Daily Tech Digest by Kannan Subbiah: data steward

Showing posts with label data steward. Show all posts

Daily Tech Digest - April 30, 2026

Quote for the day:

"You've got to get up every morning with determination if you're going to go to bed with satisfaction." --George Lorimer

🎧 Listen to this digest on YouTube Music

▶ Play Audio Digest

Duration: 15 mins • Perfect for listening on the go.

The dreaded IT audit: How to get through it and what to avoid

The article "The dreaded IT audit: how to get through it and what to avoid" from IT Pro encourages organizations to reframe the auditing process as a strategic business asset rather than a burdensome cost center. Successfully navigating an audit requires maintaining a comprehensive, up-to-date inventory of all technology assets—including those used by remote workforces—to ensure security, safety, and insurance compliance. Even startups should establish structured auditing processes, as these evaluations proactively identify vulnerabilities and optimize operational efficiency. To streamline the experience, the article recommends prioritizing high-risk areas, such as software licensing, and utilizing customized spot checks instead of repetitive, standardized reviews that may fail to uncover meaningful insights. Crucially, leaders must adopt an open-minded approach to findings; the goal is to engage in transparent discussions about discovered issues rather than becoming defensive. Key pitfalls to avoid include treating the audit as a one-time administrative hurdle, relying on outdated manual tracking methods, and ignoring the gathered data. Instead, organizations should leverage audit results to inform staff training and drive practical improvements. By viewing the audit as a strategic opportunity for growth, companies can significantly strengthen their cybersecurity posture and ensure long-term sustainability in a digital economy.

Privacy in the AI era is possible, says Proton's CEO, but one thing keeps him up at night

In a wide-ranging interview at the Semafor World Economy Summit, Proton CEO Andy Yen addressed the critical tension between the rapid advancement of artificial intelligence and the fundamental right to digital privacy. Yen voiced significant concerns regarding the current AI trajectory, arguing that the industry's reliance on massive data harvesting inherently threatens individual security. He advocated for a paradigm shift toward "privacy-first AI," where processing occurs locally on user devices or through end-to-end encrypted frameworks to ensure that personal information remains inaccessible to service providers. Unlike the advertising-driven models of Silicon Valley giants, Yen highlighted Proton’s commitment to a subscription-based business model, which avoids the ethical pitfalls of monetizing user data. He also explored the "privacy paradox," observing that while users value their data, they often succumb to the convenience of free platforms. To counter this, Proton is expanding its ecosystem with tools like encrypted email and small language models designed specifically for security. Ultimately, Yen emphasized that the future of the digital economy hinges on stricter regulatory enforcement and the adoption of decentralized technologies that empower users with absolute control over their information, rather than treating them as products to be sold.

Outsourcing contracts weren't built for AI. CIOs are renegotiating now

The rapid advancement of generative artificial intelligence is necessitating a major overhaul of IT outsourcing agreements, as traditional contracts centered on headcount and billable hours prove incompatible with AI-driven efficiency. This InformationWeek article explains that while service providers promise productivity gains of up to 70%, legacy full-time equivalent (FTE) models fail to account for this increased output, leading CIOs to aggressively renegotiate for outcome-based pricing. This shift allows organizations to pay for specific results rather than human time, yet it introduces significant legal complexities. Key concerns include data sovereignty—where proprietary data might inadvertently train a provider's large language model—and intellectual property risks regarding the ownership of AI-generated code. Furthermore, the ability of AI to automate routine tasks is prompting some enterprises to bring previously outsourced functions back in-house, as smaller internal teams can now manage workloads that once required massive offshore cohorts. To navigate these challenges, technical leaders are implementing "gain-sharing" frameworks and rigorous governance standards to manage risks like AI hallucinations and liability. Ultimately, CIOs are assuming a more central role in procurement to ensure that vendor incentives align with genuine innovation and that the financial benefits of automation are captured by the enterprise.

Bad bots make up 40% of internet traffic

The "2026 Thales Bad Bot Report: Bad Bots in the Agentic Age" reveals a transformative shift in internet traffic, where automated activity now accounts for 53% of all web interactions, surpassing human traffic for the second consecutive year. Malicious "bad bots" alone comprise 40% of global traffic, highlighting a growing threat landscape. A critical finding is the 12.5x surge in AI-driven bot attacks, fueled by the rapid adoption of agentic AI which blurs the lines between legitimate and harmful automation. These advanced bots are increasingly targeting APIs, with 27% of attacks now bypassing traditional interfaces to exploit backend logic directly at machine speed. The financial services sector remains the most vulnerable, suffering 24% of all bot attacks and nearly half of all account takeover incidents. Thales experts, including Tim Chang, emphasize that the primary security challenge has evolved from simple bot identification to the complex analysis of behavioral intent. As AI agents emerge as a new traffic category, organizations must transition to proactive, intent-based defenses that can distinguish between helpful AI agents and malicious automation. This machine-driven era necessitates deeper visibility into API traffic and identity systems to maintain trust and security across modern digital infrastructures.

Incentive drift: Why transformation fails even when everything looks green

In the article "Incentive Drift: Why Transformation Fails Even When Everything Looks Green," Mehdi Kadaoui explores the paradoxical failure of IT transformations that appear successful on paper. The central challenge is "incentive drift"—the structural separation of authority from accountability that leads organizations to optimize for project delivery rather than business value. This drift manifests through several destructive patterns: the "ownership vacuum," where strategy and execution are disconnected; the "budgetary firewall," which isolates capital spending from operational costs; and "language capture," where success definitions are subtly redefined to ensure "green" status. Kadaoui argues that "collective amnesia" often follows, as organizations quietly lower their expectations to avoid acknowledging failure. To resolve this, he proposes making drift "structurally expensive" through three key mechanisms. First, a "value prenup" requires operational leaders to explicitly own and sign off on intended outcomes before development begins. Second, a "cost mirror" forces transparency across budget ledgers. Finally, a "semantic anchor" ensures original goals are read aloud in every governance meeting to prevent meaning erosion. By grounding digital transformation in rigid accountability and linguistic clarity, leadership can ensure that technological outputs translate into genuine, durable enterprise value.

How to Be a Great Data Steward: 6 Core Skills to Build

The article "Core Data Stewardship Skills to Build" emphasizes that effective data stewardship requires a unique blend of technical proficiency, business acumen, and interpersonal skills. High-performing stewards act as "purple people," bridging the gap between IT and business by translating complex technical standards into actionable business practices. Key operational activities include identifying and documenting Critical Data Elements (CDEs), aligning them with precise business terms, and performing data profiling to identify quality issues. Beyond basic documentation, stewards must master data classification to ensure regulatory compliance with frameworks like GDPR or HIPAA. Analytical thinking is essential for interpreting patterns and uncovering root causes of data inconsistencies, while strong communication skills enable stewards to foster a collaborative, data-driven culture. Furthermore, literacy in adjacent domains such as metadata management, master data management (MDM), and the use of modern data catalogs is vital. Ultimately, the role is outcome-driven; stewards do not just manage data for its own sake but focus on ensuring data health to drive measurable organizational value. By combining attention to detail with strategic consistency, data stewards serve as the essential operational guardians who transform raw data into a reliable, high-quality strategic asset for their organizations.

Researchers unearth industrial sabotage malware that predated Stuxnet by 5 years

Researchers from SentinelOne recently uncovered a sophisticated malware framework, dubbed "Fast16," that predates the infamous Stuxnet worm by five years. Active as early as 2005, this discovery shifts the timeline of state-sponsored industrial sabotage, proving that nation-states were deploying cyberweapons against physical infrastructure much earlier than previously understood. Unlike typical espionage tools designed for data theft, Fast16 was engineered for strategic sabotage by targeting high-precision floating-point arithmetic operations within engineering modeling software. By corrupting the logic of the Floating Point Unit (FPU), the malware produced subtly altered outputs in complex simulations, potentially leading to catastrophic real-world failures. The researchers identified three specific targeted engineering programs, including one previously associated with Iran’s AMAD nuclear program and another widely used in Chinese structural design. The modular nature of Fast16, which utilizes encrypted Lua bytecode, underscores its advanced design and national importance. This finding highlights a historical precedent for cyberattacks on critical workloads in fields such as advanced physics and nuclear research. Ultimately, Fast16 serves as a significant harbinger for modern industrial sabotage, demonstrating that the transition from strategic espionage to physical disruption in cyberspace was already in full swing two decades ago, long before Stuxnet gained global notoriety.

How AI Is Transforming Business Continuity and Crisis Response

Charlie Burgess’s article, "How AI Is Transforming Business Continuity and Crisis Response," explores the pivotal role of artificial intelligence in navigating the complexities of modern digital and physical risks. As businesses face increasingly non-linear threats, from supply chain disruptions to cyber incidents, the abundance of generated data often leads to information overload. AI addresses this by acting as a sophisticated data analysis tool that parses vast information streams to identify hidden patterns and suppress low-priority noise. This allows crisis teams to focus on critical alerts and early warning signs. Furthermore, AI enhances situational awareness and coordination by correlating disparate system inputs and surfacing standardized playbook responses. During active incidents, technologies like AI-powered cameras provide real-time visibility, aiding in personnel safety and evacuation efforts. Beyond immediate response, AI suggests optimized recovery paths and strategic resource allocation, fostering long-term operational resilience. Ultimately, the integration of AI is not intended to replace human judgment but to empower decision-makers with actionable insights and agility. By bridging the gap between data collection and decisive action, AI transforms business continuity from a reactive necessity into a proactive, evidence-based strategic asset that safeguards both personnel and organizational stability in an unpredictable global landscape.

Europe Gliding Toward Mandatory Online Age Verification

The European Commission is accelerating its push toward mandatory online age verification, driven by the Digital Services Act's requirements to protect minors from harmful content. Central to this initiative is a new age assurance framework and a "technically ready" open-source mobile app designed to allow users to prove they are over a certain age using national identity documents without disclosing their full identity. However, this transition faces intense scrutiny. Security researchers recently identified significant vulnerabilities in the commission's prototype app, labeling it "easily hackable." Furthermore, privacy advocates, such as representatives from Tuta, warn that centralized age verification creates a lucrative "gold mine" for hackers, potentially exacerbating risks like phishing and identity theft. Despite these concerns, European officials like Henna Virkkunen emphasize that the DSA demands concrete action over mere terms of service, particularly following allegations that platforms like Meta have failed to adequately exclude children under thirteen. As several European nations consider raising minimum age requirements for social media, the commission continues to advocate for "robust and non-discriminatory" verification tools that can be integrated into national digital wallets, insisting that ongoing security testing will eventually yield a reliable solution for safeguarding the digital environment for children.

CodeGuardian: A Model Context Protocol Server for AI-Assisted Code Quality Analysis and Security Scanning

"CodeGuardian: A Model Context Protocol Server for AI-Assisted Code Quality Analysis and Security Scanning" introduces a breakthrough tool designed to integrate enterprise-grade security and quality checks directly into AI-powered development environments. Authored by Madhvesh Kumar and Deepika Singh, the article details how CodeGuardian leverages the Model Context Protocol (MCP) to extend coding assistants with eleven specialized analysis tools. This integration eliminates the friction of context-switching by allowing developers to execute security scans, identify hardcoded secrets across multiple layers, and generate compliant Software Bill of Materials (SBOM) using simple natural language prompts. Unlike traditional static analysis tools that merely flag issues, CodeGuardian provides context-aware, "drop-in" code remediations tailored to a project's specific framework and style. A core feature is its cross-layer security reporting, which aggregates findings into a single risk score, exposing systemic vulnerabilities that isolated scanners often miss. By shifting security "left" into the immediate coding workflow, the tool empowers developers to build more resilient software while maintaining high delivery velocity. Ultimately, CodeGuardian represents a pivot toward "agentic" security, where AI assistants act as proactive guardians of code integrity throughout the development lifecycle, effectively bridging the gap between rapid feature delivery and robust organizational compliance.

Daily Tech Digest - December 11, 2025

Quote for the day:

"We become what we think about most of the time, and that's the strangest secret." -- Earl Nightingale

SEON Predicts Fraud’s Next Frontier: Entering the Age of Autonomous Attacks

AI has become a permanent part of the fraud landscape, but not in the way many expected. AI has transformed how we detect and prevent fraud, from adaptive risk scoring to , but full autonomy remains out of reach. Fraud detection still depends on human judgment, such as weighing intent, interpreting ambiguity, and understanding context that no model can fully replicate. Fraud prevention is a complex interplay of data, intent, and context, and that is where human reasoning continues to matter most. Analysts interpret ambiguity, weigh risk appetite, and understand social signals that no model can fully replicate. What AI can do is amplify that capability. ... The boundary between genuine and synthetic activity is blurring. can now simulate human interaction with high accuracy, including realistic typing rhythms, believable navigation flows, and that replicate natural variance. The traditional approach of searching for the red flags no longer works when those flags can be easily fabricated. The next evolution in fraud detection will come from . By modelling how real users act over time, and looking at their rhythms, routines, and inconsistencies, we can identify the subtle deviations that synthetic agents struggle to mimic. It is the behavioural equivalent of knowing a familiar face in a crowd. Trust comes from recognition, not reaction.

The Invisible Vault: Mastering Secrets Management in CI/CD Pipelines

In the high-speed world of modern software development, Continuous Integration and Continuous Deployment (CI/CD) pipelines are the engines of delivery. They automate the process of building, testing, and deploying code, allowing teams to ship faster and more reliably. But this automation introduces a critical challenge: How do you securely manage the "keys to the kingdom"—the API tokens, , , and that your applications and infrastructure require? ... A single misstep can expose your entire organization to a devastating data breach. Recent breaches in CI/CD platforms have shown how exposed organizations can be when secrets leak or pipelines are compromised. As pipelines scale, the complexity and risk grow with them. ... The cryptographic algorithms that currently secure nearly all digital communications (like and used in ) are vulnerable to being broken by a sufficiently powerful quantum computer. While such computers do not yet exist at scale, they represent a future threat that has immediate consequences due to "harvest now, decrypt later" attacks. ... Relevance to CI/CD Secrets Management: The primary risk is in the transport of secrets. The secure channel (TLS) established between your CI/CD runner and your Secrets Manager is the point of vulnerability. To future-proof your pipeline, you need to consider moving towards PQC-enabled protocols.

Experience Really Matters - But Now You're Fighting AI Hacks

Defenders traditionally rely on understanding the timing and ordering of events. The shows that AI-driven activity occurs in extremely rapid cycles. Reconnaissance, exploit refinement and privilege escalation can occur through repeated attempts that adjust based on feedback from the environment. This creates a workflow that resembles iterative code generation rather than a series of discrete intrusion stages. Professionals must now account for an adversary that can alter its approach within seconds and can test multiple variations of the same technique without the delays associated with human effort. ... The AI attacker moved across cloud systems, identity structures, application layers and internal services. It interacted fluidly with whatever surface was available. Professionals who have worked primarily within a single domain may now need broader familiarity with adjacent layers of the stack because AI-driven activity does not limit itself to the boundaries of established specializations. ... The workforce shortage in will continue, but the qualifications for advancement are shifting. Organizations will look for professionals who understand both the capabilities and the limitations of . Those who can read an AI-generated artifact, refine an automated detection workflow, or construct an updated threat model will be positioned for leadership roles.

Is vibe coding the new gateway to technical debt?

The big idea in AI-driven development is that now we can just build applications by describing them in plain English. The funny thing is, describing what an application does is one of the hardest parts of software development; it’s called requirements gathering. ... But now we are riding a vibe. A vibe, in this case, is an unwritten requirement. It is always changing—and with AI, we can keep manifesting these whims at a good clip. But while we are projecting our intentions into code that we don’t see, we are producing hidden effects that add up to masses of technical debt. Eventually, it will all come back to bite us. ... Sure, you can try using AI to fix the things that are breaking, but have you tried it? Have you ever been stuck with an AI assistant confidently running you and your code around in circles? Even with something like and integration (where the AI has access to the server and client-side outputs) it can so easily descend into a maddening cycle. In the end, you are mocked by your own unwillingness to roll up your sleeves and do some work. ... If I had to choose one thing that is the most compelling about , it would be the ability to quickly scale from nothing. The moment when I get a whole, functioning something based on not much more than an idea I described? That’s a real thrill. Weirdly, AI also makes me feel less alone at times; like there is another voice in the room.

How to Be a Great Data Steward: Responsibilities and Best Practices

Data is often described as “a critical organizational asset,” but without proper stewardship, it can become a liability rather than an asset. Poor data management leads to inaccurate reporting, compliance violations, and reputational damage. For example, a financial institution that fails to maintain accurate customer records risks incurring regulatory penalties and causing customer dissatisfaction. ... Effective is guided by several foundational principles: accountability, transparency, integrity, security, and ethical use. These principles ensure that data remains accurate, secure, and ethically managed across its lifecycle. ... Data stewards can be categorized into several types: , technical data stewards, , and . Each plays a unique role in maintaining data quality and compliance in conjunction with other data management professionals, technical teams, and business stakeholders. ... Data stewardship thrives on clarity. Every data steward should have well-defined responsibilities and authority levels, and each data stewardship team should have clear boundaries and expectations identified. This includes specifying who manages which datasets, who ensures compliance, and who handles data quality issues. Clear role definitions prevent duplication of effort and ensure accountability across the organization.

Time for CIOs to ratify an IT constitution

is simultaneously a massive value multiplier and a must-immediately-take-a-nap-boring topic for executives. For busy moderns, governance is as intellectually palatable as the stale cabbage on the table René Descartes once doubted. How do CIOs get key stakeholders to care passionately and appropriately about how IT decisions are made? ... Everyone agrees that one can’t have a totally centralized, my-way-or-the-highway dictatorship or a totally decentralized you-all-do-whatever-you-want, live-in-a-yurt digital commune. Has the stakeholder base become too numerous, too culturally disparate, and too attitudinally centrifugal to be governed at all? ... Has IT governance sunk to such a state of disrepair that a total rethink is necessary? I asked 30 CIOs and thought leaders what they thought about the current state of IT governance and possible paths forward. The for IT at a state college in the northeast argued that if the CEO, the board of directors, and the CIO were “doing their job, a constitution would not be necessary.” The CIO at a midsize, mid-Florida city argued that writing an effective IT constitution “would be like pushing water up a wall.” ... CIOs need to have a conversation regarding IT rights, privileges, duties, and responsibilities. Are they willing to do so? ... It appears that IT governance is not a hill that CIOs are willing to expend political capital on.

Flash storage prices are surging – why auto-tiering is now essential

Across industries and use cases, a consistent pattern emerges. The majority of data becomes cold shortly after it is created. It is written once, accessed briefly, then retained for long periods without meaningful activity. does not require low latency, high IOPS, expensive endurance ratings or premium, power-intensive performance tiers. It only needs to be stored reliably at the lowest reasonable cost. Yet during the years when was only marginally more expensive than , many organisations placed on flash systems simply because the price difference felt manageable. With today’s economics, that model can no longer scale. ... The rise in also helped drive flash adoption. Organisations sought faster backups, quicker restores, and higher snapshot retention. Flash delivered these benefits, but the economics are breaking under current pricing conditions. Today, the cost of flash-based backup appliances is rising, long-term retention on flash is becoming unsustainable, and maintaining deep histories on premium media no longer aligns with budget expectations. ... The current flash pricing crisis is more than a temporary spike. It signals a long-term shift in storage economics driven by accelerating AI demand, constrained supply chains, and global data growth. The all-flash mindset of the past decade is now colliding with financial realities that organisations can no longer ignore. Cold data should not be placed on expensive media.

AI, sustainability and talent gaps reshape industrial growth

A new study by , a company, in partnership with HFS Research, reveals a widening divide between industrial enterprises’ ambitions and their real-world readiness for AI, sustainability, and workforce transformation. Despite strong executive push towards modernization, skills shortages, legacy systems, and misaligned priorities continue to stall progress across key industrial segments. ... The findings lay bare the scale of transition ahead: while industries recognize AI and sustainability as foundational for future competitiveness, a lack of talent and weak integration strategies are slowing measurable impact. “Industrial leaders see AI, sustainability, and talent as top priorities, yet struggle to convert these ambitions into tangible results,” said , President and CEO at GlobalLogic. ... Although operational cost reduction is the top priority today, the study finds that within two years, AI adoption and operational optimization will dominate executive focus. The industrial sector is preparing for a shift from incremental improvements to deep automation and intelligence-led models. ... “Enterprises need to embed sustainability, talent, and technology transitions into both strategy and day-to-day operations,” said , . “Clear outcomes and messaging are essential to show current and future workforces that industrial organizations are shaping — not chasing — the sustainable, tech-driven future.”

When ransomware strikes, who takes the lead -- the CIO or CISO?

"[CIOs and CISOs] will probably have different priorities for when they want to do things; the CIO is going to be more concerned [about the] business side of keeping systems operational, whereas the CISO [wants to know] where is this critical data? Is it being exfiltrated? Having a good , planning that stuff out in advance [is necessary so both parties know] what steps they're supposed to take. "The best default to contain the attack is to pull internet connectivity. You don't want to restart a system [or] shut it down, because you can lose forensic evidence. That way, if they are exfiltrating any data, that access stops, so you can begin triaging how they got in and patch that hole up. ... the first three steps come down to confirm, contain and anchor. We want to confirm that blast radius, not hypothesize or theorize what it could be, but what is it really? You'd be surprised at how many teams burn their most valuable hour debating whether it's really ransomware. "Second, contain first, communicate second. I think there's a natural [tendency for] humans to send an all-hands email out, call an emergency meeting and even notify customers. What matters most is to triage and stop the bleeding, isolate those compromised systems and cripple the bad actor's lateral movement. ... "[The best way to contain a ransomware attack will be different for each organization depending on their architectures, controls and technology, but in general, isolate as completely as possible.

LLM vulnerability patching skills remain limited

Because the models rely on patterns they have learned, a shift in structure can break those patterns. The model may still spot something that looks like the original flaw, but the fix it proposes may no longer land in the right place. That is why a patch that looks reasonable can still fail the exploit test. The weakness remains reachable because the model addressed only part of the issue or chose the wrong line to modify. Another pattern surfaced. When a fix for an artificial variant did appear, it often came from only one model. Others failed on the same case. This shows that each artificial variant pushed the systems in different directions, and only one model at a time managed to guess a working repair. The lack of agreement across models signals that these variants exposed gaps in the patterns the systems depend on. ... and models landed behind that mark but contributed steady fixes in several scenarios. The spread shows that gains do not come from one vendor alone. The study also checked overlap. Authentic issues showed substantial agreement between models, while artificial issues showed far less. Only two issues across the entire set were patched by one model and not by any other. This suggests that combining several models adds limited coverage. ... Researchers plan to extend this work in several ways. One direction involves combining output from different or from repeated runs of the same model, giving the patching process a chance to compare options before settling on one.