Daily Tech Digest by Kannan Subbiah: health IT

Showing posts with label health IT. Show all posts

Daily Tech Digest - April 10, 2026

Quote for the day:

"Things may come to those who wait, but only the things left by those who hustle." -- Abraham Lincoln

🎧 Listen to this digest on YouTube Music

▶ Play Audio Digest

Duration: 21 mins • Perfect for listening on the go.

How Agile practices ensure quality in GenAI-assisted development

The integration of Generative AI (GenAI) into software development promises significant productivity gains, yet it introduces substantial risks to code quality and architectural integrity. To mitigate these dangers, the article emphasizes that traditional Agile practices provide the essential guardrails needed for reliable AI-assisted development. Core methodologies like Test-Driven Development (TDD) serve as the foundation, where writing failing tests before generating AI code ensures the output meets precise executable specifications. Similarly, Behavior-Driven Development (BDD) and Acceptance Test-Driven Development (ATDD) utilize plain-language scenarios to ensure AI solutions align with actual business requirements rather than just producing plausible-looking code. Pair programming further enhances this safety net; studies indicate that code quality actually improves when humans and AI work together in a navigator-executor dynamic. Beyond individual practices, organizations must invest in robust continuous integration (CI) pipelines and updated code review protocols specifically tailored for AI-generated logic. By making TDD non-negotiable and establishing clear AI usage guidelines, teams can harness the speed of GenAI without compromising the stability or long-term health of their software systems. Ultimately, these disciplined Agile approaches transform GenAI from a potential liability into a controlled and highly effective engine for modern software engineering success.

Why—And How—Business Leaders Should Consider Implementing AI-Powered Automation

In the Forbes article "Why—And How—Business Leaders Should Consider Implementing AI-Powered Automation," emphasizes that while AI-driven automation offers immense potential for streamlining complex data and operational efficiency, its success depends on maintaining a strategic balance with human interaction. Rebello argues that over-automation risks alienating customers who still value the personal touch and problem-solving capabilities of human staff. To implement these technologies effectively, leaders should first identify specific areas where automation provides the most significant time-saving benefits without sacrificing the customer experience. The author advises prioritizing one process at a time and maintaining a "human-in-the-loop" approach for nuanced tasks like customer support. Furthermore, Rebello suggests launching small pilot programs to gather feedback and minimize organizational disruption. By adopting the customer's perspective and evaluating whether automation simplifies or complicates the user journey, businesses can leverage AI to handle data-heavy background tasks while preserving the essential human connections that drive long-term loyalty. This measured approach ensures that AI serves as a powerful tool for growth rather than a barrier to authentic engagement, ultimately allowing teams to focus on high-level strategy and creative brainstorming while the technology manages repetitive, data-intensive workflows.

5 questions every aspiring CIO should be prepared to answer

The article emphasizes that aspiring CIOs must master the "elevator pitch" by translating technical initiatives into strategic business value. To impress C-suite executives and board members, IT leaders should be prepared to answer five critical questions that demonstrate their business acumen rather than just technical expertise. First, they must articulate how IT initiatives, like cloud migrations, deliver quantified business value and align with strategic goals. Second, they should showcase how technology serves as a catalyst for growth and revenue, moving beyond simple productivity gains. Third, when addressing technology risks, leaders should focus on operational resilience or the competitive risk of falling behind, rather than just listing security threats. Fourth, discussions regarding emerging technologies like generative AI should highlight competitive differentiation and enhanced customer experiences rather than implementation details. Finally, aspiring CIOs must explain how they are improving organizational agility and effectiveness by fostering decentralized decision-making and treating data as a vital corporate asset. By avoiding technical jargon and focusing on overarching business objectives, future IT leaders can effectively signal their readiness for C-level responsibilities and build the necessary trust with executive leadership to advance their careers.

New framework lets AI agents rewrite their own skills without retraining the underlying model

Researchers have introduced , a groundbreaking framework that enables to develop, refine, and rewrite their own functional skills without needing to retrain the underlying large language model. Unlike traditional methods that rely on static, manually designed prompts or simple task logs, Memento-Skills utilizes an evolving external memory scaffolding. This system functions as an "agent-designing agent" by storing reusable skill artifacts as structured markdown files containing declarative specifications, specialized instructions, and executable code. Through a process called "Read-Write Reflective Learning," the agent actively mutates its memory based on environmental feedback. When a task execution fails, an orchestrator evaluates the failure trace and automatically rewrites the skill’s code or prompts to patch the error. To ensure stability in production, these updates are guarded by an automatic unit-test gate that verifies performance before saving changes. In testing on the GAIA benchmark, the framework improved accuracy by 13.7 percentage points over static baselines, reaching 66.0%. This innovation allows frozen models to build robust "muscle memory," enabling enterprise teams to deploy agents that progressively adapt to complex environments while avoiding the significant time and financial costs typically associated with model fine-tuning or retraining.

The role of intent in securing AI agents

In the evolving landscape of artificial intelligence, traditional identity and access management (IAM) frameworks are proving insufficient for securing autonomous AI agents. While identity-first security establishes accountability by identifying ownership and access rights, it fails to evaluate the appropriateness of specific actions as agents adapt and chain tasks in real-time. This article argues that is the critical missing component, as it explicitly scopes an agent’s defined purpose rather than granting indefinite, static privileges. By integrating identity, intent, and runtime context—such as environmental sensitivity and timing—organizations can enforce least-privilege policies that prevent "privilege drift," where agents quietly accumulate unnecessary access. This shift allows security teams to govern at a scalable level by reviewing high-level intent profiles instead of auditing thousands of individual technical calls. Practical implementation involves treating agents as first-class identities, requiring documented intent profiles, and continuously validating behavior against declared objectives. Ultimately, anchoring permissions to an agent’s purpose ensures that access remains dynamic and purpose-bound, providing a robust safeguard against the inherent unpredictability of autonomous systems. Without this intent-aware layer, identity-based controls alone cannot effectively scale AI safety or maintain rigorous accountability in production environments.

Do Ceasefires Slow Cyberattacks? History Suggests Not

The relationship between and is complex, as historical data indicates that a cessation of physical hostilities rarely translates to a "digital stand-down." According to research highlighted by Dark Reading, cyber operations often remain steady or even intensify during truces, serving as an asymmetric pressure valve when traditional combat is paused. While groups like the Iranian-aligned Handala may announce temporary pauses against specific nations, they often continue targeting other adversaries, maintaining that the cyber war operates independently of military agreements. Past conflicts, such as those involving Hamas and Israel or Russia and Ukraine, demonstrate that warring parties frequently use diplomatic pauses to pivot toward secondary targets or gain leverage for future negotiations. In some instances, cyberattacks have even increased during ceasefires as actors seek alternative methods to exert influence without technically violating military terms. A notable exception occurred during the 2015 Iran nuclear deal negotiations, which saw a genuine lull in malicious activity; however, this remains an outlier. Ultimately, security experts warn that threat actors view diplomatic lulls as technicalities rather than boundaries, meaning organizations must remain vigilant despite peace talks, as the digital battlefield often ignores the boundaries set by physical treaties.

The Roadmap to Mastering Agentic AI Design Patterns

The roadmap for mastering emphasizes moving beyond simple prompt engineering toward architectural strategies that ensure predictable and scalable system behavior. The foundational pattern is ReAct, which integrates reasoning and action in a continuous loop to ground model decisions in observable results. For higher quality, the Reflection pattern introduces a self-correction cycle where agents critique and refine their outputs. To move from information to action, the Tool Use pattern establishes a structured interface for agents to interact with external systems securely. When tasks grow complex, the Planning pattern breaks goals into sequenced subtasks, while Multi-Agent systems distribute specialized roles across several coordinated units. Crucially, developers must treat pattern selection as a rigorous production decision, starting with the simplest viable structure to avoid premature complexity and high latency. Effective deployment requires robust evaluation frameworks, observability for debugging, and human-in-the-loop guardrails to manage safety risks. By systematically applying these architectural templates, creators can build AI agents that are not only capable but also reliable, debuggable, and adaptable to real-world requirements. This strategic approach ensures that agentic behavior remains consistent even as project complexity increases, ultimately leading to more sophisticated and trustworthy autonomous applications.

Upstream network visibility is enterprise security’s new front line

Lumen Technologies' 2026 Defender Threatscape Report, published by its research arm Black Lotus Labs, argues that the front line of enterprise security has shifted from traditional endpoints to upstream network visibility. By leveraging its position as a major internet backbone provider, Lumen gains unique telemetry into nearly 99% of public IPv4 addresses, allowing it to detect malicious patterns before they reach internal networks. The report highlights several alarming trends: the use of generative AI to rapidly iterate malicious infrastructure, a pivot toward targeting unmonitored edge devices like VPN gateways and routers, and the industrialization of proxy networks using compromised residential and SOHO devices to bypass zero-trust controls. Notable threats include the , which achieved record-breaking 30 Tbps DDoS attacks by exploiting residential proxies. The article emphasizes that while most organizations utilize endpoint detection and response, attackers are increasingly operating in blind spots where these tools cannot see. To counter this, Lumen advises defenders to prioritize edge device security, replace static indicator blocking with pattern-based network detection, and treat residential IP traffic as a potential threat signal rather than a trusted source. Ultimately, backbone-level visibility provides the critical context needed to identify and disrupt sophisticated cyberattacks in their preparatory stages.

Artificial intelligence and biology: AI’s potential for launching a novel era for health and medicine

In his article for The Conversation, James Colter explores the transformative potential of artificial intelligence in addressing the staggering complexity of biological systems, which contain more unique interactions than stars in the known universe. Traditionally, medical science relied on slow, iterative observations, but AI now enables researchers to organize and perceive biological data at scales far beyond human capacity. Colter highlights disruptive models like , which predicts how gene variants drive conditions such as cancer and Alzheimer’s. A central theme is the field's necessary transition from purely statistical, correlation-based models to "causal-aware" AI. By utilizing experimental perturbations—purposeful disruptions to biology—scientists can distinguish direct cause and effect from mere noise or compensatory mechanisms. Despite significant hurdles, including high dimensionality and biological variance, Colter argues that integrating multi-modal datasets with robust experimental validation can overcome current data limitations. Ultimately, this trans-disciplinary synergy between AI and biology is poised to launch a novel era of medicine characterized by accelerated drug discovery and optimized personalized treatments. By moving toward a mechanistic understanding of life, researchers are on the precipice of solving some of humanity's most persistent health challenges, from chronic dysfunction to the fundamental processes of aging and regeneration.

The vibe coding bubble is going to leave a lot of broken apps behind

The "vibe coding" phenomenon represents a shift in software development where AI tools allow non-programmers to build functional applications through simple natural language prompts. However, this trend has created a bubble that threatens the long-term stability of the digital ecosystem. While vibe coding excels at rapid prototyping, it often bypasses the rigorous debugging and architectural planning essential for robust software. Many individuals entering this space are motivated by online clout or quick profits rather than a commitment to software longevity. Consequently, they often abandon their projects once the initial excitement fades. The primary risk lies in technical debt and maintenance; apps built without foundational coding knowledge are difficult to update when APIs change or operating systems evolve. This lack of ongoing support ensures that many "weekend projects" will inevitably fail, leaving users with a trail of broken, non-functional applications. Ultimately, the article argues that while AI democratizes creation, true development requires more than just a "vibe"—it demands a commitment to the tedious, long-term work of maintenance. As the current hype cycle cools, consumers will likely bear the cost of this unsustainable surge in disposable software, highlighting the critical difference between creating a prototype and sustaining a professional product.

Daily Tech Digest - March 25, 2026

Quote for the day:

"A true dreamer is one who knows how to navigate in the dark." -- John Paul Warren

🎧 Listen to this digest on YouTube Music

▶ Play Audio Digest

Duration: 22 mins • Perfect for listening on the go.

What actually changes when reliability becomes a board-level problem

When system reliability transitions from a technical metric to a board-level priority, the focus shifts from engineering jargon like latency to fiduciary responsibility and risk management. This evolution requires leaders to speak the language of revenue, reframing outages not just by their duration but by the millions in annual recurring revenue at risk. The author argues that true reliability is a governance stance where systems are treated as non-negotiable obligations. To manage this, organizations must move beyond technical hardening toward a "Trust Rebuild Journey," treating postmortems as binding customer contracts rather than internal artifacts. Operational changes, such as implementing a "Unified Command" and "game clocks," help reduce decision latency during crises. However, the core of this shift is human-centric; it’s about understanding the real-world impact on users, like small business owners or emergency dispatchers, whose lives depend on these systems. As autonomous AI begins to handle routine remediation, the author warns that human judgment remains vital for solving complex, cascading failures. Ultimately, being a board-level problem means realizing that an SLA is not just a target but a promise to protect the people behind the screen.

Rethinking Learning: Why curiosity, not compliance, is the key to success

In the article "Rethinking Learning," Shaurav Sen argues that traditional corporate training is fundamentally flawed, prioritizing compliance and completion metrics over genuine behavioral change and capability. Sen contends that many organizations fall into a "measurement trap," focusing on dashboard success while failing to improve job performance. To fix this, he proposes a shift from mandatory, "just-in-case" training to an optional, "just-in-time" model that prioritizes learner curiosity over administrative convenience. He introduces the "Spark" framework—Surface, Provoke, Activate, Reveal, and Kick-Start—as a method to create learning experiences that resonate emotionally and stick intellectually. By transforming Learning and Development (L&D) professionals into "curiosity architects," organizations can foster a culture where employees proactively seek growth. This approach involves replacing outdated metrics with "Time to Competency" and "Voluntary Re-Engagement Rates." Ultimately, Sen calls for a radical simplification of learning systems, urging leaders to move away from "learning theatre" and toward high-impact environments fueled by productive discomfort. This transition is essential in an AI-driven world where information is abundant but the spark of human curiosity remains the primary driver of successful employee skilling and organizational success.

When Patching Becomes a Coordination Problem, Not a Technical One

The article argues that patching failures are often rooted in organizational coordination breakdowns rather than technical limitations, especially regarding transitive dependencies. When vulnerabilities emerge in deeply embedded components, the remediation path is rarely linear because upstream fixes are not immediately deployable. Each layer in the dependency chain introduces delays as downstream libraries must integrate, test, and release their own updates. This lag creates a dangerous window for attackers to exploit publicly known vulnerabilities while internal teams struggle to align. CISOs face a persistent tension where security demands rapid action while engineering and operations prioritize system stability and regression testing. To overcome these hurdles, organizations must treat patching as a structured capability rather than a reactive task. Effective strategies include defining ownership for dependency-driven risks, establishing clear escalation paths, and prioritizing internet-facing or critical business systems. By investing in testing pipelines and rehearsed response playbooks, companies can replace improvised decision-making with predictable processes. Ultimately, the goal is to reduce uncertainty and internal friction, ensuring that when the next major vulnerability arrives, the organization is prepared to move with speed and clarity across all cross-functional teams involved in the remediation efforts.

AI and Medical Device Cybersecurity: The Good and Bad

The rapid integration of artificial intelligence into medical device cybersecurity presents a complex landscape of advantages and significant risks. On the positive side, AI-powered tools, such as large language models and autonomous scanners, are revolutionizing vulnerability discovery. These technologies can identify hundreds of true security flaws in hours—a task that previously took weeks—leading to a forty percent increase in known vulnerabilities. However, this surge has created a daunting vulnerability risk mitigation gap. Healthcare organizations and manufacturers struggle to manage the resulting avalanche of data, as current regulations like those from the FDA prohibit using AI for critical decision-making regarding device safety and remediation. Furthermore, the accessibility of these sophisticated tools lowers the barrier for cybercriminals, enabling even low-skilled threat actors to pinpoint exploitable flaws in life-critical equipment like infusion pumps. While the future use of Software Bills of Materials (SBOMs) alongside AI promises improved infrastructure resilience, the immediate reality is a race between rapid discovery and the ability of human-led systems to prioritize and fix flaws effectively. Balancing this technological double-edged sword remains a critical challenge for the medical sector as it navigates the evolving threat landscape of 2026 and beyond.

Autonomous AI adoption is on the rise, but it’s risky

The article "Autonomous AI adoption is on the rise, but it’s risky" highlights the rapid emergence of agentic AI platforms like OpenClaw and Anthropic’s Claude Cowork, which move beyond simple content generation to executing complex, multi-step workflows. While traditionally risk-averse sectors like healthcare and finance are beginning to experiment with these autonomous tools, the transition introduces substantial security and operational challenges. Proponents argue that these agents act as force multipliers, eliminating administrative drudgery and allowing human workers to focus on higher-value strategic tasks. However, the speed of execution can also amplify errors; for instance, a misaligned agent might inadvertently delete a user’s entire inbox or fall victim to sophisticated prompt injection attacks. Experts warn that many organizations currently lack the necessary monitoring systems and documented operational context required to manage these autonomous systems safely. To mitigate these risks, IT leaders are advised to implement robust oversight, ensure data cleanliness, and configure strict application permissions. Ultimately, despite the inherent dangers, the article encourages a balanced approach of cautious experimentation and rigorous control, as autonomous AI is poised to fundamentally reshape the global professional landscape within the next two years.

Your security stack looks fine from the dashboard and that’s the problem

According to Absolute Security’s 2026 Resilience Risk Index, a critical disconnect exists between cybersecurity dashboards and actual endpoint health, with one in five enterprise devices operating in an unprotected state daily. This "control drift" results in the average device spending approximately 76 days per year outside enforceable security states. The report highlights a widening gap in vulnerability management, where out-of-compliance rates climbed to 24%. Furthermore, while 62% of organizations are consolidating vendors to reduce complexity, this strategy creates significant "concentration exposure," where a single platform failure can paralyze an entire fleet. Patching discipline is also faltering; Windows 10 has reached end-of-life, and Windows 11 patch ages are rising across all sectors. Simultaneously, generative AI usage has surged 2.5 times, primarily through browser-based access that bypasses standard IT oversight. This shadow AI adoption, coupled with the shift toward AI-capable hardware, necessitates more robust endpoint stability to support automated workflows. Financially, the stakes are immense, as downtime costs large firms an average of $49 million annually. Ultimately, the report urges CISOs to prioritize resilience and remote recoverability over mere license coverage to mitigate these escalating operational and security risks.

Why AI scaling is so hard -- and what CIOs say works

The article highlights that while enterprises are investing heavily in generative AI, scaling these initiatives remains a significant hurdle due to high costs, poor data quality, and adoption difficulties. Insights from CIOs at First Student, OceanFirst Bank, and Lowell Community Health Center reveal that moving beyond experimental pilots requires a disciplined, value-driven strategy. Successful scaling begins with identifying specific, high-impact use cases that address tangible operational pain points rather than chasing industry hype. These leaders emphasize a "crawl, walk, run" approach, starting with small, contained pilots to validate performance before enterprise-wide rollouts. Crucially, selecting vendors with industry-specific expertise and establishing clear ROI metrics are vital for maintaining momentum. Conversely, the article warns against common pitfalls such as neglecting the end-user experience, ignoring change management, or delaying essential data governance and security frameworks. Without a solid data foundation, even the most advanced AI tools are prone to failure. Ultimately, CIOs must balance technical implementation with human-centric design, ensuring that AI serves as a practical, integrated tool rather than a novelty. By focusing on measurable outcomes and rigorous governance, organizations can bridge the gap between AI potential and actual business value.

Why Application Modernization Fails When Data Is an Afterthought

In "Why Application Modernization Fails When Data Is an Afterthought," Aman Sardana highlights that between 68% and 79% of legacy modernization projects fail because organizations prioritize cloud infrastructure over data strategy. While teams often focus on refactoring code or migrating to new platforms, they frequently ignore the "data gravity" of decades-old schemas and monolithic models. Simply moving applications to the cloud without addressing underlying data constraints merely relocates technical debt rather than retiring it. Sardana argues that modernization is fundamentally a data transformation problem, as legacy data structures built for centralized systems clash with cloud-native requirements like elastic scale and distributed ownership. To succeed, organizations must adopt a "data-first" mindset, implementing domain-aligned data ownership and explicit data contracts. This transition requires breaking down organizational silos where application and data teams operate independently. Ultimately, the article suggests that successful modernization depends on a deep collaboration between the CIO and Chief Data Officer to ensure data is treated as a primary, independent asset. Without this foundation, cloud initiatives become expensive exercises in preserving legacy limitations rather than unlocking true business agility and long-term innovation.

Architecting Portable Systems on Open Standards for Digital Sovereignty

In his article "Architecting Portable Systems on Open Standards for Digital Sovereignty," Jakob Beckmann explores the necessity of maintaining control over critical IT systems by reducing vendor dependency. He argues that while absolute digital sovereignty is an unattainable myth in a globalized economy, organizations must strive for a "Plan B" through architectural discipline and the adoption of open standards. Sovereignty is categorized into four key axes: data, technological, operational, and general governance. The author emphasizes that achieving this does not require building everything in-house or operating private data centers; rather, it involves identifying critical business processes and ensuring they are portable. Beckmann highlights that open standards like TCP/IP, TLS, and PDF serve as foundational pillars for this portability. However, he warns that the process is often more complex than anticipated due to hidden dependencies and the subtle lure of vendor-specific features in popular tools like Kubernetes. Ultimately, the article advocates for a balanced approach where resilient, portable architectures and clear guardrails empower businesses to migrate or adapt when providers change their terms, ensuring long-term operational autonomy and risk mitigation.

Why Most Data Security Strategies Collapse Under Real-World Pressure

Samuel Bocetta’s article explores why data security strategies frequently fail, arguing that most are built for ideal conditions or audit compliance rather than real-world operational pressures. A primary failure point is the disconnect between rigid policies and the critical need for speed; when engineers face urgent deadlines, security often becomes a hurdle that is quietly bypassed with temporary workarounds. Furthermore, organizations often over-rely on technical tools while ignoring human behavior and misaligned incentives. People naturally prioritize delivery and uptime over security controls that cause friction, especially when leadership rewards speed over diligence. Data sprawl—driven by shadow AI and decentralized analytics—also outpaces traditional governance models, creating visibility gaps that attackers exploit. Additionally, many strategies remain static in a dynamic threat landscape, failing to evolve alongside modern attack vectors. Bocetta concludes that building resilient security must shift from a narrow "checkbox" compliance mentality to an integrated, continuously evolving practice. True success requires meticulously aligning security measures with actual business workflows, executive incentives, and the fluid reality of how data is used daily, ensuring that protection is built into the organization's core rather than being treated as a secondary obstacle to progress.

Daily Tech Digest - January 01, 2026

Quote for the day:

"It always seems impossible until it’s done." -- Nelson Mandela

Why data trust is the missing link in digital transformation

Data trust is often framed as a technical issue, delegated to IT or data teams. In reality, it is a business capability with direct implications for growth, risk, and reputation. Trusted data enables organisations to: Confidently automate customer and operational workflows; Personalise experiences without introducing errors; Improve forecasting and performance reporting; and Reduce operational rework and exception handling When data cannot be trusted, leaders are forced to rely on manual checks, conservative assumptions, and duplicated processes. This increases cost and slows decision-making - the opposite of what digital transformation aims to achieve. .... Establishing data trust is not a one-time project. It requires a shift in mindset across the organisation. Data quality should be viewed as a shared responsibility, supported by the right processes and tools. Leading organisations embed data validation into their digital workflows, measure data quality as part of system health, and treat trusted data as a strategic asset. Over time, this creates a culture where decisions are made with confidence and transformation initiatives are more likely to succeed. ... Digital transformation is ultimately about enabling better decisions, faster execution, and stronger customer relationships. None of these goals can be achieved without trusted data. As organisations continue to modernise their platforms and processes, data quality should be treated as core infrastructure, not an afterthought.

Health Data Privacy, Cyber Regs: What to Watch in 2026

When federal regulators hesitate, states often jump into filing privacy and security gaps involving health data. That includes mandates in New York to shore up cybersecurity at certain hospitals (see: New York Hospitals Are Facing Tougher Cyber Rules Than HIPAA). Also worth watching is the New York Health Information Privacy Act, Greene said. "It was passed by both New York legislative chambers in January but has not yet been formally submitted to the governor for signature, with lobbying efforts underway to amend it." "In its most recent version, it would be the toughest health privacy law in the country in many respects, including a controversial prohibition on obtaining consents for secondary uses of data until at least 24 hours after an individual creates an account or first uses the requested product or service," Greene said. ... Greene predicted HIPAA resolution agreements and civil monetary penalties will continue much as they have in years past, with one to two dozen such cases next year. HHS has recently indicated that it intends to begin enforcing the Information Blocking Rule. "The primary target will be health IT developers," Greene said. "I expect that there are less information blocking issues with health information networks and believe that the statute and regulation's knowledge standard makes it more challenging to enforce against healthcare providers because the government must prove that a healthcare provider knew its practice to be unreasonable."

From integration pain to partnership gain: How collaboration strengthens cybersecurity

When collaborators leverage data in specific cybersecurity work, they unlock several valuable benefits, especially since no organization has complete insight into every possible threat. A shared, data-driven cybersecurity framework can offer both sides a better understanding of existing and emerging threats that could undermine one or both collaborators. Data-driven collaboration also enables partners to become more proactive in their cybersecurity posture. Coordinated data can give business partners insights into where there’s greater exposure for a cyberattack, allowing partners to work together with data-backed guidance on how to better prepare. ... The Vested model — an innovative approach based on research from the University of Tennessee — focuses on shared goals and outcomes rather than traditional transactional buyer and seller agreements. Both companies agreed on a specific set of KPIs they could use to measure the health of the partnership and keep their security goals on track, allowing them to continue to adapt cybersecurity initiatives as needs and threats evolve. “You have to build, maintain and exercise the right partnerships with business units and shared services across the enterprise so continuity plans identify the issue quickly, deploy appropriate mitigations, and ultimately restore client and business services as quickly as possible,” says Royce Curtin, IBM’s former VP of corporate security.

AI governance: A risk and audit perspective on responsible AI adoption

AI governance refers to the policies, procedures, and oversight mechanisms that guide how AI systems are developed, deployed, and monitored. It ensures that AI aligns with business objectives, complies with applicable laws, and operates in a way that is ethical and transparent. Regulatory scrutiny is increasing. The EU AI Act is setting a precedent for global standards, and U.S. agencies are signaling more aggressive enforcement, particularly in sectors like healthcare, finance, and employment. Organizations are expected to demonstrate accountability in how AI systems make decisions, manage data, and interact with users. Beyond regulation, there is growing pressure from customers, employees, and investors. ... Audit teams also help boards and audit committees understand the risks associated with AI. Their work supports transparency and builds trust with regulators and stakeholders. As AI becomes more embedded in business operations, internal audit must expand its scope to include model governance, data lineage, and ethical risk. ... Organizations that treat AI as a strategic risk are better positioned to scale it responsibly. Risk and internal audit teams have a central role in ensuring that AI systems are secure, compliant, and aligned with business goals. Citrin Cooperman helps organizations navigate AI adoption with confidence by combining deep risk expertise, practical governance frameworks, and advanced technology solutions that support secure, scalable, and compliant growth.

Six data shifts that will shape enterprise AI in 2026

While RAG won't entirely disappear in 2026, one approach that will likely surpass it in terms of usage for agentic AI is contextual memory, also known as agentic or long-context memory. This technology enables LLMs to store and access pertinent information over extended periods. Multiple such systems emerged over the course of 2025 including Hindsight, A-MEM framework, General Agentic Memory (GAM), LangMem, and Memobase. RAG will remain useful for static data, but agentic memory is critical for adaptive assistants and agentic AI workflows that must learn from feedback, maintain state, and adapt over time. In 2026, contextual memory will no longer be a novel technique; it will become table stakes for many operational agentic AI deployments. ... In 2025, we saw numerous innovations, like the notion that an AI is able to parse data from an unstructured data source like a PDF. That's a capability that has existed for several years, but proved harder to operationalize at scale than many assumed. Databricks now has an advanced parser, and other vendors, including Mistral, have emerged with their own improvements. The same is true with natural language to SQL translation. While some might have assumed that was a solved problem, it's one that continued to see innovation in 2025 and will see more in 2026. It's critical for enterprises to stay vigilant in 2026.

Communicating AI Risk to the Board With Confidence

Most board members can comprehend that AI will drive growth. What they fail to grasp concretely is how the technology introduces a massive amount of exposure. This predicament is typically a result of how information is presented. Security and risk managers (SRMs) often describe AI incidents in the vocabulary of adversarial inputs, model drift, and architecture choices, which matter deeply but rarely answer the questions that directors tackle during their meetings. High-level stakeholders, in reality, are concerned with issues such as revenue protection, operational continuity, and competitive differentiation, creating a gap that requires more than translating acronyms. ... Traditional discussions about technology risk revolve around the triad of confidentiality, integrity, and availability. Boards know these categories well, and over the past few decades, they have learned that cybersecurity failures directly affect the business along these lines. GenAI has formidably challenged this familiar structure, with its associated risks not limited to one of these three domains. ... When the conversation begins with the business consequence, though, the relevance is immediate. The most effective approach involves replacing those mechanics that mean so much to the internal teams with the strategic information boards need to operate. These details open a path for meaningful conversations that encourage directors to think through the implications and make more informed decisions.

The six biggest security challenges coming in 2026

For many organizations, cybersecurity and resilience is a compliance exercise. But it must evolve into “a core intentional cybersecurity capability”, says Dimitriadis. “In 2026, organizations will need to build the capacity to anticipate regulatory changes, understand their strategic implications, and embed them into long-term planning.” ... Attackers are leveraging AI to create convincing email templates and fake websites “almost indistinguishable” from real ones – and without the common warning signs employees are trained to identify, says Mitchell. AI is also being used in vishing attacks, with deepfakes making it easier to clone the voice of high-ranking company executives to trick victims. In 2026, there will be more attacks utilizing realistic voice cloning and high-quality video deepfakes, says Joshua Walsh ... There is a current shift towards agentic AI that can take real-world actions, such as adjusting configurations, interacting with APIs, booking services and initiating financial tasks. This can increase efficiency, but it can also lead to unsafe decisions made at speed, says rradar’s Walsh. An agent told to "optimize performance" might disable logging or bypass authentication because it views security controls as delays, he suggests. Prompt injection is a hidden issue to look out for, he adds. “If a threat actor slips hidden instructions into data that the agent consumes, they can make it run actions on internal systems without anyone realising.”

5 Changes That Will Define AI-Native Enterprises in 2026

As enterprises scale to multi-agent systems, the engineering focus will shift from creating prompts to architecting context. Multi-agent workflows rapidly expand requirements with tool definitions, conversation history, and data from multiple sources. This creates two challenges: context windows fill up, and models suffer from “context rot,” forgetting information buried in lengthy prompts. By mid-2026, context engineering will emerge as a distinct discipline with dedicated teams and specialized infrastructure, serving the minimal but complete information agents need. The best context engineers will understand both LLM constraints and their business domain’s semantic structure. ... Enterprises are realizing that AI agents need both data and meaning. Companies that spent years perfecting data lakes are already finding those assets are insufficient. AI can retrieve data, but without semantic context, it can’t interpret action or intent. That’s why teams will move beyond vector search toward building knowledge graphs, ontologies, and metadata-driven maps that teach AI how their business works. The battleground will shift from owning raw data to owning its interpretation. Off-the-shelf agents will struggle in complex domains because semantics are domain-specific. ... The AI-native enterprise looks very different from what came before. It serves machine customers, treats context as critical infrastructure, and has the tools to escape decades of technical debt.

Microsegmentation: the unsung hero of cybersecurity (and why it should be your top priority)

Think of your network like an apartment building. You’ve got a locked front door — that’s your perimeter. But once someone gets inside, there’s no front desk checking IDs, no elevator security and the same outdated lock on every unit. An intruder can roam freely, entering any apartment they choose. Microsegmentation is the internal security system. It’s the keycard for the elevator, the camera in the hallway, the unique lock on your door. It’s what stops one compromised device from becoming a full-blown breach. ... OT environments are different. They’re often built on legacy systems, lack patching and operate in real-time. You can’t just drop an agent or reroute traffic without risking downtime. That’s why agencies need solutions that are agentless, software-defined and tailored to the unique constraints of OT. Otherwise, you’re only protecting half the house. ... Microsegmentation also plays a critical role in enabling zero trust. It enforces least privilege at the network level. It’s not just about who gets in; it’s about what they can touch once they’re inside. For agencies building toward zero trust, microsegmentation isn’t an afterthought. It’s a foundation. Despite all this, microsegmentation remains underutilized. According to TechTarget’s Enterprise Strategy Group, only 36% of organizations use it today, even though it’s foundational to zero trust. Why? Because 28% believe it’s too complex. But that perception is often rooted in outdated tooling.

Beyond Chatbots: What Makes an AI Agent Truly Autonomous

Autonomous agents must retain and use context over time. Memory enables an agent to recall previous interactions, data, and decisions—allowing it to continue a process seamlessly without restarting each time. That persistence turns single exchanges into long-running workflows. In enterprise settings, it means an agent can track a contract review across multiple sessions or follow a complex support case without losing context. ... Traditional automation runs on fixed, rule-based workflows. Autonomous agents build and revise their own plans on the fly, adapting to results and feedback. This ability to plan dynamically—think, act, observe, and adjust—is what differentiates agentic AI from robotic process automation (RPA) or prompt chaining. In practice, an agent might be tasked with analyzing a set of contracts, then automatically decide how to proceed: extract key terms, assess risk, and summarize results. ... Resilient agents are designed to operate across models, retry failed actions, or launch sub-agents to handle specialized work—all within defined guardrails. That adaptability is what separates a proof of concept (POC) from a production-ready system. ... All the reasoning in the world means little if an agent can’t execute. Tools are what translate intelligence into impact. They’re the functions, APIs, and integrations that allow agents to interact with business systems—searching systems, generating documents, updating records, or triggering workflows across CRMs, ERPs, and analytics platforms.

Daily Tech Digest - August 02, 2025

Quote for the day:

"Successful leaders see the opportunities in every difficulty rather than the difficulty in every opportunity" -- Reed Markham

Chief AI role gains traction as firms seek to turn pilots into profits

CAIOs understand the strategic importance of their role, with 72% saying their organizations risk falling behind without AI impact measurement. Nevertheless, 68% said they initiate AI projects even if they can’t assess their impact, acknowledging that the most promising AI opportunities are often the most difficult to measure. Also, some of the most difficult AI-related tasks an organization must tackle rated low on CAIOs’ priority lists, including measuring the success of AI investments, obtaining funding and ensuring compliance with AI ethics and governance. The study’s authors didn’t suggest a reason for this disconnect. ... Though CEO sponsorship is critical, the authors also stressed the importance of close collaboration across the C-suite. Chief operating officers need to redesign workflows to integrate AI into operations while managing risk and ensuring quality. Tech leaders need to ensure that the technical stack is AI-ready, build modern data architectures and co-create governance frameworks. Chief human resource officers need to integrate AI into HR processes, foster AI literacy, redesign roles and foster an innovation culture. The study found that the factors that separate high-performing CAIOs from their peers are measurement, teamwork and authority. Successful projects address high-impact areas like revenue growth, profit, customer satisfaction and employee productivity.

Mind the overconfidence gap: CISOs and staff don’t see eye to eye on security posture

“Executives typically rely on high-level reports and dashboards, whereas frontline practitioners see the day-to-day challenges, such as limitations in coverage, legacy systems, and alert fatigue — issues that rarely make it into boardroom discussions,” she says. “This disconnect can lead to a false sense of security at the top, causing underinvestment in areas such as secure development, threat modeling, or technical skills.” ... Moreover, the CISO’s rise in prominence and repositioning for business leadership may also be adding to the disconnect, according to Adam Seamons, information security manager at GRC International Group. “Many CISOs have shifted from being technical leads to business leaders. The problem is that in doing so, they can become distanced from the operational detail,” Seamons says. “This creates a kind of ‘translation gap’ between what executives think is happening and what’s actually going on at the coalface.” ... Without a consistent, shared view of risk and posture, strategy becomes fragmented, leading to a slowdown in decision-making or over- or under-investment in specific areas, which in turn create blind spots that adversaries can exploit. “Bridging this gap starts with improving the way security data is communicated and contextualized,” Forescout’s Ferguson advises.

7 tips for a more effective multicloud strategy

For enterprises using dozens of cloud services from multiple providers, the level of complexity can quickly get out of hand, leading to chaos, runaway costs, and other issues. Managing this complexity needs to be a key part of any multicloud strategy. “Managing multiple clouds is inherently complex, so unified management and governance are crucial,” says Randy Armknecht, a managing director and global cloud practice leader at business advisory firm Protiviti. “Standardizing processes and tools across providers prevents chaos and maintains consistency,” Armknecht says. Cloud-native application protection platforms (CNAPP) — comprehensive security solutions that protect cloud-native applications from development to runtime — “provide foundational control enforcement and observability across providers,” he says. ... Protecting data in multicloud environments involves managing disparate APIs, configurations, and compliance requirements across vendors, Gibbons says. “Unlike single-cloud environments, multicloud increases the attack surface and requires abstraction layers [to] harmonize controls and visibility across platforms,” he says. Security needs to be uniform across all cloud services in use, Armknecht adds. “Centralizing identity and access management and enforcing strong data protection policies are essential to close gaps that attackers or compliance auditors could exploit,” he says.

Building Reproducible ML Systems with Apache Iceberg and SparkSQL: Open Source Foundations

Data lakes were designed for a world where analytics required running batch reports and maybe some ETL jobs. The emphasis was on storage scalability, not transactional integrity. That worked fine when your biggest concern was generating quarterly reports. But ML is different. ... Poor data foundations create costs that don't show up in any budget line item. Your data scientists spend most of their time wrestling with data instead of improving models. I've seen studies suggesting sixty to eighty percent of their time goes to data wrangling. That's... not optimal. When something goes wrong in production – and it will – debugging becomes an archaeology expedition. Which data version was the model trained on? What changed between then and now? Was there a schema modification that nobody documented? These questions can take weeks to answer, assuming you can answer them at all. ... Iceberg's hidden partitioning is particularly nice because it maintains partition structures automatically without requiring explicit partition columns in your queries. Write simpler SQL, get the same performance benefits. But don't go crazy with partitioning. I've seen teams create thousands of tiny partitions thinking it will improve performance, only to discover that metadata overhead kills query planning. Keep partitions reasonably sized (think hundreds of megabytes to gigabytes) and monitor your partition statistics.

The Creativity Paradox of Generative AI

Before talking about AI creation ability, we need to understand a simple linguistic limitation: despite the data used for these compositions having human meanings initially, i.e., being seen as information, after being de- and recomposed in a new, unknown way, these compositions do not have human interpretation, at least for a while, i.e., they do not form information. Moreover, these combinations cannot define new needs but rather offer previously unknown propositions to the specified tasks. ... Propagandists of know-it-all AI have a theoretical basis defined in the ethical principles that such an AI should realise and promote. Regardless of how progressive they sound, their core is about neo-Marxist concepts of plurality and solidarity. Plurality states that the majority of people – all versus you – is always right (while in human history it is usually wrong), i.e., if an AI tells you that your need is already resolved in the way that the AI articulated, you have to agree with it. Solidarity is, in essence, a prohibition of individual opinions and disagreements, even just slight ones, with the opinion of others; i.e., everyone must demonstrate solidarity with all. ... The know-it-all AI continuously challenges a necessity in the people’s creativity. The Big AI Brothers think for them, decide for them, and resolve all needs; the only thing that is required in return is to obey the Big AI Brother directives.

Doing More With Your Existing Kafka

The transformation into a real-time business isn’t just a technical shift, it’s a strategic one. According to MIT’s Center for Information Systems Research (CISR), companies in the top quartile of real-time business maturity report 62% higher revenue growth and 97% higher profit margins than those in the bottom quartile. These organizations use real-time data not only to power systems but to inform decisions, personalize customer experiences and streamline operations. ... When event streams are discoverable, secure and easy to consume, they are more likely to become strategic assets. For example, a Kafka topic tracking payment events could be exposed as a self-service API for internal analytics teams, customer-facing dashboards or third-party partners. This unlocks faster time to value for new applications, enables better reuse of existing data infrastructure, boosts developer productivity and helps organizations meet compliance requirements more easily. ... Event gateways offer a practical and powerful way to close the gap between infrastructure and innovation. They make it possible for developers and business teams alike to build on top of real-time data, securely, efficiently and at scale. As more organizations move toward AI-driven and event-based architectures, turning Kafka into an accessible and governable part of your API strategy may be one of the highest-leverage steps you can take, not just for IT, but for the entire business.

Meta-Learning: The Key to Models That Can "Learn to Learn"

Meta-learning is a field within machine learning that focuses on algorithms capable of learning how to learn. In traditional machine learning, an algorithm is trained on a specific dataset and becomes specialized for that task. In contrast, meta-learning models are designed to generalize across tasks, learning the underlying principles that allow them to quickly adapt to new, unseen tasks with minimal data. The idea is to make machine learning systems more like humans — able to leverage prior knowledge when facing new challenges. ... This is where meta-learning shines. By training models to adapt to new situations with few examples, we move closer to creating systems that can handle the diverse, dynamic environments found in the real world. ... Meta-learning represents the next frontier in machine learning, enabling models that are adaptable and capable of generalizing across a wide range of tasks with minimal data. By making machines more capable of learning from fewer examples, meta-learning has the potential to revolutionize fields like healthcare, robotics, finance, and more. While there are still challenges to overcome, the ongoing advancements in meta-learning techniques, such as few-shot learning, transfer learning, and neural architecture search, are making it an exciting area of research with vast potential for practical applications.

US govt, Big Tech unite to build one stop national health data platform

Under this framework, applications must support identity-proofing standards, consent management protocols, and Fast Healthcare Interoperability Resources (FHIR)-based APIs that allow for real-time retrieval of medical data across participating systems. The goal, according to CMS Administrator Chiquita Brooks-LaSure, is to create a “unified digital front door” to a patient’s health records that are accessible from any location, through any participating app, at any time. This unprecedented public-private initiative builds on rules first established under the 2016 21st Century Cures Act and expanded by the CMS Interoperability and Patient Access Final Rule. This rule mandates that CMS-regulated payers such as Medicare Advantage organizations, Medicaid programs, and Affordable Care Act (ACA)-qualified health plans make their claims, encounter data, lab results, provider remittances, and explanations of benefits accessible through patient-authorized APIs. ... ID.me, another key identity verification provider participating in the CMS initiative, has also positioned itself as foundational to the interoperability framework. The company touts its IAL2/AAL2-compliant digital identity wallet as a gateway to streamlined healthcare access. Through one-time verification, users can access a range of services across providers and government agencies without repeatedly proving their identity.

What Is Data Literacy and Why Does It Matter?

Building data literacy in an organization is a long-term project, often spearheaded by the chief data officer (CDO) or another executive who has a vision for instilling a culture of data in their company. In a report from the MIT Sloan School of Management, experts noted that to establish data literacy in a company, it’s important to first establish a common language so everyone understands and agrees on the definition of commonly used terms. Second, management should build a culture of learning and offer a variety of modes of training to suit different learning styles, such as workshops and self-led courses. Finally, the report noted that it’s critical to reward curiosity – if employees feel they’ll get punished if their data analysis reveals a weakness in the company’s business strategy, they’ll be more likely to hide data or just ignore it. Donna Burbank, an industry thought leader and the managing director of Global Data Strategy, discussed different ways to build data literacy at DATAVERSITY’s Data Architecture Online conference in 2021. ... Focusing on data literacy will help organizations empower their employees, giving them the knowledge and skills necessary to feel confident that they can use data to drive business decisions. As MIT senior lecturer Miro Kazakoff said in 2021: “In a world of more data, the companies with more data-literate people are the ones that are going to win.”

LLMs' AI-Generated Code Remains Wildly Insecure

In the past two years, developers' use of LLMs for code generation has exploded, with two surveys finding that nearly three-quarters of developers have used AI code generation for open source projects, and 97% of developers in Brazil, Germany, and India are using LLMs as well. And when non-developers use LLMs to generate code without having expertise — so-called "vibe coding" — the danger of security vulnerabilities surviving into production code dramatically increases. Companies need to figure out how to secure their code because AI-assisted development will only become more popular, says Casey Ellis, founder at Bugcrowd, a provider of crowdsourced security services. ... Veracode created an analysis pipeline for the most popular LLMs (declining to specify in the report which ones they tested), evaluating each version to gain data on how their ability to create code has evolved over time. More than 80 coding tasks were given to each AI chatbot, and the subsequent code was analyzed. While the earliest LLMs tested — versions released in the first half of 2023 — produced code that did not compile, 95% of the updated versions released in the past year produced code that passed syntax checking. On the other hand, the security of the code has not improved much at all, with about half of the code generated by LLMs having a detectable OWASP Top-10 security vulnerability, according to Veracode.

Daily Tech Digest - May 24, 2025

Quote for the day:

“In my experience, there is only one motivation, and that is desire. No reasons or principle contain it or stand against it.” -- Jane Smiley

DanaBot botnet disrupted, QakBot leader indicted

Operation Endgame relies on help from a number of private sector cybersecurity companies (Sekoia, Zscaler, Crowdstrike, Proofpoint, Fox-IT, ESET, and others), non-profits such as Shadowserver and white-hat groups like Cryptolaemus. “The takedown of DanaBot represents a significant blow not just to an eCrime operation but to a cyber capability that has appeared to align Russian government interests. The case (…) highlights why we must view certain Russian eCrime groups through a political lens — as extensions of state power rather than mere criminal enterprises,” Crowdstrike commented the DanaBot disruption. ... “We’ve previously seen disruptions have significant impacts on the threat landscape. For example, after last year’s Operation Endgame disruption, the initial access malware associated with the disruption as well as actors who used the malware largely disappeared from the email threat landscape,” Selena Larson, Staff Threat Researcher at Proofpoint, told Help Net Security. “Cybercriminal disruptions and law enforcement actions not only impair malware functionality and use but also impose cost to threat actors by forcing them to change their tactics, cause mistrust in the criminal ecosystem, and potentially make criminals think about finding a different career.”

AI in Cybersecurity: Protecting Against Evolving Digital Threats

Beyond detecting threats, AI excels at automating repetitive security tasks. Tasks like patching vulnerabilities, filtering malicious traffic, and conducting compliance checks can be time-consuming. AI’s speed and precision in handling these tasks free up cybersecurity professionals to focus on complex problem-solving. ... The integration of AI into cybersecurity raises ethical questions that must be addressed. Privacy concerns are at the forefront, as AI systems often rely on extensive data collection. This creates potential risks for mishandling or misuse of sensitive information. Additionally, AI’s capabilities for surveillance can lead to overreach. Governments and corporations may deploy AI tools for monitoring activities under the guise of security, potentially infringing on individual rights. There is also the risk of malicious actors repurposing legitimate AI tools for nefarious purposes. Clear guidelines and robust governance are crucial to ensuring responsible AI deployment in cybersecurity. ... The growing role of AI in cybersecurity necessitates strong regulatory frameworks. Governments and organizations are working to establish policies that address AI’s ethical and operational challenges in this field. Transparency in AI decision-making processes and standardized best practices are among the key priorities.

Open MPIC project defends against BGP attacks on certificate validation

MPIC is a method to enhance the security of certificate issuance by validating domain ownership and CA checks from multiple network vantage points. It helps prevent BGP hijacking by ensuring that validation checks return consistent results from different geographical locations. The goal is to make it more difficult for threat actors to compromise certificate issuance by redirecting internet routes. ... Open MPIC operates through a parallel validation architecture that maximizes efficiency while maintaining security. When a domain validation check is initiated, the framework simultaneously queries all configured perspectives and collects their results. “If you have 10 perspectives, then it basically asks all 10 perspectives at the same time, and then it will collect the results and determine the quorum and give you a thumbs up or thumbs down,” Sharkov said. This approach introduces some unavoidable latency, but the implementation minimizes performance impact through parallelization. Sharkov noted that the latency is still just a fraction of a second. ... The open source nature of the project addresses a significant challenge for the industry. While large certificate authorities often have the resources to build their own solutions, many smaller CAs would struggle with the technical and infrastructure requirements of multi-perspective validation.

How to Close the Gap Between Potential and Reality in Tech Implementation

First, there has to be alignment between the business and tech sides. So, I’ve seen in many institutions that there’s not complete alignment between both. And where they could be starting, they sometimes separate and they go in opposite directions. Because at the end of the day, let’s face it, we’re all looking at how it will help ourselves. Secondly, it’s just the planning, ensuring that you check all the boxes and have a strong implementation plan. One recent customer who just joined Backbase: One of the things I loved about what they brought to the kickoff call was what success looked like to them for implementation. So, they had the work stream, whether the core integration, the call center, their data strategy, or their security requirements. Then, they had the leader who was the overall owner and then they had the other owners of each work stream. Then, they defined success criteria with the KPIs associated with those success criteria. ... Many folks forget that they are, most of the time, still running on a legacy platform. So, for me, success is when they decommission that legacy platform and a hundred percent of their members or customers are on Backbase. That’s one of the very important internal KPIs.

How AIOps sharpens cybersecurity posture in the age of cyber threats

The good news is, AIOps platforms are built to scale with complexity, adapting to new environments, users, and risks as they develop. And organizations can feel reassured that their digital vulnerabilities are safeguarded for the long term. For example, modern methods of attack, such as hyperjacking, can be identified and mitigated with AIOps. This form of attack in cloud security is where a threat actor gains control of the hypervisor – the software that manages virtual machines on a physical server. It allows them to then take over the virtual machines running on that hypervisor. What makes hyperjacking especially dangerous is that it operates beneath the guest operating systems, effectively evading traditional monitoring tools that rely on visibility within the virtual machines. As a result, systems lacking deep observability are the most vulnerable. This makes the advanced observability capabilities of AIOps essential for detecting and responding to such stealthy threats. Naturally, this evolving scope of digital malice also requires compliance rules to be frequently reviewed. When correctly configured, AIOps can support organizations by interpreting the latest guidelines and swiftly identifying the data deviations that would otherwise incur penalties.

Johnson & Johnson Taps AI to Advance Surgery, Drug Discovery

J&J's Medical Engagement AI redefines care delivery, identifying 75,000 U.S. patients with unmet needs across seven disease areas, including oncology. Its analytics engine processes electronic health records and clinical guidelines to highlight patients missing optimal treatments. A New York oncologist, using J&J's insights, adjusted treatment for 20 patients in 2024, improving the chances of survival. The platform engages over 5,000 providers, empowering medical science liaisons with real-time data. It helps the AI innovation team turn overwhelming data into an advantage. Transparent data practices and a focus on patient outcomes align with J&J's ethical standards, making this a model that bridges tech and care. ... J&J's AI strategy rests on five ethical pillars, including fairness, privacy, security, responsibility and transparency. It aims to deliver AI solutions that benefit all stakeholders equitably. The stakeholders and users understand the methods through which datasets are collected and how external influences, such as biases, may affect them. Bias is mitigated through annual data audits, privacy is upheld with encrypted storage and consent protocols, and on top of it is AI-driven cybersecurity monitoring. A training program, launched in 2024, equipped 10,000 employees to handle sensitive data.

Surveillance tech outgrows face ID

Many oppose facial recognition technology because it jeopardizes privacy, civil liberties, and personal security. It enables constant surveillance and raises the specter of a dystopian future in which people feel afraid to exercise free speech.Another issue is that one’s face can’t be changed like a password can, so if face-recognition data is stolen or sold on the Dark Web, there’s little anyone can do about the resulting identity theft and other harms. .... You can be identified by your gait (how you walk). And surveillance cameras now use AI-powered video analytics to track behavior, not just faces. They can follow you based on your clothing, the bag you carry, and your movement patterns, stitching together your path across a city or a stadium without ever needing a clear shot of your face. The truth is that face recognition is just the most visible part of a much larger system of surveillance. When public concern about face recognition causes bans or restrictions, governments, companies, and other organizations simply circumvent that concern by deploying other technologies from a large and growing menu of options. Whether we’re IT professionals, law enforcement technologists, security specialists, or privacy advocates, it’s important to incorporate the new identification technologies into our thinking, and face the new reality that face recognition is just one technology among many.

How Ready Is NTN To Go To Scale?

Non-Terrestrial Networks (NTNs) represent a pivotal advancement in global communications, designed to extend connectivity far beyond the limits of ground-based infrastructure. By leveraging spaceborne and airborne assets—such as Low Earth Orbit (LEO), Medium Earth Orbit (MEO), and Geostationary (GEO) satellites, as well as High-Altitude Platform Stations (HAPS) and UAVs—NTNs enable seamless coverage in regions previously considered unreachable. Whether traversing remote deserts, deep oceans, or mountainous terrain, NTNs provide reliable, scalable connectivity where traditional terrestrial networks fall short or are economically unviable. This paradigm shift is not merely about extending signal reach; it’s about enabling entirely new categories of applications and industries to thrive in real time. ... A core feature of NTNs is their use of varied orbital altitudes, each offering distinct performance characteristics. Low Earth Orbit (LEO) satellites (altitudes of 500–2,000 km) are known for their low latency (20–50 ms) and are ideal for real-time services. Medium Earth Orbit (MEO) systems (2,000–35,000 km) strike a balance between coverage and latency and are often used in navigation and communications. Geostationary Orbit (GEO) satellites, positioned at ~35,786 km, provide wide-area coverage from a fixed position relative to Earth’s rotation—particularly useful for broadcast and constant-area monitoring.

Enterprises are wasting the cloud’s potential

One major key to achieving success with cloud computing is training and educating employees. Although the adoption of cloud technology signifies a significant change, numerous companies overlook the importance of equipping their staff with the technical expertise and strategic acumen to capitalize on its potential benefits. IT teams that lack expertise in cloud services may use cloud resources inefficiently or ineffectively. Business leaders who are unfamiliar with cloud tools often struggle to leverage data-driven insights that could drive innovation. Employees relying on cloud-based applications might not fully utilize all their functionality due to insufficient training. These skill gaps lead to dissatisfaction with cloud services, and the company doesn’t benefit from its investments in cloud infrastructure. ... The cloud is a tool for transforming operations rather than just another piece of IT equipment. Companies can refine their approach to the cloud by establishing effective governance structures and providing employees with training on the optimal utilization of cloud technology. Once they engage architects and synchronize cloud efforts with business objectives, most companies will see tangible results: cost savings, system efficiency, and increased innovation.

The battle to AI-enable the web: NLweb and what enterprises need to know

NLWeb enables websites to easily add AI-powered conversational interfaces, effectively turning any website into an AI app where users can query content using natural language. NLWeb isn’t necessarily about competing with other protocols; rather, it builds on top of them. The new protocol uses existing structured data formats like RSS, and each NLWeb instance functions as an MCP server. “The idea behind NLWeb is it is a way for anyone who has a website or an API already to very easily make their website or their API an agentic application,” Microsoft CTO Kevin Scott said during his Build 2025 keynote. “You really can think about it a little bit like HTML for the agentic web.” ... “NLWeb leverages the best practices and standards developed over the past decade on the open web and makes them available to LLMs,” Odewahn told VentureBeat. “Companies have long spent time optimizing this kind of metadata for SEO and other marketing purposes, but now they can take advantage of this wealth of data to make their own internal AI smarter and more capable with NLWeb.” ... “NLWeb provides a great way to open this information to your internal LLMs so that you don’t have to go hunting and pecking to find it,” Odewahn said. “As a publisher, you can add your own metadata using schema.org standard and use NLWeb internally as an MCP server to make it available for internal use.”