Daily Tech Digest by Kannan Subbiah: data trust

Showing posts with label data trust. Show all posts

Daily Tech Digest - January 01, 2026

Quote for the day:

"It always seems impossible until it’s done." -- Nelson Mandela

Why data trust is the missing link in digital transformation

Data trust is often framed as a technical issue, delegated to IT or data teams. In reality, it is a business capability with direct implications for growth, risk, and reputation. Trusted data enables organisations to: Confidently automate customer and operational workflows; Personalise experiences without introducing errors; Improve forecasting and performance reporting; and Reduce operational rework and exception handling When data cannot be trusted, leaders are forced to rely on manual checks, conservative assumptions, and duplicated processes. This increases cost and slows decision-making - the opposite of what digital transformation aims to achieve. .... Establishing data trust is not a one-time project. It requires a shift in mindset across the organisation. Data quality should be viewed as a shared responsibility, supported by the right processes and tools. Leading organisations embed data validation into their digital workflows, measure data quality as part of system health, and treat trusted data as a strategic asset. Over time, this creates a culture where decisions are made with confidence and transformation initiatives are more likely to succeed. ... Digital transformation is ultimately about enabling better decisions, faster execution, and stronger customer relationships. None of these goals can be achieved without trusted data. As organisations continue to modernise their platforms and processes, data quality should be treated as core infrastructure, not an afterthought.

Health Data Privacy, Cyber Regs: What to Watch in 2026

When federal regulators hesitate, states often jump into filing privacy and security gaps involving health data. That includes mandates in New York to shore up cybersecurity at certain hospitals (see: New York Hospitals Are Facing Tougher Cyber Rules Than HIPAA). Also worth watching is the New York Health Information Privacy Act, Greene said. "It was passed by both New York legislative chambers in January but has not yet been formally submitted to the governor for signature, with lobbying efforts underway to amend it." "In its most recent version, it would be the toughest health privacy law in the country in many respects, including a controversial prohibition on obtaining consents for secondary uses of data until at least 24 hours after an individual creates an account or first uses the requested product or service," Greene said. ... Greene predicted HIPAA resolution agreements and civil monetary penalties will continue much as they have in years past, with one to two dozen such cases next year. HHS has recently indicated that it intends to begin enforcing the Information Blocking Rule. "The primary target will be health IT developers," Greene said. "I expect that there are less information blocking issues with health information networks and believe that the statute and regulation's knowledge standard makes it more challenging to enforce against healthcare providers because the government must prove that a healthcare provider knew its practice to be unreasonable."

From integration pain to partnership gain: How collaboration strengthens cybersecurity

When collaborators leverage data in specific cybersecurity work, they unlock several valuable benefits, especially since no organization has complete insight into every possible threat. A shared, data-driven cybersecurity framework can offer both sides a better understanding of existing and emerging threats that could undermine one or both collaborators. Data-driven collaboration also enables partners to become more proactive in their cybersecurity posture. Coordinated data can give business partners insights into where there’s greater exposure for a cyberattack, allowing partners to work together with data-backed guidance on how to better prepare. ... The Vested model — an innovative approach based on research from the University of Tennessee — focuses on shared goals and outcomes rather than traditional transactional buyer and seller agreements. Both companies agreed on a specific set of KPIs they could use to measure the health of the partnership and keep their security goals on track, allowing them to continue to adapt cybersecurity initiatives as needs and threats evolve. “You have to build, maintain and exercise the right partnerships with business units and shared services across the enterprise so continuity plans identify the issue quickly, deploy appropriate mitigations, and ultimately restore client and business services as quickly as possible,” says Royce Curtin, IBM’s former VP of corporate security.

AI governance: A risk and audit perspective on responsible AI adoption

AI governance refers to the policies, procedures, and oversight mechanisms that guide how AI systems are developed, deployed, and monitored. It ensures that AI aligns with business objectives, complies with applicable laws, and operates in a way that is ethical and transparent. Regulatory scrutiny is increasing. The EU AI Act is setting a precedent for global standards, and U.S. agencies are signaling more aggressive enforcement, particularly in sectors like healthcare, finance, and employment. Organizations are expected to demonstrate accountability in how AI systems make decisions, manage data, and interact with users. Beyond regulation, there is growing pressure from customers, employees, and investors. ... Audit teams also help boards and audit committees understand the risks associated with AI. Their work supports transparency and builds trust with regulators and stakeholders. As AI becomes more embedded in business operations, internal audit must expand its scope to include model governance, data lineage, and ethical risk. ... Organizations that treat AI as a strategic risk are better positioned to scale it responsibly. Risk and internal audit teams have a central role in ensuring that AI systems are secure, compliant, and aligned with business goals. Citrin Cooperman helps organizations navigate AI adoption with confidence by combining deep risk expertise, practical governance frameworks, and advanced technology solutions that support secure, scalable, and compliant growth.

Six data shifts that will shape enterprise AI in 2026

While RAG won't entirely disappear in 2026, one approach that will likely surpass it in terms of usage for agentic AI is contextual memory, also known as agentic or long-context memory. This technology enables LLMs to store and access pertinent information over extended periods. Multiple such systems emerged over the course of 2025 including Hindsight, A-MEM framework, General Agentic Memory (GAM), LangMem, and Memobase. RAG will remain useful for static data, but agentic memory is critical for adaptive assistants and agentic AI workflows that must learn from feedback, maintain state, and adapt over time. In 2026, contextual memory will no longer be a novel technique; it will become table stakes for many operational agentic AI deployments. ... In 2025, we saw numerous innovations, like the notion that an AI is able to parse data from an unstructured data source like a PDF. That's a capability that has existed for several years, but proved harder to operationalize at scale than many assumed. Databricks now has an advanced parser, and other vendors, including Mistral, have emerged with their own improvements. The same is true with natural language to SQL translation. While some might have assumed that was a solved problem, it's one that continued to see innovation in 2025 and will see more in 2026. It's critical for enterprises to stay vigilant in 2026.

Communicating AI Risk to the Board With Confidence

Most board members can comprehend that AI will drive growth. What they fail to grasp concretely is how the technology introduces a massive amount of exposure. This predicament is typically a result of how information is presented. Security and risk managers (SRMs) often describe AI incidents in the vocabulary of adversarial inputs, model drift, and architecture choices, which matter deeply but rarely answer the questions that directors tackle during their meetings. High-level stakeholders, in reality, are concerned with issues such as revenue protection, operational continuity, and competitive differentiation, creating a gap that requires more than translating acronyms. ... Traditional discussions about technology risk revolve around the triad of confidentiality, integrity, and availability. Boards know these categories well, and over the past few decades, they have learned that cybersecurity failures directly affect the business along these lines. GenAI has formidably challenged this familiar structure, with its associated risks not limited to one of these three domains. ... When the conversation begins with the business consequence, though, the relevance is immediate. The most effective approach involves replacing those mechanics that mean so much to the internal teams with the strategic information boards need to operate. These details open a path for meaningful conversations that encourage directors to think through the implications and make more informed decisions.

The six biggest security challenges coming in 2026

For many organizations, cybersecurity and resilience is a compliance exercise. But it must evolve into “a core intentional cybersecurity capability”, says Dimitriadis. “In 2026, organizations will need to build the capacity to anticipate regulatory changes, understand their strategic implications, and embed them into long-term planning.” ... Attackers are leveraging AI to create convincing email templates and fake websites “almost indistinguishable” from real ones – and without the common warning signs employees are trained to identify, says Mitchell. AI is also being used in vishing attacks, with deepfakes making it easier to clone the voice of high-ranking company executives to trick victims. In 2026, there will be more attacks utilizing realistic voice cloning and high-quality video deepfakes, says Joshua Walsh ... There is a current shift towards agentic AI that can take real-world actions, such as adjusting configurations, interacting with APIs, booking services and initiating financial tasks. This can increase efficiency, but it can also lead to unsafe decisions made at speed, says rradar’s Walsh. An agent told to "optimize performance" might disable logging or bypass authentication because it views security controls as delays, he suggests. Prompt injection is a hidden issue to look out for, he adds. “If a threat actor slips hidden instructions into data that the agent consumes, they can make it run actions on internal systems without anyone realising.”

5 Changes That Will Define AI-Native Enterprises in 2026

As enterprises scale to multi-agent systems, the engineering focus will shift from creating prompts to architecting context. Multi-agent workflows rapidly expand requirements with tool definitions, conversation history, and data from multiple sources. This creates two challenges: context windows fill up, and models suffer from “context rot,” forgetting information buried in lengthy prompts. By mid-2026, context engineering will emerge as a distinct discipline with dedicated teams and specialized infrastructure, serving the minimal but complete information agents need. The best context engineers will understand both LLM constraints and their business domain’s semantic structure. ... Enterprises are realizing that AI agents need both data and meaning. Companies that spent years perfecting data lakes are already finding those assets are insufficient. AI can retrieve data, but without semantic context, it can’t interpret action or intent. That’s why teams will move beyond vector search toward building knowledge graphs, ontologies, and metadata-driven maps that teach AI how their business works. The battleground will shift from owning raw data to owning its interpretation. Off-the-shelf agents will struggle in complex domains because semantics are domain-specific. ... The AI-native enterprise looks very different from what came before. It serves machine customers, treats context as critical infrastructure, and has the tools to escape decades of technical debt.

Microsegmentation: the unsung hero of cybersecurity (and why it should be your top priority)

Think of your network like an apartment building. You’ve got a locked front door — that’s your perimeter. But once someone gets inside, there’s no front desk checking IDs, no elevator security and the same outdated lock on every unit. An intruder can roam freely, entering any apartment they choose. Microsegmentation is the internal security system. It’s the keycard for the elevator, the camera in the hallway, the unique lock on your door. It’s what stops one compromised device from becoming a full-blown breach. ... OT environments are different. They’re often built on legacy systems, lack patching and operate in real-time. You can’t just drop an agent or reroute traffic without risking downtime. That’s why agencies need solutions that are agentless, software-defined and tailored to the unique constraints of OT. Otherwise, you’re only protecting half the house. ... Microsegmentation also plays a critical role in enabling zero trust. It enforces least privilege at the network level. It’s not just about who gets in; it’s about what they can touch once they’re inside. For agencies building toward zero trust, microsegmentation isn’t an afterthought. It’s a foundation. Despite all this, microsegmentation remains underutilized. According to TechTarget’s Enterprise Strategy Group, only 36% of organizations use it today, even though it’s foundational to zero trust. Why? Because 28% believe it’s too complex. But that perception is often rooted in outdated tooling.

Beyond Chatbots: What Makes an AI Agent Truly Autonomous

Autonomous agents must retain and use context over time. Memory enables an agent to recall previous interactions, data, and decisions—allowing it to continue a process seamlessly without restarting each time. That persistence turns single exchanges into long-running workflows. In enterprise settings, it means an agent can track a contract review across multiple sessions or follow a complex support case without losing context. ... Traditional automation runs on fixed, rule-based workflows. Autonomous agents build and revise their own plans on the fly, adapting to results and feedback. This ability to plan dynamically—think, act, observe, and adjust—is what differentiates agentic AI from robotic process automation (RPA) or prompt chaining. In practice, an agent might be tasked with analyzing a set of contracts, then automatically decide how to proceed: extract key terms, assess risk, and summarize results. ... Resilient agents are designed to operate across models, retry failed actions, or launch sub-agents to handle specialized work—all within defined guardrails. That adaptability is what separates a proof of concept (POC) from a production-ready system. ... All the reasoning in the world means little if an agent can’t execute. Tools are what translate intelligence into impact. They’re the functions, APIs, and integrations that allow agents to interact with business systems—searching systems, generating documents, updating records, or triggering workflows across CRMs, ERPs, and analytics platforms.

Daily Tech Digest - December 06, 2025

Quote for the day:

"The distance between insanity and genius is measured only by success." -- Bruce Feirstein

AI denial is becoming an enterprise risk: Why dismissing “slop” obscures real capability gains

After all, by any objective measure AI is wildly more capable than the vast majority of computer scientists predicted only five years ago and it is still improving at a surprising pace. The impressive leap demonstrated by Gemini 3 is only the latest example. At the same time, McKinsey recently reported that 20% of organizations already derive tangible value from genAI. ... So why is the public buying into the narrative that AI is faltering, that the output is “slop,” and that the AI boom lacks authentic use cases? Personally, I believe it’s because we’ve fallen into a collective state of AI denial, latching onto the narratives we want to hear in the face of strong evidence to the contrary. Denial is the first stage of grief and thus a reasonable reaction to the very disturbing prospect that we humans may soon lose cognitive supremacy here on planet earth. In other words, the overblown AI bubble narrative is a societal defense mechanism. ... It’s likely that AI will soon be able to read our emotions faster and more accurately than any human, tracking subtle cues in our micro-expressions, vocal patterns, posture, gaze and even breathing. And as we integrate AI assistants into our phones, glasses and other wearable devices, these systems will monitor our emotional reactions throughout our day, building predictive models of our behaviors. Without strict regulation, which is increasingly unlikely, these predictive models could be used to target us with individually optimized influence that maximizes persuasion.

A smarter way for large language models to think about hard problems

“The computational cost of inference has quickly become a major bottleneck for frontier model providers, and they are actively trying to find ways to improve computational efficiency per user queries. For instance, the recent GPT-5.1 release highlights the efficacy of the ‘adaptive reasoning’ approach our paper proposes. By endowing the models with the ability to know what they don’t know, we can enable them to spend more compute on the hardest problems and most promising solution paths, and use far fewer tokens on easy ones. That makes reasoning both more reliable and far more efficient,” says Navid Azizan, the Alfred H. and Jean M. Hayes ... Typical inference-time scaling approaches assign a fixed amount of computation for the LLM to break the problem down and reason about the steps. Instead, the researchers’ method, known as instance-adaptive scaling, dynamically adjusts the number of potential solutions or reasoning steps based on how likely they are to succeed, as the model wrestles with the problem. “This is how humans solve problems. We come up with some partial solutions and then decide, should I go further with any of these, or stop and revise, or even go back to my previous step and continue solving the problem from there?” Wang explains. ... “The beauty of our approach is that this adaptation happens on the fly, as the problem is being solved, rather than happening all at once at the beginning of the process,” says Greenewald.

Extending Server Lifespan: Cost-Saving Strategies for Data Centers

Predicting server lifespan is complicated, as servers don’t typically wear out at a consistent rate. In fact, many of the components inside servers, like CPUs, don’t really wear out at all, so long as they’re not subject to unusual conditions, like excess heat. But certain server parts, such as hard disks, will eventually fail because they contain mechanical components that wear down over time. ... A challenge is that cooler server rooms often lead to higher data center energy costs, and possibly greater water usage, due to the increased load on cooling systems. But if you invest in cooling optimization measures, it may be possible to keep your server room cool without compromising on sustainability goals. ... Excess or highly fluctuating electrical currents can fry server components. Insufficient currents may also cause problems, as can frequent power outages. Thus, making smart investments in power management technologies for data centers is an important step toward keeping servers running longer. The more stable and reliable your power system, the longer you can expect your servers to last. ... The greater the percentage of available CPU and memory a server uses on a regular basis, the more likely it is to wear out due to the increased load placed on system components. That’s why it’s important to avoid placing workloads on servers that continuously max out their resource consumption.

Sleepless in Security: What’s Actually Keeping CISOs Up at Night

While mastering the fundamentals keeps your organization secure day to day, CISOs face another, more existential challenge. The interconnected nature of the modern software ecosystem — built atop stacks of open-source components and complex layers of interdependent libraries — is always a drumbeat risk in the background. It’s a threat that often flies under the radar until it’s too late. ... While CISOs can’t rewrite the entire software ecosystem, what they can do is bring the same discipline to third-party and open-source risk management that they apply to internal controls. That starts with visibility, especially when it comes to third-party libraries and packages. By maintaining an accurate and continuously updated inventory of all components and their dependencies, CISOs can enforce patching and vulnerability management processes that enable them to respond quickly to bugs, breaches, vulnerabilities, and other potential challenges. ... The cybersecurity landscape is relentless—and the current rate of change is unlikely to shift anytime soon. While splashy headlines soak up a lot of the attention, the things keeping CISOs awake at night usually look a little different. The fundamentals we often take for granted and the fragile systems our enterprises depend on aren’t always as secure as they seem, and accounting for that risk is critical. From basic hygiene like user lifecycle management and MFA coverage to the sprawling, interdependent web of open-source software, the threats are systemic and constantly evolving.

Agents-as-a-service are poised to rewire the software industry and corporate structures

AI agents are set to change the dynamic between enterprises and software vendors in other ways, too. One major difference between software and agents is software is well-defined, operates in a particular way, and changes slowly, says Jinsook Han, chief of strategy, corporate development, and global agentic AI at Genpact. “But we expect when the agent comes in, it’s going to get smarter every day,” she says. “The world will change dramatically because agents are continuously changing. And the expectations from the enterprises are also being reshaped.” ... Another aspect of the agentic economy is instead of a human employee talking to a vendor’s AI agent, a company agent can handle the conversation on the employee’s behalf. And if a company wants to switch vendors, the experience will be seamless for employees, since they never had to deal directly with the vendor anyway. “I think that’s something that’ll happen,” says Ricardo Baeza-Yates, co-chair of the US technology policy committee at the Association for Computing Machinery. “And it makes the market more competitive, and makes integrating things much easier.” In the short term, however, it might make more sense for companies to use the vendors’ agents instead of creating their own. ... That doesn’t mean SaaS will die overnight. Companies have made significant investments in their current technology infrastructure, says Patrycja Sobera, SVP of digital workplace solutions at Unisys.

Beyond the Buzzword: The Only Question that Matters for AI in Network Operations

The problem isn’t the lack of information; it’s the volume and pace at which information arrives from a dozen different monitoring tools that can’t communicate with each other. You know the pattern: the tool sprawl problem definitely exists. A problem occurs, and it’s no longer just an alarm—it’s a full-blown storm of noise out of which you can’t differentiate the source of the problem. Our ops teams are the real heroes who keep the lights on and spend way too much of their time correlating information across various screens. They are essentially trying to jump from network to log file to application trace as the clock ticks. ... In operations, reliability is everything. You cannot build a house on shifting sand, and you certainly can’t build a reliable operational strategy on noisy, inconsistent data. If critical context is missing, even the most sophisticated model will start to drift toward educated guesswork. It’s like commissioning an architect to design a skyscraper without telling them where the foundation will be or what soil they’ll be working with. ... The biggest shortcoming of traditional tools is the isolated visibility they provide: they perceive incidents as a series of isolated points. The operator receives three notifications: one regarding the routing problem (NetOps), one regarding high CPU on the server (ITOps), and one regarding application latency (CloudOps). The platform receives three symptoms.

Architecting efficient context-aware multi-agent framework for production

To build production-grade agents that are reliable, efficient, and debuggable, the industry is exploring a new discipline: Context engineering — treating context as a first-class system with its own architecture, lifecycle, and constraints. Based on our experience scaling complex single- or multi-agentic systems, we designed and evolved the context stack in Google Agent Development Kit (ADK) to support that discipline. ADK is an open-source, multi-agent-native framework built to make active context engineering achievable in real systems. ... Early agent implementations often fall into the "context dumping" trap: placing large payloads—a 5MB CSV, a massive JSON API response, or a full PDF transcript—directly into the chat history. This creates a permanent tax on the session; every subsequent turn drags that payload along, burying critical instructions and inflating costs. ADK solves this by treating large data as Artifacts: named, versioned binary or text objects managed by an ArtifactService. Conceptually, ADK applies a handle pattern to large data. Large data lives in the artifact store, not the prompt. By default, agents see only a lightweight reference (a name and summary) via the request processor. When—and only when—an agent requires the raw data to answer a question, it uses the LoadArtifactsTool. This action temporarily loads the content into the Working Context.

Can Europe Build Digital Sovereignty While Safeguarding Its Rights Legacy?

The biggest constraint to the EuroStack vision is not technical — it is energy. AI and digital infrastructure demand massive, continuous power, and Europe’s grid is not yet built for it. ... Infrastructure sovereignty is impossible without sovereign capital. Aside from the Schwarz Digits pledge, general financing plans remain insufficient, and the venture financing landscape is fragmented. While the 2026 EU budget allocates €1.0 billion to the Digital Europe Programme, this foundational funding is not sufficient for the scale of EuroStack. The EU needs a unified capital markets union and targeted instruments to fund capital-intensive projects—specifically open-source infrastructure, which was identified as a strategic necessity by the Sovereign Tech Agency. ... Sovereignty requires control over the digital stack’s core layers, a control proprietary software inherently denies. The EU must view open-source technologies not just as a cheaper alternative for public procurement, but as the only viable path to technical autonomy, transparency, and resilience. ... Finally, Europe must abandon the fortress mentality. Sovereignty does not mean isolation; it means strategic interdependence. Inward-looking narratives risk ignoring crucial alliances with emerging economies. Europe must actively position itself as the global bridge-builder, offering an alternative to the US-China binary by advocating for its standards and co-developing interoperable infrastructure with emerging economies.

Avoiding the next technical debt: Building AI governance before it breaks

In fact, AI risks aren’t just about the future — they’re already part of daily operations. These risks arise when algorithms affect business results without clear accountability, when tools collect sensitive data and when automated systems make decisions that people no longer check. These governance gaps aren’t new. We saw the same issues with cloud, APIs, IoT and big data. The solution is also familiar: keep track, assess, control and monitor. ... Without the right guardrails, an agent can access systems it shouldn’t, expose confidential data, create unreliable information, start unauthorized transactions, skip established workflows or even act against company policy or ethics. These risks are made worse by how fast and independently agent AI works, which can cause big problems before people notice. In the rush to try new things, many companies launch these agents without basic access controls or oversight. The answer is to use proven controls like least privilege, segregation of duties, monitoring and accountability. ... Technical debt isn’t just about code anymore. It’s also about trusting your data, holding models accountable and protecting your brand’s reputation. The organizations that succeed with AI will be the ones that see governance as part of the design process, not as something that causes delays. They’ll move forward with clear plans and measure value and risk together.

How Data is Reshaping Science – Part 4: The New Trust Problem in Scientific Discovery

Scientific AI runs on architectures spread across billions (possibly trillions soon) of parameters, trained on datasets that remain partially or fully opaque. Peer review was built for methods a human could trace, not pipelines that mutate through thousands of training cycles. The trust layer that once anchored scientific work is now under strain. Traditional validation frameworks fall behind for the same reason. They were designed for fixed algorithms and stable datasets. Modern models shift with each retraining step, and disciplines lack shared benchmarks for measuring accuracy. ... The trust problems emerging across data-driven science point to a missing layer, one that operates beneath the experiments and above the compute. It is the layer that connects data, models, and decisions into a single traceable chain. Without it, every insight relies too heavily on the integrity of (potentially undocumented) the steps to reach this point. A modern governance system would require full provenance tracking. It would need permissions that define who can modify what and have audit trails that record data transformation. This is not an easy task, given how vast the datasets tend to be. Scientific AI complicates this further. These models shift as datasets change and as new configurations alter their behavior. That means science must adopt the same version control rigor seen in highly regulated industries.

Daily Tech Digest - November 11, 2025

Quote for the day:

"The measure of who we are is what we do with what we have." -- Vince Lombardi

Your passwordless future may never fully arrive

The challenges are many. Beyond legacy industrial systems, homegrown apps, door/facility access systems, and IoT, even routine workgroup deployment of passwordless solutions is anything but routine. Different operating systems and specialized access requirements typically translate to enterprises needing to roll out multiple passwordless packages, which can be expensive and time-consuming, and create operational delays and other friction. Worst of all, it can create new security holes as attackers try to slip between the cracks of those multiple passwordless systems. ... “Passwordless implementations typically leave a dangerous blind spot. Passwords are still there, lurking inside the passkey enrollment and recovery flows,” says Aaron Painter, CEO of Nametag. “Think of it this way: How do you really know who’s enrolling or resetting a passkey? Attackers don’t have to break the cryptography of passkeys. They go after the weakest link, whether it’s a helpdesk call, an SMS code, or a ‘can’t access my passkey’ button. By keeping both a password and a passkey, organizations multiply their attack surface.” ... Part of the passwordless debate focuses on ROI strategies. The proverbial gold at the end of the rainbow is having all password credentials eliminated. That means an attacker with a 12-month-old admin password from a breach of a partner company would have nothing of value. But as long as some passwords must be supported, the risk of such an attack remains.

CISOs are cracking under pressure

Most CISOs surveyed experienced a major security incident in the last six months. For most, that level of disruption has become normal. More than half said they are personally blamed when breaches occur, and fear their job would be at risk if a serious incident happened under their watch. That sense of personal accountability stands out because many breaches occur despite defenses being in place. Fifty-eight percent of CISOs said at least one recent incident happened even though a tool was supposed to stop it. The researchers say this gap between investment and outcome has left security leaders exposed to reputational and career risk for problems that are often beyond their control. ... Most CISOs say they can quantify risk, but more than half admit they lack standardized, business-focused metrics that make sense to leadership. Boards often want trendlines that show risk is declining or metrics that link incidents to business outcomes. Without these, the conversation between CISOs and directors can break down. This disconnect means security leaders are often held accountable without being equipped to demonstrate progress in the terms boards expect. The researchers note that aligning on a shared understanding of risk is key to reducing tension and helping CISOs do their jobs. ... Many CISOs say they’re being pushed to use AI to cut costs and automate tasks, with some already under formal mandates and others feeling growing pressure from leadership. That puts CISOs in a difficult position.

The Sustainable Transformation Roadmap: Rethink, Align, Deploy

A significant part of the success stems from the weeding out process of debt. Like technical debt in IT systems, process debt refers to the accumulation of outdated procedures, inefficient workflows, and redundant steps that have built up over years of incremental changes. These legacy practices hinder productivity and make it challenging to fully realize the benefits of digital solutions. Overall, while process debt is rampant, forward-thinking organizations succeed by treating automation as a catalyst for redesign, not a quick fix—potentially unlocking millions in annual savings per use case. To sidestep potential traps, organizations should prioritize process optimization before they begin automating. This entails a focus on audit and redesign, starting with thorough process mapping to identify process debt. ... Also, start small and iterate by piloting in low-risk areas, such as invoice chasing or design reviews, measuring against baselines to ensure automation resolves, not replicates, debt. Failure to confront process debt, Yousufani said, leads to a familiar pitfall associated with “citizen-led transformation.” Organizations distribute productivity tools hoping employees will optimize their own workflows. But at best, this bottom-up innovation results in minor efficiency gains: “If an individual deployed Gen AI, and they gain—in a best-case scenario—10% productivity, that’s 10% for one employee. The gains are much greater when looking at an entire process transformation,” he said.

Building Resilient Platforms: Insights from Over Twenty Years in Mission-Critical Infrastructure

In technology terms, a platform represents a set of integrated technologies used as a base to develop other applications or processes. The best platform builders succeed when they are taken for granted, seeing success not in recognition, but in silence. Users can work without ever thinking about the underlying infrastructure, because the platforms simply function, consistently and reliably, making them invisible. ... Successfully hiding complexity while delivering powerful functionality defines platform excellence. The sophisticated engineering underneath should remain invisible to users who simply want to accomplish their tasks without friction. ... Stability means consistent, reliable operation at all times. However, achieving stability through stagnation creates security vulnerabilities from unpatched systems. Patching introduces changes that can impact stability while enabling security. ... The temptation to defer maintenance always exists, but falling behind creates insurmountable technical debt. From a security perspective, increased exploitation of zero day vulnerabilities by bad actors demonstrate how quickly deferred maintenance becomes crisis management. Staying evergreen requires eternal vigilance and commitment. Once you fall behind, catching up becomes nearly impossible. This principle demands upfront planning and unwavering execution.

From Data Transfer to Data Trust

As more businesses move to hybrid and multi-cloud environments, data exchanges happen across different infrastructures and jurisdictions, which adds to the complexity and risk. Old models that only look at the perimeter are no longer enough. Instead, companies need a model in which trust is not taken for granted but is always checked. Gartner (2023) says that trust should be built into every transaction, every request for access, and every exchange of data. ... Businesses need to take a big-picture view based on the following pillars to build a trusted data integration framework: Authentication and Authorization: Use strict identity controls like OAuth 2.0, SAML, and context-aware Multi-Factor Authentication (MFA). API gateways should enforce role-based access and rate limiting. Transport Layer Security (TLS) should encrypt data while it is being sent, and Advanced Encryption Standard (AES) should be used to encrypt data while it is at rest. Use checksums, digital signatures, and data validation protocols to ensure the data is correct. Monitoring and Observability: Use observability platforms like ELK Stack, Prometheus, or Splunk to monitor logs, metrics, and traces in real time. Principles of Site Reliability Engineering (SRE) say that you should set up Service-Level Indicators (SLIs), Service-Level Objectives (SLOs), and automatic incident detection.

Who Owns the Cybersecurity of Space?

There is no comprehensive and binding international cybersecurity framework governing satellites, orbital systems or ground-to-space communications. Australia's growing space sector, spanning manufacturing in South Australia, launch facilities in the Northern Territory and emerging tracking infrastructure in Queensland, is expanding quickly. ... Many satellites, especially those launched before 2020, lack encryption or rely on outdated telemetry protocols. A single compromised ground station could trigger cascading effects across dependent systems. A man-in-the-middle attack in orbit would not simply exfiltrate data. It could spoof navigation, interrupt emergency communications or feed falsified intelligence to defense networks. We saw a warning sign in the ViaSat KA-SAT attack during the early stages of the Russia-Ukraine conflict, which temporarily crippled satellite communications across Europe. ... Many satellites, especially those launched before 2020, lack encryption or rely on outdated telemetry protocols. A single compromised ground station could trigger cascading effects across dependent systems. A man-in-the-middle attack in orbit would not simply exfiltrate data. It could spoof navigation, interrupt emergency communications or feed falsified intelligence to defense networks. ... For cybersecurity professionals, space is now a part of your threat landscape. Whether you work in defense, telecommunications, energy or government, your organization likely depends on orbital networks.

AI & phishing attacks highlight human risk in Australian fraud

Cybercriminals continue to rely on phishing attacks, exploiting trust and human error to initiate breaches. Despite ongoing investment in advanced detection technologies, there is widespread agreement that improving behavioural awareness within organisations is crucial. ... Salehi highlighted the growing sophistication of AI-powered attacks, describing how threat actors automate reconnaissance and deploy harder-to-detect campaigns. "As AI reshapes the threat landscape, these human vulnerabilities become even more exploitable. Threat actors are using AI to automate reconnaissance and craft highly personalised phishing campaigns that are faster, more convincing and far harder to detect," said Salehi. He went further to advocate for a risk-based security approach, aligning protection with business priorities and focusing on critical assets. "To counter this, organisations must adopt a risk-based approach that aligns security investments to business context - prioritising protection of the assets most critical to operations and continuity, while investing equally in human-centric education and training to recognise AI-generated phishing and deepfake content," said Salehi. ... Fraud schemes are also evolving beyond traditional IT boundaries, impacting operational processes and supply chains. Complex webs of partners and suppliers increase the risk of unnoticed manipulation and data leaks, particularly as generative AI technology is embedded across business operations.

The AI revolution has a power problem

In the race for AI dominance, American tech giants have the money and the chips, but their ambitions have hit a new obstacle: electric power. "The biggest issue we are now having is not a compute glut, but it's the power and...the ability to get the builds done fast enough close to power," Microsoft CEO Satya Nadella acknowledged on a recent podcast with OpenAI chief Sam Altman. "So if you can't do that, you may actually have a bunch of chips sitting in inventory that I can't plug in," Nadella added. ... Already blamed for inflating household electricity bills, data centers in the United States could account for 7% to 12% of national consumption by 2030, up from 4% today, according to various studies. But some experts say the projections could be overblown. "Both the utilities and the tech companies have an incentive to embrace the rapid growth forecast for electricity use," Jonathan Koomey, a renowned expert from UC Berkeley, warned in September. ... Tech giants are quietly downplaying their climate commitments. Google, for example, promised net-zero carbon emissions by 2030 but removed that pledge from its website in June. Instead, companies are promoting long-term projects. Amazon is championing a nuclear revival through Small Modular Reactors (SMRs), an as-yet experimental technology that would be easier to build than conventional reactors.

Cut Lead Time In Half With Pragmatic Agile

Agility isn’t sprints; it’s small, reversible changes flowing safely to users. We get there by adopting trunk-based development, feature flags, and explicit WIP limits. Trunk-based means branches live hours, not weeks. We merge small increments behind flags, ship to production early, and turn features on when we’re ready. Review stays fast because the surface area is small. If we need to bail out, we toggle the flag off and fix forward. No hero rollbacks, no 2 a.m. conference bridge. Feature flags don’t need to be fancy at the start, but they must be disciplined: clear names, default off, auditability, and a plan to retire them. Tooling is personal preference; control plane matters less than consistency. We like OpenFeature because it’s vendor-neutral and simple. ... Boring deploys are the highest compliment. We get them by codifying our path to production and reducing manual gates. Start with a trunk-based pipeline that runs unit tests, security checks, build, and deploy in the same PR context. Then add guardrails: environment protection rules, small canaries, and automatic rollbacks if health checks dip. ... Agile claims to balance speed with quality, but without SLOs we end up arguing feelings. Service-level objectives anchor our pace to user impact. We pick a few golden signals per service—availability, latency, error rate—and set realistic targets based on current performance and business expectations.

EU Set the Global Standard on Privacy and AI. Now It’s Pulling Back

The EU’s landmark AI Act entered into force earlier this year but will not fully apply until 2026. Reporting by MLex, Reuters, and Financial Times indicates that the European Commission is considering changes that could delay enforcement and reduce transparency. Under the proposals, companies deploying high-risk AI systems could receive a one-year grace period before fines and other obligations take effect. This would particularly benefit providers that already placed generative AI systems on the market, giving them time to adjust without disrupting operations. Draft documents also suggest postponing penalties for transparency violations, such as failing to clearly label AI-generated content, until August 2027. MLex reported that the package would also make compliance easier for companies and centralize enforcement through a new EU AI office. ... The proposal is still being discussed within the Commission and could change before November 19. Once adopted, it will head to EU governments and the European Parliament for approval. Privacy advocates have criticized the fast-track process of the Digital Omnibus. While the GDPR took years to negotiate, public consultation on the Omnibus only concluded in October. According to noyb, some Brussels units had just five working days to review a 180+ page draft. The Commission has not prepared impact assessments, saying the proposed changes are “targeted and technical.”

Daily Tech Digest - July 28, 2025

Quote for the day:

"Don't watch the clock; do what it does. Keep going." -- Sam Levenson

Architects Are… Human

Architects are not super-human. Most learned to be good by failing miserably dozens or hundreds of times. Many got the title handed to them. Many gave it to themselves. Most come from spectacularly different backgrounds. Most have a very different skill set. Most disagree with each other. ... When someone gets online and says, ‘Real Architects’, I puke a little. There are no real architects. Because there is no common definition of what that means. What competencies should they have? How were those competencies measured and by whom? Did the person who measured them have a working model by which to compare their work? To make a real architect repeatedly, we have to get together and agree what that means. Specifically. Repeatably. Over and over and over again. Tens of thousands of times and learn from each one how to do it better as a group! ... The competency model for a successful architect is large, difficult to learn, and most of employers do not recognize or give you opportunities to do it very often. They have defined their own internal model, from ‘all architects are programmers’ to ‘all architects work with the CEO’. The truth is simple. Study. Experiment. Ask tough questions. Simple answers are not the answer. You do not have to be everything to everyone. Business architects aren’t right, but neither are software architects.

Mitigating Financial Crises: The Need for Strong Risk Management Strategies in the Banking Sector

Poor risk management can lead to liquidity shortfalls, and failure to maintain adequate capital buffers can potentially result in insolvency and trigger wider market disruptions. Weak practices also contribute to a build-up of imbalances, such as lending booms, which unravel simultaneously across institutions and contribute to widespread market distress. In addition, banks’ balance sheets and financial contracts are interconnected, meaning a failure in one institution can quickly spread to others, amplifying systemic risk. ... Poor risk controls and a lack of enforcement also encourage excessive moral hazard and risk-taking behavior that exceed what a bank can safely manage, undermining system stability. Homogeneous risk diversification can also be costly and exacerbate systemic risk. When banks diversify risks in similar ways, individual risk reduction paradoxically increases the probability of simultaneous multiple failures. Fragmented regulation and inadequate risk frameworks fail to address these systemic vulnerabilities, since persistent weak risk management practices threaten the entire financial system. In essence, weak risk management undermines individual bank stability, while the interconnected and pro-cyclical nature of the banking system can trigger cascading failures that escalate into systemic crises.

Where Are the Big Banks Deploying AI? Simple Answer: Everywhere

Of all the banks presenting, BofA was the most explicit in describing how it is using various forms of artificial intelligence. Artificial intelligence allows the bank to effectively change the work across more areas of its operations than prior types of tech tools allowed, according to Brian Moynihan, chair and CEO. The bank included a full-page graphic among its presentation slides, the chart describing four "pillars," in Moynihan’s words, where the bank is applying AI tools. ... While many banks have tended to stop short of letting their use of GenAI touch customers directly, Synchrony has introduced a tool for its customers when they want to shop for various consumer items. It launched its pilot of Smart Search a year ago. Smart Search provides a natural language hunt joined with GenAI. It is a joint effort of the bank’s AI technology and product incubation teams. The functionality permits shoppers using Synchrony’s Marketplace to enter a phrase or theme to do with decorating and home furnishings. The AI presents shoppers with a "handpicked" selection of products matching the information entered, all of which are provided by merchant partners. ... Citizens is in the midst of its "Reimagining the Bank," Van Saun explained. This entails rethinking and redesigning how Citizens serves customers. He said Citizens is "talking with lots of outside consultants looking at scenarios across all industries across the planet in the banking industry."

How logic can help AI models tell more truth, according to AWS

By whatever name you call it, automated reasoning refers to algorithms that search for statements or assertions about the world that can be verified as true by using logic. The idea is that all knowledge is rigorously supported by what's logically able to be asserted. As Cook put it, "Reasoning takes a model and lets us talk accurately about all possible data it can produce." Cook gave a brief snippet of code as an example that demonstrates how automated reasoning achieves that rigorous validation. ... AWS has been using automated reasoning for a decade now, said Cook, to achieve real-world tasks such as guaranteeing delivery of AWS services according to SLAs, or verifying network security. Translating a problem into terms that can be logically evaluated step by step, like the code loop, is all that's needed. ... The future of automated reasoning is melding it with generative AI, a synthesis referred to as neuro-symbolic. On the most basic level, it's possible to translate from natural-language terms into formulas that can be rigorously analyzed using logic by Zelkova. In that way, Gen AI can be a way for a non-technical individual to frame their goal in informal, natural language terms, and then have automated reasoning take that and implement it rigorously. The two disciplines can be combined to give non-logicians access to formal proofs, in other words.

Can Security Culture Be Taught? AWS Says Yes

Security culture is broadly defined as an organization's shared strategies, policies, and perspectives that serve as the foundation for its enterprise security program. For many years, infosec leaders have preached the importance of a strong culture and how it cannot only strengthen the organization's security posture but also spur increases in productivity and profitability. Security culture has also been a focus in the aftermath of last year's scathing Cyber Safety Review Board (CSRB) report on Microsoft, which stemmed from an investigation into a high-profile breach of the software giant at the hands of the Chinese nation-state threat group Storm-0558. The CSRB found "Microsoft's security culture was inadequate and requires an overhaul," according to the April 2024 report. Specifically, the CSRB board members flagged an overall corporate culture at Microsoft that "deprioritized both enterprise security investments and rigorous risk management." ... But security culture goes beyond frameworks and executive structures; Herzog says leaders need to have the right philosophies and approaches to create an effective, productive environment for employees throughout the organization, not just those on the security team. ... A big reason why a security culture is hard to build, according to Herzog, is that many organizations are simply defining success incorrectly.

Data and AI Programs Are Effective When You Take Advantage of the Whole Ecosystem — The AIAG CDAO

What set the Wiki system apart was its built-in intelligence to personalize the experience based on user roles. Kashikar illustrated this with a use case: “If I’m a marketing analyst, when I click on anything like cross-sell, upsell, or new customer buying prediction, it understands I’m a marketing analyst, and it will take me to the respective system and provide me the insights that are available and accessible to my role.” This meant that marketing, engineering, or sales professionals could each have tailored access to the insights most relevant to them. Underlying the system were core principles that ensured the program’s effectiveness, says Kaahikar. This includes information, accessibility, and discoverability, and its integration with business processes to make it actionable. ... AI has become a staple in business conversations today, and Kashikar sees this growing interest as a positive sign of progress. While this widespread awareness is a good starting point, he cautions that focusing solely on models and technologies only scratches the surface, or can provide a quick win. To move from quick wins to lasting impact, Kashikar believes that data leaders must take on the role of integrators. He says, “The data leaders need to consider themselves as facilitators or connectors where they have to take a look at the entire ecosystem and how they leverage this ecosystem to create the greatest business impact which is sustainable as well.”

Designing the Future of Data Center Physical Security

Security planning is heavily shaped by the location of a data center and its proximity to critical utilities, connectivity, and supporting infrastructure. “These factors can influence the reliability and resilience of data centers – which then in turn will shift security and response protocols to ensure continuous operations,” Saraiya says. In addition, rurality, crime rate, and political stability of the region will all influence the robustness of security architecture and protocols required. “Our thirst for information is not abating,” JLL’s Farney says. “We’re doubling the amount of new information created every four years. We need data centers to house this stuff. And that's not going away.” John Gallagher, vice president at Viakoo, said all modern data centers include perimeter security, access control, video surveillance, and intrusion detection. ... “The mega-campuses being built in remote locations require more intentionally developed security systems that build on what many edge and modular deployments utilize,” Dunton says. She says remote monitoring and AI-driven analytics allow centralized oversight with minimizing on-site personnel, while compact, hardened enclosures with integrated access control, surveillance, and environmental sensors Emphasis is also placed on tamper detection, local alerting, and quick response escalation paths.

The legal minefield of hacking back

Attribution in cyberspace is incredibly complex because attackers use compromised systems, VPNs, and sophisticated obfuscation techniques. Even with high confidence, you could be wrong. Rather than operating in legal gray areas, companies need to operate under legally binding agreements that allow security researchers to test and secure systems within clearly defined parameters. That’s far more effective than trying to exploit ambiguities that may not actually exist when tested in court. ... Active defense, properly understood, involves measures taken within your own network perimeter, like enhanced monitoring, deception technologies like honeypots, and automated response systems that isolate threats. These are defensive because they operate entirely within systems you own and control. The moment you cross into someone else’s system, even to retrieve your own stolen data, you’ve entered offensive territory. It doesn’t matter if your intentions are defensive; the action itself is offensive. Retaliation goes even further. It’s about causing harm in response to an attack. This could be destroying the attacker’s infrastructure, exposing their operations, or launching counter-attacks. This is pure vigilantism and has no place in responsible cybersecurity. ... There’s also the escalation risk. That “innocent” infrastructure might belong to a government entity, a major corporation, or be considered critical infrastructure.

What Is Data Trust and Why Does It Matter?

Data trust can be seen as data reliability in action. When you’re driving your car, you trust that its speedometer is reliable. A driver who believes his speedometer is inaccurate may alter the car’s speed to compensate unnecessarily. Similarly, analysts who lose faith in the accuracy of the data powering their models may attempt to tweak the models to adjust for anomalies that don’t exist. Maximizing the value of a company’s data is possible only if the people consuming the data trust the work done by the people developing their data products. ... Understanding the importance of data trust is the first step in implementing a program to build trust between the producers and consumers of the data products your company relies on increasingly for its success. Once you know the benefits and risks of making data trustworthy, the hard work of determining the best way to realize, measure, and maintain data trust begins. Among the goals of a data trust program are promoting the company’s privacy, security, and ethics policies, including consent management and assessing the risks of sharing data with third parties. The most crucial aspect of a data trust program is convincing knowledge workers that they can trust AI-based tools. A study released recently by Salesforce found that more than half of the global knowledge workers it surveyed don’t trust the data that’s used to train AI systems, and 56% find it difficult to extract the information they need from AI systems.

Six reasons successful leaders love questions

A modern way of saying this is that questions are data. Leaders who want to leverage this data should focus less on answering everyone’s questions themselves and more on making it easy for the people they are talking to—their employees—to access and help one another answer the questions that have the biggest impact on the company’s overall purpose. For example, part of my work with large companies is to help leaders map what questions their employees are asking one another and analyze the group dynamics in their organization. This gives leaders a way to identify critical problems and at the same time mobilize the people who need to solve them. ... The key to changing the culture of an organization is not to tell people what to do, but to make it easy for them to ask the questions that make them consider their current behavior. Only by making room for their colleagues, employees, and other stakeholders to ask their own questions and activate their own experience and insights can leaders ensure that people’s buy-in to new initiatives is an active choice, and thus something they feel committed to acting on. ... The decision to trust the process of asking and listening to other people’s questions is also a decision to think of questioning as part of a social process—something we do to better understand ourselves and the people surrounding us.

Daily Tech Digest - February 01, 2025

Quote for the day:

"Leadership is a matter of having people look at you and gain confidence, seeing how you react. If you're in control, they're in control." -- Tom Laundry

5 reasons the enterprise data center will never die

Cloud repatriation — enterprises pulling applications back from the cloud to the data center — remains a popular option for a variety of reasons. According to a June 2024 IDC survey, about 80% of 2,250 IT decision-maker respondents “expected to see some level of repatriation of compute and storage resources in the next 12 months.” IDC adds that the six-month period between September 2023 and March 2024 saw increased levels of repatriation plans “across both compute and storage resources for AI lifecycle, business apps, infrastructure, and database workloads.” ... According to Forrester’s 2023 Infrastructure Cloud Survey, 79% of roughly 1,300 enterprise cloud decision-makers said their firms are implementing internal private clouds, which will use virtualization and private cloud management. Nearly a third (31%) of respondents said they are building internal private clouds using hybrid cloud management solutions such as software-defined storage and API-consistent hardware to make the private cloud more like the public cloud, Forrester adds. ... “Edge is a crucial technology infrastructure that extends and innovates on the capabilities found in core datacenters, whether enterprise- or service-provider-oriented,” says IDC. The rise of edge computing shatters the binary “cloud-or-not-cloud” way of thinking about data centers and ushers in an “everything everywhere all at once” distributed model

How to Understand and Manage Cloud Costs with a Data-Driven Strategy

Understanding your cloud spend starts with getting serious about data. If your cloud usage grew organically across teams over time, you're probably staring at a bill that feels more like a puzzle than a clear financial picture. You know you're paying too much, and you have an idea of where the spending is happening across compute, storage, and networking, but you are not sure which teams are overspending, which applications are being overprovisioned, and so on. Multicloud environments add even another layer of complexity to data visibility. ... With a holistic view of your data established, the next step is augmenting tools to gain a deeper understanding of your spending and application performance. To achieve this, consider employing a surgical approach by implementing specialized cost management and performance monitoring tools that target specific areas of your IT infrastructure. For example, granular financial analytics can help you identify and eliminate unnecessary expenses with precision. Real-time visibility tools provide immediate insights into cost anomalies and performance issues, allowing for prompt corrective actions. Governance features ensure that spending aligns with budgetary constraints and compliance requirements, while integration capabilities with existing systems facilitate seamless data consolidation and analysis across different platforms.

Top cybersecurity priorities for CFOs

CFOs need to be aware of the rising threats of cyber extortion, says Charles Soranno, a managing director at global consulting firm Protiviti. “Cyber extortion is a form of cybercrime where attackers compromise an organization’s systems, data or networks and demand a ransom to return to normal and prevent further damage,” he says. Beyond a ransomware attack, where data is encrypted and held hostage until the ransom is paid, cyber extortion can involve other evolving threats and tactics, Soranno says. “CFOs are increasingly concerned about how these cyber extortion schemes impact lost revenue, regulatory fines [and] potential payments to bad actors,” he says. ... “In collaboration with other organizational leaders, CFOs must assess the risks posed by these external partners to identify vulnerabilities and implement a proactive mitigation and response plan to safeguard from potential threats and issues.” While a deep knowledge of the entire supply chain’s cybersecurity posture might seem like a luxury for some organizations, the increasing interconnectedness of partner relationships is making third-party cybersecurity risk profiles more of a necessity, Krull says. “The reliance on third-party vendors and cloud services has grown exponentially, increasing the potential for supply chain attacks,” says Dan Lohrmann, field CISO at digital services provider Presidio.

GDPR authorities accused of ‘inactivity’

The idea that the GDPR has brought about a shift towards a serious approach to data protection has largely proven to be wishful thinking, according to a statement from noyb. “European data protection authorities have all the necessary means to adequately sanction GDPR violations and issue fines that would prevent similar violations in the future,” Schrems says. “Instead, they frequently drag out the negotiations for years — only to decide against the complainant’s interests all too often.” ... “Somehow it’s only data protection authorities that can’t be motivated to actually enforce the law they’re entrusted with,” criticizes Schrems. “In every other area, breaches of the law regularly result in monetary fines and sanctions.” Data protection authorities often act in the interests of companies rather than the data subjects, the activist suspects. It is precisely fines that motivate companies to comply with the law, reports the association, citing its own survey. Two-thirds of respondents stated that decisions by the data protection authority that affect their own company and involve a fine lead to greater compliance. Six out of ten respondents also admitted that even fines imposed on other organizations have an impact on their own company.

The three tech tools that will take the heat off HR teams in 2025

As for the employee review process, a content services platform enables HR employees to customise processes, routing approvals to the right managers, department heads, and people ops. This means that employee review processes can be expedited thanks to customisable forms, with easier goal setting, identification of upskilling opportunities, and career progression. When paperwork and contracts are uniform, customisable, and easily located, employers are equipped to support their talent to progress as quickly as possible – nurturing more fulfilled employees who want to stick around. ... Naturally, a lot of HR work is form-heavy, with anything from employee onboarding and promotions to progress reviews and remote working requests requiring HR input. However, with a content services platform, HR professionals can route and approve forms quickly, speeding up the process with digital forms that allow employees to enter information quickly and accurately. Going one step further, HR leaders can leverage automated workflows to route forms to approvers as soon as an employee completes them – cutting out the HR intermediary. ... Armed with a single source of truth, HR professionals can take advantage of automated workflows, enabling efficient notifications and streamlining HR compliance processes.

AI Could Turn Against You — Unless You Fix Your Data Trust Issues

Without unified standards for data formats, definitions, and validations, organizations struggle to establish centralized control. Legacy systems, often ill-equipped to handle modern data volumes, further exacerbate the problem. These systems were designed for periodic updates rather than the continuous, real-time streams demanded by AI, leading to inefficiencies and scalability limitations. To address these challenges, organizations must implement centralized governance, quality, and observability within a single framework. This enables them to leverage data lineage and track their data as it moves through systems to ensure transparency and identify issues in real-time. It also ensures they can regularly validate data integrity to support consistent, reliable AI models by conducting real-time quality checks. ... For organizations to maximize the potential of AI, they must embed data trust into their daily operations. This involves using automated systems like data observability to validate data integrity throughout its lifecycle, integrated governance to maintain reliability, and assuring continuous validation within evolving data ecosystems. By addressing data quality challenges and investing in unified platforms, organizations can transform data trust into a strategic advantage.

Backdoor in Chinese-made healthcare monitoring device leaks patient data

“By reviewing the firmware code, the team determined that the functionality is very unlikely to be an alternative update mechanism, exhibiting highly unusual characteristics that do not support the implementation of a traditional update feature,” CISA said in its analysis report. “For example, the function provides neither an integrity checking mechanism nor version tracking of updates. When the function is executed, files on the device are forcibly overwritten, preventing the end customer — such as a hospital — from maintaining awareness of what software is running on the device.” In addition to this hidden remote code execution behavior, CISA also found that once the CMS8000 completes its startup routine, it also connects to that same IP address over port 515, which is normally associated with the Line Printer Daemon (LPD), and starts transmitting patient information without the device owner’s knowledge. “The research team created a simulated network, created a fake patient profile, and connected a blood pressure cuff, SpO2 monitor, and ECG monitor peripherals to the patient monitor,” the agency said. “Upon startup, the patient monitor successfully connected to the simulated IP address and immediately began streaming patient data to the address.”

3 Considerations for Mutual TLS (mTLS) in Cloud Security

Traditional security approaches often rely on IP whitelisting as a primary method of access control. While this technique can provide a basic level of security, IP whitelists operate on a fundamentally flawed assumption: that IP addresses alone can accurately represent trusted entities. In reality, this approach fails to effectively model real-world attack scenarios. IP whitelisting provides no mechanism for verifying the integrity or authenticity of the connecting service. It merely grants access based on network location, ignoring crucial aspects of identity and behavior. In contrast, mTLS addresses these shortcomings by focusing on cryptographic identity(link is external) rather than network location. ... In the realm of mTLS, identity is paramount. It's not just about encrypting data in transit; it's about ensuring that both parties in a communication are exactly who they claim to be. This concept of identity in mTLS warrants careful consideration. In a traditional network, identity might be tied to an IP address or a shared secret. But, in the modern world of cloud-native applications, these concepts fall short. mTLS shifts the mindset by basing identity on cryptographic certificates. Each service possesses its own unique certificate, which serves as its identity card.

Artificial Intelligence Versus the Data Engineer

It’s worth noting that there is a misconception that AI can prepare data for AI, when the reality is that, while AI can accelerate the process, data engineers are still needed to get that data in shape before it reaches the AI processes and models and we see the cool end results. At the same time, there are AI tools that can certainly accelerate and scale the data engineering work. So AI is both causing and solving the challenge in some respects! So, how does AI change the role of the data engineer? Firstly, the role of the data engineer has always been tricky to define. We sit atop a large pile of technology, most of which we didn’t choose or build, and an even larger pile of data we didn’t create, and we have to make sense of the world. Ostensibly, we are trying to get to something scientific. ... That art comes in the form of the intuition required to sift through the data, understand the technology, and rediscover all the little real-world nuances and history that over time have turned some lovely clean data into a messy representation of the real world. The real skill great data engineers have is therefore not the SQL ability but how they apply it to the data in front of them to sniff out the anomalies, the quality issues, the missing bits and those historical mishaps that must be navigated to get to some semblance of accuracy.

How engineering teams can thrive in 2025

Adopting a "fail forward" mentality is crucial as teams experiment with AI and other emerging technologies. Engineering teams are embracing controlled experimentation and rapid iteration, learning from failures and building knowledge. ... Top engineering teams will combine emerging technologies with new ways of working. They’re not just adopting AI—they’re rethinking how software is developed and maintained as a result of it. Teams will need to stay agile to lead the way. Collaboration within the business and access to a multidisciplinary talent base is the recipe for success. Engineering teams should proactively scenario plan to manage uncertainty by adopting agile frameworks like the "5Ws" (Who, What, When, Where, and Why.) This approach allows organizations to tailor tech adoption strategies and marry regulatory compliance with innovation. Engineering teams should also actively address AI bias and ensure fair and responsible AI deployment. Many enterprises are hiring responsible AI specialists and ethicists as regulatory standards are now in force, including the EU AI Act, which impacts organizations with users in the European Union. As AI improves, the expertise and technical skills that proved valuable before need to be continually reevaluated. Organizations that successfully adopt AI and emerging tech will thrive.