Daily Tech Digest by Kannan Subbiah: continuous delivery

Showing posts with label continuous delivery. Show all posts

Daily Tech Digest - February 25, 2026

Quote for the day:

"To strongly disagree with someone, and yet engage with them with respect, grace, humility and honesty, is a superpower" -- Vala Afshar

Is ‘sovereign cloud’ finally becoming something teams can deploy – not just discuss?

Historically, sovereign cloud discussions in Europe have been driven primarily by risk mitigation. , legal jurisdiction, and protection from international legislation have dominated the narrative. These concerns are valid, but they have framed sovereign cloud largely as a defensive measure – a way to reduce exposure – rather than as an enabler of innovation or value creation. Without a clear value proposition beyond compliance, sovereign cloud has struggled to compete with hyperscale public cloud platforms that offer scale, maturity, and rich developer ecosystems. The absence of enforceable regulation has further compounded this. ... Policymakers and enterprises are also beginning to ask a more practical question: where does sovereign cloud actually create the most value? The answer increasingly points to innovation ecosystems, critical national capabilities, and trust. First, there is a growing recognition that sovereign cloud can underpin domestic innovation, particularly in areas such as AI, advanced research, and data-intensive start-ups. Organisations working with sensitive datasets, intellectual property, or public funding often require cloud environments that are both scalable and secure. ... Second, the sovereign cloud is increasingly being aligned with critical digital infrastructure. Sectors like healthcare, energy, transportation, and defence depend on continuity, accountability, and control.

India’s DPDP rules 2025: Why access controls are priority one for CIOs

The security stack has traditionally broken down at the point of data rendering or exfiltration. Firewalls and encryption protect the data in transit and at rest, but once the data is rendered on a screen, the risk of data breaches from smartphone cameras, screenshots, or unauthorized sharing occurs outside of the security stack’s ability to protect it. ... Poor enterprise access practices amplify this risk. Over-provisioned user accounts, inconsistent multi-factor authentication, poor logging, and the absence of contextual checks make it easy for insider threats, credential compromise, and supply chain breaches to succeed. Under DPDP, accountability also extends to processors, so third-party CRM or cloud access must meet the same security standards. ... Shift from trust by implication to trust by verification. Implement to ensure users view only required apps and data. Add device posture with device binding, location, time, watermarking and behavior analysis to deny suspicious access. ... Implement identity infrastructure for just-in-time access and automated de-Provisioning based on role changes. Record fine-grained, immutable logs (user, device, resource, date/time) for breach analysis and annual retention. ... Enable dynamic, user-level watermarks (injecting username, IP address, timestamp) for forensic analysis. Prohibit unauthorized screen capture, sharing, or download activity during sensitive sessions, while permitting approved business processes.

What really caused that AWS outage in December?

The back-story was broken by the Financial Times, which reported the 13-hour outage was caused by a that decided to improve operations by deleting and then recreating a key environment. AWS on Friday shot back to flag what it dubbed “inaccuracies” in the FT story. “The brief service interruption they reported on was the result of user error — specifically — not AI as the story claims,” AWS said. ... “The issue stemmed from a misconfigured role — the same issue that could occur with any developer tool (AI powered or not) or manual action.” That’s an impressively narrow interpretation of what happened. AWS then promised it won’t do it again. ... The key detail missing — which AWS would not clarify — is just what was asked and how the engineer replied. Had the engineer been asked by Kiro “I would like to delete and then recreate this environment. May I proceed?” and the engineer replied, “By all means. Please do so,” that would have been user error. But that seems highly unlikely. The more likely scenario is that the system asked something along the lines of “Do you want me to clean up and make this environment more efficient and faster?” Did the engineer say “Sure” or did the engineer respond, “Please list every single change you are proposing along with the likely result and the worst-case scenario result. Once I review that list, I will be able to make a decision.”

Model Inversion Attacks: Growing AI Business Risk

A is a form of privacy attack against machine learning systems in which an adversary uses the outputs of a model to infer sensitive information about the data used to train it. Rather than breaching a database or stealing credentials, attackers observe how a model responds to input queries and leverage those outputs, often including confidence scores or probability values, to reconstruct aspects of the training data that should remain private. ... This type of attack differs fundamentally from other ML attacks, such as membership inference, which aims to determine whether a specific data point was part of the training set, and model extraction, which seeks to copy the model itself. ... Successful model inversion attacks can inflict significant damage across multiple areas of a business. When attackers extract sensitive training data from machine learning models, organizations face not only immediate financial losses but also lasting reputational harm and operational setbacks that continue well beyond the initial incident. ... Attackers target inference-time privacy by moving through multiple stages, submitting carefully crafted queries, studying the model’s responses, and gradually reconstructing sensitive attributes from the outputs. Because these activities can resemble normal usage patterns, such attacks frequently remain undetected when monitoring systems are not specifically tuned to identify machine learning–related security threats.

It’s time to rethink CISO reporting lines

The age-old problem with reporting into CIOs is that it could present — or at least appear to present — a conflict of interest. Cybersecurity consultant Brian Levine, a former federal prosecutor who serves as executive director of FormerGov, says that concern is even more warranted today. “It’s the legacy model: Treat security as a technical function instead of an enterprise‑wide risk discipline,” he says. ... Enterprise CISOs should be reporting a notch higher, Levine argues. “Ideally, the CISO would report to the CEO or the general counsel, high-level roles explicitly accountable for enterprise risk. Security is fundamentally a risk and governance function, not a cost‑center function,” Levine points out. “When the CISO has independence and a direct line to the top, organizations make clearer decisions about risk, not just cheaper ones." ... Painter is “less dogmatic about where the CISO reports and more focused on whether they actually have a seat at the table,” he says. “Org charts matter far less than influence,” he adds. “Whether the CISO reports to the CIO, the CEO, or someone else, the real question is this: Are they brought in early, listened to, and empowered to shape how the business operates? When that’s true, the structure works. When it’s not, no reporting line will save it.” ... “When the CISO reports to the CIO, risk can be filtered, prioritized out of sight, or reshaped to fit a delivery narrative. It’s not about bad actors. It’s about role tension. And when that tension exists within the same reporting line, risk loses.”

AI drives cyber budgets yet remains first on the chop list

Cybersecurity budgets are rising sharply across large organisations, but a new multinational survey points to a widening gap between spending on artificial intelligence and the ability to justify that spending in business terms. ... "Security leaders are getting mandates to invest in AI, but nobody's given them a way to prove it's working. You can't measure AI transformation with pre-AI metrics," Wilson said. He added that security teams struggle to translate operational data into board-level evidence of reduced risk. "The problem isn't that security teams lack data. They're drowning in it. The issue is they're tracking the wrong things and speaking a language the board doesn't understand. Those are the budgets that get cut first. The window to fix this is closing fast," Wilson said. ... "We need new ways to measure security effectiveness that actually show business impact, because boards don't fund faster ticket closure, they fund measurable risk reduction and business resilience. We have to show that we're not just responding quickly but eliminating and improving the conditions that allow incidents to happen in the first place," he said. ... Security leaders reported pressure to invest in AI, while also struggling to link those investments to outcomes executives recognise as resilience and risk reduction. The report argues this tension may become harder to sustain if economic conditions tighten and boards begin looking for costs to cut.

A cloud-smart strategy for modernizing mission-critical workloads

As enterprises mature in their cloud journeys, many CIOs and senior technology leaders are discovering that modernization is not about where workloads run — it’s about how deliberately they are designed. This realization is driving a shift from cloud-first to cloud-smart, particularly for systems the business cannot afford to lose. A cloud-smart strategy, as highlighted by the Federal Cloud Computing Strategy, encourages agencies to weigh the long-term, total costs of ownership and security risks rather than focusing only on immediate migration. ... Sticking indefinitely with legacy systems can lead to rising maintenance costs, inability to support new business initiatives, security vulnerabilities and even outages as old hardware fails. Many organizations reach a tipping point where they must modernize to stay competitive. The key is to do it wisely — balancing speed and risk and having a solid strategy in place to navigate the complexity. ... A cloud-smart strategy aligns workload placement with business risk, performance needs and regulatory expectations rather than ideology. Instead of asking whether a system can move to the cloud, cloud-smart organizations ask where it performs best. ... Rather than lifting and shifting entire platforms, teams separate core transaction engines from decisioning, orchestration and experience layers. APIs and event-driven integration enable new capabilities around stable cores, allowing systems to evolve incrementally without jeopardizing operational continuity.

Enterprises still can't get a handle on software security debt – and it’s only going to get worse

Four-in-five organizations are drowning in software security debt, new research shows, and the backlog is only getting worse. ... "The speed of software development has skyrocketed, meaning the pace of flaw creation is outstripping the current capacity for remediation,” said Chris Wysopal, chief security evangelist at Veracode. “Despite marginal gains in fix rates, security debt is becoming a much larger issue for many organizations." Organizations are discovering more vulnerabilities as their testing programs mature and expand. Meanwhile, the accelerating pace of software releases creates a continuous stream of new code before existing vulnerabilities can be addressed. ... "Now that AI has taken software development velocity to an unprecedented level, enterprises must ensure they’re making deliberate, intelligent choices to stem the tide of flaws and minimize their risk," said Wysopal. The rise in flaws classed as both “severe” and “highly exploitable” means organizations need to shift from generic severity scoring to prioritization based on real-world attack potential, advised Veracode. As such, researchers called for a shift from simple detection toward a more strategic framework of Prioritize, Protect, and Prove. ... “We are at an inflection point where running faster on the treadmill of vulnerability management is no longer a viable strategy. Success requires a deliberate shift,” said Wysopal.

Protecting your users from the 2026 wave of AI phishing kits

To protect your users today, you have to move past the idea of reactive filtering and embrace . This means your software needs to be smart enough to validate that a user is who they say they are, regardless of the credentials they provide. We’re seeing a massive shift toward behavioral analytics. Instead of just checking a password, your platform should be looking at communication patterns and login behaviors. If a user who typically logs in from Chicago suddenly tries to authorize a high-value financial transfer from a new device in a different country, your system should do more than just send a push notification. ... Beyond the tech, you need to think about the “human” friction you’re creating. We often prioritize convenience over security, but in the current climate, that’s a losing bet. Implementing “probabilistic approval workflows” can help. For example, if your system’s AI is 95% sure a login is legitimate, let it through. If that confidence drops, trigger a more rigorous verification step. ... The phishing scams of 2026 are successful because they leverage the same tools we use for productivity. To counter them, we have to be just as innovative. By building identity validation and phishing-resistant protocols into the core of your product, you’re doing more than just securing data. You’re securing the trust that your business is built on.

GitOps Implementation at Enterprise Scale — Moving Beyond Traditional CI/CD

Most engineering organizations running traditional CI/CD pipelines eventually hit the ceiling. Deployments work until they don’t, and when they break, the fixes are manual, inconsistent and hard to trace. ... We kept Jenkins and GitHub Actions in the stack for build and test stages where they already worked well. Harness remained an option for teams requiring more sophisticated approval workflows and governance controls. We ruled out purely script-based push deployment approaches because they offered poor drift control and scaled badly. ... Organizational resistance proved more challenging to address than the technical work. Teams feared the new approach would introduce additional bureaucracy. Engineers accustomed to quick kubectl fixes worried about losing agility. We ran hands-on workshops demonstrating that GitOps actually produced faster deployments, easier rollbacks and better visibility into what was running where. We created golden templates for common deployment patterns, so teams did not have to start from scratch. ... Unexpected benefits emerged after full adoption. Onboarding improved as deployment knowledge now lived in Git history and manifests rather than in senior engineers’ heads. Incident response accelerated because traceability let teams pinpoint exactly what changed and when, and rollback became a consistent, reliable operation. The shift from push-based to pull-based operations improved security posture by limiting direct cluster access.

Daily Tech Digest - February 20, 2026

Quote for the day:

"Hold yourself responsible for a higher standard than anybody expects of you. Never excuse yourself." -- Henry Ward Beecher

From in-house CISO to consultant. What you need to know before making the leap

A growing number of CISOs are either moving into consulting roles or seriously considering it. The appeal is easy to see: more flexibility and quicker learning, alongside steady demand for experienced security leaders. Some of these professionals work as virtual CISOs (vCISOs), advising companies from a distance. Others operate as fractional CISOs, embedding into the organization one or two days a week. ... CISOs line up their first clients while they’re still employed. Otherwise, he says, it can take a long time to build momentum. And the pressure to make it work can quickly turn into panic. In that moment, security professionals may start “underpricing themselves because they need money immediately,” he says. Once rates are set out of desperation, they’re often hard to reset without straining the relationship. Other CISOs-turned-consultants also emphasize preparation. ... Many of the skills CISOs honed inside large organizations translate directly to the new consulting job, while others suddenly matter more than they ever did before. In addition to technical skills, it is often the practical ones that prove most valuable. The ability to prioritize — sharpened over years in a CISO role — becomes especially important in consulting. ... Crisis management is another essential skill. Paired with hands-on knowledge of cybersecurity processes and best practices, it gives former CISOs a real advantage as they move into consulting.

New phishing campaign tricks employees into bypassing Microsoft 365 MFA

The message purports to be about a corporate electronic funds payment, a document about salary bonuses, a voicemail, or contains some other lure. It also includes a code for ‘Secure Authorization’ that the user is asked to enter when they click on the link, which takes them to a real Microsoft Office 365 login page. Victims think the message is legitimate, because the login page is legitimate, so enter the code. But unknown to the victim, it’s actually the code for a device controlled by the threat actor. What the victim has done is issued an granting the hacker’s device access to their Microsoft account. From there, the hacker has access to everything the account allows the employee to use. Note that this isn’t about credential theft, although if the attacker wants credentials, they can be stolen. It’s about stealing the victim’s OAuth access and refresh tokens for persistent access to their Microsoft account, including to applications such as Outlook, Teams, and OneDrive. ... The main defense against the latest version of this attack is to restrict the applications users are allowed to connect to their account, he said. Microsoft provides enterprise administrators with the ability to allowlist specific applications that the user may authorize via OAuth. ... The easiest defense is to turn off the ability to add extra login devices to Office 365, unless it’s needed, he said. In addition, employees should also be continuously educated about the risks of unusual login requests, even if they come from a familiar system.

The 200ms latency: A developer’s guide to real-time personalization

The first hurdle every developer faces is the “.” How do you personalize for a user with no history or an anonymous session? Traditional collaborative filtering fails here because it relies on a sparse matrix of past interactions. If a user just landed on your site for the first time, that matrix is empty. To solve this within a 200ms budget, you cannot afford to query a massive data warehouse to look for demographic clusters. You need a strategy based on session vectors. We treat the user’s current session as a real-time stream. ... Another architectural flaw I frequently encounter is the dogmatic attempt to run everything in real-time. This is a recipe for cloud bill bankruptcy and latency spikes. You need a strict decision matrix to decide exactly what happens when the user hits “load.” We divide our strategy based on the “Head” and “Tail” of the distribution. ... Speed means nothing if the system breaks. In a distributed system, a 200ms timeout is a contract you make with the frontend. If your sophisticated AI model hangs and takes 2 seconds to return, the frontend spins and the user leaves. We implement strict circuit breakers and degraded modes. ... We are moving away from static, rule-based systems toward agentic architectures. In this new model, the system does not just recommend a static list of items. It actively constructs a user interface based on intent. This shift makes the 200ms limit even harder to hit. It requires a fundamental rethink of our data infrastructure.

Spec-Driven Development – Adoption at Enterprise Scale

Spec-Driven Development emerged as AI models began demonstrating sustained focus on complex tasks for extended periods of time. Operating in a continuous back-and-forth pattern, instructional interactions between humans and AI is not the best use of this capability. At the same time, allowing AI to operate independently for long periods risks significant deviation from intended outcomes. We need effective context engineering to ensure intent alignment in this scenario. SDD addresses this need by establishing a shared understanding with AI, with specs facilitating dialogue between humans and AI, rather than serving as instruction manuals. ... When senior engineers collaborate, communication is conversational, rather than one-way instructions. We achieve shared understanding through dialogue. That shared understanding defines what we build. SDD facilitates this same pattern between humans and AI agents, where agents help us think through solutions, challenge assumptions, and refine intent before diving into execution. ... Given this significant cultural dimension, treating SDD as a technical rollout leaves substantial value on the table. SDD adoption is an organizational capability to develop, not just a technical practice to install. Those who have lived through enterprise agile adoption will recognize the pattern. Tools and ceremonies are easy to install, but without the cultural shifts we risk "SpecFall" (the equivalent of "Scrumerfall").

Tech layoffs in 2026: Why skills matter more than experience in tech

The impact of is becoming visible as companies prioritise data science and machine learning skills over conventional IT roles. During decades, layoffs were typically associated with the economic recession or lack of revenue in companies. The difference between the present wave is the involvement of automation and strategic restructuring. Although automation has had beneficial impacts on increasing productivity, it implies that jobs that aim at routine and repetitive duties continue to be at risk. ... The traditional career trajectories based on experience or seniority are replaced by market needs of niche skills in machine learning, data engineering, cloud architecture, and product leadership. Employees whose skills have not increased are more exposed to displacement in the event of reorganisation of the companies. These developments explain why tech professionals must reskill to remain employable in an AI-driven industry. The tech labor force in India, which is also one of the largest in the world, is especially vulnerable to the change. ... The future of tech jobs in India 2026 will favour professionals who combine technical expertise with analytical and problem-solving skills. The layoffs in early 2026 explain why the technology industry is vulnerable to job losses because corporate interests can change rapidly. To individuals, it entails being future-ready through the development of skills that would be relevant in the industry direction, including AI integration, cybersecurity, cloud computing, and advanced analytics.

Secrets Management Failures in CI/CD Pipelines

are still the most entrenched security issue. API keys, access tokens and private certificates continue to live in the configuration files of the pipeline, shell scripts or application manifests. While the repository is private, security exposure is the result of only one misconfiguration or breached account. Once committed, secrets linger for months or even years, far outlasting the necessary rotation period. Another common failure is secret sprawl. accumulate credentials over time with no clear ownership. Old tokens remain active because nobody remembers which service depends on them. Thus, as the pipeline develops, secrets management becomes reactive rather than intentional, compromising the likelihood of exposing credentials. Over-permissioned credentials make things worse. ... Technology is not the reason for most secrets management failures; it’s people. Developers tend to copy and paste credentials when they’re trying to get to the bottom of some problem or other. They might even just bypass the security safeguards because things are tight against the wire. It’s pretty easy for nobody to keep absolutely on top of their security posture as your CI/CD pipelines evolve. It’s just exactly for this reason that a DevSecOps culture is important. It has got to be more than just the tools; it has got to be how we all work together to get the job done. Security teams must recognize that what is needed is to consider the CI/CD pipeline as production infrastructure, not some internal tool that can be altered ‘on the fly’.

Agentic AI systems don’t fail suddenly — they drift over time

As organizations move from experimentation to real operational deployment of agentic AI, a new category of risk is emerging — one that traditional AI evaluation, testing and governance practices often struggle to detect. ... Most enterprise AI governance practices evolved around a familiar mental model: a stateless model receives an input and produces an output. Risk is assessed by measuring accuracy, bias or robustness at the level of individual predictions. Agentic systems strain that model. The operational unit of risk is no longer a single prediction, but a behavioral pattern that emerges over time. An agent is not a single inference. It is a process that reasons across multiple steps, invokes tools and external services, retries or branches when needed, accumulates context over time and operates inside a changing environment. Because of that, the unit of failure is no longer a single output, but the sequence of decisions that leads to it. ... In real environments, degradation rarely begins with obviously incorrect outputs. It shows up in subtler ways, such as verification steps running less consistently, tools being used differently under ambiguity, retry behavior shifting or execution depth changing over time. ... Without operational evidence, governance tends to rely more on intent and design assumptions than on observed reality. That’s not a failure of governance so much as a missing layer. Policy defines what should happen, diagnostics help establish what is actually happening and controls depend on that evidence.

Prompt Control is the New Front Door of Application Security

Application security has always been built around a simple assumption: There is a front door. Traffic enters through known interfaces, authentication establishes identity, authorization constrains behavior, and controls downstream enforcement of policy. That model still exists, but our most recent research shows it no longer captures where risk actually concentrates in AI-driven systems. ... are where intent enters the system. They define not only what a user is asking, but how the model should reason, what context it should retain, and which safeguards it should attempt to bypass. That is why prompt layers now outrank traditional integration points as the most impactful area for both application security and delivery. ... Output moderation still matters, and our research shows it remains a meaningful concern. But its lower ranking is telling. Output controls catch problems after the system has already behaved badly. They are essential guardrails, not primary defenses. It’s always more efficient to stop the thief on the way in rather than try to catch him after the fact, and in the case of inference, it’s less costly because stopping on the ingress means no token processing costs incurred. ... Our second set of findings reinforces this point. Authentication and observability lead the methods organizations use to secure and deliver AI inference services, cited by 55% and 54% of respondents, respectively. This holds true across roles, with the exception of developers, who more often prioritize protection against sensitive data leaks.

The 'last-mile' data problem is stalling enterprise agentic AI — 'golden pipelines' aim to fix it

Traditional ETL tools like dbt or Fivetran prepare data for reporting: structured analytics and dashboards with stable schemas. AI applications need something different: preparing messy, evolving operational data for model inference in real-time. calls this distinction "inference integrity" versus "reporting integrity." Instead of treating data preparation as a separate discipline, golden pipelines integrate normalization directly into the AI application workflow, collapsing what typically requires 14 days of manual engineering into under an hour, the company says. Empromptu's "golden pipeline" approach is a way to accelerate data preparation and make sure that data is accurate. ... "Enterprise AI doesn't break at the model layer, it breaks when messy data meets real users," Shanea Leven, CEO and co-founder of Empromptu told VentureBeat in an exclusive interview. "Golden pipelines bring data ingestion, preparation and governance directly into the AI application workflow so teams can build systems that actually work in production." ... Golden pipelines target a specific deployment pattern: organizations building integrated AI applications where data preparation is currently a manual bottleneck between prototype and production. The approach makes less sense for teams that already have mature data engineering organizations with established ETL processes optimized for their specific domains, or for organizations building standalone AI models rather than integrated applications.

From installation to predictive maintenance: The new service backbone of AI data centers

bring together several shifts at once: much higher rack densities, more dynamic load profiles, new forms of cooling, and tighter integration between electrical and digital systems. A single misconfiguration in the power chain can have much wider consequences than would have been the case in a traditional facility. This is happening at a time when many operators struggle to recruit and retain experienced operations and maintenance staff. The personnel on site often have to cope with hybrid environments that combine legacy air-cooled rooms with liquid-ready zones, energy storage, and multiple software layers for control and monitoring. In such an environment, services are not a ‘nice to have’. ... As architectures become more intricate, human error remains one of the main residual risks. AI-ready infrastructures combine complex electrical designs, liquid cooling circuits, high-density rack layouts, and multiple software layers such as . Operating and maintaining such systems safely requires clear procedures and a high level of discipline. ... In an AI-driven era, service strategy is as important as the choice of UPS topology, cooling technology or energy storage. Commissioning, monitoring, maintenance, and training are not isolated activities. Together, they form a continuous backbone that supports the entire lifecycle of the data center. Well-designed service models help operators improve availability, optimise energy performance and make better use of the assets they already have.

Daily Tech Digest - November 02, 2025

Quote for the day:

“Identify your problems but give your power and energy to solutions.” -- Tony Robbins

AI Agents: Elevating Cyber Threat Intelligence to Autonomous Response

Embedded across the security stack, AI agents can ingest vast volumes of threat data, triage alerts, correlate intelligence, and distribute insights in real time. For instance, agents can automate threat triage by filtering out false positives and flagging high-priority threats based on severity and relevance, thereby refining threat intelligence. They also enrich threat intelligence by cross-referencing multiple data sources to add meaningful context and track Indicators of Behavior (IoBs) that might otherwise go unnoticed. ... A major challenge for security teams is the inherent complexity they face. Often, the issue isn’t a lack of data or tools, but rather a lack of understanding the relevancy, coordination, collaboration and contextual actioning. Threat intelligence is frequently fragmented across systems, teams, and workflows, creating blind spots, unknowns and delays that attackers can exploit. ... As enterprises evolve, they can transform from leveraging one model to another. Both approaches have value, but striking the right balance between integrating smarter tools and securing cyber threat intelligence depends on clearly defining responsibilities. For most, a hybrid model will be the best fit, allowing AI agents to scale routine tasks while keeping humans in control of complex, high-stakes decisions within the framework of smarter cyber threat intelligence.

The Future Of Leadership Is Human: Why Empathy Outweighs Authority

When employees feel understood and valued, their brains operate in a state conducive to creativity and problem-solving. Conversely, when they perceive threat or indifference from leadership, their cognitive resources shift to self-preservation, limiting their capacity for innovation and collaboration. ... Developing empathetic leadership requires intentional systems and cultural changes. At our company, we've implemented several practices that have transformed our leadership culture, drawing inspiration from organizations that are leading this shift. ... Skeptics often question whether empathetic leadership can coexist with aggressive business goals and competitive markets, but evidence suggests the opposite. Empathetic leadership enables more aggressive goals because it unlocks human potential in ways that authority alone cannot. When people feel genuinely valued and understood, they contribute discretionary effort, share innovative ideas and advocate for the organization in ways that drive measurable business results. ... These results didn't happen overnight; they required genuine commitment to changing how we interact with our team members daily. I've personally shifted from viewing my role as "providing answers" to "asking better questions." Instead of dictating solutions in meetings, I now spend more time understanding the challenges my team faces and creating space for them to develop solutions.

Why password controls still matter in cybersecurity

Despite all the advanced authentication technologies, passwords continue to be the primary way attackers move through corporate networks. That makes it more important than ever to ensure your organization employs robust password controls. Today's IT environments are a tangled web of systems that defy simple security solutions. On-premises servers, cloud platforms, and remote work setups each add another layer of complexity to password management. ... Legacy accounts are like forgotten spare keys hidden under old doormats, just waiting for someone to find them. Windows Active Directory domains, standalone systems, and specialized application accounts have become the digital equivalent of unlocked side doors that nobody remembers to check. These forgotten entry points are a hacker's dream, offering easy access to networks that think they're buttoned up tight. ... Risk-based authentication takes this a step further, dynamically assessing each password change request based on context like device, location, and user behavior. It's like having a digital bouncer that knows exactly who should and shouldn't get past the velvet rope. ... Passwords aren't going anywhere. They remain the fallback for even the most advanced authentication methods. By implementing intelligent, dynamic password controls, your organization can turn them from a constant security challenge into a resilient defense mechanism.

What most companies get wrong about AI—and how to fix it, explains Ahead’s CPO

Despite the hype, Supancich is realistic about where most companies stand in their AI journey. Many, she says, know they need to "do something" with AI but lack clarity on what that should be. For Supancich, the priority is mapping processes, identifying the best use cases, and going deep in targeted areas to build real capability, rather than spreading efforts too thin. At Ahead, this means investing in both internal transformation and external consulting capabilities. The company has made AI training mandatory for all employees, equipping them with practical skills and demystifying the technology. The response, she reports, has been overwhelmingly positive, with employees discovering new ways to enhance their work and add value. Supancich is also alert to the data and privacy implications of AI, working closely with the CIO to ensure that the organisation’s approach is both innovative and secure. ... Throughout the conversation, one theme recurs: the centrality of leadership in navigating the future of work. Supancich sees the CPO as both guardian and architect of culture, a strategic partner who must be deeply involved in every aspect of the business. The future belongs to those who can blend technical fluency with emotional intelligence, strategic acumen with a passion for people.

Bake Ruthless Compliance Into CI/CD Without Slowing Releases

Compliance breaks when we glue it onto the end of a release, or when it’s someone’s “side job” to assemble evidence after the fact. The fix is to treat controls as non-functional requirements with acceptance criteria, put those criteria into policy-as-code, and make pipelines refuse to ship when the criteria aren’t met. A second source of breakage is ambiguity about shared responsibility. We push to managed services, assume the provider “has it,” and then discover that logging, encryption, or key rotation was our part of the dance. Map what belongs to us versus the platform, and turn that into explicit checks. The third killer is evidence debt. If we can’t answer “who approved what, when, with what config and tests” in under five minutes, the debt collectors will arrive during audit season. ... Compliance isn’t a meeting; it’s a pipeline step. Our CI/CD pipelines generate the evidence we need while doing the work we already do: building, testing, signing, scanning, and shipping. We don’t rely on optional post-build scanners or a “security stage” we can skip under pressure. Instead, we make the happy path compliant by default and fail fast when something’s off. That means SBOMs built with every image, vulnerability scanning with defined SLAs, provenance signed and attached to artifacts, and deployment gates that verify attestations.

Inside AstraZeneca’s AI Strategy: CDO Brian Dummann on Innovation, Governance and Speed

“One of our core values as a company is innovation. Our business is wired to be curious — to push the boundaries of science. And to be pioneers in science, we’ve got to be pioneers in technology.” That curiosity has created a healthy tension between demand and delivery. “I’ve got a company full of employees outside of the IT organization who are thirsty to get their hands on data and AI tools,” he says. “It’s a blessing and a challenge. They want new models, new platforms, and they want them now. It’s never fast enough.” ... Empowering employees to innovate is one thing; enabling them to do it safely and quickly is another. That’s where AstraZeneca’s AI Accelerator comes in — a cross-functional initiative designed to shorten the time between idea and implementation. “The ultimate goal is to accelerate how we can experiment with AI and use it to innovate across all areas of our business,” he says. “We’ve built an AI Accelerator whose sole purpose is to work through how to accelerate the introduction of new technologies or quickly review use cases.” Legacy processes, once measured in weeks or months, now need to operate in hours or days. The AI Accelerator brings together technology, legal, compliance, and governance teams to streamline assessments and approvals. ... “We’re now putting a lot more decision-making in the hands of our employees and empowering them,” he says. “With great power comes greater responsibility.”

8 ways to help your teams build lasting responsible AI

"For tech leaders and managers, making sure AI is responsible starts with how it's built," Rohan Sen, principal for cyber, data, and tech risk with PwC US and co-author of the survey report, told ZDNET. "To build trust and scale AI safely, focus on embedding responsible AI into every stage of the AI development lifecycle, and involve key functions like cyber, data governance, privacy, and regulatory compliance," said Sen. "Embed governance early and continuously. ... "Start with a value statement around ethical use," said Logan. "From here, prioritize periodic audits and consider a steering committee that spans privacy, security, legal, IT, and procurement. Ongoing transparency and open communication are paramount so users know what's approved, what's pending, and what's prohibited. Additionally, investing in training can help reinforce compliance and ethical usage." ... "A new AI capability will be so exciting that projects will charge ahead to use it in production. The result is often a spectacular demo. Then things break when real users start to rely on it. Maybe there's the wrong kind of transparency gap. Maybe it's not clear who's accountable if you return something illegal. Take extra time for a risk map or check model explainability. The business loss from missing the initial deadline is nothing compared to correcting a broken rollout."

Rising Identity Crime Losses Take a Growing Emotional Toll

What is changing now is how easily attackers can operationalize personal information data, observed Henrique Teixeira, a senior vice president for strategy at Saviynt, an identity governance and access management company in El Segundo, Calif. “In a recent attack I personally experienced, a criminal logged into one of my accounts using stolen credentials and then launched a subscription bombing campaign, flooding my inbox with hundreds of fake mailing list signups to bury legitimate fraud alerts,” he told TechNewsWorld. ... Kevin Lee, senior vice president for trust and safety at Sift, a fraud-prevention company for digital businesses, in San Francisco, called the suicide numbers “stark and concerning.” “Part of what’s driving this is probably the sheer magnitude of the losses,” he told TechNewsWorld. “When people are losing $100,000 or even $1 million due to identity theft, they’re losing years of savings they’ve built up. The financial devastation is compounded by feelings of shame and embarrassment, which keep people from seeking help.” There’s also the repeat victimization factor, he added. “When someone gets hit once and then targeted again, it creates this sense of helplessness,” he explained. “They feel like they can’t protect themselves, and that vulnerability is deeply traumatic.” “The report shows that victims who reach out to the ITRC have lower rates of suicidal thoughts, which tells us that having support and resources makes a real difference,” he said.

The Learning Gap in Generative AI Deployment

The learning gap is best understood as the space between what organisations experiment with and what they are able to deploy and scale effectively. It is an organisational phenomenon, as much about culture, governance, and leadership as about technology. ... Beyond training, the learning gap is perpetuated by structural and organisational barriers. One critical factor is the absence of effective feedback mechanisms. Generative AI tools are most valuable when they evolve in response to human inputs, errors, and changing contexts. Without monitoring systems and structured feedback loops, AI deployments remain static, brittle, and context-blind. Organisations that do not track performance, error rates, or user corrections fail to create a continuous learning cycle, leaving both humans and machines in a state of stagnation. ... Closing the learning gap requires a shift in focus from technology to organisation. Pilots must be anchored in real business problems, with measurable objectives that align with workflow needs. Incremental, context-sensitive deployment allows organisations to refine AI applications in situ, providing both employees and AI systems the feedback necessary to improve over time. Small-scale success builds confidence, generates data for iteration, and lays the groundwork for broader adoption. Equally important is the creation of structured learning opportunities within operational contexts.

How to Integrate Quantum-Safe Security into Your DevOps Workflow

To ensure that your DevOps workflow holds up against quantum threats, you must secure the information at rest and in transit. Consider implementing quantum-resistant encryption for your backups, credentials, pipeline secrets, and even internal communications, so that even your most sensitive data transfers remain safe. Some organizations are even experimenting with quantum key distribution solutions to safeguard the most critical communications, while others are taking a hybrid approach combining encryption with post-quantum algorithms. If you often exchange build outputs, orchestration signals, and credentials in your communication, you are going to need all the security you can get. ... For smoother integration of post-quantum security protocols, DevOps teams must opt for a phased and crypto-agile strategy that lets them leverage their legacy and quantum-safe algorithms. Doing so can also help DevOps maintain interoperability and reduce any operational disruption. ... Quantum security is not a one-time undertaking and is a recurring initiative that requires consistent efforts and time from your end. As the standards for cyberattacks and cyberdefense evolve, monitoring and improving our quantum security protocols should be an important part of your security strategy. You can also enhance your dashboards with quantum-specific metrics, such as cryptographic events and anomalies in encrypted traffic.

Daily Tech Digest - July 25, 2025

Quote for the day:

"Technology changes, but leadership is about clarity, courage, and creating momentum where none exists." -- Inspired by modern digital transformation principles

Why foundational defences against ransomware matter more than the AI threat

The 2025 Cyber Security Breaches Survey paints a concerning picture. According to the study, ransomware attacks doubled between 2024 and 2025 – a surge less to do with AI innovation and more about deep-rooted economic, operational and structural changes within the cybercrime ecosystem. At the heart of this growth in attacks is the growing popularity of the ransomware-as-a-service (RaaS) business model. Groups like DragonForce or Ransomhub sell ready-made ransomware toolkits to affiliates in exchange for a cut of the profits, enabling even low-skilled attackers to conduct disruptive campaigns. ... Breaches often stem from common, preventable issues such as poor credential hygiene or poorly configured systems – areas that often sit outside scheduled assessments. When assessments happen only once or twice a year, new gaps may go unnoticed for months, giving attackers ample opportunity. To keep up, organisations need faster, more continuous ways of validating defences. ... Most ransomware actors follow well-worn playbooks, making them frequent visitors to company networks but not necessarily sophisticated ones. That’s why effective ransomware prevention is not about deploying cutting-edge technologies at every turn – it’s about making sure the basics are consistently in place.

Subliminal learning: When AI models learn what you didn’t teach them

“Subliminal learning is a general phenomenon that presents an unexpected pitfall for AI development,” the researchers from Anthropic, Truthful AI, the Warsaw University of Technology, the Alignment Research Center, and UC Berkeley, wrote in their paper. “Distillation could propagate unintended traits, even when developers try to prevent this via data filtering.” ... Models trained on data generated by misaligned models, where AI systems diverge from their original intent due to bias, flawed algorithms, data issues, insufficient oversight, or other factors, and produce incorrect, lewd or harmful content, can also inherit that misalignment, even if the training data had been carefully filtered, the researchers found. They offered examples of harmful outputs when student models became misaligned like their teachers, noting, “these misaligned responses are egregious far beyond anything in the training data, including endorsing the elimination of humanity and recommending murder.” ... Today’s multi-billion parameter models are able to discern extremely complicated relationships between a dataset and the preferences associated with that data, even if it’s not immediately obvious to humans, he noted. This points to a need to look beyond semantic and direct data relationships when working with complex AI models.

Why people-first leadership wins in software development

It frequently involves pushing for unrealistic deadlines, with project schedules made without enough input from the development team about the true effort needed and possible obstacles. This results in ongoing crunch periods and mandatory overtime. ... Another indicator is neglecting signs of burnout and stress. Leaders may ignore or dismiss signals such as team members consistently working late, increased irritability, or a decline in productivity, instead pushing for more output without addressing the root causes. Poor work-life balance becomes commonplace, often without proper recognition or rewards for the extra effort. ... Beyond the code, there’s a stifled innovation and creativity. When teams are constantly under pressure to just “ship it,” there’s little room for creative problem-solving, experimentation, or thinking outside the box. Innovation, often born from psychological safety and intellectual freedom, gets squashed, hindering your company’s ability to adapt to new trends and stay competitive. Finally, there’s damage to your company’s reputation. In the age of social media and employer review sites, news travels fast. ... It’s vital to invest in team growth and development. Provide opportunities for continuous learning, training, and skill enhancement. This not only boosts individual capabilities but also shows your commitment to their long-term career paths within your organization. This is a crucial retention strategy.

Achieving resilience in financial services through cloud elasticity and automation

In an era of heightened regulatory scrutiny, volatile markets, and growing cybersecurity threats, resilience isn’t just a nice-to-have—it’s a necessity. A lack of robust operational resilience can lead to regulatory penalties, damaged reputations, and crippling financial losses. In this context, cloud elasticity, automation, and cutting-edge security technologies are emerging as crucial tools for financial institutions to not only survive but thrive amidst these evolving pressures. ... Resilience ensures that financial institutions can maintain critical operations during crises, minimizing disruptions and maintaining service quality. Efficient operations are crucial for maintaining competitive advantage and customer satisfaction. ... Effective resilience strategies help institutions manage diverse risks, including cyber threats, system failures, and third-party vulnerabilities. The complexity of interconnected systems and the rapid pace of technological advancement add layers of risk that are difficult to manage. ... Financial institutions are particularly susceptible to risks such as system failures, cyberattacks, and third-party vulnerabilities. ... As financial institutions navigate a landscape marked by heightened risk, evolving regulations, and increasing customer expectations, operational resilience has become a defining imperative.

Digital attack surfaces expand as key exposures & risks double

Among OT systems, the average number of exposed ports per organisation rose by 35%, with Modbus (port 502) identified as the most commonly exposed, posing risks of unauthorised commands and potential shutdowns of key devices. The exposure of Unitronics port 20256 surged by 160%. The report cites cases where attackers, such as the group "CyberAv3ngers," targeted industrial control systems during conflicts, exploiting weak or default passwords. ... The number of vulnerabilities identified on public-facing assets more than doubled, rising from three per organisation in late 2024 to seven in early 2025. Critical vulnerabilities dating as far back as 2006 and 2008 still persist on unpatched systems, with proof-of-concept code readily available online, making exploitation accessible even to attackers with limited expertise. The report also references the continued threat posed by ransomware groups who exploit such weaknesses in internet-facing devices. ... Incidents involving exposed access keys, including cloud and API keys, doubled from late 2024 to early 2025. Exposed credentials can enable threat actors to enter environments as legitimate users, bypassing perimeter defenses. The report highlights that most exposures result from accidental code pushes to public repositories or leaks on criminal forums.

How Elicitation in MCP Brings Human-in-the-Loop to AI Tools

Elicitation represents more than an incremental protocol update. It marks a shift toward collaborative AI workflows, where the system and human co-discover missing context rather than expecting all details upfront. Python developers building MCP tools can now focus on core logic and delegate parameter gathering to the protocol itself, allowing for a more streamlined approach. Clients declare an elicitation capability during initialization, so servers know they may elicit input at any time. That standardized interchange liberates developers from generating custom UIs or creating ad hoc prompts, ensuring coherent behaviour across diverse MCP clients. ... Elicitation transforms human-in-the-loop (HITL) workflows from an afterthought to a core capability. Traditional AI systems often struggle with scenarios that require human judgment, approval, or additional context. Developers had to build custom solutions for each case, leading to inconsistent experiences and significant development overhead. With elicitation, HITL patterns become natural extensions of tool functionality. A database migration tool can request confirmation before making irreversible changes. A document generation system can gather style preferences and content requirements through guided interactions. An incident response tool can collect severity assessments and stakeholder information as part of its workflow.

Cognizant Agents Gave Hackers Passwords, Clorox Says in Lawsuit

“Cognizant was not duped by any elaborate ploy or sophisticated hacking techniques,” the company says in its partially redacted 19-page complaint. “The cybercriminal just called the Cognizant Service Desk, asked for credentials to access Clorox’s network, and Cognizant handed the credentials right over. Cognizant is on tape handing over the keys to Clorox’s corporate network to the cybercriminal – no authentication questions asked.” ... The threat actors made multiple calls to the Cognizant help desk, essentially asking for new passwords and getting them without any effort to verify them, Clorox wrote. They then used those new credentials to gain access to the corporate network, launching a “debilitating” attack that “paralyzed Clorox’s corporate network and crippled business operations. And to make matters worse, when Clorox called on Cognizant to provide incident response and disaster recovery support services, Cognizant botched its response and compounded the damage it had already caused.” In statement to media outlets, a Cognizant spokesperson said it was “shocking that a corporation the size of Clorox had such an inept internal cybersecurity system to mitigate this attack.” While Clorox is placing the blame on Cognizant, “the reality is that Clorox hired Cognizant for a narrow scope of help desk services which Cognizant reasonably performed. Cognizant did not manage cybersecurity for Clorox,” the spokesperson said.

Digital sovereignty becomes a matter of resilience for Europe

Open-source and decentralized technologies are essential to advancing Europe’s strategic autonomy. Across cybersecurity, communications, and foundational AI, we’re seeing growing support for open-source infrastructure, now treated with the same strategic importance once reserved for energy, water and transportation. The long-term goal is becoming clear: not to sever global ties, but to reduce dependencies by building credible, European-owned alternatives to foreign-dominated systems. Open-source is a cornerstone of this effort. It empowers European developers and companies to innovate quickly and transparently, with full visibility and control, essential for trust and sovereignty. Decentralized systems complement this by increasing resilience against cyber threats, monopolistic practices and commercial overreach by “big tech”. While public investment is important, what Europe needs most is a more “risk-on” tech environment, one that rewards ambition, accelerated growth and enables European players to scale and compete globally. Strategic autonomy won’t be achieved by funding alone, but by creating the right innovation and investment climate for open technologies to thrive. Many sovereign platforms emphasize end-to-end encryption, data residency, and open standards. Are these enough to ensure trust, or is more needed to truly protect digital independence?

Building better platforms with continuous discovery

Platform teams are often judged by stability, not creativity. Balancing discovery with uptime and reliability takes effort. So does breaking out of the “tickets and delivery” cycle to explore problems upstream. But the teams that manage it? They build platforms that people want to use, not just have to use. Start by blocking time for discovery in your sprint planning, measuring both adoption and friction metrics, and most importantly, talking to your users periodically rather than waiting for them to come to you with problems. Cultural shifts like this take time because you're not just changing the process; you're changing what people believe is acceptable or expected. That kind of change doesn't happen just because leadership says it should, or because a manager adds a new agenda to planning meetings. It sticks when ICs feel inspired and safe enough to work differently and when managers back that up with support and consistency. Sometimes a C-suite champion helps set the tone, but day-to-day, it's middle managers and senior ICs who do the slow, steady work of normalizing new behavior. You need repeated proof that it's okay to pause and ask why, to explore, to admit uncertainty. Without that psychological safety, people just go back to what they know: deliverables and deadlines.

AI-enabled software development: Risk of skill erosion or catalyst for growth?

We need to reframe AI not as a rival, but as a tool—one that has its own pros and cons and can extend human capability, not devalue it. This shift in perspective opens the door to a broader understanding of what it means to be a skilled engineer today. Using AI doesn’t eliminate the need for expertise—it changes the nature of that expertise. Classical programming, once central to the developer’s identity, becomes one part of a larger repertoire. In its place emerge new competencies: critical evaluation, architectural reasoning, prompt literacy, source skepticism, interpretative judgment. These are not hard skills, but meta-cognitive abilities—skills that require us to think about how we think. We’re not losing cognitive effort—we’re relocating it. This transformation mirrors earlier technological shifts. ... Some of the early adopters of AI enablement are already looking ahead—not just at the savings from replacing employees with AI, but at the additional gains those savings might unlock. With strategic investment and redesigned expectations, AI can become a growth driver—not just a cost-cutting tool. But upskilling alone isn’t enough. As organizations embed AI deeper into the development workflow, they must also confront the technical risks that come with automation. The promise of increased productivity can be undermined if these tools are applied without adequate context, oversight, or infrastructure.

Daily Tech Digest - May 18, 2025

Quote for the day:

“We are all failures - at least the best of us are.” -- J.M. Barrie

Extra Qubits Slash Measurement Time Without Losing Precision

Fast and accurate quantum measurements are essential for future quantum devices. However, quantum systems are extremely fragile; even small disturbances during measurement can cause significant errors. Until now, scientists faced a fundamental trade-off: they could either improve the accuracy of quantum measurements or make them faster, but not both at once. Now, a team of quantum physicists, led by the University of Bristol and published in Physical Review Letters, has found a way to break this trade-off. The team’s approach involves using additional qubits, the fundamental units of information in quantum computing, to “trade space for time.” Unlike the simple binary bits in classical computers, qubits can exist in multiple states simultaneously, a phenomenon known as superposition. In quantum computing, measuring a qubit typically requires probing it for a relatively long time to achieve a high level of certainty. ... Remarkably, the team’s process allows the quality of a measurement to be maintained, or even enhanced, even as it is sped up. The method could be applicable to a broad range of leading quantum hardware platforms. As the global race to build the highest-performance quantum technologies continues, the scheme has the potential to become a standard part of the quantum read-out process.

The leadership legacy: How family shapes the leaders we become

We’ve built leadership around performance metrics, dashboards and influence. Yet the traits that truly sustain teams — empathy, accountability, consistency — are often born not in corporate training but in the everyday rituals of family life. On this International Day of Families, it’s time to reevaluate leadership models that have long been defined by clarity, charisma and control and define it with something deeper like care, connection and community. ... Here are five principles drawn from healthy family systems that can reframe leadership models: Consistency over chaos: Families thrive on routines and reliability. Leaders who bring emotional consistency, set clear expectations and avoid reactionary decisions foster psychological safety. Presence over performance: In families, presence often matters more than fixing the problem. Leaders who truly listen, offer time and engage with empathy build trust that performance alone cannot buy. Accountability with care: Families call out mistakes, but with the intent to support, not shame. Leaders who combine feedback with care build growth mindsets without fear. Shared purpose over solo glory: Families move together. In workplaces, this means shifting from individual heroism to collaborative wins. Leaders must champion shared success. Adaptability with anchoring: Just like families adjust to life stages, leaders need to flex without losing values. Adapt strategy, but anchor culture.

IPv4 was meant to be dead within a decade; what's happening with IPv6?

Globally, IPv6 is now approaching the halfway mark of Internet traffic. Google, which tracks the percentage of its users that reach it via IPv6, reports that around 46% of users worldwide access Google over IPv6 as of mid-May 2025. In other words, given the ubiquity of Google's usage, nearly half of Internet users have IPv6 capability today. While that’s a significant milestone, IPv4 still carries about half of the traffic, even though it was long expected to be retired by now. The growth has not been exponential, but it is persistent. ... The first, and arguably largest hurdle is that IPv6 was not designed to be backward-compatible with IPv4, a big criticism of IPv6 in general and largely blamed for its slow adoption. An IPv6-only device cannot directly communicate with an IPv4-only device without the help of a complex translation gateway, such as NAT64. This means networks usually run dual-stack support for both protocols, and IPv4 can't just be "switched off." This has major downsides, though; dual-stack operation doubles certain aspects of network management, requiring two address configurations, two sets of firewall rules, and more, which increases operational complexity for businesses and home users alike. This complexity causes a significant slowdown in deployment, as network engineers and software developers must ensure everything works on IPv6 in addition to IPv4. Any lack of feature parity or small misconfigurations can cause major issues.

Agentic mesh: The future of enterprise agent ecosystems

Many companies describe agents as “science experiments” that never leave the lab. Others complain about suffering the pain of “a thousand proof-of-concepts” with agents. The root cause of this pain? Most agents today aren’t designed to meet enterprise-grade standards. ... As enterprises adopt more agents, a familiar problem is emerging: silos. Different teams deploy agents in CRMs, data warehouses, or knowledge systems, but these agents operate independently, with no awareness of each other. ... An agentic mesh is a way to turn fragmented agents into a connected, reliable ecosystem. But it does more: It lets enterprise-grade agents operate in an enterprise-grade agent ecosystem. It allows agents to find each other and to safely and securely collaborate, interact, and even transact. The agentic mesh is a unified runtime, control plane, and trust framework that makes enterprise-grade agent ecosystems possible. ... Agentic mesh fulfills two major architectural goals: It lets you build enterprise-grade agents and it gives you an enterprise-grade run-time environment to support these agents. To support secure, scalable, and collaborative agents, an agentic mesh needs a set of foundational components. These capabilities ensure that agents don’t just run, but run in a way that meets enterprise requirements for control, trust, and performance.

OpenAI launches research preview of Codex AI software engineering agent for developers

The new Codex goes far beyond its predecessor. Now built to act autonomously over longer durations, Codex can write features, fix bugs, answer codebase-specific questions, run tests, and propose pull requests—each task running in a secure, isolated cloud sandbox. The design reflects OpenAI’s broader ambition to move beyond quick answers and into collaborative work. Josh Tobin, who leads the Agents Research Team at OpenAI, said during a recent briefing: “We think of agents as AI systems that can operate on your behalf for a longer period of time to accomplish big chunks of work by interacting with the real world.” Codex fits squarely into this definition. ... Codex executes tasks without internet access, drawing only on user-provided code and dependencies. This design ensures secure operation and minimizes potential misuse. “This is more than just a model API,” said Embiricos. “Because it runs in an air-gapped environment with human review, we can give the model a lot more freedom safely.” OpenAI also reports early external use cases. Cisco is evaluating Codex for accelerating engineering work across its product lines. Temporal uses it to run background tasks like debugging and test writing. Superhuman leverages Codex to improve test coverage and enable non-engineers to suggest lightweight code changes.

AI-Driven Software: Why a Strong CI/CD Foundation Is Essential

While AI can significantly boost speed, it also drives higher throughput, increasing the demand for testing, QA monitoring, and infrastructure investment. More code means development teams need to find ways to shorten feedback loops, build times, and other key elements of the development process to keep pace. Without a solid DevOps framework and CI/CD engine to manage this, AI can create noise and distractions that drain engineers’ attention, slowing them down instead of freeing them to focus on what truly matters: delivering quality software at the right pace. ... By investing in a CI/CD platform with these capabilities, you’re not just buying a tool — you’re establishing the foundation that will determine whether AI becomes a force multiplier for your team or simply creates more noise in an already complex system. The right platform turns your CI/CD pipeline from a bottleneck into a strategic advantage, allowing your team to harness AI’s potential while maintaining quality, security, and reliability. To harness the speed and efficiency gains of AI-driven development, you need a CI/CD platform capable of handling high throughput, rapid iteration, and complex testing cycles while keeping infrastructure and cloud costs in check. ... It is easy to get caught up in the excitement of powerful technologies like AI and dive straight into experimentation without laying the right groundwork for success.

Quantum Algorithm Outpaces Classical Solvers in Optimization Tasks, Study Indicates

The study focuses on a class of problems known as higher-order unconstrained binary optimization (HUBO), which model real-world tasks like portfolio selection, network routing, or molecule design. These problems are computationally intensive because the number of possible solutions grows exponentially with problem size. On paper, those are exactly the types of problems that most quantum theorists believe quantum computers, once robust enough, would excel at solving. The researchers evaluated how well different solvers — both classical and quantum — could find approximate solutions to these HUBO problems. The quantum system used a technique called bias-field digitized counterdiabatic quantum optimization (BF-DCQO). The method builds on known quantum strategies by evolving a quantum system under special guiding fields that help it stay on track toward low-energy states. ... It is probably important to note that the researchers didn’t just rely on the quantum component and that the hybrid approach was essential in securing the quantum edge. Their BF-DCQO pipeline includes classical preprocessing and postprocessing, such as initializing the quantum system with good guesses from fast simulated annealing runs and cleaning up final results with simple local searches.

How human connection drives innovation in the age of AI

When we are working toward a shared goal, there are core values and shared aspirations that bind us. By actively seeking out this common ground and fostering positive interactions, we can all bridge divides, both in our personal lives and within our organizations.  Feeling connection is not just good for our own wellbeing, it is also crucial for business outcomes. According to research, 94% of employees say that feeling connected to their colleagues makes them more productive at work, and over four times as likely to feel job satisfaction and half as likely to leave their jobs within the next year.  ... As we integrate AI deeper into our workflows, we should be deliberate in cultivating environments that prioritize genuine human connection and the development of these essential human skills.  This means creating intentional spaces—both physical and virtual—that encourage open dialogue, active listening, and the respectful exchange of diverse perspectives. Leaders should champion empathy and relationship-building skill development within their teams, actively working to promote thoughtful opportunities for human connection in our AI-driven environment. Ultimately, the future of innovation and progress will be shaped by our ability to harness the power of AI in a way that amplifies our uniquely human capacities, especially our innate drive to connect with one another.

Enterprise Intelligence: Why AI Data Strategy Is A New Advantage

Forward-thinking enterprises are embracing cloud-native data platforms that abstract infrastructure complexity and enable a new class of intelligent, responsive applications. These platforms unify data access across object, file, and block formats while enforcing enterprise-grade governance and policy. They incorporate intelligent tiering and KV caching strategies that learn from access patterns to prioritize hot data, accelerating inference and reducing overhead. They support multimodal AI workloads by seamlessly managing petabyte-scale datasets across edge, core, and cloud locations—without burdening teams with manual tuning. And they scale elastically, adapting to growing demand without disruptive re-architecture. ... AI-driven businesses are no longer defined by how much compute power they can deploy but by how efficiently they can manage, access, and utilize data. The enterprises that rethink their data strategy—eliminating friction, reducing latency, and ensuring seamless integration across AI pipelines—will gain a decisive competitive edge. For CIOs, the message is clear: AI success isn’t just about faster algorithms or bigger models; it’s about creating a smarter, more agile data architecture. Organizations that embrace real-time, scalable data platforms will not only unlock AI’s full potential but also future-proof their operations in an increasingly data-driven world.

The future of the modern data stack: Trends and predictions

AI and ML are also key drivers of the modern data stack, because they are creating new (or greatly amplifying existing) demands on data infrastructure. Suddenly, the provenance and lineage of information is taking on new importance, as enterprises fight against “hallucinations” and accidental exposure of PII or PHI through AI mechanisms. Data sharing is also more important than ever, because no single organization is likely to host all the information needed by GenAI models itself, and will intrinsically rely on others to augment models, RAG, prompt engineering, and other approaches when building AI-based solutions. ... The goal of simplifying data management and giving more users more access to data has been around since long before computers were invented. But recent improvements in GenAI and data sharing have vastly accelerated these trends — suddenly, the idea that non-technical professionals can transform, combine, analyze, and utilize complex datasets from inside and outside an organization feels not just achievable, but probable. ... Advances in data sharing, especially heterogeneous data sharing, through common formats like Iceberg, governance approaches like Polaris, and safety and security mechanisms like Vendia IceBlock are quickly removing the historical challenges to data product distribution.