test the system, and how many testers you could throw at the testing,” he says. “With AI, we can expand the scale of the testing.” ... Another use of AI in fuzzing is that it takes more than a set of test cases to fully test an application — you also need a mechanism, a harness, to feed the test cases into the app, and in all the nooks and crannies of the application. “If the fuzzing harness does not have good coverage, then you may not uncover vulnerabilities through your fuzzing,” says , staff innovations architect for emerging technologies at .

CISOs flag gaps in third-party risk management

CISOs rank among their highest-impact threats. Vendor relationships touch nearly every core business function, from cloud infrastructure and software development to data processing and AI services. Each added dependency expands the attack surface and increases the number of organizations involved in protecting sensitive systems and data. ... Only a small portion of organizations report visibility across third-, fourth-, and nth-party relationships. Most operate with partial insight limited to direct vendors or a narrow segment of the extended supply chain. CISOs say limited visibility complicates incident response, risk prioritization, and compliance planning. When a breach emerges several layers removed from a known vendor, security teams may struggle to understand exposure, timelines, and downstream impact. ... CISOs report rising regulatory scrutiny tied to third-party cyber risk. Regulatory frameworks place greater expectations on organizations to demonstrate oversight across vendor ecosystems, including indirect relationships. Only a minority of organizations feel ready to meet upcoming requirements without major changes. Most report progress underway, with further work needed to align processes, tooling, and internal coordination. Third-party risk management involves legal, procurement, compliance, and executive leadership alongside security teams. ... At the same time, AI adoption accelerates within vendor risk management itself.

Anti-fragility – what is it and why should it be the goal for your organisation?

That ability to thrive in the face of disruption must become the basis for improved resilience. Modern organisations shouldn’t strive for survival, but for continual improvement. In the , that is crucial. Threat actors are constantly changing tack, targeting new , and executing increasingly complicated . Resilience must therefore move in tandem as an ongoing process of learning and adapting. That is the crux of . It defines systems that thrive and improve from stress, volatility, disorder and shocks, rather than just resisting them. If a security model is only designed to recover, it remains just as vulnerable as before. But an anti-fragile approach actively benefits from each attack, identifying weaknesses, addressing them, and adapting as needed. ... Increasingly, organisations are recognising the value in anti-fragility as a strategy and more will adopt it next year. However, getting there means going beyond regulatory compliance. Compliance lays the foundations from which successful cybersecurity can be built, yet many currently see it as the finished structure. There are several problems with that. Security legislation frequently lags behind the threat landscape, and so the gap between a new threat emerging and a new law coming in to address it can stretch over the course of years. Organisations must therefore understand that compliance doesn’t equal protection.

Daily Tech Digest - November 05, 2025

Quote for the day:

"Effective leaders know that resources are never the problem; it's always a matter of resourfulness." -- Tony Robbins

AI web browsers are cool, helpful, and utterly untrustworthy

AI browsers can and do interact with everything on a web page: summarizing content, reading emails, composing posts, looking at images, etc., etc. Every element on the page, whether you can see it or not, can hide an attack. A hacker can embed clipboard manipulations or other hacks that traditional browsers would never, not ever, execute automatically. ... AI browser agents can be tricked by hidden instructions embedded in websites via invisible text, images, scripts, or, believe it or not, bad grammar. Your eyes might glaze over at a long run-on sentence, but your AI web browser will read it all, including instructions for an attack hidden in plain sight within it. Such malicious commands are read and executed by the AI. This can lead to exposure of sensitive data, such as emails, authentication tokens, and login details, or triggering unwanted actions, including sending emails, posting to social media, or giving your computer a bad case of malware. ... Privacy is pretty much lost these days anyway, but with AI web browsers, we’ll have all the privacy of a goldfish in a bowl. Since AI browsers monitor our every last move, they process much more granular personal information than conventional browsers. Worrying about cookies and privacy is so 1990s. AI browsers track everything. This is then used to create highly detailed behavioral profiles. What? You didn’t know that AI browsers have built-in memory functions that retain your interactions, browser history, and content from other apps? How do you think they do what they do? Intuition? ESP?

AI can flag the risk, but only humans can close the loop

Companies embedding AI into vendor risk processes need governance structures that ensure transparency, accountability, and compliance. This includes maintaining an approved sources catalogue and requiring either the system or an analyst to validate findings and document the rationale behind them. Data minimization should be built into the design by defining what information is always in scope, such as sanctions or embargo lists, and what is contextually relevant, while excluding protected or sensitive attributes under GDPR and configuring AI to ignore them. Risk assessments should be tiered, calibrating the depth of checks to supplier criticality and geography to avoid unnecessary data collection for low-risk relationships while expanding scope for high-risk scenarios. Human accountability remains essential, with a named individual owning due diligence decisions while AI provides recommendations without replacing human judgment ... Regulators are likely to allow AI use if firms establish strong controls and demonstrate effective oversight, as required by frameworks like the EU AI Act. Responsibility remains with individuals or organizations; liability does not transfer to AI itself. While regulators may struggle to specify detailed technical rules, one clear shift is that “the data volume was too large to review” will no longer be an acceptable defense.

10 top devops practices no one is talking about

“A key, yet overlooked, devops practice is building true shared ownership, which means more than just putting teams in the same chat room,” says Chris Hendrich, associate CTO of AppMod at SADA. “It requires making production reliability and performance a primary success indicator for development, not solely an operational concern. This shared accountability is what builds the organizational competency of creating better, more resilient products.” ... “Baking an integrated code quality and code security approach into your devops workflow isn’t just good practice, it’s essential and a game-changer,” says Donald Fischer, VP at Sonar. “Tackling security alongside quality from day one isn’t merely about early bug detection; it’s about building fundamentally stronger, more trustworthy, and resilient software that is secure by design.” ... “Open source is a no-brainer for developers, but as the ecosystem grows, so do the risks of malware, unsafe AI models, license issues, outdated packages, poor performance, and missing features,” says Mitchell Johnson, CPDO of Sonatype. “Modern devops teams need visibility into what’s getting pulled in, not just to stay secure and compliant, but to make sure they’re building with high-quality components.” ... “Version-controlling database schemas and configurations across development, QA, and production is a quietly powerful devops practice,” says McMillan.

Cloud Identity Exposure Is 'a Critical Point of Failure'

Attackers keep targeting cloud-based identities to help them bypass endpoint and network defenses, says an August report from cybersecurity firm CrowdStrike. That report counts a 136% increase in cloud intrusions over the preceding 12 months, plus a 40% year-on-year increase in cloud intrusions tied to threat actors likely working for the Chinese government. "The cloud is a priority target for both criminals and nation-state threat actors," said Adam Meyers, head of counter adversary operations at CrowdStrike ... One challenge is that enough cloud identities justify elevated permissions, putting organizations at elevated risk when their credentials are exposed. Take security operations centers and incident response teams. In general, while "the principle of least privilege and minimal manual access" is a best practice, first responders often need immediate and "necessary access," says an August report from Darktrace. "Security teams need access to logs, snapshots and configuration data to understand how an attack unfolded, but giving blanket access opens the door to insider threats, misconfigurations and lateral movement." Rather than always allowing such access, experts recommend using tools that only provide it when needed, for example, through Amazon Web Services' Security Token Service. "Leveraging temporary credentials, such as AWS STS tokens, allows for just-in-time access during an investigation" that can be automatically revoked after, which "reduces the window of opportunity for potential attackers to exploit elevated permissions," Darktrace said.

How Software Development Teams Can Securely and Ethically Deploy AI Tools

Clearly, there is a danger that teams will trust AI too much, as these tools lack a command of the often nuanced context to recognize complex vulnerabilities. They may not fully grasp an application’s authentication or authorization framework, potentially leading to the omission of critical checks. If developers reach a state of complacency in their vigilance, the potential for such risks will only increase. ... Beyond security, team leaders and members must focus more on ethical and even legal considerations: Nearly one-half of software engineers are facing legal, compliance and ethical challenges in deploying AI, according the The AI Impact Report 2025 from LeadDev. The ethical/legal scenarios can take on a highly perplexing nature: A human engineer can read, learn from and write original code from an open-source library. But if an LLM does the same thing, it can be accused of engaging in derivative practices. What’s more, the current legal picture is a murky work in progress. Given the still-evolving judicial conclusions and guidelines, those using third-party AI tools need to ensure they are properly indemnified from potential copyright infringement liability, according to Ropes & Gray, a global law firm that advises clients on intellectual property and data matters. “Risk allocation in contracts concerning or contemplating AI models should be approached very carefully,” according to the firm.

How AI is Revolutionising RegTech and Compliance

Traditional approaches are failing, overwhelmed by increasing regulatory complexity and cross-border requirements. Enter RegTech: a technological revolution transforming how institutions manage regulatory obligations. Advanced artificial intelligence systems now predict compliance breaches weeks before they occur, while blockchain platforms create tamper-proof audit trails that streamline regulatory examinations. ... Natural language processing interprets complex regulatory documents automatically, updating compliance procedures within minutes of regulatory changes. Smart contracts execute compliance actions without human intervention, ensuring consistent adherence to evolving requirements. Leading institutions are achieving remarkable results. Barclays reduced regulatory document processing time from days to minutes using AI-powered analysis. JPMorgan's blockchain settlement system maintains compliance across multiple jurisdictions simultaneously. ... Regulatory-as-a-Service models are democratising access to sophisticated compliance capabilities. Smaller institutions can now access enterprise-grade RegTech through subscription services, reducing compliance costs by up to 50% whilst improving regulatory coverage. Challenges remain significant. Data privacy concerns intensify as compliance systems process vast quantities of sensitive information. Regulatory fragmentation across jurisdictions complicates platform development.

CEOs Go All-In on AI, But Talent Isn't Ready

Despite the enthusiasm for AI, workforce readiness is still a critical concern. Approximately 74% of Indian CEOs see AI talent readiness as a determinant of their company's future success, yet 34% admit to a widening skills gap. This talent gap is multifaceted; it's not only technical proficiency that's in short supply, but also expertise in blending data science with ethics, regulatory understanding and business acumen. About 26% struggle to find candidates who balance technical skill with collaboration capabilities. ... Regulatory uncertainty still weighs heavily on CEOs' minds, with nearly half of Indian CEOs awaiting clearer regulatory guidance before pushing bold innovation initiatives, compared to only 39% globally. This cautious stance underlines a pragmatic approach to integrating AI amid evolving governance landscapes. About 76% of Indian CEOs worry that slow AI regulation progress could hinder organizational success. Ethical concerns also loom large: 62% of Indian CEOs cite them as significant barriers, slightly higher than the 59% global average, underscoring the importance of embedding trust and governance frameworks alongside technological investments. "This is why culture and leadership are very important. The board of directors must have a degree of AI literacy. There must be psychological safety in the organization. Employees must feel safe and if there's clear governance, it means there is a proactive suggestion to use sanctioned AI that meets security requirements," John Barker

Powering financial services innovation: The critical role of colocation

As AI continues to evolve, its impact on financial services is becoming both broader and deeper – moving beyond high-level innovation into the operational core of the enterprise. Today’s financial institutions face a dual mandate: to accelerate AI adoption in pursuit of competitive advantage, and to do so within the constraints of an increasingly complex digital and regulatory environment. From risk modelling and fraud prevention to real-time analytics and customer personalization, AI is being embedded into mission-critical functions. Realising its full potential, however, isn't solely a matter of algorithms – it hinges on having a data-first strategy, with the right infrastructure and governance in place. ... With exponential data growth presenting challenges, customers gain access to a secure, compliant, resilient, and performant foundation. This foundation enables the implementation of new technologies and seamless orchestration of data flows. Our goal is to simplify data management complexity and serve as the single, trusted, global data center partner for our customers. As organizations optimize their AI strategies, many are exploring cloud repatriation – the process of moving certain workloads from the cloud back to on-premises or colocation environments. This strategic move can be crucial for AI success, as it allows for better control over sensitive data, reduced latency, and improved performance for demanding AI workloads.

Measuring, Reporting, and Improving: Making Resilience Tangible and Accountable

A continuity plan sitting on a shelf provides little assurance of resilience. What matters is whether organizations can demonstrate their strategies work, they are tested, and corrective actions are tracked. Measurement transforms resilience from an abstract concept into quantifiable performance. ... Metrics ensure resilience is not left to chance or anecdote. They provide boards and regulators with evidence of progress, reinforcing accountability at the executive and governance levels. A resilience strategy that cannot be measured cannot be trusted. ... The first step in strengthening measurement is to define resilience key performance indicators (KPIs) and key risk indicators (KRIs). These metrics should evaluate outcomes rather than simply tracking activities, ensuring performance reflects actual readiness. ... Measurement alone is not enough without transparency. Organizations must establish reporting practices that make resilience performance visible to boards, regulators, and, when appropriate, customers. Sharing outcomes openly not only demonstrates accountability but also builds trust and credibility. ... One challenge organizations often encounter when measuring resilience is metric overload. In the effort to capture every detail, leaders may track too many indicators, creating complexity that dilutes focus and makes it difficult to interpret results.

Bridging the Gap: Why DevOps Teams Are Quietly Becoming the Front Line of Security

For experienced DevOps practitioners, the idea of shifting security left isn't new. Static analysis in CI/CD pipelines, dependency scanning, and Infrastructure as Code (IaC) validation have become the norm. What's changed more recently is the pressure to respond to security events operationally, in addition to preventing them during builds. DevOps teams are adjusting in very real ways. Many are building security context into their logging practices, ensuring that logs are structured for debugging, and also for investigation and audit. Others are automating triage for security alerts using the same mindset they've applied to performance monitoring and deployment pipelines. Perhaps most importantly, DevOps teams are often the first to respond when something unusual shows up in system logs or access patterns. ... Security can be a shared responsibility across teams as long as boundaries and expectations are set. DevOps teams are defining their role in security more clearly by, for example, determining what gets logged, what counts as an anomaly, and who owns the investigation. They're also setting expectations around incident escalation, CVE response timeframes, and compliance requirements. When these lines are clear, security becomes an integrated part of the workflow instead of an extra burden. ... For many DevOps teams, security is part of the daily reality. It comes as a series of small, increasingly frequent interruptions.

Daily Tech Digest - March 31, 2025

Quote for the day:

"To succeed in business it is necessary to make others see things as you see them." -- Aristotle Onassis

World Backup Day: Time to take action on data protection

“The best protection that businesses can give their backups is to keep at least two copies, one offline and the other offsite”, continues Fine. “By keeping one offline, an airgap is created between the backup and the rest of the IT environment. Should a business be the victim of a cyberattack, the threat physically cannot spread into the backup as there’s no connection to enable this daisy-chain effect. By keeping another copy offsite, businesses can prevent the backup suffering due to the same disaster (such as flooding or wildfires) as the main office.” ... “As such, traditional backup best practices remain important. Measures like encryption (in transit and at rest), strong access controls, immutable or write-once storage, and air-gapped or physically separated backups help defend against increasingly sophisticated threats. To ensure true resilience, backups must be tested regularly. Testing confirms that the data is recoverable, helps teams understand the recovery process, and verifies recovery speeds, whilst supporting good governance and risk management.” ... “With the move towards a future of AI-driven technologies, the amount of data we generate and use is set to increase exponentially. With data often containing valuable information, any loss or impact could have devastating consequences.”

5 Common Pitfalls in IT Disaster Recovery (and How to Avoid Them)

One of the most common missteps in IT disaster recovery is viewing it as a “check-the-box” exercise — something to complete once and file away. But disaster recovery isn’t static. As infrastructure evolves, business processes shift and new threats emerge, a plan that was solid two years ago may now be dangerously outdated. An untested, unrefreshed IT/DR plan can give a false sense of security, only to fail when it’s needed most. Instead, treat IT/DR as a living process. Regularly review and update it with changes to your technology stack, business priorities, and risk landscape. ... A disaster recovery plan that lives only on paper is likely to fail. Many organizations either skip testing altogether or run through it under ideal, low-pressure conditions (far from the chaos of a real crisis). When a true disaster hits, the stress, urgency, and complexity can quickly overwhelm teams that haven’t practiced their roles. That’s why regular, scenario-based testing is essential. ... Even the most robust IT disaster recovery plan can fail if roles are unclear and communication breaks down. Without well-defined responsibilities and structured escalation paths, response efforts become disorganized and slow — often when speed matters most.

How CISOs can balance business continuity with other responsibilities

The challenge for CISOs is providing security while ensuring the business recovers quickly without reinfecting systems or making rushed decisions that could lead to repeated incidents. The new reality of business continuity is dealing with cyber-led disruptions. Organizations have taken note, with 46% of organizations nominating cybersecurity incidents as the top business continuity priority ... While CISOs may find that their remit is expanding to cover business continuity, a lack of clear delineation of roles and responsibilities can spell trouble. To effectively handle business continuity, cybersecurity leaders need a framework to collaborate with IT leadership. Responding to events requires a delicate balance between thoroughness of investigation and speed of recovery that traditional business continuity plan approaches may not fit. On paper, the CISO owns the protection of confidentiality, integrity, and availability, but availability was outsourced a long time ago to either the CIO or facilities, according to Blake. “BCDR is typically owned by the CIO or facilities, but in a cyber incident, the CISO will be holding the toilet chain for the attack, while all the plumbing is provided by the CIO,” he says

Two things you need in place to successfully adopt AI

A well-defined policy is essential for companies to deploy and leverage this technology securely. This technology will continue to move fast and innovate giving automation and machines more power in organizational decision-making, and the first line of defense for companies is a clear, accessible AI policy that the whole company is aware of and subscribes to. Enforcing a security policy also means defining what risk ratings are acceptable for an organization, and the ability to reprioritize the risk ratings as the environment changes. There are always going to be errors and false positives. Different organizations have different risk tolerances or different interpretations depending on their operations and data sensitivity. ... Developers need to have a secure code mindset that extends beyond basic coding knowledge. Code written by developers needs to be clear, elegant, and secure. If it is not, it leaves that written code open for attack. Secure coding training driven by industry is, therefore, a must and must be built into an organization’s DNA, especially during a time when the already prevalent AppSec dilemma is being intensified by the current tech layoffs.

3 things haven’t changed in software engineering

Strategic thinking has long been part of a software engineer’s job, to go beyond coding to building. Working in service of a larger purpose helps engineers develop more impactful solutions than simply coding to a set of specifications. With the rise in AI-assisted coding—and, thus, the ability to code and build much faster—the “why” remains at the forefront. We drive business impact by delivering measurable customer benefits. And you have to understand a problem before you can solve it with code. ... The best engineers are inherently curious, with an eye for detail and a desire to learn. Through the decades, that hasn’t really changed; a learning mindset continues to be important for technologists at every level. I’ve always been curious about what makes things tick. As a child, I remember taking things apart to see how they worked. I knew I wanted to be an engineer when I was able to put them back together again. ... Not every great coder aspires to be a people leader; I certainly didn’t. I was introverted growing up. But as I worked my way up at Intuit, I saw firsthand how the right leadership skills could deepen my impact, even when I wasn’t charged with leading anybody. I’ve seen how quick decision making, holistic problem solving, and efficient delegation can drive impact at every level of an organization. And these assets only become more important as we fold AI into the process.

Understanding AI Agent Memory: Building Blocks for Intelligent Systems

Episodic memory in AI refers to the storage of past interactions and the specific actions taken by the agent. Like human memory, episodic memory records the events or “episodes” an agent experiences during its operation. This type of memory is crucial because it enables the agent to reference previous conversations, decisions, and outcomes to inform future actions. ... Semantic memory in AI encompasses the agent’s repository of factual, external information and internal knowledge. Unlike episodic memory, which is tied to specific interactions, semantic memory holds generalized knowledge that the agent can use to understand and interpret the world. This may include language rules, domain-specific information, or self-awareness of the agent’s capabilities and limitations. One common semantic memory use is in Retrieval-Augmented Generation (RAG) applications, where the agent leverages a vast data store to answer questions accurately. ... Procedural memory is the backbone of an AI system’s operational aspects. It includes systemic information such as the structure of the system prompt, the tools available to the agent, and the guardrails that ensure safe and appropriate interactions. In essence, procedural memory defines “how” the agent functions rather than “what” it knows.

Why Leadership Teams Need Training In Crisis Management

You don’t have the time to mull over different iterations or think about different possibilities and outcomes. You and your team need to make a decision quickly. Depending on the crisis at hand, you’ll need to assess the information available, evaluate potential risks, and make a timely decision. Waiting can be detrimental to your business. Failure to inform customers that their information was compromised during a cybersecurity attack could lead them to take their business elsewhere. ... Crisis or not, communication is how teams facilitate information and build trust. During a crisis, it’s up to the leader to communicate efficiently and effectively to the internal teams. It’s natural for panic to ensue during a time of unpredictability and stress. ... it’s not only internal communications that you’re responsible for. You also need to consider what you’re communicating to your customers, vendors, and shareholders. This is where crisis management can come in handy. While you should know how best to speak to your team, communicating externally can present itself as more challenging. ... One crisis can be the end of your business if not handled properly and considerably. This is especially the case for businesses that undergo internal crises, such as cybersecurity attacks, product recalls, or miscalculated marketing campaigns.

SaaS Is Broken: Why Bring Your Own Cloud (BYOC) Is the Future

BYOC allows customers to run SaaS applications using their own cloud infrastructure and resources rather than relying on a third-party vendor’s infrastructure. This hybrid approach preserves the convenience and velocity of SaaS while balancing cost and ownership with the control of self-hosted solutions. Building a BYOC stack that is easy to adopt, cost-effective, and performant is a significant engineering challenge. But as a software vendor, there are many benefits to your customers that make it worth the effort. ... SaaS brought speed and simplicity to software consumption, while traditional on premises offered control and predictability. But a more balanced approach is emerging as companies face rising costs, compliance challenges, and the need for data ownership. BYOC is the consolidated evolution of both worlds — combining the convenience of SaaS with the control of on premises. Instead of sending massive amounts of data to third-party vendors, companies can run SaaS applications within their cloud infrastructure. This means predictable costs, better compliance, and tailored performance. We’ve seen this hybrid model succeed in other areas. Meta’s Llama gained massive adoption as users could run it on their infrastructure.

What Happens When AI Is Used as an Autonomous Weapon

The threat to enterprises is already substantial, according to Ben Colman, co-founder and CEO at deepfake and AI-generated media detection platform Reality Defender. “We’re seeing bad actors leverage AI to create highly convincing impersonations that bypass traditional security mechanisms at scale. AI voice cloning technology is enabling fraud at unprecedented levels, where attackers can convincingly impersonate executives in phone calls to authorize wire transfers or access sensitive information,” Colman says. Meanwhile, deepfake videos are compromising verification processes that previously relied on visual confirmation, he adds. “These threats are primarily coming from organized criminal networks and nation-state actors who recognize the asymmetric advantage AI offers. They’re targeting communication channels first because they’re the foundation of trust in business operations.” Attackers are using AI capabilities to automate, scale, and disguise traditional attack methods. According to Casey Corcoran, field CISO at SHI company Stratascale, examples include creating more convincing phishing and social engineering attacks to automatically modify malware so that it is unique to each attack, thereby defeating signature-based detection.

Worldwide spending on genAI to surge by hundreds of billions of dollars

“The market’s growth trajectory is heavily influenced by the increasing prevalence of AI-enabled devices, which are expected to comprise almost the entire consumer device market by 2028,” said Lovelock. “However, consumers are not chasing these features. As the manufacturers embed AI as a standard feature in consumer devices, consumers will be forced to purchase them.” In fact, for organizations, AI PCs could solve key issues organizations face when using cloud and data center AI instances, including cost, security, and privacy concerns, according to a study released this month by IDC Research. This year is expected to be the year of the AI PC, according to Forrester Research. It defines an AI PC as one that has an embedded AI processor and algorithms specifically designed to improve the experience of AI workloads across the central processing unit (CPU), graphics processing unit (GPU), and neural processing unit, or NPU. ... “This reflects a broader trend toward democratizing AI capabilities, ensuring that teams across functions and levels can benefit from its transformative potential,” said Tom Mainelli, IDC’s group vice president for device and consumer research. “As AI tools become more accessible and tailored to specific job functions, they will further enhance productivity, collaboration, and innovation across industries.”