Daily Tech Digest by Kannan Subbiah: database

Showing posts with label database. Show all posts

Daily Tech Digest - April 18, 2026

Quote for the day:

"Vision isn’t a starting point. It’s what you create every day through your actions." -- Gordon Tregold

🎧 Listen to this digest on YouTube Music

▶ Play Audio Digest

Duration: 21 mins • Perfect for listening on the go.

The 10 skills every modern integration architect must master

The article "The 10 skills every modern integration architect must master" highlights the fundamental shift of enterprise integration from a back-end technical role to a vital strategic capability. Author Sadia Tahseen argues that modern integration architects must transition from traditional middleware specialists into multifaceted leaders who act as the "digital nervous system" of the enterprise. The ten essential competencies include adopting a long-term platform mindset over isolated project thinking and mastering alongside cloud-native capabilities. Architects must prioritize and event-driven designs to decouple systems effectively, while utilizing canonical data modeling and robust governance to ensure scalability. Security-by-design, business-centric observability, and planning for continuous change are also crucial for maintaining resilience in volatile SaaS environments. Furthermore, integrating DevOps automation, gaining deep business domain expertise, and exerting enterprise-wide leadership allow architects to bridge the gap between technical execution and business priorities. Ultimately, those who master these diverse skills—ranging from coding to strategic influence—enable their organizations to adapt quickly and harness the full power of modern technology investments. By moving beyond simple app connectivity to complex workflow design, these professionals ensure that integration platforms remain scalable, secure, and ready for the emerging era of AI-driven transformation.

Nobody told legal about your RAG pipeline -- why that's a problem

The widespread adoption of Retrieval-Augmented Generation (RAG) as the standard architecture for enterprise AI has created a significant governance gap, as engineering teams prioritize performance while legal and compliance departments remain largely disconnected from the process. Although legal teams may approve AI vendors, they often lack oversight of the actual data pipelines and , leading to a state where RAG systems are "unowned" and unaudited. This structural misalignment is problematic because regulators like the SEC and FTC increasingly demand granular traceability, requiring organizations to prove the origin and handling of underlying content. Traditional legal concepts, such as document custodians and chain of custody, do not easily translate to the world of embeddings and vector retrieval, making e-discovery and compliance audits exceptionally difficult. Furthermore, specific technical processes like pose severe risks; when data is embedded into model weights, it cannot be selectively deleted, potentially violating "" mandates under regulations like GDPR. To mitigate these risks, companies must move beyond simple accuracy and establish a comprehensive "retrieval trail" that includes source versions, model prompts, and human review steps. Without this integrated approach to AI governance, the "ragged edges" of these pipelines could lead to significant legal and regulatory surprises.

Lakehouse Tower of Babel: Handling Identifier Resolution Rules Across Database Engines

The article "Lakehouse Tower of Babel" explores a critical interoperability gap in modern , where diverse compute engines like Spark, Snowflake, and Trino interact with shared data formats such as Apache Iceberg. Although open table formats successfully standardize data and metadata, they fail to align the fundamental SQL identifier resolution and catalog naming rules across different database platforms. This "Tower of Babel" effect arises because engines vary significantly in their handling of casing; for instance, Spark is case-preserving, while Trino normalizes identifiers to lowercase, and Flink enforces strict case-sensitivity. Such inconsistencies often lead to situations where tables or columns become invisible or unqueryable when accessed by a different tool, resulting in significant pipeline reliability challenges. To mitigate these interoperability failures, the author recommends that organizations enforce a strict, uniform naming convention—specifically using lowercase characters with underscores—and treat identifier normalization as a formal part of their data contracts. Additionally, architects should proactively adjust engine-specific configuration settings and implement cross-stack validation via automated CI jobs to guarantee end-to-end portability. Ultimately, a seamless lakehouse experience requires more than just unified storage; it demands a reconciliation of the underlying philosophical divides in how various engines resolve and interpret SQL identifiers within shared catalogs.

Google’s Merkle Certificate Push Signals a Rethink of Digital Trust

Google’s initiative to advance Merkle Tree Certificates (MTCs) through the IETF’s PLANTS working group represents a foundational shift in digital trust architectures, moving away from traditional X.509 certificate chains toward an inclusion-based validation model. As the tech industry prepares for the post-quantum cryptography (PQC) era, existing Public Key Infrastructure (PKI) faces significant scaling challenges because quantum-resistant algorithms produce much larger signatures. These larger certificates increase TLS handshake overhead, heighten bandwidth demands, and cause noticeable latency across content delivery networks and mobile clients. MTCs address these issues by replacing linear chains with compact Merkle proofs anchored in signed trees, significantly reducing transmission overhead while maintaining high security. This evolution aligns with modern Certificate Transparency ecosystems and necessitates a broader "crypto-agility" within organizations, as the transition is an architectural migration rather than a simple algorithm swap. By shifting to this high-velocity, inclusion-based model, Google and its partners aim to ensure that security and system performance remain aligned in a world of shrinking certificate lifetimes and tightening revocation timelines. Ultimately, this rethink of digital trust ensures that distributed systems can scale efficiently while remaining resilient against future quantum threats, provided enterprises move beyond simple inventories to understand their deeper cryptographic dependencies.

DevOps Playbook for the Agentic Era

represents a transformative shift from traditional automation to autonomous software engineering, where AI agents act as intelligent collaborators rather than mere scripted tools. This Microsoft DevBlog article outlines the core principles and strategic evolution required to integrate these agents into the modern DevOps lifecycle. It emphasizes that robust DevOps foundations—including automated testing and infrastructure as code—are essential prerequisites, as agents amplify both healthy and broken practices. The strategic direction focuses on evolving the engineer's role from a code producer to a system designer and quality steward who orchestrates autonomous teams. Key practices include adopting specification-driven development, where structured requirements replace ad hoc prompts, and treating repositories as machine-readable interfaces with explicit skill profiles. Furthermore, the article highlights the necessity of active verifier pipelines that validate agent output against architectural standards and security constraints to mitigate risks like hallucinations and prompt injection. By progressing through a four-level maturity model, organizations can transition from reactive AI assistance to optimized, agent-native operations. Ultimately, Agentic DevOps seeks to redefine productivity by offloading cognitive overhead to specialized agents, allowing human teams to focus on high-value innovation while maintaining rigorous governance and system reliability in cloud-native environments.

Digital infrastructure shifts from spend to measurable value

In 2026, digital infrastructure strategy has pivoted from broad, ambitious spending to a disciplined focus on measurable business value and operational efficiency. As budgets tighten, organizations are moving away from parallel, uncoordinated modernization initiatives toward a maturing mindset that treats technology as a rigorous economic system. CIOs are now prioritizing "execution discipline" by consolidating platforms to eliminate tool sprawl, automating manual workflows, and implementing robust financial governance like FinOps to curb cloud cost leakage. This lean approach emphasizes extracting maximum value from existing assets and funding only those projects that demonstrate clear returns within six to twelve months. Critical foundations such as security, resilience, and data quality remain non-negotiable, but they are increasingly justified through risk mitigation and AI-readiness rather than sheer capacity expansion. The shift reflects a transition from digital ambition to digital justification, where success is defined by how intelligently infrastructure supports resilience and outcome-led growth. Ultimately, the winners in this era are not the companies launching the most projects, but those building governable, observable, and high-performing systems that minimize complexity while maximizing impact. Precision in decision-making and the ability to prove near-term ROI have become the primary benchmarks for modern enterprise leadership in a constrained environment.

The autonomous SOC: A dangerous illusion as firms shift to human-led AI security

In the article "The autonomous SOC: A dangerous illusion as firms shift to human-led AI security," author Moe Ibrahim argues that while a fully automated Security Operations Center is a tempting solution for talent shortages, it remains a fundamentally flawed concept. The core issue is that cybersecurity is not merely an execution problem but a complex decision-making challenge that demands nuanced organizational context. Ibrahim highlights that total autonomy risks significant business disruption, as algorithms lack the situational awareness to distinguish between a malicious threat and a critical business process. Consequently, the industry is pivoting toward a "human-on-the-loop" model, where human experts act as orchestrators who define policies and maintain oversight while AI manages scale and speed. This collaborative approach prioritizes transparency through three essential pillars: explainability, reversibility, and traceability. As organizations transition into "agentic enterprises" with AI agents across various departments, the need for human governance becomes even more critical to manage cross-functional risks. Ultimately, the future of security lies in empowering human analysts with machine intelligence rather than replacing them, ensuring that responses are not only fast but also accurate and accountable. This disciplined integration of capabilities avoids the dangerous pitfalls of unchecked automation and ensures long-term operational resilience.

The Golden Rule of Big Memory: Persistence Is Not Harmful

In the Communications of the ACM article "The Golden Rule of Big Memory: Persistence is Not Harmful," authors Yu Hua, Xue Liu, and Ion Stoica argue for a fundamental paradigm shift in how modern computer systems manage data. The authors propose that persistence should be embraced as the "Golden Rule"—a first-class design principle—rather than an auxiliary feature relegated to slower storage layers. Historically, system architects have viewed persistence as a "harmful" overhead that introduces significant latency and complicates memory management. However, the piece contends that this perspective is outdated in the era of byte-addressable non-volatile memory (NVM) and memory disaggregation. By integrating persistence directly into the memory hierarchy through innovative techniques like speculative and deterministic persistence, the authors demonstrate that systems can achieve DRAM-like performance without sacrificing durability. This holistic approach effectively flattens the traditional memory-storage wall, creating a unified pool that eliminates the bottlenecks of data movement and serialization. Ultimately, the authors conclude that making persistence a primary architectural goal is not only harmless but essential for the future of data-intensive applications. This shift simplifies full-stack software development and provides a robust, high-performance foundation for next-generation AI services, cloud-native databases, and large-scale distributed systems.

When Geopolitics Writes Your Compliance Roadmap

In the article "When Geopolitics Writes Your Compliance Roadmap," Jack Poller examines how shifting global power dynamics are fundamentally altering the cybersecurity regulatory landscape. Drawing from the NCC Group’s Global Cyber Policy Radar, the author argues that the era of reactive regulation is ending as three primary forces reshape compliance strategies: , integrated , and increased board-level legal accountability. Digital sovereignty is leading to a fragmented technology stack characterized by data localization mandates and strict supply chain controls. Meanwhile, AI security is increasingly embedded within existing frameworks rather than through standalone legislation, requiring organizations to apply rigorous security standards to AI systems as part of their broader resilience efforts. Crucially, regulations like DORA and NIS2 are transforming board responsibility from a vague goal into a strict legal obligation, often carrying personal liability for executives. Additionally, the normalization of state-sponsored offensive cyber operations adds a new layer of complexity to corporate defense strategies. To survive this volatile environment, organizations must move beyond traditional checklists and adopt evidence-led resilience programs that align cyber risk with geopolitical realities. Those failing to integrate these external pressures into their compliance roadmaps risk being left behind in an increasingly fractured and litigious digital world.

Microservices Without Tears: A Practical DevOps Playbook

"Microservices Without Tears: A Practical DevOps Playbook" serves as a strategic manual for organizations transitioning from monolithic systems to distributed architectures. The article posits that while microservices offer significant benefits like team autonomy and independent deployment cycles, they also act as an amplifier for both good and bad engineering habits. To avoid the operational "tears" associated with increased complexity, the author advocates for a foundation built on robust automation and clear organizational ownership. Central to this playbook is the emphasis on "right-sizing" service boundaries through domain-driven design, ensuring that teams are accountable for a service's entire lifecycle—from development to on-call support. Technically, the guide champions "boring" but reliable CI/CD pipelines and minimal Kubernetes manifests that prioritize essential health checks and resource limits. Furthermore, it highlights the necessity of observability, recommending the use of correlation IDs and "golden signals" to maintain system visibility. By standardizing communication through versioned APIs and adopting a "you build it, you run it" philosophy, teams can successfully manage the overhead of distributed systems. Ultimately, the post argues that architectural flexibility must be balanced with disciplined operational standards to ensure long-term resilience and speed without sacrificing system stability.

Daily Tech Digest - January 07, 2026

Quote for the day:

“If you're not prepared to be wrong, you'll never come up with anything original.” -- Ken Robinson

Strategy is dying from learning lag, not market change

At first, you might think this is about being more agile, more innovative, or more aggressive. However, those are reactions, not solutions. The real shift is deeper: strategy no longer scales when the underlying assumptions expire too quickly. The advantage erodes because the environment moves faster than the organization’s ability to sense, understand and adapt to it. ... Strategic failure today is less about being wrong and more about staying wrong for too long. ... One way and perhaps the only one, out of uncertainty is to learn faster and closer to where the actual signals appear. Learning to me is the disciplined updating of beliefs when new evidence arrives. Every decision is a prediction about how things will work. When reality proves you wrong, learning is how you fix that prediction. In a stable environment, you can afford to learn slowly. However, in unstable ones, like today’s, slow learning becomes existential. ... Organizations don’t fall behind all at once. They fall behind step by step: first in what they notice, then in how they interpret it, then in how long it takes to decide what to do and finally in how slowly they act. ... Strategy stalls not because people refuse to change, but because they can’t agree on the story beneath the change. They chased precision in interpretation when the real advantage would have come from running small tests to find out faster which interpretation is correct.

The new tech job doesn't require a degree. It starts in a data center

The answer won't be found in Silicon Valley or Data Center Alley. It's closer to home. Veterans, trade workers, and high school graduates not headed to college don't come through traditional pipelines, but they bring the right aptitude and mindset to the data center. Veterans have discipline and process-driven thinking that fits naturally into our operations — and for many, these roles offer a transition into a stable career. Someone who kept an aircraft carrier running knows what it means to manage infrastructure that can't fail. Many arrive with experience in related systems and are comfortable with shift work and high stakes. ... Young adults without college plans are often overlooked, but some excel in hands-on settings and just need an opportunity to prove it. Once they learn about a data center career and where it can take them, it becomes a chance to build a middle-class lifestyle close to home. ... Hiring nontraditional candidates is only the first step. What keeps them is a promotion track that works. After four weeks of hands-on and self-guided onboarding, techs can pursue certifications in battery backup systems, tower clearance, generator safety, and more. When qualified, they show it in the field and move up. This kind of investment has a ripple effect. A paycheck can lead to a mortgage and financial stability. And as techs move up or out, someone else steps in — maybe through a local program that appeared once your jobs did.

Automated data poisoning proposed as a solution for AI theft threat

The technique, created by researchers from universities in China and Singapore, is to inject plausible but false data into what’s known as a knowledge graph (KG) created by an AI operator. A knowledge graph holds the proprietary data used by the LLM. Injecting poisoned or adulterated data into a data system for protection against theft isn’t new. What’s new in this tool – dubbed AURA (Active Utility Reduction via Adulteration)– is that authorized users have a secret key that filters out the fake data so the LLM’s answer to a query is usable. If the knowledge graph is stolen, however, it’s unusable by the attacker unless they know the key, because the adulterants will be retrieved as context, causing deterioration in the LLM’s reasoning and leading to factually incorrect responses. The researchers say AURA degrades the performance of unauthorized systems to an accuracy of just 5.3%, while maintaining 100% fidelity for authorized users, with “negligible overhead,” defined as a maximum query latency increase of under 14%. ... As the use of AI spreads, CSOs have to remember that artificial intelligence and everything needed to make it work also make it much harder to recover from bad data being put into a system, Steinberg noted. ... “For now, many AI systems are being protected in similar manners to the ways we protected non-AI systems. That doesn’t yield the same level of protection, because if something goes wrong, it’s much harder to know if something bad has happened, and its harder to get rid of the implications of an attack.”

From Zero Trust to Cyber Resilience: Why Architecture Alone Will Not Protect Enterprises in 2026

The core challenge facing CISOs is not whether Zero Trust is implemented, but whether the organization can continue to operate when, inevitably, controls fail. Modern threat actors no longer focus exclusively on breaching defenses; they aim to disrupt operations, degrade trust, and extend business impact over time. In this context, architecture alone is insufficient. What enterprises require is cyber resilience: the ability to anticipate, withstand, recover from, and adapt to cyber disruption. ... Zero Trust answers the question “Who can access what?” Cyber resilience answers a more consequential one: “How quickly can the business recover when access controls are no longer the primary failure point?” ... Resilience engineering reframes cybersecurity as a property of complex socio-technical systems. In this model, failure is not an anomaly; it is an expected condition. The objective shifts from breach avoidance to disruption management. In practice, this means evolving from an assume breach mindset to an assume disruption operating model, one where systems, teams, and leadership are prepared to function under degraded conditions. ... To prepare for 2026, CISOs should: Treat cyber resilience as a continuous operating capability, not a project; Integrate cybersecurity with business continuity and crisis management; Train executives and board members through realistic disruption scenarios; and Invest in recovery validation, not just control deployment.

Generative AI and the future of databases

The data is at the heart of your line of business application, but it is also changing all the time, and if you keep extracting the data into some other corpus it gets stale. You can view it as two approaches: replication or federation. Am I going to replicate out of the database to some other thing or am I going to federate into the database? ... engineers know how to write good SQL queries. Whether they know how to write good English language description of the SQL queries is a completely different matter, but let’s assume for a second we can or we can have AI do it for us. Then the AI can figure out which tool to call for the user request and then generate the parameters. There are some things to worry about in terms of security. How can you set the right secure parameters? What parameters are the LLM allowed to set versus not allowed to set? ... When you combine structured and unstructured data, the next step is that it’s not just about exact results but about the most relevant results. In this sense databases start to have some of the capabilities of search engines, which is about relevance and ranking, and what becomes important is almost like precision versus recall for information retrieval systems. But how do you make all of this happen? One key piece is vector indexing. ... AI search is a key attribute of an AI-native database. And the other key attribute is AI functions.

Cyber Risk Trends for 2026: Building Resilience, Not Just Defenses

On the defensive side, AI can accelerate detection and response, but tooling without guardrails will create fresh exposures. Your questions as a board should be: Where have we embedded AI in critical workflows? How do we assure the provenance and integrity of the data those models touch? Are we red-teaming our AI-enabled processes, not just our perimeter? ... Second, third party ecosystems present attack surface. The risk isn’t abstract: it’s a payroll provider outage that stops salaries, a logistics partner breach that stalls distribution, or a SaaS compromise that leaks your crown jewels. ... Third is quantum computing. Some will say it’s too early; some will say it’s too late. The pragmatic position is this: crypto agility is a business requirement now. Inventory where and how you use cryptography—applications, devices, certificates, key management, data at rest and in transit. Prioritize crown-jewel systems and long-lived data that must remain confidential for years. ... Fourth is the risk posed by geopolitics. We live in a more unstable world, and digital risk doesn’t respect borders. Conflicts spill into cyberspace, data sovereignty rules tighten, and critical components can become chokepoints overnight. ... We won’t repel every attack in 2026. But we can decide to bend rather than break. Resilience comes of age when it stops being a slogan and becomes a practiced capability—where governance, operations, technology, and people move as one.

Will there be a technology policy epiphany in 2026?

The UK government still seems implacably opposed to bringing forward any cross-sector, comprehensive AI legislation. Its one-liner in the 2024 King’s Speech said the government “will seek to establish the appropriate legislation to place requirements on those working to develop the most powerful artificial intelligence models.” That seemed sparing at the time, and now seems extraordinarily overblown. ... Turning to crypto-asset regulation, 2026 will continue the journey from draft legislation being published on 15 December last year through to 25 October 2027- yes, that’s meant to say 2027 - for the current “go live” date. Already we have seen some definitional clarification and the arrival of new provisions related to market abuse, public offers and disclosures. ... A critical thread to all of this is cyber. The Cyber Security Bill receives its second reading in the Commons today, 6 January. I’m very much looking forward to the bill arriving in the Lords later in the Spring and would welcome your thoughts on what’s in and what currently is not. If that wasn’t enough for week one of 2026, we have the committee stage of the Crime and Policing Bill in the Lords tomorrow, Wednesday 7 January. ... By contrast, there is much chat on digital ID. A consultation is said to be coming this month with a draft bill in May’s speech. This has hardly been helped by the government last year hanging its digital ID coat all around illegal immigration - a more than unfortunate decision.

The Big Shift: Five Trends Show Why 2026 is About Getting to Value

The conversation shifts from “What can this AI do?” to “What problem does it solve, and how much value does it unlock?”—and the technology that wins won’t be the most sophisticated. Still, the one that directly accelerates revenue, reduces friction in customer-facing workflows, or demonstrably improves employee productivity within a 12-month payback window. Crawford says this is “getting back to brass tacks. “Organizations will carefully define their business objectives, whether customer engagement, revenue growth, employee productivity, or whatever it needs to be, before selecting a technology,” he says. ... In 2026, if your digital transformation project can’t demonstrate meaningful return within twelve months, it competes for oxygen with projects that can, and many won’t survive that fight, Batista says. This compression of payback expectations reflects a fundamental shift in how CFOs and boards view technology investments. Still, initiatives based on regulatory or compliance requirements—things mandated by law, for example—still justify longer timelines, but discretionary projects face much stricter scrutiny, Batista says. ... When it comes to limiting factors in scaling successful AI deployments, Crawford says the top issue will be failures in AI governance. “AI governance will be the bottleneck that constrains an enterprise’s ability to scale AI, not AI capability itself. And enterprises rushing to deploy autonomous agents without governance infrastructure will face either painful reworks or serious operational issues.

Why CES 2026 Signals The End Of ‘AI As A Tool’

The idea of AI as a coordinating layer or “ambient background” across entire ecosystems of tools and devices was also prominent this year. Samsung outlined its vision of AI companions for everyday life, demonstrating how smart appliances will form an intelligent background fabric to our day-to-day activities. As well as in the home, Samsung is a key player in industrial technology, where the same principle will see AI coordinating and optimizing operations across smart, connected enterprise systems. ... First, it’s clear that today’s leading manufacturers and developers believe that the future of AI lies in agentic, always-on systems, rather than free-standing, isolated tools and applications. Just as consumer AI now coordinates home and entertainment technology, enterprise AI will orchestrate workflows, schedules, documents, data and codebases, anticipating business needs and proactively solving problems before they occur. Another thing that can’t be overlooked is that consumer technology clearly shapes our expectations and tolerances of enterprise technology. Workplace AI that doesn’t live up to the seamless, friction-free experiences provided by consumer AI will quickly cause frustration, limiting adoption and buy-in. ... As this AI infrastructure becomes more capable, the role of employees will shift, too, from executing routine tasks to supervising automated processes, as well as applying uniquely human skills to challenges that machines still can’t tackle.

Build Resilient cloudops That Shrug Off 99.95% Outages

If a guardrail lives only in a wiki, it’s not a guardrail, it’s an aspiration. We encode risk controls in Terraform so they’re enforced before a resource even exists. Tagging, encryption, backup retention, network egress—these are all policy. We don’t rely on code reviews to catch missing encryption on a bucket; the pipeline fails the plan. That’s how cloudops scales across teams without nag threads. ... If you’re starting from scratch, standardize on OpenTelemetry libraries for services and send everything through a collector so you can change backends without code churn. Sampling should be responsive to pain—raise trace sampling when p95 latency jumps or error rates spike. Reducing cardinality in labels (looking at you, per-user IDs) will keep storage and costs sane. Most teams benefit from a small set of “stop asking, here it is” dashboards: request volume and latency by endpoint, error rate by version, resource saturation by service, and database health with connection pools and slow query counts. ... We don’t win medals for shipping fast; we win trust for shipping safely. Progressive delivery lets us test the actual change, in production, on a small slice before we blast everyone. We like canaries and feature flags together: canary catches systemic issues; flags let us disable risky code paths within a version. ... Reliability with no cost controls is just a nicer way to miss your margin. We give cost the same respect as latency: we define a monthly budget per product and a change budget per release.

Daily Tech Digest - December 12, 2025

Quote for the day:

"Always remember, your focus determines your reality." -- George Lucas

Escaping the transformation trap: Why we must build for continuous change, not reboots

Each new wave of innovation demands faster decisions, deeper integration and tighter alignment across silos. Yet, most organizations are still structured for linear, project-based change. As complexity compounds, the gap between what’s possible and what’s operationally sustainable continues to widen. The result is a growing adaptation gap — the widening distance between the speed of innovation and the enterprise’s capacity to absorb it. CIOs now sit at the fault line of this imbalance, confronting not only relentless technological disruption but also the limits of their organizations’ ability to evolve at the same pace. ... has been rapidly amassing in three areas: accumulated, acquired, and emergent. The result destabilizes transformation efforts. ... Most modernization programs change the surface, not the supporting systems. New and analytics layers often sit atop and brittle integration models. Without rearchitecting the semantic and process foundations, the shared meaning behind data and decisions, enterprises modernize their appearance without improving their fitness. ... The new question is not, ‘How do we transform again?’ but ‘How do we build so we never need to?’ That requires architectures capable of sustaining and sharing meaning across every system and process, which technologists refer to as .

The state of AI in 2026 – part 1

“The real race will be about purpose, measurable outcomes and return on investment. AI is no longer simply a technical challenge, it has become a business strategy,” said . “However, this evolution comes with new risks. As agentic systems gain autonomy, securing the underlying AI infrastructure becomes critical. Standards are still emerging, but adopting strong security and governance practices early dramatically increases the likelihood of success. At the same time, AI is reshaping the risk landscape faster than regulation can adapt, which means it’s raising pressing questions around , and access to AI-generated data across jurisdictions.” ... “Many teams now face practical limits around data quality, compute efficiency and responsible integration with existing systems. There is a clear gap between those who just wrap APIs around foundation models and those who actually optimise architectures and training pipelines. The next phase of AI is about reliability, interpretability and building systems that engineers can trust and improve over time,” said. ... “To close the gap between the vision and reality of agentic AI over the next 12 months, enterprise agentic automation (EAA) will be essential. By blending dynamic AI with determinist guardrails and human-in-the-loop checkpoints, EAA empowers enterprises to automate complex, exception-heavy or cognitive work without losing control,” explained .

Cybersecurity isn’t underfunded — It’s undermanaged

Of course, cybersecurity projects are often complex because they need to reach across corporate silos and geographies to deliver effective protection to the business. This is not natural in large firms, which are, almost by essence, territorial and political. But beyond that, the profile of is also a key dimension: Most are technologists by trade and background, and have spent the last decade firefighting incidents, incapable of building or delivering any kind of long-term narrative. They have not developed the type of management experience, political finesse or personal gravitas that they would require to be truly successful, now that the spotlight is firmly on them from the top of the firm. Many genuinely think that chronic under-investment in cybersecurity is the root cause of insufficient maturity levels, while it is in fact chronic execution failure linked to endemic business short-termism that is at the heart of the matter: All point to governance and cultural aspects that are the real root causes of the long-term stagnation of cybersecurity maturity levels in large firms. For the CISOs who have not integrated those cultural aspects and are almost always left out of those decisions, it breeds frustration; frustration breeds short tenures; short tenures aggravate the management and leadership mismatch: You cannot deliver much of genuine transformative impact in large firms on those timeframes.

Document databases – understanding your options

There are two decisions to take around databases today—what you choose to run, and how you choose to run it. The latter choice covers a range of different deployment options, from implementing your own instance of a technology on your own hardware and storage, through to picking a database as a service where all the infrastructure is abstracted away and you only see an API. In between, you can look at hosting your own instances in the cloud, where you manage the software while the cloud service provider runs the infrastructure, or adopt a where you still decide on the design but everything else is done for you. ... The first option is to look at alternative approaches to running itself. Alongside MongoDB-compatible APIs, you can choose to run different versions of MongoDB or alternatives to meet your document database needs. ... The second migration option is to use a service that is compatible with MongoDB’s API. For some workloads, being compatible with the API will be enough to move to another service with minimal to no impact. ... The third option is to use an alternative document database. In the world of open source, is another document database that works with and can be used for projects. It is particularly useful where applications might run on mobile devices as well as cloud instances; mobile support is a feature that MongoDB has deprecated.

Why AI Fatigue Is Sending Customers Back to Humans

The pattern is familiar across industries: digital experiences that start strong, then steadily degrade as companies prioritize cost-cutting over satisfaction. In banking, this manifests in frustratingly specific ways: chatbots that loop through unhelpful responses, automated fraud alerts that lock accounts without a path to resolution, and phone trees that make reaching a human nearly impossible. ... The path forward for community banks and credit unions isn’t choosing between digital efficiency and human service or retreating to nostalgia for branch-based banking. It’s investing strategically in both. ... Geographic proximity enables genuine empathy that algorithms can’t replicate. , CEO at Digital Agents Service Organization (CUSO), offers an example: “When there’s a disaster in a community, an AI chatbot doesn’t know what happened. But a local branch employee knows and can say, ‘I understand. Let me help you.'” The most sophisticated community bank strategy uses technology to identify opportunities while humans deliver the insight. ... After decades of pursuing digital transformation, community banks and credit unions are discovering their competitive advantage was human all along. But the path forward isn’t nostalgia for branch-based banking, it’s strategic investment in both digital infrastructure and human capacity.

The Cloud Investment Paradox: Why More Spending Isn’t Delivering AI Results

There are three common gaps that stall AI progress, even after significant cloud spend. First is data architecture. Many organisations lift and shift legacy systems into the cloud without rethinking how data will flow across teams and tools. They end up with the same fragmentation problems, just in a new environment. Second is the skills gap. Research has found that 27% of organisations lack the internal expertise to harness AI’s potential. And it is not just data scientists. You need cloud architects who understand how to design environments specifically for AI workloads, not just generic compute. Third is data quality and accessibility. AI models cannot perform well without clean, consistent input. But too often, data governance is an afterthought. Only 1 in 5 organisations feel confident that their data is truly AI-ready. That is a foundational issue, not a fine-tuning one. ... Before investing in another AI pilot or data science hire, organisations should take a step back. Is the data ready? Are the pipelines in place? Do internal teams have what they need to turn compute into insight? This means prioritising data integration and governance before algorithms. It means investing in internal training and hiring with long-term capability in mind. And it means treating cloud and AI as part of the same strategy, not separate silos.

Beyond the login: Why “identity-first” security is leaking data and why “context-first” is the fix

The uncomfortable truth emerging from recent high-profile breaches is that identity-first security—when operating in isolation—is leaking data. Threat actors have evolved; they are no longer just trying to break down the door; they are cloning the keys. The reliance on static authentication events has created a dangerous blind spot. ... Standard facial recognition often looks for geometric matches—distance between eyes, shape of the nose. Deepfakes can replicate this perfectly, turning video verification into a vulnerability rather than a safeguard. To counter this, modern security must implement advanced “Liveness Detection”. It is no longer enough to match a face to a database; the system must analyse micro-expressions and texture to ensure the face belongs to a live human presence, not a digital puppet. Yet, even with these safeguards, betting the entire security posture solely on verifying who the user is, remains a risky strategy. ... To stop these leaks, security must move beyond the “Who” (Identity) and interrogate the “Where,” “What,” and “How” (Context). This requires a shift from static gates to . Context is not a single data point; it is a composite score derived from real-time telemetry. ... For technology leaders, this convergence is not just a technical upgrade; it is a strategic necessity for compliance. Frameworks like the Digital Personal Data Protection (DPDP) Act require organisations to implement “reasonable security safeguards”.

Why Critical Infrastructure Needs Security-Forward Managed File Transfer Now

Today’s cyber attackers often use ordinary documents and files to breach organizations. Without strong security checks, it’s surprisingly easy for bad actors to cause major problems. Attacks exploit both common file formats and weaknesses in legacy operational technology (OT) environments. ... Modern managed file transfer (MFT) requires a layered security approach to effectively combat file-based threats and comply with best practices. This approach dictates that organizations must encrypt files at rest and in transit, employ strong hash checks, and use to validate the origin and integrity of files throughout their lifecycle. ... Many MFT tools incorporate multi-layered malware scanning. This works by scanning every file with multiple malware engines rather than relying on a single one, given that different engines detect different malware families and variants. Parallel multiscanning not only improves detection rates but also shortens the window for exploitation of zero‑day vulnerabilities and . This helps to reduce the chance of false negatives before files enter sensitive networks. The scanning should be directly integrated into upload, download, and workflow steps so no file can move between zones without passing through a multi‑engine inspection pipeline. ... MFT workflows can automatically route files to a sandbox based on risk scores, file types, sender reputation, or country of origin. Then, files are only released upon passing behavioral checks.

Fight AI Disinformation: A CISO Playbook for Working with Your C-Suite

Unlike misinformation or malinformation, which may be inaccurate or misleading but not necessarily harmful, disinformation is both false and designed specifically to damage organizations. It can be episodic, targeting individuals for immediate gain, such as tricking an employee into transferring funds via a . It can also be industrial, operating at scale to undermine brand reputation, manipulate stock prices, or probe organizational defenses over time. The attack surfaces are broad: internally, adversaries exploit corporate meeting solutions, email, and messaging platforms to bypass authentication and impersonate trusted individuals. ... Without clear ownership and cross-functional collaboration, efforts to counter disinformation are often disjointed and ineffectual. In some cases, organizations leave disinformation as an unmanaged risk, exposing themselves to episodic attacks on individuals and industrial campaigns targeting reputation and financial stability. Another common pitfall is failing to differentiate between types of information threats. CISOs should focus their resources on disinformation where intent to harm and lack of accuracy intersect, rather than attempting to police all forms of misinformation or malinformation. ... CISOs must lead the way in communicating the risks and fostering a culture of shared responsibility, engaging all employees in detection, reporting, and response. This includes developing internal tooling for monitoring and reporting, promoting transparency, and ensuring ongoing education about evolving threats.

Why AI Scaling Innovation Requires an Open Cloud Ecosystem

Developers and enterprises should have the flexibility to construct custom multi-cloud infrastructure that provides the appropriate specifications. Distributing workloads allows them to move faster on new projects without driving up infrastructure spend and overconsuming resources. It also enables them to prioritize in-country data residency for enhanced compliance and security. With an open ecosystem, developers and enterprises can stagger cloud-agnostic applications across a mosaic of public and private clouds to optimize hardware efficiency, maintain greater autonomy in data management and data security, and run applications seamlessly at the edge. This promotes innovation at all layers of the stack, from training to testing to processing, making it easier to deploy the best possible services and applications. An open ecosystem also reduces the branding and growth risks associated with dependence. Often, when a developer or enterprise runs their products exclusively on a single platform, they become less their own product and more an outgrowth of their hyperscaler cloud provider; instead of selling their app on its own, they sell the hyperscaler’s services. ... Supporting hyper-specific AI use cases often begets complex development demands: from hefty compute power, to multi-model frameworks, to strict data governance and pristine data quality. Even large enterprises don’t always have the resources in-house to account for these parameters.

Daily Tech Digest - November 16, 2025

Quote for the day:

"Life is 10% what happens to me and 90% of how I react to it." -- Charles Swindoll

Hybrid AI: The future of certifiable and trustworthy intelligence

An emerging approach in AI innovation is hybrid AI, which combines the scalability of machine learning (ML) with the constraint-checking and provenance of symbolic models. Hybrid AI forms a foundation for system-level certification and helps CIOs balance the pursuit of performance with the need for accountability. ... Clustering, a core unsupervised learning technique, organizes unlabeled data into groups based on similarity. It’s widely used to segment customers, group documents or analyze sensor data by measuring distances in a numeric feature space. But conventional clustering works on similarity alone and has no grasp of meaning. This can group items by coincidence rather than concept. ... For enterprise leaders, verifiability isn’t optional; it’s a governance requirement. Systems that support strategic or regulatory decisions must show constraint conformance and leave a traceable decision path. Ontology-driven clustering provides that foundation, creating an auditable chain of logic aligned with frameworks such as the NIST AI Risk Management Framework. In both government and industry, this hybrid approach makes AI more accountable and reliable. Trustworthiness is not a checkbox but an assurance case that connects data science, compliance and oversight. An organization that cannot trace what was allowed into a model or which constraints were applied does not truly control the decision.

Upwork study shows AI agents excel with human partners but fail independently

The research challenges both the hype around fully autonomous AI agents and fears that such technology will imminently replace knowledge workers. "AI agents aren't that agentic, meaning they aren't that good," Andrew Rabinovich, Upwork's chief technology officer and head of AI and machine learning, said in an exclusive interview with VentureBeat. "However, when paired with expert human professionals, project completion rates improve dramatically, supporting our firm belief that the future of work will be defined by humans and AI collaborating to get more work done, with human intuition and domain expertise playing a critical role." ... The research reveals stark differences in how AI agents perform with and without human guidance across different types of work. For data science and analytics projects, Claude Sonnet 4 achieved a 64% completion rate working alone but jumped to 93% after receiving feedback from a human expert. In sales and marketing work, Gemini 2.5 Pro's completion rate rose from 17% independently to 31% with human input. OpenAI's GPT-5 showed similarly dramatic improvements in engineering and architecture tasks, climbing from 30% to 50% completion. The pattern held across virtually all categories, with agents responding particularly well to human feedback on qualitative, creative work requiring editorial judgment — areas like writing, translation, and marketing — where completion rates increased by up to 17 percentage points per feedback cycle.

Debunking AI Security Myths for State and Local Governments

As state and local governments adopt AI, they must return to cybersecurity basics and strengthen core principles to help build resilience and earn public trust. For AI workloads, governments should apply zero-trust principles; for example, continuously verifying identities, limiting access by role and segmenting system components. Clear data policies for access, protection and backups help safeguard sensitive information and keep systems resilient. Perhaps most important, security teams need to be involved early in AI design conversations to build in security from the start. ... As state and local governments deploy more sophisticated AI systems, it’s crucial to view the technology as a partner, not a replacement for human intelligence. There is a misconception that advanced AI — particularly agentic AI, which can make its own decisions — eliminates the need for human oversight. The truth is, responsible AI deployment hinges on human oversight and strong governance. The more autonomous an AI system becomes, the more essential human governance is. ... Securing AI is not a one-time milestone. It’s an ongoing process of preparation and adaptation as the threat landscape evolves. For state and local governments advancing their AI initiatives, the path forward centers on building resilience and confidence. And the good news is, they don’t need to start from scratch. The tools and strategies already exist.

When Open Source Meets Enterprise: A Fragile Alliance

The answer is by no means simple; it is determined by a number of factors, of which the vendor’s ethos is one of the most important. Some vendors genuinely give back to the open-source communities from which they gain value. Others are more extractive, building closed proprietary layers atop open foundations and pushing little back to the community. The difference matters enormously. Organisations hold true optionality when a vendor actively maintains the open-source core, while keeping its proprietary features genuinely additive rather than substitutive. In theory, they could shift to another provider or take the open-source components in-house should the relationship sour. ... Commercial open-source vendors can provide training, certification, and managed services to fill this gap, for a fee naturally. Then there is innovation velocity. Open-source communities can move incredibly quickly, with contributions from numerous sources, enabling organisations to adopt cutting-edge features faster than conventional enterprise procurement cycles allow. Conversely, vital security patches can stall if a project lacks maintainers, creating unacceptable exposure for risk-averse organisations. ... Ultimately, the question is not whether open source should exist within the enterprise; that debate has been resolved. The challenge lies in thoughtfully incorporating open-source components into broader technology strategies that balance innovation, resilience, sovereignty, and pragmatic risk management.

The Hidden Cost of Technical Debt in Databases

At its core, technical debt represents the trade-off between speed and quality. When a development team chooses a “quick and dirty” path to meet a deadline, debt is incurred. The database world sees the same phenomenon. ... The first step to eliminating technical debt is recognition. DBAs must adopt a mindset that managing technical debt is part of the job. Although it can be enticing to quickly fix a problem and move on, it should always be a part of the job to reflect on the potential future impact of any change that is made. ... Importantly, DBAs also sit at the crossroads between technical staff and business stakeholders. They can explain how technical debt translates into business impact: lost productivity, slower application delivery, higher infrastructure costs, and greater operational risk. This ability to connect database health to business outcomes is essential for winning support to tackle debt. In practice, the DBA’s role involves three things: identification, communication, and advocacy. DBAs must identify where debt exists, communicate its impact clearly, and advocate for resources to remediate it. Sometimes that means lobbying for time to redesign a schema, other times it means convincing leadership that archiving inactive data will save more money than buying new storage. Yet other times it may involve championing a new tool or process to be put in place to automate required tasks to thwart technical debt.

Seek Skills, Not Titles

Titles feel good—at first. They make your resume and LinkedIn profile look prettier. But when you confuse your title for your identity, you’re setting yourself up for a rude awakening. Titles can be taken away. Or they just expire, like milk in the back of the fridge. Your skills, on the other hand? No one can take those away from you. ... Some roles taught me how to work hard and build trust. Some taught me to communicate clearly and adapt quickly. Others taught me to see the big picture and act decisively. The titles didn’t teach me those skills; the experience did. ... It’s easy to let your job title become your identity, especially when you’re leading at a high level. Everyone wants something from you. Board members, investors, employees. They project their version of who they think you should be. You must have clarity on your core values. Not the company’s core values, but your own. Otherwise, you’ll find yourself playing a dozen different roles without knowing which one is actually you. ... Don’t wait for the title to teach you a skill. Start now. The best way to grow is to pursue skills that will open up opportunities, especially the ones that align with your personal values. Because when your values and skills match, your impact multiplies, regardless of the title. When has pursuing a title led you away from the skills you truly needed? What impact have you seen when your skills are aligned with your values? How might you need to detour to get back on the right track?

Strategic Autarky for the AI Age

AI is still emerging. Overspecifying rules, enforcing rigid certification pathways, or creating sector wise chokepoints too early can stifle the very innovation we aim to promote. Burdensome compliance layers, mandated algorithmic disclosures, prescriptive model testing protocols, and fragmented approval processes can all create friction. Overregulation can discourage experimentation, elevate the cost of market entry, and drain our fastest growing startups. The risk is simple. Innovation flight. Loss of competitive edge. A domestic ecosystem slowed down before it reaches maturity. Balancing sovereignty and innovation, therefore, becomes the central task. India cannot afford to remain dependent, but it also cannot smother its own technological growth. India’s new AI Governance Framework addresses this balance directly. It follows seven guiding principles built around trust, accountability, transparency, privacy, security, human centricity, and collaboration. The standout feature is its “light touch” approach. Instead of imposing rigid controls, the framework sets high level principles that can evolve with technology. It relies on India’s existing legal foundation, including the Digital Personal Data Protection Act and the Information Technology Act, and is supported by institutional structures like the AI Governance Group and the AI Safety Institute. The framework contains several strong provisions. It encourages voluntary risk assessments rather than mandatory rigid audits for most systems.

Google Brain founder Andrew Ng thinks you should still learn to code - here's why

"Because AI coding has lowered the bar to entry so much, I hope we can encourage everyone to learn to code -- not just software engineers," Ng said during his keynote. How AI will impact jobs and the future of work is still unfolding. Regardless, Ng told ZDNET in an interview that he thinks everyone should know the basics of how to use AI to code, equivalent to knowing "a little bit of math," -- still a hard skill, but applied more generally to many careers for whatever you may need. "One of the most important skills of the future is the ability to tell a computer exactly what you want it to do for you," he said, noting that everyone should know enough to speak a computer's language, without needing to write code yourself. "Syntax, the arcane incantations we use, that's less important." ... The new challenge for developers, Ng said during the panel, will be coming up with the concept of what they want. Hedin agreed, adding that if AI is doing the coding in the future, developers should focus on their intuition when building a product or tool. "The thing that AI will be worst at is understanding humans," he said. ... He cited the overhiring sprees tech companies went on -- and then ultimately reversed -- during the COVID-19 pandemic as the primary reason entry-level coding jobs are hard to come by. Beyond that, though, it's a question of grads having the right kind of coding skills.

How Development Teams Are Rethinking the Way They Build Software

While low-code/no-code platforms accelerate development, they can become challenging when trying to achieve high levels of customization or when dealing with complex systems. Custom solutions might be more cost-effective for highly specialized applications. Low-code and no-code platforms must provide clear guidance to users within a structured framework to minimize mistakes, and they may offer less flexibility compared to traditional coding. AI tools can be easily used to generate code, suggest optimizations, or even create entire applications based on natural language prompts. However, they work best when integrated into a broader development ecosystem, not as standalone solutions. ... The future of software development appears to be a blended approach, where traditional programming, low-code/no-code platforms, and AI each play a role. The key to success in this dynamic landscape is understanding when to use each method, ensuring C-level executives, team leaders, and team members are versatile and leverage technology to enhance, rather than replace, human ingenuity. Let me share my firsthand experience. When I asked my developers a year ago how they thought using AI tools at work would evolve, many said: “I expect that as the tools improve, I’ll shift from mostly writing code to mostly reviewing AI-generated code.” Fast forward a year, and when we posed the same question, a common theme emerged: “We are spending less time writing the mundane stuff.”

Businesses must bolster cyber resilience, now more than ever

Cyber upskilling must be built into daily work for both technical and non-technical employees. It’s not a one-off training exercise; it’s part of how people perform their roles confidently and securely. For technical teams, staying current on certifications and practising hands-on defence is essential. Labs and sandboxes that simulate real-world attacks give them the experience needed to respond effectively when incidents happen. For everyone else, the focus should be on clarity and relevance. Employees need to understand exactly what’s expected of them; how their individual decisions contribute to the organisation’s resilience. ... Boards aren’t expected to manage technical defences, but they are responsible for ensuring the organisation can withstand, recover from, and learn after a cyber disruption. Cyber incidents have evolved into full business continuity events, affecting operations, supply chains, and reputation. Resilience should now sit alongside financial performance and sustainability as a core board KPI. That means directors receiving regular updates not only on threat trends and audit findings, but also on recovery readiness, incident transparency, and the cultural maturity of the organisation’s response. Re-engaging boards on this agenda isn’t about assigning blame—it’s about enabling smarter oversight. When leaders understand how resilience protects trust, continuity, and brand, cybersecurity stops being a technical issue and becomes what it truly is: a measure of business strength.

Daily Tech Digest - October 02, 2025

Quote for the day:

"Success is the progressive realization of predetermined, worthwhile, personal goals." -- Paul J. Meyer

AI cost overruns are adding up — with major implications for CIOs

Many organizations appear to be “flying blind” while deploying AI, adds John Pettit, CTO at Google Workspace professional services firm Promevo. If a CIO-led AI project misses budget by a huge margin, it reflects on the CIO’s credibility, he adds. “Trust is your most important currency when leading projects and organizations,” he says. “If your AI initiative costs 50% more than forecast, the CFO and board will hesitate before approving the next one.” ... Beyond creating distrust in IT leadership, missed cost estimates also hurt the company’s bottom line, notes Farai Alleyne, SVP of IT operations at accounts payable software vendor Billtrust. “It is not just an IT spending issue, but it could materialize into an overall business financials issue,” he says. ... enterprise leaders often assume AI coding assistants or no-code/low-code tools can take care of most of the software development needed to roll out a new AI tool. These tools can be used to create small prototypes, but for enterprise-grade integrations or multi-agent systems, the complexity creates additional costs, he says. ... In addition, organizations often underestimate the cost of operating an AI project, he says. Token usage for vectorization and LLM calls can cost tens of thousands of dollars per month, but hosting your own models isn’t cheap, either, with on-premises infrastructure costs potentially running into the thousands of dollars per month.

AI-Powered Digital Transformation: A C-Suite Blueprint For The Future Of Business

At its core, digital transformation is a strategic endeavor, not a technological one. To succeed, it should be at the forefront of the organizational strategy. This means moving beyond simply automating existing processes and instead asking how AI enables new ways of creating value. The shift is from operational efficiency to business model innovation. ... True digital leaders possess a visionary mindset and the critical competencies to guide their teams through change. They must be more than tech-savvy; they must be emotionally intelligent and capable of inspiring trust. This demands an intentional effort to develop leaders who can bridge the gap between deep business acumen and digital fluency. ... With the strategic, cultural and data foundations in place, organizations can focus on building a scalable and secure digital infrastructure. This may involve adopting cloud computing to provide flexible resources needed for big data processing and AI model deployment. It can also mean investing in a range of complementary technologies that, when integrated, create a cohesive and intelligent ecosystem. ... Digital transformation is a complex, continuous journey, not a single destination. This framework provides a blueprint, but its success requires leadership. The challenge is not technological; it's a test of leadership, culture and strategic foresight.

Why Automation Fails Without the Right QA Mindset

Automation alone doesn’t guarantee quality — it is only as effective as the tests it is scripted to run. If the requirements are misunderstood, automated tests may pass while critical issues remain undetected. I have seen failures where teams relied solely on automation without involving proper QA practices, leading to tests that validated incorrect behavior. Automation frequently fails to detect new or unexpected issues introduced by system upgrades. It often misses critical problems such as faulty data mapping, incomplete user interface (UI) testing and gaps in test coverage due to outdated scripts. Lack of adaptability is another common obstacle that I’ve repeatedly seen undermine automation testing efforts. When UI elements are tightly coupled, even minor changes can disrupt test cases. With the right QA mindset, this challenge is anticipated — promoting modular, maintainable automation strategies capable of adapting to frequent UI and logic changes. Automation lacks the critical analysis required to validate business logic and perform true end-to-end testing. From my experience, the human QA mindset proved essential during the testing of a mortgage loan calculation system. While automation handled standard calculations and data validation, it could not assess whether the logic aligned with real-world lending rules.

Stop Feeding AI Junk: A Systematic Approach to Unstructured Data Ingestion

Worse, bad data reduces accuracy. Poor quality data not only adds noise, but it also leads to incorrect outputs that can erode trust in AI systems. The result is a double penalty: wasted money and poor performance. Enterprises must therefore treat data ingestion as a discipline in its own right, especially for unstructured data. Many current ingestion methods are blunt instruments. They connect to a data source and pull in everything, or they rely on copy-and-sync pipelines that treat all data as equal. These methods may be convenient, but they lack the intelligence to separate useful information from irrelevant clutter. Such approaches create bloated AI pipelines that are expensive to maintain and impossible to fine-tune. ... Once data is classified, the next step is to curate it. Not all data is equal. Some information may be outdated, irrelevant, or contradictory. Curating data means deliberately filtering for quality and relevance before ingestion. This ensures that only useful content is fed to AI systems, saving compute cycles and improving accuracy. This also ensures that RAG and LLM solutions can utilize their context windows on tokens for relevant data and not get cluttered up with irrelevant junk. ... Generic ingestion pipelines often lump all data into a central bucket. A better approach is to segment data based on specific AI use cases.

Five critical API security flaws developers must avoid

Developers might assume that if an API endpoint isn’t publicly advertised, it’s inherently secure, a dangerous myth known as “security by obscurity.” This mistake manifests in a few critical ways: developers may use easily guessable API keys or leave critical endpoints entirely unprotected, allowing anyone to access them without proving their identity. ... You must treat all incoming data as untrusted, meaning all input must be validated on the server-side. Your developers should implement comprehensive server-side checks for data types, formats, lengths, and expected values. Instead of trying to block everything that is bad, it is more secure to define precisely what is allowed. Finally, before displaying or using any data that comes back from the API, ensure it is properly sanitized and escaped to prevent injection attacks from reaching end-users. ... Your teams must adhere to the “only what’s necessary” principle by designing API responses to return only the absolute minimum data required by the consuming application. For production environments, configure systems to suppress detailed error messages and stack traces, replacing them with generic errors while logging the specifics internally for your team. ... Your security strategy must incorporate rate limiting to apply strict controls on the number of requests a client can make within a given timeframe, whether tracked by IP address, authenticated user, or API key.

Disaster recovery and business continuity: How to create an effective plan

If your disaster recovery and business continuity plan has been gathering dust on the shelf, it’s time for a full rebuild from the ground up. Key components include strategies such as minimum viable business (MVB); emerging technologies such as AI and generative AI; and tactical processes and approaches such as integrated threat hunting, automated data discovery and classification, continuous backups, immutable data, and gamified tabletop testing exercises. Backup-as-a-service (BaaS) and disaster recovery-as-a-service (DRaaS) are also becoming more popular, as enterprises look to take advantage of the scalability, cloud storage options, and ease-of-use associated with the “as-a-service” model. ... Accenture’s Whelan says that rather than try to restore the entire business in the event of a disaster, a better approach might be to create a skeletal replica of the business, an MVB, that can be spun up immediately to keep mission-critical processes going while traditional backup and recovery efforts are under way. ... The two additional elements are: one offline, immutable, or air-gapped backup that will enable organizations to get back on their feet in the event of a ransomware attack, and a goal of zero errors. Immutable data is “the gold standard,” Whelan says, but there are complexities associated with proper implementation.

Building Intelligence into the Database Layer

At the core of this evolution is the simple architectural idea of the database as an active intelligence engine. Rather than simply recording and serving historical data, an intelligent database interprets incoming signals, transforms them in real-time, and triggers meaningful actions directly from within the database layer. From a developer’s perspective, it still looks like a database, but under the hood, it’s something more: a programmable, event-driven system designed to act on high-velocity data streams with intense precision in real-time. ... Built-in processing engines unlock features like anomaly detection, forecasting, downsampling, and alerting in true real-time. These embedded engines enable real-time computation directly inside the database. Instead of moving data to external systems for analysis or automation, developers can run logic where the data already lives. ... Active intelligence doesn’t just enable faster reactions; it opens the door to proactive strategies. By continuously analyzing streaming data and comparing it to historical trends, systems can anticipate issues before they escalate. For example, gradual changes in sensor behavior can signal the early stages of a failure, giving teams time to intervene. ... Developers need more than just storage and query, they need tools that think. Embedding intelligence into the database layer represents a shift toward active infrastructure: systems that monitor, analyze, and respond at the edge, in the cloud, and across distributed environments.

AI Cybersecurity Arms Race: Are Companies Ready?

Security operations centers were already overwhelmed before AI became mainstream. Human analysts, drowning in alerts, can’t possibly match the velocity of machine-generated threats. Detection tools, built on static signatures and rules, simply can’t keep up with attacks that mutate continuously. The vendor landscape isn’t much more reassuring. Every security company now claims its product is “AI-powered,” but too many of these features are black boxes, immature, or little more than marketing gloss. ... That doesn’t mean defenders are standing still. AI is beginning to reshape cybersecurity on the defensive side, too, and the potential is enormous. Anomaly detection, fueled by machine learning, is allowing organizations to spot unusual behavior across networks, endpoints, and cloud environments far faster than humans ever could. In security operations centers, agentic AI assistants are beginning to triage alerts, summarize incidents, and even kick off automated remediation workflows. ... The AI arms race isn’t something the CISO can handle alone; it belongs squarely in the boardroom. The challenge isn’t just technical — it’s strategic. Budgets must be allocated in ways that balance proven defenses with emerging AI tools that may not be perfect but are rapidly becoming necessary. Security teams must be retrained and upskilled to govern, tune, and trust AI systems. Policies need to evolve to address new risks such as AI model poisoning or unintended bias.

Agentic AI needs stronger digital certificates

The consensus among practitioners is that existing technologies can handle agentic AI – if, that is, organisations apply them correctly from the start. “Agentic AI fits into well-understood security best practices and paradigms, like zero trust,” Wetmore emphasises. “We have the technology available to us – the protocols and interfaces and infrastructure – to do this well, to automate provisioning of strong identities, to enforce policy, to validate least privilege access.” The key is approaching AI agents with security-by-design principles rather than bolting on protection as an afterthought. Sebastian Weir, executive partner and AI Practice Leader at IBM UK&I, sees this shift happening in his client conversations. ... Perhaps the most critical insight from security practitioners is that managing agentic AI isn’t primarily about new technology – it’s about governance and orchestration. The same platforms and protocols that enable modern DevOps and microservices can support AI agents, but only with proper oversight. “Your ability to scale is about how you create repeatable, controllable patterns in delivery,” Weir explains. “That’s where capabilities like orchestration frameworks come in – to create that common plane of provisioning agents anywhere in any platform and then governance layers to provide auditability and control.”

Learning from the Inevitable

Currently, too many organizations follow a “nuke and pave” approach to IR, opting to just reimage computers because they don’t have the people to properly extract the wisdom from an incident. In the short term, this is faster and cheaper but has a detrimental impact on protecting against future threats. When you refuse to learn from past mistakes, you are more prone to repeating them. Conversely, organizations may turn to outsourcing. Experts in managed security services and IR have realized consulting gives them a broader reach and impact over the problem — but none of these are long-term solutions. This kind of short-sighted IR creates a false sense of security. Organizations are solving the problem for the time being, but what about the future? Data breaches are going to happen, and reliance on reactive problem-solving creates a flimsy IR program that leaves an organization vulnerable to threats. ... Knowledge-sharing is the best way to go about this. Sharing key learnings from previous attacks is how these teams can grow and prevent future disasters. The problem is that while plenty of engineers agree they learn the most when something “breaks” and that incidents are a treasure trove of knowledge for security teams, these conversations are often restricted to need-to-know channels. Openness about incidents is the only way to really teach teams how to address them.