Quote for the day:
“The moment you’re comfortable is the moment you stop growing.” -- Allison Dunn
AI Security Spending Jumps as Fear Outpaces Proof of Value
Companies are heavily investing in artificial intelligence for cybersecurity,
often prioritizing swift adoption over clear proof of its effectiveness. Driven
by the transition of AI from a testing phase into active use, along with the
rising deployment of AI by bad actors, organizations feel immense pressure to
keep pace. For many chief information security officers (CISOs), fear of falling
behind and the need for "blame insurance" against potential breaches are
accelerating spending. In fact, a significant number of CISOs cite AI as their
top priority for new budget allocations. Despite this aggressive funding, the
most common AI implementations often fall short of delivering the highest
returns. The challenge is compounded by the inherent difficulty of measuring the
return on investment (ROI) in cybersecurity, where success is defined by
preventing events like data breaches rather than generating direct profit.
Experts advise a more deliberate approach, urging organizations to move past the
hype. Rather than adopting AI simply for the sake of having it, companies should
focus on areas where the technology can genuinely lower risk and handle
repetitive tasks. Thoughtful integration, backed by strong governance and clear
goals, will ultimately determine which organizations benefit most from their AI
cybersecurity investments.Salesforce’s massive outage exposes the hidden risks of cloud dependencies
A massive Salesforce outage during its flagship Dreamforce event has underscored
the hidden architectural risks of cloud dependency. A roughly
seven-and-a-half-hour service disruption on September 16 impacted multiple
instances across all regions, initially stemming from a core system component
struggling with an "external dependency failure" linked to a legacy login
server. Although the issue was resolved by mid-afternoon through manual
interventions after automated rolling restarts fell short, the outage highlights
that cloud systems do not eradicate architectural vulnerabilities. Instead,
these dependencies can become enterprise risks when a central platform fails.
The service failure emphasizes the necessity of looking beyond immediate access
restoration. Enterprises must transition into a reconciliation phase to address
"temporal data problems," ensuring transactions, scheduled jobs, and downstream
systems remain consistent. The disruption proves that a legacy component's age
is less critical than its role within the system's dependency graph.
Organizations should not equate modernization simply with replacing old
technology. They must assess dependency concentration, failure blast radius, and
isolation strategies. While there are no signs of a security incident, industry
experts suggest automated AI tools or recent workforce reductions might have
played a role in the disruption. Future post-incident reviews must provide clear
insights into failure propagation and preventive measures.Crypto Industry Figures Blackmailed by Revolut's Hacker
A recent data breach at the British financial services company Revolut has
exposed the sensitive personal information of roughly six hundred and eighty
high-profile cryptocurrency exchange customers. An extortion group calling
itself "Iamnotavillain" orchestrated the attack without breaking into the
bank's secure servers. Instead, the criminals gained access to a legitimate
Italian government email system. By posing as authorized law enforcement
officials for several months, they submitted fraudulent data requests to the
bank's compliance team. Believing the inquiries were authentic, employees
handed over highly confidential customer files. This exposed data included
passport copies, verification photographs, home addresses, phone numbers, and
detailed transaction histories. The attackers specifically targeted users with
substantial digital asset activity, and notable industry figures such as
former Mt. Gox executive Mark Karpelès were among the victims. After securing
these detailed identity packages, the hackers launched a blackmail campaign.
They demanded a ransom payment of three million dollars, requested in the
privacy-focused digital currency Monero, to prevent the information from being
released. The extortionists even set up a public website with a countdown
clock, threatening to sell the stolen records to other criminal organizations
if the company failed to meet their demands within a strict twenty-four hour
window.Stop Treating CSS Container Queries Like Traditional Media Queries
The article clarifies the common misconception that CSS container queries and media queries serve the same purpose. Despite having a 94% browser support rate, container queries are vastly underutilized. Many developers mistakenly treat them interchangeably because of their similar syntax, but they fundamentally differ in their approach to responsive design. Media queries focus outward on the "macro" layout. They check the viewport's dimensions to adjust overarching page structures, such as main grids or full-width headers. Conversely, container queries look inward at "micro" layouts. They allow individual components, like cards or widgets, to adapt based on the available space within their specific parent container, rather than the entire screen size. This distinction is crucial for creating reusable components that maintain their layout integrity regardless of where they are placed on a page. The author advises against replacing media queries entirely with container queries. Instead, the focus should be on a separation of concerns. Media queries remain ideal for page-level adjustments, while container queries shine when a component's layout depends on its immediate context. However, container queries require an extra wrapper element, cannot query their own block size without collapsing, and cannot accept custom property values. Ultimately, understanding these differences unlocks more resilient responsive design.Trust becomes the product: Five takeaways from the Splunk .conf26 keynotes
The recent Splunk conference centered on a critical theme for modern
businesses: trust is the most important element when deploying artificial
intelligence agents. As these agents shift from being simple tools to
functioning as autonomous digital teammates, they are handling complex tasks
around the clock. This shift requires a strong system of record to ensure they
act appropriately. A major takeaway is the necessary merging of system
monitoring and security. Because it is difficult to tell the difference
between a software error, a security breach, or a poorly executed AI command,
companies must combine their monitoring and security data to accurately
diagnose issues. Cost management is another significant focus. AI agents can
quickly become expensive to run if they are not carefully controlled, meaning
businesses need better visibility into their data usage to prevent unexpected
bills. Furthermore, managing the massive amounts of data required for these
systems must become more affordable and efficient so companies do not have to
choose which information to keep. Ultimately, organizations are treating AI
agents like new employees. They are granting them limited permissions
initially and slowly increasing their responsibilities as they prove their
reliability, ensuring that human oversight remains an essential part of the
process.
Architecting for the Knowledge You Can’t Capture
The article argues that organizations often underestimate how much essential
knowledge never makes it into their documentation or AI systems. It opens with
a familiar scenario: an experienced engineer is asked to “document everything”
before leaving, but what gets captured is only the clean, idealized version of
the work. The subtle judgments, exceptions, and sensory cues that guide real
decisions never appear in the flowcharts or transcripts, leaving future teams
without the insight needed to handle unusual situations. The author explains
that this gap reflects the nature of tacit knowledge—skills and perceptions
people rely on but rarely articulate. Modern AI can learn from examples, but
when expertise is rare or incidents are infrequent, there simply isn’t enough
data for models to infer the missing judgment. The article proposes a
structured elicitation protocol that pushes experts to clarify thresholds,
exceptions, evidence, and escalation paths, turning vague statements into
actionable rules. It also outlines a four‑layer architecture—capture,
representation, serving, and transmission—to preserve context, surface
uncertainty, and support apprenticeship when documentation falls short. The
core message is that organizations must design for the knowledge people can’t
easily express, or their AI systems will remain blind to the expertise that
actually keeps operations running.
The article discusses the challenge of keeping AI-generated code aligned with
organizational standards. As more developers use AI coding tools, the risk of
accumulating technical and operational debt increases if code is only judged
by whether it works functionally. To prevent this, engineering teams must
clearly document their non-functional requirements, such as security rules,
performance expectations, and data governance policies. These standards should
not remain hidden as tribal knowledge. Instead, they must be explicit,
machine-readable, and fed into the AI tools as context before any code is
generated. Furthermore, organizations should enforce these rules by turning
them into automated acceptance criteria within their continuous integration
and delivery pipelines. This ensures that any AI-generated code is
automatically checked for compliance, security, and performance before it
merges. Experts recommend treating AI output as untrusted until it passes the
exact same rigorous reviews, tests, and monitoring as human-written code.
Ultimately, governing AI-generated code requires shifting from manual audits
to automated, systemic enforcement. By maintaining clear specifications,
integrating standards into automated testing, and adapting context engines to
learn from past decisions, development teams can safely scale their AI use
while keeping code quality strictly aligned with enterprise expectations over
the long term.
Enterprise AI systems increasingly require human-in-the-loop (HITL) oversight
to ensure accountability and mitigate risks associated with flawed AI outputs.
The FTC's actions against DoNotPay highlight the legal perils of deploying
unchecked AI, driving the adoption of software with built-in human escalation
for complex workflows. While HITL is meant to catch model errors before they
become compliance or legal issues, experts warn against relying solely on an
AI's self-assessed confidence score to trigger review, as a confident model
can still be wrong. Effective HITL design involves intelligent routing that
escalates issues to the appropriate personnel based on organizational risk
tolerance, rather than a simple binary system. Furthermore, real oversight
demands more than a rubber-stamp approval process; it requires reviewers with
the context and time to actually evaluate the AI's work and overturn it if
necessary, combating the tendency for reviewers to become biased in favor of
the AI's suggestions. Legislation like the EU AI Act necessitates demonstrable
proof of this oversight through clear audit trails. Successful
implementations, like those by Nominal and IgniteTech, often mandate human
approval for critical actions and use "grounding," which forces the AI to rely
only on verified company data or escalate the query if it lacks the
information, ensuring accountability remains firmly with human operators.
The provided article discusses the need to prepare the FIDO2 ecosystem, which
includes passkeys, for the post-quantum era. Passkeys, which rely on
asymmetric cryptography, are vulnerable to future quantum computers that could
potentially break the current public-key algorithms like RSA and elliptic
curve cryptography.
The author, Johann-Philipp Thiers, explains that transitioning to Post-Quantum Cryptography (PQC) is a complex process. It goes beyond simply swapping out algorithms. PQC algorithms often result in larger keys and signatures, which can be problematic for resource-constrained authenticators like hardware security keys due to memory, processing power, and transport limitations.
Furthermore, the transition involves updating the entire trust chain, including metadata service signatures, certificate formats, and relying party support. The author emphasizes that FIDO’s current crypto-agility is beneficial but requires coordination among various stakeholders, such as operating systems, browsers, and certification programs. Practical demonstrators are crucial for identifying engineering challenges like message sizes, performance impacts, and interoperability issues. Ultimately, securing passkeys against quantum threats requires a gradual, coordinated effort involving standardization, testing, and careful engineering to ensure their long-term viability.
How to keep AI-generated code aligned with your standards
The article discusses the challenge of keeping AI-generated code aligned with
organizational standards. As more developers use AI coding tools, the risk of
accumulating technical and operational debt increases if code is only judged
by whether it works functionally. To prevent this, engineering teams must
clearly document their non-functional requirements, such as security rules,
performance expectations, and data governance policies. These standards should
not remain hidden as tribal knowledge. Instead, they must be explicit,
machine-readable, and fed into the AI tools as context before any code is
generated. Furthermore, organizations should enforce these rules by turning
them into automated acceptance criteria within their continuous integration
and delivery pipelines. This ensures that any AI-generated code is
automatically checked for compliance, security, and performance before it
merges. Experts recommend treating AI output as untrusted until it passes the
exact same rigorous reviews, tests, and monitoring as human-written code.
Ultimately, governing AI-generated code requires shifting from manual audits
to automated, systemic enforcement. By maintaining clear specifications,
integrating standards into automated testing, and adapting context engines to
learn from past decisions, development teams can safely scale their AI use
while keeping code quality strictly aligned with enterprise expectations over
the long term.
Human-in-the-loop oversight is critical for enterprise AI: 4 experts explain why
Enterprise AI systems increasingly require human-in-the-loop (HITL) oversight
to ensure accountability and mitigate risks associated with flawed AI outputs.
The FTC's actions against DoNotPay highlight the legal perils of deploying
unchecked AI, driving the adoption of software with built-in human escalation
for complex workflows. While HITL is meant to catch model errors before they
become compliance or legal issues, experts warn against relying solely on an
AI's self-assessed confidence score to trigger review, as a confident model
can still be wrong. Effective HITL design involves intelligent routing that
escalates issues to the appropriate personnel based on organizational risk
tolerance, rather than a simple binary system. Furthermore, real oversight
demands more than a rubber-stamp approval process; it requires reviewers with
the context and time to actually evaluate the AI's work and overturn it if
necessary, combating the tendency for reviewers to become biased in favor of
the AI's suggestions. Legislation like the EU AI Act necessitates demonstrable
proof of this oversight through clear audit trails. Successful
implementations, like those by Nominal and IgniteTech, often mandate human
approval for critical actions and use "grounding," which forces the AI to rely
only on verified company data or escalate the query if it lacks the
information, ensuring accountability remains firmly with human operators.
Passkeys in the post-quantum era: Why FIDO needs more than new algorithms
The provided article discusses the need to prepare the FIDO2 ecosystem, which
includes passkeys, for the post-quantum era. Passkeys, which rely on
asymmetric cryptography, are vulnerable to future quantum computers that could
potentially break the current public-key algorithms like RSA and elliptic
curve cryptography.The author, Johann-Philipp Thiers, explains that transitioning to Post-Quantum Cryptography (PQC) is a complex process. It goes beyond simply swapping out algorithms. PQC algorithms often result in larger keys and signatures, which can be problematic for resource-constrained authenticators like hardware security keys due to memory, processing power, and transport limitations.
Furthermore, the transition involves updating the entire trust chain, including metadata service signatures, certificate formats, and relying party support. The author emphasizes that FIDO’s current crypto-agility is beneficial but requires coordination among various stakeholders, such as operating systems, browsers, and certification programs. Practical demonstrators are crucial for identifying engineering challenges like message sizes, performance impacts, and interoperability issues. Ultimately, securing passkeys against quantum threats requires a gradual, coordinated effort involving standardization, testing, and careful engineering to ensure their long-term viability.
AI made software development unrecognizable. Is cybersecurity next?
Artificial intelligence is rapidly reshaping the cybersecurity landscape, much
as it has already transformed software development. While the shift in
security might take slightly longer, experts predict that fundamental changes
are inevitable. Security Operations Centers will soon rely heavily on
autonomous agents to perform initial triage, allowing human analysts to focus
on complex oversight and critical decisions. This transition is essential
because AI is drastically increasing the discovery of vulnerabilities,
creating a massive backlog that security teams struggle to absorb and
remediate. Furthermore, as attackers begin using AI to launch high speed
automated threats, organizations must deploy their own rapid containment
systems to respond effectively. This shift will also alter the cybersecurity
workforce. Rather than eliminating jobs, organizations will likely adopt
flatter teams featuring highly experienced senior professionals at one end and
junior staff at the other, putting pressure on middle management roles. AI
might also serve as a unifying interface to manage sprawling security
toolsets. To prepare, security leaders should begin testing agents on high
volume tasks while establishing strong governance frameworks. Most
importantly, leaders must ensure that every autonomous agent has a designated
human owner who remains fully accountable for its actions and potential
failures within the organization.
/articles/architecting-autonomy-scale/en/smallimage/architecting-autonomy-scale-thumbnail-1774360140662.jpg)
