Daily Tech Digest by Kannan Subbiah: design

Showing posts with label design. Show all posts

Daily Tech Digest - August 03, 2026

Quote for the day:

“Treat employees like they make a difference, and they will.” -- Jim Goodnight

🎧 Listen to the audio debrief on YouTube

▶ Play Audio Digest

Duration: 23 mins • Perfect for listening on the go.

Stop graphing everything: When GraphRAG actually beats vector RAG

The article discusses the recent trend of using knowledge graphs for modern artificial intelligence applications and advises against using them for absolutely every project. While these graphs offer useful ways to connect different pieces of information, they also introduce significant costs, added complexity, and ongoing maintenance demands. For most everyday needs, standard vector retrieval remains the more sensible and efficient option. This traditional method works very well for direct questions where the system simply needs to find existing text with a similar meaning. Still, there are specific situations where a graph approach clearly performs better than standard methods. The main benefit of using a graph system appears when a task involves complex reasoning with multiple steps. If a project requires connecting scattered details across massive amounts of data or understanding deep networks of relationships, such as tracking company ownership or untangling legal documents, a graph structure becomes necessary. The main takeaway is to look closely at what your project actually requires before paying for a new, complex database setup. By saving graph tools for problems that truly need them and using standard retrieval for direct questions, development teams can build capable systems without taking on needless expenses or technical burdens.

Why AI Code Risk Must Be a Line Item in Every Organization's Budget

As artificial intelligence increasingly writes our software, organizations are restructuring their budgets to treat security testing tools as essential infrastructure rather than mere compliance checkboxes. A recent survey reveals that the primary bottleneck in software development has shifted from writing code to reviewing and validating it. With AI generating massive volumes of code, human review capacity is struggling to keep pace. Almost half of the organizations surveyed are already running AI generated code in production, yet many admit that AI introduced issues, such as security vulnerabilities, unintended dependencies, and performance problems, regularly slip through the cracks. These challenges have drawn the attention of legal, compliance, and leadership teams, prompting the creation of new policies and more rigorous review processes. Additionally, relying heavily on AI poses a long term risk to the development of junior engineers, who lose valuable learning opportunities. Despite these hurdles, the productivity gains and cost reductions are too significant to ignore. However, simply purchasing more security tools is not quite enough. To safely manage this transition, organizations need cross disciplinary visibility into their codebases. By understanding exactly how software changes from week to week, teams can confidently harness this speed without sacrificing system reliability.

Zero Trust drives biometrics in physical access security

Organizations are increasingly applying the concept of continuous verification to physical security, recognizing that protecting a building is just as important as protecting a digital network. Historically, physical access relied on perimeter defense, assuming anyone inside a facility could be trusted. This approach is no longer effective against modern threats. When companies invest heavily in digital safeguards but neglect physical entry points, they leave critical assets vulnerable to unauthorized access. To bridge this gap, organizations are adopting biometric identification methods, such as fingerprint and facial recognition. Unlike traditional keys or access cards, which can be easily lost, shared, or stolen, biometrics provide a reliable link between the authorized identity and the actual person requesting entry. However, simply adding a biometric scanner to a standard door does not prevent unauthorized individuals from following someone inside. Effective security requires a layered approach that combines identity checks with controlled movement through specialized portals or gates. By creating multiple verification points, facilities ensure that if one security measure fails, others are in place to prevent a breach. This comprehensive strategy is now expanding beyond highly restricted data centers into standard office buildings, providing reliable and straightforward access control for our modern corporate environments today.

The Bull And Bear Case For Digital Design In The Age Of AI

In "The Bull And Bear Case For Digital Design In The Age Of AI," Andy Budd explores how artificial intelligence shifts the balance of power for digital designers. For years, designers have argued they could produce better work if organizational barriers like limited engineering time or rigid product roadmaps were removed. The optimistic bull case suggests AI grants this wish. By enabling designers to prototype, write copy, and build working models independently, AI reduces their reliance on permission from others. Strong designers can evolve into hybrid leaders with direct influence over product outcomes, rather than simply making screens. Conversely, the pessimistic bear case argues that this newfound independence also removes a convenient excuse for weak work. When designers can build their own solutions, they must own the results. Additionally, AI empowers product managers and engineers to bypass design teams entirely by generating plausible interfaces that look decent but lack careful thought. This could narrow the designer's role to mere maintenance and cleanup. Ultimately, Budd suggests both futures will unfold simultaneously. The best designers will use AI to increase their agency and impact, while average practitioners may find their roles shrinking or replaced as the industry demands genuine product judgment over superficial polish.

Crisis Leadership in 2026: Why Organizational Resilience Has Become the New Measure of Trust

In 2026, organizational resilience has evolved from a purely operational checklist into a critical measure of leadership and trust. Historically, companies focused on how fast they could recover systems during a crisis. Today, stakeholders look far beyond basic business continuity to evaluate how leaders communicate, adapt, and make decisions under pressure. Resilience is now recognized as a broad leadership skill rather than just an IT or operations duty. A major shift is the interconnected nature of modern crises. What starts as a technical glitch can rapidly snowball into financial, reputational, and operational challenges. To navigate this effectively, trust must be built well before a crisis hits. A company's overall credibility during a disruption draws heavily on its past behavior and consistent transparency with the public. Furthermore, while technology like artificial intelligence aids in crisis monitoring, it also fuels new risks like deepfakes and rapid misinformation, making human judgment more vital than ever. Leaders cannot rely on speed alone; they must show adaptability and empathy. Crucially, a crisis does not end when systems come back online. Stakeholders watch closely to see if organizations learn from their mistakes and follow through on long-term improvements. Ultimately, true organizational resilience means sustaining confidence through continual change.

FinAI & Managing AI Costs: Innovation, Production, and Lifecycle

This episode of the StarCIO podcast focuses on the emerging practice of FinAI, which involves strategically managing the costs associated with artificial intelligence. As organizations increasingly adopt AI, they often face unexpected expenses across different stages of development. The discussion highlights the importance of tracking these costs carefully, from the initial innovation and experimentation phases right through to full scale production. Rather than just focusing on the technology itself, leaders need to understand the financial implications of the entire AI lifecycle. This includes the computing power required for training models, the ongoing expenses of running them, and the resources needed for continuous monitoring and updates. By applying financial operations principles to artificial intelligence, companies can make more informed decisions about which projects to pursue and how to allocate their budgets effectively. The podcast suggests that successful AI initiatives require a balanced approach, where innovation is encouraged but guided by clear financial visibility and accountability. Ultimately, mastering FinAI allows organizations to maximize the true value of their investments while avoiding the budget overruns that often derail complex technology projects. Managing the complete lifecycle ensures that artificial intelligence delivers real business benefits without compromising financial stability or essential long-term growth objectives.

The Massive AI Security Hole Your CISO Doesn't Know About

Many security teams mistakenly apply traditional software security checks to modern artificial intelligence deployments, leaving a significant vulnerability unchecked. While conventional systems are predictable, language models process unpredictable natural language, rendering standard defenses like input validation and traditional data loss prevention ineffective. Most chief information security officers ensure the infrastructure is secure but completely overlook the model itself. Consequently, these models are exposed to unique risks such as indirect prompt injections, where hidden instructions in standard documents trick the model into extracting internal data. Another major oversight is granting AI agents broad permissions rather than limiting their access to specific tasks, essentially creating an internal threat without a clear audit trail. Furthermore, models can inadvertently leak sensitive information through normal conversation, and employees often expose company data by using unsanctioned consumer AI tools. To actually secure these deployments, organizations must fundamentally adapt their approach. This involves strictly limiting the permissions of AI agents, treating any data the model retrieves as potentially malicious, and implementing strict controls on what the model can send outward. Additionally, conducting specialized adversarial testing and providing approved internal AI tools will help close these gaps, ensuring the system is genuinely secure from the inside out.

Managing your supplier risk isn't a deadline. It's about your resilience

The Digital Operational Resilience Act is shifting how financial technology companies in the United Kingdom approach third-party risk. While many organizations view compliance as a completed checklist of policies and questionnaires, true operational security requires a deeper understanding of the supplier ecosystem. Financial technology firms rely heavily on external connections, such as cloud infrastructure and payment systems, meaning every external connection introduces a potential vulnerability. Rather than treating regulations as a mere compliance exercise, organizations should use them as frameworks to build practical resilience. This involves fully mapping technology dependencies, identifying concentration risks, updating contracts to reflect actual risk levels, and rigorously testing incident response plans in realistic scenarios. Organizations that understand their data flows and supply chain dependencies do more than satisfy regulatory requirements; they establish reliable foundations that build trust with institutional clients and partners. As regulatory enforcement becomes more rigorous following the initial implementation phase, superficial compliance is no longer adequate. Companies must transition from treating supplier risk as a deadline to viewing it as a core management priority. Genuine resilience means knowing exactly what happens if a critical supplier fails and having the proven capacity to maintain continuity during an actual incident, ensuring long-term operational stability.

AI is making cybersecurity fundamentals more important than ever

The rise of artificial intelligence in cyberattacks has led many to believe we need entirely new defensive playbooks. However, industry experts argue that AI actually makes traditional cybersecurity fundamentals more critical than ever. Rather than inventing entirely novel vulnerability classes, AI empowers attackers to execute familiar techniques—like social engineering, credential theft, and exploiting unpatched software—at unprecedented speed and scale. Because AI systems can continuously scan for misconfigurations and weak access controls, long-standing security debt is now a severe liability. To defend against these rapidly automated threats, organizations must double down on basic practices such as multifactor authentication, zero-trust architectures, routine system patching, and proper identity management. These foundational controls efficiently block entire categories of attacks, preventing modern adversaries from easily penetrating sensitive digital environments. While generative AI introduces specific new risks like prompt injection, most immediate threats still rely on conventional technical oversights. Furthermore, relying solely on AI for corporate defense without dedicated human oversight is a dangerous trap. Security professionals must clearly understand core principles to verify AI-generated recommendations and ensure that automated tools function correctly. Ultimately, the most effective strategy pairs a strong foundation of basic security hygiene with the massive scale of defensive AI, preserving essential human accountability.

Keeping Proprietary Data Out of AI Training Models

As artificial intelligence becomes a standard part of business operations, companies face a serious new risk: the accidental sharing of their private information. When employees use AI tools, the data they enter can sometimes be absorbed into the system's training models. According to legal experts, the primary danger here is the permanent loss of trade secrets and intellectual property. If your company's private strategies or customer details are used to train a public AI model, that information could eventually benefit your competitors. Currently, many organizations handle this risk poorly by keeping their legal, security, and purchasing teams in separate silos. This separation often allows hidden AI features in standard software updates to slip through the cracks. To fix this, companies must adopt a unified, cross-functional approach to reviewing new technology. Most importantly, businesses cannot rely on simple opt-out buttons or marketing promises to protect their assets. Chief Information Officers and legal teams must demand strict, written guarantees in their vendor contracts. These agreements must clearly state that no company data, including prompts and inputs, will be used to train or improve any AI models. Furthermore, companies must secure the right to independently audit vendors to ensure complete and ongoing compliance.

Daily Tech Digest - February 08, 2026

Quote for the day:

"The litmus test for our success as Leaders is not how many people we are leading, but how many we are transforming into leaders" -- Kayode Fayemi

Why agentic AI and unified commerce will define ecommerce in 2026

Agentic AI and unified commerce are set to shape ecommerce in 2026 because the foundations are now in place: consumers are increasingly comfortable using AI tools, and retailers are under pressure to operate seamlessly across channels. ... When inventory, orders, pricing, and customer context live in disconnected systems, both humans and AI struggle to deliver consistent experiences. When those systems are unified, retailers can enable more reliable automation, better availability promises, and more resilient fulfillment, especially at peak. ... Unified commerce platforms matter because they provide a single operational framework for inventory, orders, pricing, and customer context. That coordination is increasingly critical as more interactions become automated or AI-assisted. ... The shift toward “agentic” happens when AI can safely take actions, like resolving a customer service step, updating a product feed, or proposing a replenishment recommendation, based on reliable data and explicit rules. That’s why unified commerce matters: it reduces the risk of automation acting on partial truth. Because ROI varies dramatically by category, maturity, and data quality, it’s safer to avoid generic percentage claims. The defensible message is: companies that pair AI with clean operational data and clear governance will unlock automation faster and with fewer reputational risks. ... Ultimately, success in 2026 will not be defined by how many AI features a retailer deploys, but by how well their systems can interpret context, act reliably, and scale under pressure.

EU's Digital Sovereignty Depends On Investment In Open-Source And Talent

We argue that Europe must think differently and invest where it matters, leveraging its strengths, and open technologies are the place to look. While Europe does not have the tech giants of the US and China, it possesses a huge pool of innovation and human capital, as well as a small army of capable and efficient technology service providers, start-ups, and SMEs. ... Recent data shows that while Europe accounts for a substantial share of global open source developers, its contribution to open source-derived infrastructure remains fragmented across countries, with development being concentrated in a small number of countries. ... Europe may not have a Silicon Valley, but it has something better: a robust open source workforce. We are beginning to recognize this through fora such as the recent European Open Source Awards, which celebrated European citizens and residents working on things ranging from the Linux kernel and open office suites to open hardware and software preservation. ... Europe has a chance of succeeding. Historically, Europe has done a good job in making open source and open standards a matter of public policy. For example, the European Commission's DG DIGIT has an open source software strategy which is being renewed this year, and Europe possesses three European Standards Organizations, including CEN, CENELEC, and ETSI. While China has an open source software strategy, Europe is arguably leading the US in harnessing the potential of open technologies as a matter of public and industrial policy, and it has a strong foundation for catching up to China.

Is artificial general intelligence already here? A new case that today's LLMs meet key tests

Approaching the AGI question from different disciplinary perspectives—philosophy, machine learning, linguistics, and cognitive science—the four scholars converged on a controversial conclusion: by reasonable standards, current large language models (LLMs) already constitute AGI. Their argument addresses three key questions: What is general intelligence? Why does this conclusion provoke such strong reactions? And what does it mean for ... "There is a common misconception that AGI must be perfect—knowing everything, solving every problem—but no individual human can do that," explains Chen, who is lead author. "The debate often conflates general intelligence with superintelligence. The real question is whether LLMs display the flexible, general competence characteristic of human thought. Our conclusion: insofar as individual humans possess general intelligence, current LLMs do too." ... "This is an emotionally charged topic because it challenges human exceptionalism and our standing as being uniquely intelligent," says Belkin. "Copernicus displaced humans from the center of the universe, Darwin displaced humans from a privileged place in nature; now we are contending with the prospect that there are more kinds of minds than we had previously entertained." ... "We're developing AI systems that can dramatically impact the world without being mediated through a human and this raises a host of challenging ethical, societal, and psychological questions," explains Danks.

Biometrics deployments at scale need transparency to help businesses, gain trust

As adoption invites scrutiny, more biometrics evaluations, completed assessments and testing options come available. Communication is part of the same issue, with major projects like EES, U.S. immigration and protest enforcement, and more pedestrian applications like access control and mDLs all taking off. ... Biometric physical access control is growing everywhere, but with some key sectorial and regional differences, Goode Intelligence Chief Analyst Alan Goode explains in a preview of his firm’s latest market research report on the latest episode of the Biometric Update Podcast. Imprivata could soon be on the market, with PE owner Thoma Bravo working with JPMorgan and Evercore to begin exploring its options. ... A panel at the “Identity, Authentication, and the Road Ahead 2026” event looked at NIST’s work on a playbook to help businesses implement mDLs. Representatives from the NCCoE, Better Identity Coalition, PNC Bank and AAMVA discussed the emerging situation, in which digital verifiable credentials are available, but people don’t know how to use them. ... DHS S&T found 5 of 16 selfie biometrics providers met the performance goals of its Remote Identity Validation Rally, Shufti and Paravision among them. RIVR’s first phase showed that demographically similar imposters still pose a significant problem for many face biometrics developers.

The Invisible Labor Force Powering AI

A low-cost labor force is essential to how today’s AI models function. Human workers are needed at every stage of AI production for tasks like creating and annotating data, reinforcing models, and moderating content. “Today’s frontier models are not self-made. They’re socio-technical systems whose quality and safety hinge on human labor,” said Mark Graham, a professor at the University of Oxford Internet Institute and a director of the Fairwork project, which evaluates digital labor platforms. In his book Feeding the Machine: the Hidden Human Labor Powering AI (Bloomsbury, 2024), Graham and his co-authors illustrate that this global workforce is essential to making these systems usable. “Without an ongoing, large human-in-the-loop layer, current capabilities would be far more brittle and misaligned, especially on safety-critical or culturally sensitive tasks,” Graham said. ... The industry’s reliance on a distributed, gig-work model goes back years. Hung points to the creation of the ImageNet database around 2007 as the moment that set the referential data practices and work organization for modern AI training. ... However, cost is not the only factor. Graham noted that cost arbitrage plays a role, but it is not the whole explanation. AI labs, he said, need extreme scale and elasticity, meaning millions of small, episodic tasks that can be staffed up or down at short notice, as well as broad linguistic and cultural coverage that no single in-house team can reproduce.

Code smells for AI agents: Q&A with Eno Reyes of Factory

In order to build a good agent, you have to have one that's model agnostic. It needs to be deployable in any environment, any OS, any IDE. A lot of the tools out there force you to make a hard trade off that we felt wasn't necessary. You either have to vendor lock yourself to one LLM or ask everyone at your company to switch IDEs. To build like a true model agnostic, vendor agnostic coding agent, you put in a bunch of time and effort to figure out all the harness engineering that's necessary to make that succeed, which we think is a fairly different skillset from building models. And so that's why we think companies like us actually are able to build agents that outperform on most evaluations from our lab. ... All LLMs have context limits so you have to manage that as the agent progresses through tasks that may take as long as eight to ten hours of continuous work. There are things like how you choose to instruct or inject environment information. It's how you handle tool calls. The sum of all of these things requires attention to detail. There really is no individual secret. Which is also why we think companies like us can actually do this. It's the sum of hundreds of little optimizations. The industrial process of building these harnesses is what we think is interesting or differentiated. ... Of course end-to-end and unit tests. There are auto formatters that you can bring in, SaaS static application security testers and scanners: your sneaks of the world.

Software-Defined Vehicles Transform Auto Industry With Four-Stage Maturity Framework For Engineers

More refined software architectures in both edge and cloud enable the interpretation of real-time data for predictive maintenance, adaptive user interfaces, and autonomous driving functions, while cloud-based AI virtualized development systems enable continuous learning and updates. Electrification has only further accelerated this evolution as it opened the door for tech players from other industries to enter the automotive market. This represents an unstoppable trend as customers now expect the same seamless digital experiences they enjoy on other devices. ... Legacy vehicle systems rely on dozens of electronic control units (ECUs), each managing isolated functions, such as powertrain or infotainment systems. SDVs consolidate these functions into centralized compute domains connected by high-speed networks. This architecture provides hardware and software abstraction, enabling OTA updates, seamless cross-domain feature integration, and real-time data sharing, are essential for continuous innovation. ... Processing sensor data at the edge – directly within the vehicle – enables highly personalized experiences for drivers and passengers. It also supports predictive maintenance, allowing vehicles to anticipate mechanical issues before they occur and proactively schedule service to minimize downtime and improve reliability. Equally important are abstraction layers that decouple software applications from underlying hardware.

Cybersecurity and Privacy Risks in Brain-Computer Interfaces and Neurotechnology

Neuromorphic computing is developing faster than predicted by replicating the human brain's neural architecture for efficient, low-power AI computation. As highlighted in talks around brain-inspired chips and meshing, these systems are blurring distinctions between biological and silicon-based computation. In the meanwhile, bidirectional communication is made possible by BCIs, such as those being developed by businesses and research facilities, which can read brain activity for feedback or control and possibly write signals back to affect cognition. ... Neural data is essentially personal. Breaches could expose memories, emotions, or subconscious biases. Adversaries may reverse-engineer intentions for coercion, fraud, or espionage as AI decodes brain scans for "mind captioning" or talent uploading. ... Compromised BCIs blur cyber-physical boundaries farther than OT-IT convergence already has. A malevolent actor might damage medical implants, alter augmented reality overlays, or weaponize neurotech in national security scenarios. ... Implantable devices rely on worldwide supply chains prone to tampering. Neuromorphic hardware, while efficient, provides additional attack surfaces if not designed with zero-trust principles. Using AI to process neural signals can introduce biases, which may result in unfair treatment in brain-augmented systems

Designing for Failure: Chaos Engineering Principles in System Design

To design for failure, we must understand how the system behaves when failure inevitably happens. What is the cost? What is the impact? How do we mitigate it? How do we still maintain over 99% uptime? This requires treating failure as a default state, not an exception. ... The first step is defining steady-state behavior. Without this, there is no baseline to measure against. ... Chaos experiments are most valuable in production. This is where real traffic patterns, real user behavior, and real data shapes exist. That said, experiments must be controlled. ... Chaos Engineering is not a one-off exercise. Systems evolve. Dependencies change. Teams rotate. Experiments should be automated, repeatable, and run continuously, either as scheduled jobs or integrated into CI/CD pipelines. Over time, experiments can be expanded to test higher-impact scenarios. ... Additional considerations include health checks, failover timing, and data consistency. Strong consistency simplifies reasoning but reduces availability. Eventual consistency improves availability but introduces complexity and potential inconsistency windows. ... Network failures are unavoidable in distributed systems. Latency spikes, packets get dropped, DNS fails, and sometimes the network splits entirely. Many system outages are not caused by servers crashing, but by slow or unreliable communication between otherwise healthy components. This is where several of the classic fallacies of distributed computing show up, especially the assumption that the network is reliable and has zero latency.

Why SMBs Need Strong Data Governance Practices

Good data governance for small businesses is about building trust, control and scalability into your data from day one. Governance should be built into the data foundation, not bolted on later. Small businesses move fast, and governance works best when it’s native to how data is managed. That means choosing platforms that apply security, access controls and compliance consistently across all data, without requiring manual oversight or specialized teams. Additionally, clear visibility and control over what data exists and who can access it is essential. Even at a smaller scale, businesses handle sensitive information ranging from customer and financial data to operational insights. ... Governance also future proofs the business. Regulations are becoming more complex, customer expectations for data protection are rising, and AI systems must have high-quality, well-governed data to perform reliably. Small businesses that treat governance as a foundation are better positioned to adopt AI and safely expand into new use cases, markets and regulatory environments without needing to rearchitect later. At the same time, strong data governance improves day-to-day efficiency. When data is well governed, teams can spend more time acting on insights and less time questioning data quality, managing access manually or duplicating work. ... From a cybersecurity perspective, governance provides the controls and visibility needed to reduce attack surfaces and detect misuse.

Daily Tech Digest - October 27, 2025

Quote for the day:

“There is no failure except in no longer trying.” -- Chris Bradford

AWS Outage Is Just the Latest Internet Glitch Banks Must Insulate Against

If clouds fail or succumb to , the damage can be enormous, measured only by the maliciousness and creativity of the hacker and the redundancy and resilience of the defenses that users have in place. ... As I describe in , we are already way down the rabbit hole of . It would take a massive coordinated global effort to secure the current internet. That is unlikely to happen. Therefore, the most realistic business strategy is to assume the inevitable: A glitch, human error or a successful breach or cloud failure will occur. That means systems must be in place to distribute patches, resume operations, reconstruct networks, and recover lost data. Redundancy is a necessary component to get back online, but how much redundancy is feasible or economically sustainable? And will those backstops actually work? ... Given these ever-increasing challenges and cyber incursions in the financial services business, I have argued for a fundamental change in regulation — one that will keep regulators on the cutting edge of digital and . To accomplish that, regulation should be a more collaborative experience that invests the financial industry in its own oversight and systemic security. This effort should include industry executives and their staffs. Their expertise in the oversight process would enrich the quality of regulation, particularly from the perspective of strengthening the cyber defenses of the industry.

The 10 biggest issues CISOs and cyber teams face today

“It’s not finger-pointing; we’re all learning,” Lee says. “Business is now expected to embrace and move quickly with AI. Boards and C-level executives are saying, ‘We have to lean into this more’ and then they turn to security teams to support AI. But security doesn’t fully understand the risk. No one has this down because it’s moving so fast.” As a result, many organizations skip security hardening in their rush to embrace AI. But CISOs are catching up. ... Moreover, Todd Moore, global vice president of data security at , says CISOs are facing a torrent of AI-generated data — generally unstructured data such as chat logs — that needs to be secured. “In some aspects, AI is becoming the new insider threat in organizations,” he says. “The reason why I say it’s a new insider threat is because there’s a lot of information that’s being put in places you never expected. CISOs need to identify and find that data and be able to see if that data is critical and then be able to protect it.” ... “We’re now getting to the stage where no one is off-limits,” says Simon Backwell, head of information security at tech company and a member of ’s Emerging Trends Working Group. “Attack groups are getting bolder, and they don’t care about the consequences. They want to cause mass destruction.”

The AI Inflection Point Isn’t in the Cloud, It’s at the Edge

Beyond the screen, there is a need for agentic applications that specifically reduce latency and improve throughput. “You need an agentic architecture with several things going on,” Shelby said about using models to analyze the packaging of , for instance. “You might need to analyze the defects. Then you might need an with a RAG behind it to do manual lookup. That’s very complex. It might need a lot of data behind it. It might need to be very large. You might need 100 billion parameters.” The analysis, he noted, may require integration with a backend system to perform another task, necessitating collaboration among several agents. AI appliances are then necessary to manage multiagent workflows and larger models. ... The nature of LLMs, Shelby said, requires a person to tell you if the LLM’s output is correct, which in turn impacts how to judge the relevancy of LLMs in edge environments. It’s not like you can rely on an LLM to provide an answer to a prompt. Consider a camera in the , focusing on an oil pump, Shelby said. “The LLM is like, ‘Oh, there are some campers cooking some food,’ when really there’s a fire” at the oil pump. So, how do you make the process testable in a way that engineers expect, Shelby asked. It requires end-to-end guard rails. And that’s why random, cloud-based LLMs do not yet apply to industrial environments.

Scaling Identity Security in Cloud Environments

One significant challenge organizations face is the disconnect between security and research and development (R&D) teams. This gap can lead to vulnerabilities being overlooked during the development phase, resulting in potential security risks once new systems are operational in cloud environments. To bridge this gap, a collaborative approach involving both teams is essential. Creating a secure cloud environment necessitates an understanding of the specific needs and challenges faced by each department. ... The journey to achieving scalable identity security in cloud environments is ongoing and requires constant vigilance. By integrating management into their cybersecurity strategies, organizations can reduce risks, increase efficiencies, and ensure compliance with regulatory requirements. With security continue to evolve, staying informed and adaptable remains key. To gain further insights into cybersecurity, you might want to read about some cybersecurity predictions for 2025 and how they may influence your strategies surrounding . The integration of effective NHI and secrets management into cloud security controls is not just recommended but necessary for safeguarding data. It’s an invaluable part of a broader cybersecurity strategy aimed at minimizing risk and ensuring seamless, secure operations across all sectors.

Owning the Fallout: Inside Blameless Culture

For an organization to truly own the fallout after an incident, there must be a cultural shift from blame to inquiry. A ‘blameless culture’ doesn’t mean it’s a free-for-all, with no accountability. Instead, it’s a circumstance where the first question after an incident isn’t “Who screwed up?” it’s “What failed — and why?” As Gustavo Razzetti describes, “blame is a sign of an unhealthy culture,” and the goal is to replace it with curiosity. In a blameless postmortem, you break down what happened, map the contributing systemic factors, and focus on where processes, tooling, or assumptions broke down. This mindset aligns with the concept of just culture, which balances accountability and systems thinking. After an incident, the focus is to ask how things went wrong, not whom to punish — unless egregious misconduct is involved. ... The most powerful learning happens in the moment when incident patterns redirect strategic priorities. For example, during post-mortems, a team could discover that under-monitored dependencies cause high-severity incidents. With a resilience mindset, that insight can become an objective: “Build automated dependency-health dashboards by Q2.” When feedback and insights flow into , teams internalize resilience as part of delivery, not an afterthought. Resilient teams move beyond damage control to institutional learning.

Can your earbuds recognize you? Researchers are working on it

Each person’s ear canal produces a distinct acoustic signature, so the researchers behind designed a method that allows earbuds to identify their wearer by using sound. The earbuds emit acoustic signals into the user’s ear canal, and the reflections from that sound reveal patterns shaped by the ear’s structure. What makes this study stand out is that the authentication process happens entirely on the earbuds themselves. The device extracts a unique binary key based on the user’s ear canal shape and then verifies that key on the paired mobile device. By working with binary keys instead of raw biometric data, the system avoids sending sensitive information over . This helps prevent interception or replay attacks that could expose biometric data. ... A key part of the research is showing that earbuds can handle biometric processing without large hardware or cloud support. EarID runs on a small microcontroller comparable to those found in commercial earbuds. The researchers measured performance on an with an 80 MHz chip and found that it could perform the key extraction in under a third of a second. For comparison, traditional machine learning classifiers took three to ninety times longer to train and process data. This difference could make a real impact if ear canal authentication ever reaches consumer devices, since users expect quick and seamless authentication.

What It 'Techs' to Run Real-Time Payments at Scale

Beyond hosting applications, the architecture is designed for scale, reuse and rapid provisioning. APIs and services support multiple verticals including lending, insurance, investments and even quick commerce through a shared infrastructure-as-a-service model. "Every vertical uses the same underlying infra, and we constantly evaluate whether something can be commoditized for the group and then scaled centrally. It's easier to build and scale one accounting stack than reinvent it every time," Nigam said. Early investments in real-time compute systems and edge analytics enable rapid anomaly detection and insights, cutting operational downtime by 30% and improving response times to under 50 milliseconds. A recent on financial infrastructure in emerging economies underscores the importance of edge computation and near-real-time monitoring for high-volume payments networks - a model increasingly being adopted by global fintech leaders to ensure both speed and reliability. ... Handling spikes and unexpected surges is another critical consideration. India's payments ecosystem experiences predictable peaks - including festival seasons or weekends - and unpredictable surges triggered by government announcements or regulatory deadlines. When a payments platform is built for population scale, any single merchant or use case does not create a surge at this level.

Who’s right — the AI zoomers or doomers?

Earlier this week, the editorial board published an opinion column claiming that without regulation, AI will soon outpace humanity’s ability to control it. The post said AI’s uncontrolled evolution threatens human autonomy, free expression, and democracy, stressing that the technical development is faster than what lawmakers can handle. ... Both zoomers and doomers agree that humanity’s fate will be decided when the industry releases AGI or superintelligent AI. But there’s strong disagreement on when that will happen. From ’s Sam Altman to Elon Musk, Eric Schmidt, Demis Hassabis, Dario Amodei, Masayoshi Son, Jensen Huang, Ray Kurzweil, Louis Rosenberg, Geoffrey Hinton, Mark Zuckerberg, Ajeya Cotra, and Jürgen Schmidhuber — all predict AGI by later this year to later this decade. ... Some say we need strict global rules, maybe like those for nuclear weapons. Others say strong laws would slow progress, stop new ideas, and give the benefits of AI to China. ... AI is already causing harms. It contributes to privacy invasion, disinformation and deepfakes, surveillance overreach, job displacement, cybersecurity threats, child and psychological harms, environmental damage, erosion of human creativity and autonomy, economic and political instability, manipulation and loss of trust in media, unjust criminal justice outcomes, and other problems.

Powering Data in the Age of AI: Part 3 – Inside the AI Data Center Rebuild

You can’t design around AI the way data centers used to handle general compute. The loads are heavier, the heat is higher, and the pace is relentless. You start with racks that pull more power than entire server rooms did a decade ago, and everything around them has to adapt. New builds now work from the inside out. Engineers start with workload profiles, then shape airflow, cooling paths, cable runs, and even structural supports based on what those clusters will actually demand. In some cases, different types of jobs get their own electrical zones. That means separate cooling loops, shorter throw cabling, dedicated switchgear — multiple systems, all working under the same roof. Power delivery is changing, too. In a conversation with , David Beach, Market Segment Manager at , explained, “Equipment is taking advantage of much higher voltages and simultaneously increasing current to achieve the rack densities that are necessary. This is also necessitating the development of components and infrastructure to properly carry that power.” ... We know that hardware alone doesn’t move the needle anymore. The real advantage comes from pushing it online quickly, without getting bogged down by power, permits, and other obstacles. That’s where the cracks are beginning to open.

Strategic Domain-Driven Design: The Forgotten Foundation of Great Software

The strategic aspect of is often overlooked because many people do not recognize its importance. This is a significant mistake when applying DDD. Strategic design provides context for the model, establishes clear boundaries, and fosters a shared understanding between business and technology. Without this foundation, developers may focus on modeling data rather than behavior, create isolated microservices that do not represent the domain accurately, or implement design patterns without a clear purpose. ... The first step in strategic modeling is to define your domain, which refers to the scope of knowledge and activities that your software intends to address. Next, we apply the age-old strategy of "divide and conquer," a principle used by the Romans that remains relevant in modern software development. We break down the larger domain into smaller, focused areas known as subdomains. ... Once the language is aligned, the next step is to define bounded contexts. These are explicit boundaries that indicate where a particular model and language apply. Each bounded context encapsulates a subset of the ubiquitous language and establishes clear borders around meaning and responsibilities. Although the term is often used in discussions about microservices, it actually predates that movement.

Daily Tech Digest - September 26, 2025

Quote for the day:

“You may be disappointed if you fail, but you are doomed if you don’t try.” -- Beverly Sills

Moving Beyond Compliance to True Resilience

Organisations that treat compliance as the finish line are missing the bigger picture. Compliance frameworks such as HIPAA, GDPR, and PCI-DSS provide critical guidelines, but they are not designed to cover the full spectrum of evolving cyber threats. Cybercriminals today use AI-driven reconnaissance, deepfake impersonations, and polymorphic phishing techniques to bypass traditional defences. Meanwhile, businesses face growing attack surfaces from hybrid work models and interconnected systems. A lack of leadership commitment, underfunded security programs, and inadequate employee training exacerbate the problem. ... Building resilience requires more than reactive policies, it calls for layered, proactive defence mechanisms such as threat intelligence, endpoint detection and response (EDR), and intrusion prevention systems (IPS). These are essential in identifying and stopping threats before they can cause damage which should be at the front line of defence. Ultimately reducing exposure and giving teams the visibility they need to act swiftly. ... True cyber resilience means moving beyond regulatory compliance to develop strategic capabilities that protect against, respond to, and recover from evolving threats. This includes implementing both offensive and defensive security layers, such as penetration testing and real-time intrusion prevention, to identify weaknesses before attackers do.

Architecture Debt vs Technical Debt: Why Companies Confuse Them and What It Costs Business

The contrast is clear: technical debt reflects inefficiencies at the system level — poorly structured code, outdated infrastructure, or quick fixes that pile up over time. Architecture debt emerges at the enterprise level — structural weaknesses across applications, data, and processes that manifest as duplication, fragmentation, and misalignment. One constrains IT efficiency; the other constrains business competitiveness. Recognizing this difference is the first step toward making the right strategic investments. ... The difference lies in visibility: technical debt is tangible for developers, showing up in unstable code, infrastructure issues, and delayed releases. Architecture debt, by contrast, hides in organizational complexity: duplicated platforms, fragmented data, and misaligned processes. When CIOs and business leaders hear the word “debt,” they often assume it refers to the same challenge. It does not. ... Recognizing this distinction is critical because it determines where investments should be made. Addressing technical debt improves efficiency within systems; addressing architecture debt strengthens the foundations of the enterprise. One enables smoother operations, while the other ensures long-term competitiveness and resilience. Leaders who fail to separate the two-risk solving local problems while leaving the structural weaknesses that undermine the organization’s future unchallenged.

Data Fitness in the Age of Emerging Privacy Regulations

Enter the concept of Data Fitness: a multidimensional measure of how well data aligns with privacy principles, business objectives, and operational resilience. Much like physical fitness, data fitness is not a one-time achievement but a continuous discipline. Data fitness is not just about having high-quality data, but also about ensuring that data is managed in a way that is compliant, secure, and aligned with business objectives. ... The emerging privacy regulations have also introduced a new layer of complexity to data management. They shift the focus from simply collecting and monetizing data to a more responsible and transparent approach, which call for sweeping review and redesign of all applications and processes that handles data. ... The days of storing customer data forever are over. New regulations often specify that personal data can only be retained for as long as it's needed for the purpose for which it was collected. This requires companies to implement robust data lifecycle management and automated deletion policies. ... Data privacy isn't just an IT or legal issue; it's a shared responsibility. Organizations must educate and train all employees on the importance of data protection and the specific policies they need to follow. A strong privacy culture can be a competitive advantage, building customer trust and loyalty. ... It's no longer just about leveraging data for profit; it's about being a responsible steward of personal information.

Independent Management of Cloud Secrets

An independent approach to NHI management can empower DevOps teams by automating the lifecycle of secrets and identities, thus ensuring that security doesn’t compromise speed or agility. By embedding secrets management into the development pipeline, teams can preemptively address potential overlaps and misconfigurations, as highlighted in the resource on common secrets security misconfigurations. Moreover, NHIs’ automation capabilities can assist DevOps enterprises in meeting regulatory audit requirements without derailing their agile processes. This harmonious blend of compliance and agility allows for a framework that effectively bridges the gap between speed and security. ... Automation of NHI lifecycle processes not only saves time but also fortifies systems by means of stringent access control. This is critical in large-scale cloud deployments, automated renewal and revocation of secrets ensure uninterrupted and secure operations. More insightful strategies can be explored in Secrets Security Management During Development. ... While the integration of systems provides comprehensive security benefits, there is an inherent risk in over-relying on interconnected solutions. Enterprises need a balanced approach that allows for collaboration between systems without compromising individual segment vulnerabilities. A delicate balance is found by maintaining independent secrets management systems, which operate cohesively but remain distinct from operational systems.

Why cloud repatriation is back on the CIO agenda

Cost pressure often stems from workload shape. Steady, always-on services do not benefit from pay-as-you-go pricing. Rightsizing, reservations and architecture optimization will often close the gap, yet some services still carry a higher unit cost when they remain in public cloud. A placement change then becomes a sensible option. Three observations support a measurement-first approach. Many organizations report that managing cloud spend is their top challenge; egress fees and associated patterns affect a growing share of firms, and the finops community places unit economics and allocation at the centre of cost accountability. ... Public cloud remains viable for many regulated workloads, assisted by sovereign configurations. Examples include the AWS European Sovereign Cloud (scheduled to be released at the end of 2025), the Microsoft EU Data Boundary and Google’s sovereign controls and partner offerings. These options have scope limits that should be assessed during design. Public cloud remains viable for many regulated workloads when sovereign configurations meet requirements. ... Repatriation tends to underperform where workloads are inherently elastic or seasonal, where high-value managed services would need to be replicated at significant opportunity cost, where the organization lacks the run maturity for private platforms, or where the cost issues relate primarily to tagging, idle resources or discount coverage that a FinOps reset can address.

Colocation meets regulation

While there have been many instances of behind-the-meter agreements in the data center sector, the AWS-Talen agreement differed in both scale and choice of energy. Unlike previous instances, often utilizing onsite renewables, the AWS deal involved a regional key generation asset, which provides consistent and reliable power to the grid. As a result, to secure the go-ahead, PJM Interconnection, the regional transmission operator in charge of the utility services in the state, had to apply for an amendment to the plant's existing Interconnection Service Agreement (ISA), permitting the increased power supply. However, rather than the swift approval the companies hoped for, two major utilities that operate in the region, Exelon and American Electric Power (AEP), vehemently opposed the amended ISA, submitting a formal objection to its provisions. ... Since the rejection by FERC, Talen and AWS have reimagined the agreement, with it moving from behind to an in-front-of-the-meter arrangement. The 17-year PPA will see Talen supply AWS with 1.92GW of power, ramped up over the next seven years, with the power provided through PJM. This reflects a broader move within the sector, with both Talen and nuclear energy generator Constellation indicating their intention to focus on grid-based arrangements going forward. Despite this, Phillips still believes that under the correct circumstances, colocation can be a powerful tool, especially for AI and hyperscale cloud deployments seeking to scale quickly.

Employees learn nothing from phishing security training, and this is why

Phishing training programs are a popular tactic aimed at reducing the risk of a successful phishing attack. They may be performed annually or over time, and typically, employees will be asked to watch and learn from instructional materials. They may also receive fake phishing emails sent by a training partner over time, and if they click on suspicious links within them, these failures to spot a phishing email are recorded. ... "Taken together, our results suggest that anti-phishing training programs, in their current and commonly deployed forms, are unlikely to offer significant practical value in reducing phishing risks," the researchers said. According to the researchers, a lack of engagement in modern cybersecurity training programs is to blame, with engagement rates often recorded as less than a minute or none at all. When there is no engagement with learning materials, it's unsurprising that there is no impact. ... To combat this problem, the team suggests that, for a better return on investment in phishing protection, a pivot to more technical help could work. For example, imposing two or multi-factor authentication (2FA/MFA) on endpoint devices, and enforcing credential sharing and use on only trusted domains. That's not to say that phishing programs don't have a place in the corporate world. We should also go back to the basics of engaging learners.

SOC teams face 51-second breach reality—Manual response times are officially dead

When it takes just 51 seconds for attackers to breach and move laterally, SOC teams need more help. ... Most SOC teams first aim to extend ROI from existing operations investments. Gartner's 2025 Hype Cycle for Security Operations notes that organizations want more value from current tools while enhancing them with AI to handle an expansive threat landscape. William Blair & Company's Sept. 18 note on CrowdStrike predicts that "agentic AI potentially represents a 100x opportunity in terms of the number of assets to secure," with TAM projected to grow from $140 billion this year to $300 billion by 2030. ... Kurtz's observation reflects concerns among SOC leaders and CISOs across industries. VentureBeat sees enterprises experimenting with differentiated architectures to solve governance challenges. Shlomo Kramer, co-founder and CEO of Cato Networks, offered a complementary view in a VentureBeat interview: "Cato uses AI extensively… But AI alone can't solve the range of problems facing IT teams. The right architecture is important both for gathering the data needed to drive AI engines, but also to tackle challenges like agility, connecting enterprise edges, and user experience." Kramer added, "Good AI starts with good data. Cato logs petabytes weekly, capturing metadata from every transaction across the SASE Cloud Platform. We enrich that data lake with hundreds of threat feeds, enabling threat hunting, anomaly detection, and network degradation detection."

Timeless inclusive design techniques for a world of agentic AI

Progressive enhancement and inclusive design allow us to design for as many users as possible. They are core components of user-centered design. The word "user" often hides the complex magnificence of the human being using your product, in all their beautiful diversity. And it’s this rich diversity that makes inclusive design so important. We are all different, and use things differently. While you enjoy that sense of marvel at the richness and wonder of your users' lives, there is no need to feel it for AI agents. These agents are essentially just super-charged "stochastic parrots" (to borrow a phrase from esteemed AI ethicist and professor of Computational Linguistics Emily M. Bender) guessing the next token. ... Every breakthrough since we learnt to make fire has been built on what came before. Isaac Newton said he could only see so far because he was "standing on the shoulders of giants". The techniques and approaches needed to enable this new wave of agent-powered AI devices have been around for a long time. But they haven't always been used. In our desire to ship the shiniest features, we often forget to make our products work for people who rely on accessibility features. ... Patterns are things like adding a "skip to content link" and implementing form validation in a way that makes it easier to recover from errors. Alongside patterns, there are a wealth of freely available accessibility testing tools that can tell you if your product is meeting necessary standards.

Stronger Resilience Starts with Better Dependency Mapping

As recent disruptions made painfully clear, you cannot manage what you cannot see. When a single upstream failure ripples through eligibility checks, billing, scheduling, or clinical systems, executives need answers in minutes, not months. Who is impacted? What services are degraded? Which applications are truly critical? What are our fourth-party exposures? In too many organizations, those answers require a scavenger hunt. ... Modern operations rely on external platforms for authorizations, payments, data enrichment, analytics, and communications, yet many organizations stop their mapping at the data center boundary. That blind spot creates serious risk, since a single vendor outage can ripple across multiple critical services. Regulators are responding. In the U.S., the OCC, Federal Reserve, and FDIC’s 2023 Interagency Guidance on Third-Party Risk Management requires banks to identify and monitor critical vendor relationships, including subcontractors and concentration risks. ... Dependency data without impact data is trivia. Mapping is only valuable when assets and services are tied to business impact analysis (BIA) outputs like recovery time objectives and maximum tolerable downtime. Without this, leaders face a flat picture of connections but no way to prioritize what to restore first, or how long they can operate without a service before consequences cascade.

Daily Tech Digest - May 03, 2025

Quote for the day:

"It is during our darkest moments that we must focus to see the light." -- Aristotle Onassis

Why agentic AI is the next wave of innovation

AI agents have become integral to modern enterprises, not just enhancing productivity and efficiency, but unlocking new levels of value through intelligent decision-making and personalized experiences. The latest trends indicate a significant shift towards proactive AI agents that anticipate user needs and act autonomously. These agents are increasingly equipped with hyper-personalization capabilities, tailoring interactions based on individual preferences and behaviors. ... According to NVIDIA, when Azure AI Agent Service is paired with NVIDIA AgentIQ, an open-source toolkit, developers can now profile and optimize teams of AI agents in real time to reduce latency, improve accuracy, and drive down compute costs. ... “The launch of NVIDIA NIM microservices in Azure AI Foundry offers a secure and efficient way for Epic to deploy open-source generative AI models that improve patient care, boost clinician and operational efficiency, and uncover new insights to drive medical innovation,” says Drew McCombs, vice president, cloud and analytics at Epic. “In collaboration with UW Health and UC San Diego Health, we’re also researching methods to evaluate clinical summaries with these advanced models. Together, we’re using the latest AI technology in ways that truly improve the lives of clinicians and patients.”

Businesses intensify efforts to secure data in cloud computing

Building a robust security strategy begins with understanding the delineation between the customer's and the provider's responsibilities. Customers are typically charged with securing network controls, identity and access management, data, and applications within the cloud, while the CSP maintains the core infrastructure. The specifics of these responsibilities depend on the service model and provider in question. The importance of effective cloud security has grown as more organisations shift away from traditional on-premises infrastructure. This shift brings new regulatory expectations relating to data governance and compliance. Hybrid and multicloud environments offer businesses unprecedented flexibility, but also introduce complexity, increasing the challenge of preventing unauthorised access. ... Attackers are adjusting their tactics accordingly, viewing cloud environments as potentially vulnerable targets. A well-considered cloud security plan is regarded as essential for reducing breaches or damage, improving compliance, and enhancing customer trust, even if it cannot eliminate all risks. According to the statement, "A well-thought-out cloud security plan can significantly reduce the likelihood of breaches or damage, enhance compliance, and increase customer trust—even though it can never completely prevent attacks and vulnerabilities."

Safeguarding the Foundations of Enterprise GenAI

Implementing strong identity security measures is essential to mitigate risks and protect the integrity of GenAI applications. Many identities have high levels of access to critical infrastructure and, if compromised, could provide attackers with multiple entry points. It is important to emphasise that privileged users include not just IT and cloud teams but also business users, data scientists, developers and DevOps engineers. A compromised developer identity, for instance, could grant access to sensitive code, cloud functions, and enterprise data. Additionally, the GenAI backbone relies heavily on machine identities to manage resources and enforce security. As machine identities often outnumber human ones, securing them is crucial. Adopting a Zero Trust approach is vital, extending security controls beyond basic authentication and role-based access to minimise potential attack surfaces. To enhance identity security across all types of identities, several key controls should be implemented. Enforcing strong adaptive multi-factor authentication (MFA) for all user access is essential to prevent unauthorised entry. Securing access to credentials, keys, certificates, and secrets—whether used by humans, backend applications, or scripts—requires auditing their use, rotating them regularly, and ensuring that API keys or tokens that cannot be automatically rotated are not permanently assigned.

The new frontier of API governance: Ensuring alignment, security, and efficiency through decentralization

To effectively govern APIs in a decentralized landscape, organizations must embrace new principles that foster collaboration, flexibility and shared responsibility. Optimized API governance is not about abandoning control, rather about distributing it strategically while still maintaining overarching standards and ensuring critical aspects such as security, compliance and quality. This includes granting development teams with autonomy to design, develop and manage their APIs within clearly defined boundaries and guidelines. This encourages innovation while fostering ownership and allows each team to optimize their APIs to their specific needs. This can be further established by a shared responsibility model amongst teams where they are accountable for adhering to governance policies while a central governing body provides the overarching framework, guidelines and support. This operating model can be further supported by cultivating a culture of collaboration and communication between central governance teams and development teams. The central government team can have a representative from each development team and have clear channels for feedback, shared documentation and joint problem-solving scenarios. Implementing governance policies as code, leveraging tools and automation make it easier to enforce standards consistently and efficiently across the decentralized environment.

Banking on innovation: Engineering excellence in regulated financial services

While financial services regulations aren’t likely to get simpler, banks are finding ways to innovate without compromising security. "We’re seeing a culture change with our security office and regulators," explains Lanham. "As cloud tech, AI, and LLMs arrive, our engineers and security colleagues have to upskill." Gartner's 2025 predictions say GenAI is shifting data security to protect unstructured data. Rather than cybersecurity taking a gatekeeper role, security by design is built into development processes. "Instead of saying “no”, the culture is, how can we be more confident in saying “yes”?" notes Lanham. "We're seeing a big change in our security posture, while keeping our customers' safety at the forefront." As financial organizations carefully tread a path through digital and AI transformation, the most successful will balance innovation with compliance, speed with security, and standardization with flexibility. Engineering excellence in financial services needs leaders who can set a clear vision while balancing tech potential with regulations. The path won’t be simple, but by investing in simplification, standardization and a shared knowledge and security culture, financial services engineering teams can drive positive change for millions of banking customers.

‘Data security has become a trust issue, not just a tech issue’

Data is very messy and data ecosystems are very complex. Every organisation we speak to has data across multiple different types of databases and data stores for different use cases. As an industry, we need to acknowledge the fact that no organisation has an entirely homogeneous data stack, so we need to support and plug into a wide variety of data ecosystems, like Databricks, Google and Amazon, regardless of the tooling used for data analytics, for integration, for quality, for observability, for lineage and the like. ... Cloud adoption is causing organisations to rethink their traditional approach to data. Most use cloud data services to provide a shortcut to seamless data integration, efficient orchestration, accelerated data quality and effective governance. In reality, most organisations will need to adopt a hybrid approach to address their entire data landscape, which typically spans a wide variety of sources that span both cloud and on premises. ... Data security has become a trust issue, not just a tech issue. With AI, hybrid cloud and complex supply chains, the attack surface is massive. We need to design with security in mind from day one – think secure coding, data-level controls and zero-trust principles. For AI, governance is critical, and it too needs to be designed in and not an afterthought. That means tracking where data comes from, how models are trained, and ensuring transparency and fairness.

Secure by Design vs. DevSecOps: Same Security Goal, Different Paths

Although the "secure by design" initiative offers limited guidance on how to make an application secure by default, it comes closer to being a distinct set of practices than DevSecOps. The latter is more of a high-level philosophy that organizations must interpret on their own; in contrast, secure by design advocates specific practices, such as selecting software architectures that mitigate the risk of data leakage and avoiding memory management practices that increase the chances of the execution of malicious code by attackers. ... Whereas DevSecOps focuses on all stages of the software development life cycle, the secure by design concept is geared mainly toward software design. It deals less with securing applications during and after deployment. Perhaps this makes sense because so long as you start with a secure design, you need to worry less about risks once your application is fully developed — although given that there's no way to guarantee an app can't be hacked, DevSecOps' holistic approach to security is arguably the more responsible one. ... Even if you conclude that secure by design and DevSecOps mean basically the same thing, one notable difference is that the government sector has largely driven the secure by design initiative, while DevSecOps is more popular within private industry.

Immutable by Design: Reinventing Business Continuity and Disaster Recovery

Immutable backups create tamper-proof copies of data, protecting it from cyber threats, accidental deletion, and corruption. This guarantees that critical data can be quickly restored, allowing businesses to recover swiftly from disruptions. Immutable storage provides data copies that cannot be manipulated or altered, ensuring data remains secure and can quickly be recovered from an attack. In addition to immutable backup storage, response plans must be continually tested and updated to combat the evolving threat landscape and adapt to growing business needs. The ultimate test of a response plan ensures data can be quickly and easily restored or failed over, depending on the event. Activating a second site in the case of a natural disaster or recovering systems without making any ransomware payments in the case of an attack. This testing involves validating the reliability of backup systems, recovery procedures, and the overall disaster recovery plan to minimize downtime and ensure business continuity. ... It can be challenging for IT teams trying to determine the perfect fit for their ecosystem, as many storage vendors claim to provide immutable storage but are missing key features. As a rule of thumb, if "immutable" data can be overwritten by a backup or storage admin, a vendor, or an attacker, then it is not a truly immutable storage solution.

Neurohacks to outsmart stress and make better cybersecurity decisions

In cybersecurity where clarity and composure are essential, particularly during a data breach or threat response, these changes can have high-stakes consequences. “The longer your brain is stuck in this high-stress state, the more of those changes you will start to see and burnout is just an extreme case of chronic stress on the brain,” Landowski says. According to her, the tipping point between healthy stress and damaging chronic stress usually comes after about eight to 12 weeks, but it varies between individuals. “If you know about some of the things you can do to reduce the impact of stress on your body, you can potentially last a lot longer before you see any effects, whereas if you’re less resilient, or if your genes are more susceptible to stress, then it could be less.” ... working in cybersecurity, particularly as a hacker, is often about understanding how people think and then spotting the gaps. That same shift in understanding — tuning into how the brain works under different conditions — can help cybersecurity leaders make better decisions and build more resilient teams. As Cerf highlights, he works with organizations to identify these optimal operating states, testing how individuals and entire teams respond to stress and when their brains are most effective. “The brain is not just a solid thing,” Cerf says.

Beyond Safe Models: Why AI Governance Must Tackle Unsafe Ecosystems

Despite the evident risks of unsafe deployment ecosystems, the prevailing approach to AI governance still heavily emphasizes pre-deployment interventions—such as alignment research, interpretability tools, and red teaming—aimed at ensuring that the model itself is technically sound. Governance initiatives like the EU AI Act, while vital, primarily place obligations on providers and developers to ensure compliance through documentation, transparency, and risk management plans. However, the governance of what happens after deployment when these models enter institutions with their own incentives, infrastructures, and oversight receives comparatively less attention. For example, while the EU AI Act introduces post-market monitoring and deployer obligations for high-risk AI systems, these provisions remain limited in scope. Monitoring primarily focuses on technical compliance and performance, with little attention to broader institutional, social, or systemic impacts. Deployer responsibilities are only weakly integrated into ongoing risk governance and focus primarily on procedural requirements—such as record-keeping and ensuring human oversight—rather than assessing whether the deploying institution has the capacity, incentives, or safeguards to use the system responsibly.