Daily Tech Digest by Kannan Subbiah: legacy

Showing posts with label legacy. Show all posts

Daily Tech Digest - March 16, 2026

Quote for the day:

"Inspired leaders move a business beyond problems into opportunities." -- Dr. Abraham Zaleznik

🎧 Listen to this digest on YouTube Music

▶ Play Audio Digest

Duration: 23 mins • Perfect for listening on the go.

Why many enterprises struggle with outdated digital systems & how to fix them

The article on Express Computer, "Why many enterprises struggle with outdated digital systems & how to fix them," explores the pervasive issue of legacy technical debt. Many organizations remain tethered to aging infrastructure that stifles innovation and hampers agility. The struggle often stems from the prohibitive costs of replacement, the immense complexity of migrating mission-critical processes, and a fundamental fear of business disruption. Governance layers and siloed ownership further exacerbate these challenges, creating compounding "enterprise debt" across processes, data, and talent. To address these bottlenecks, the author advocates for a strategic shift toward a product mindset and incremental modernization instead of high-risk, wholesale replacements. Recommended fixes include mapping system dependencies, quantifying inefficiencies, and following a clear roadmap that progresses from stabilization to systematic optimization. By decoupling tightly integrated components and establishing clear ownership, enterprises can transform their brittle legacy systems into scalable, resilient assets. Fostering a culture of continuous improvement and aligning with core business objectives are equally vital for survival. Ultimately, the piece emphasizes that overcoming outdated digital systems is a strategic necessity in a fast-paced market, requiring a balanced approach to technical remediation and organizational change to ensure long-term competitiveness.

COBOL developers will always be needed, even as AI takes the lead on modernization projects

The article from ITPro explores the enduring necessity of COBOL developers amidst the rise of in legacy modernization projects. While AI is increasingly being marketed as a "silver bullet" for converting ancient COBOL codebases into modern languages like Java, industry experts argue that these digital transformations cannot succeed without human domain expertise. COBOL remains the backbone of global financial and administrative systems, housing decades of intricate business logic that AI often fails to interpret accurately. The piece emphasizes that while can significantly accelerate code translation and documentation, it lacks the contextual understanding required to define what a successful transformation actually looks like. Consequently, veteran developers are essential for overseeing AI-driven migrations, identifying potential risks, and ensuring that the logic preserved in the legacy system is correctly replicated in the new environment. Rather than replacing the workforce, AI acts as a collaborative tool that shifts the developer's role from manual coding to strategic orchestration. Ultimately, the survival of critical infrastructure depends on a hybrid approach that combines the speed of machine learning with the deep-seated knowledge of COBOL specialists, proving that legacy expertise is more valuable than ever in the modern era.

The CTO is dead. Long live the CTO

In the article "The CTO is dead. Long live the CTO" on CIO.com, Marios Fakiolas argues that the traditional role of the as a technical gatekeeper and "human compiler" has become obsolete due to the rise of advanced AI. Modern Large Language Models can now design complex system architectures in minutes, outperforming humans in handling multidimensional constraints and technical interdependencies. Consequently, the new era demands a "multiplier" who shifts focus from providing technical answers to architecting systems that enable continuous organizational intelligence. Today’s CTO is measured not by architectural purity, but by tangible business outcomes such as gross margin, ROI, and operational velocity. This evolution requires leaders to move beyond their "AI comfort zone" of fancy demos and instead tackle difficult structural challenges like cost optimization and team restructuring. The author emphasizes that the modern leader must lead from the front, ruthlessly killing legacy "darlings" and designing for impermanence rather than static stability. Ultimately, the successful CTO must transition from being a bottleneck to becoming an orchestrator of AI agents and human expertise, ensuring that the entire organization can pivot rapidly without trauma. By embracing this proactive mindset, technology leaders can transcend the gatekeeping era and drive meaningful innovation in a fierce, AI-driven market.

When insider risk is a wellbeing issue, not just a disciplinary one

In the article "When insider risk is a wellbeing issue, not just a disciplinary one" on Security Boulevard, Katie Barnett argues for a paradigm shift in how organizations manage insider threats. Moving beyond traditional framing—which often focuses on malicious intent and punitive disciplinary measures—the author highlights that many security incidents are actually the byproduct of employee stress, fatigue, and disengagement. In a modern work environment characterized by digital isolation and economic uncertainty, personal strains such as financial pressure or burnout can erode professional judgment, making individuals more susceptible to manipulation or unintentional policy violations. The piece emphasizes that relying solely on technical controls and monitoring is insufficient; these tools do not address the underlying human factors that lead to risk. Instead, Barnett advocates for a proactive approach where wellbeing is treated as a core pillar of organizational resilience. This involves training managers to recognize early behavioral warning signs, fostering a supportive culture where staff feel safe raising concerns, and creating interdepartmental cooperation between HR and security teams. Ultimately, the article posits that by integrating support and psychological safety into the security strategy, organizations can prevent incidents before they escalate, strengthening their overall security posture through empathy rather than just compliance.

What it takes to win that CSO role

In the CSO Online article "What it takes to win that CSO role," David Weldon explores the transformation of the Chief Security Officer position into a high-stakes C-suite role requiring board-level accountability. No longer a back-office function, the modern CSO operates at the critical intersection of technology, regulatory exposure, revenue continuity, and brand trust. Achieving success in this position demands a shift from being a "cost center" to a "trust center," where security is positioned as a strategic business enabler that supports revenue growth rather than just a preventative measure. Key requirements include deep expertise in identity and access management and a sophisticated understanding of emerging threats like shadow AI, data poisoning, and model risk. Beyond technical prowess, financial acumen is non-negotiable; aspiring CSOs must translate security investments into business value, such as reduced insurance premiums or contractual leverage. Communication is paramount, as the role involves constant negotiation and the ability to translate complex risks for non-technical stakeholders. Ultimately, winning the role requires aligning accountability with authority and demonstrating the operating depth to maintain business resilience during sustained outages. By evolving from a "no" person to a "how" person, successful CSOs ensure that security becomes a foundational pillar of organizational success and customer confidence.

Human-Centered AI Is Becoming A Leadership Imperative

In his Forbes article, "Human-Centered AI Is Becoming A Leadership Imperative," Rhett Power argues that while artificial intelligence offers unprecedented industrial opportunities, its successful implementation depends entirely on a shift from technical obsession to human-centric leadership. Power contends that unchecked AI deployment often fails because it ignores the social and cognitive arrangements necessary for technology to thrive. To bridge the widening gap between technological promise and actual business value, leaders must adopt three foundational principles: prioritizing desired business outcomes over specific tools, evolving training to support role-specific enablement, and treating human-centered design as a core competitive advantage. Power identifies a new leadership paradigm where executives must serve as visionary guides who align AI with human values, ethical guardians who ensure transparency and bias mitigation, and human advocates who prioritize employee experience. By focusing on augmenting rather than replacing human expertise, organizations can transform AI into a seamless collaborative partner that drives long-term resilience and innovation. Ultimately, the article emphasizes that the true value of AI lies in its ability to extend the reach of human judgment, making the integration of empathy and ethical oversight a non-negotiable requirement for modern executive accountability in a rapidly evolving digital landscape.

Employee Experience 2.0: AI as the Performance Engine of the Work Operating System

In the article "Employee Experience 2.0: AI as the Performance Engine of the Work Operating System," Jeff Corbin outlines an essential evolution in workplace management. While the first version of the Employee Experience (EX 1.0) focused on cross-departmental alignment between HR, IT, and Communications, the author argues that human capacity alone is no longer sufficient to manage the modern digital workspace. EX 2.0 introduces artificial intelligence as a "performance layer" that transforms the work operating system from a static framework into a self-optimizing engine. AI addresses critical challenges such as "digital friction"—where employees waste nearly 30% of their day searching through disconnected systems like SharePoint and ServiceNow—by acting as an automated editor for content governance. Beyond cleaning up data, AI-driven EX 2.0 enables hyper-personalization of communications and provides predictive analytics that can identify turnover risks or workflow bottlenecks before they escalate. By integrating AI as a core architectural component, organizations can move beyond manual coordination to create a frictionless environment that boosts engagement and productivity. Ultimately, the piece calls for leaders to upgrade their governance models, positioning AI not just as a tool, but as a collaborative partner that ensures the employee experience remains agile and effective in a technology-driven era.

The Next Era of UX and Analytics, and Merging Conversational AI with Design-to-Code

The article "The Transformation of Software Development: , the Next Era of UX and Analytics" explores the profound shift from static, reactive user interfaces to proactive, intelligent systems. Modern software development is evolving beyond standard component libraries toward "smarter" UI elements that leverage embedded analytics and machine learning to adapt to user behavior in real-time. This transformation allows digital interfaces to anticipate user needs, personalize layouts dynamically, and optimize complex workflows without manual intervention. By integrating sophisticated telemetry directly into front-end components, developers gain granular, actionable insights into performance and engagement, effectively bridging the gap between user experience and technical execution. This evolution significantly impacts the modern DevOps lifecycle, as development teams move from building isolated features to orchestrating continuous learning environments. The article further highlights that these intelligent components reduce the cognitive load for end-users by surfacing relevant information and simplifying intricate navigations. Ultimately, the synergy between advanced data analytics and front-end engineering is setting a new industry standard for digital excellence, where personalization and efficiency are core to the process. Organizations that embrace this era of "smarter" components will deliver highly tailored experiences that drive superior retention and user satisfaction in an increasingly competitive market.

Certificate lifespans are shrinking and most organizations aren’t ready

The article "Certificate lifespans are shrinking and most organizations aren't ready," featured on Help Net Security, outlines the critical challenges businesses face as TLS certificate validity periods compress from one year down to 47 days. John Murray of GlobalSign emphasizes that this rapid shift, driven by browser requirements, necessitates a complete overhaul of traditional manual certificate management. To avoid operational disruptions and outages, organizations must prioritize "discovery" as the foundational step, utilizing tools like GlobalSign's Atlas or LifeCycle X to inventory every certificate and platform. This proactive approach is not only vital for managing shorter lifecycles but also serves as essential preparation for the eventual migration to post-quantum cryptography. Murray suggests that manual spreadsheets are no longer sustainable; instead, businesses should adopt automation protocols like ACME and shift toward flexible, SAN-based licensing models to remove procurement friction. While larger enterprises may have dedicated PKI teams, mid-market and smaller organizations are at a higher risk of being caught off guard. By establishing automated renewal pipelines and closing the specialized knowledge gap in PKI expertise, companies can build a resilient security posture. Ultimately, the window for preparation is closing, and integrating automated lifecycle management is now a strategic imperative rather than a future luxury.

Agoda CTO on why AI still needs human oversight

In the Tech Wire Asia article, , Idan Zalzberg, discusses the essential role of human oversight in an era dominated by artificial intelligence. While AI tools have significantly accelerated developer workflows and boosted productivity—with early experiments at Agoda showing a 27% uplift—Zalzberg emphasizes that these technologies remain supplementary. The primary challenge lies in the inherent unpredictability and non-deterministic nature of generative AI, which differs from traditional software by producing inconsistent outputs. Consequently, Agoda maintains a strict policy where human engineers remain fully accountable for all code, regardless of its origin. Quality control remains rigorous, utilizing the same static analysis and automated testing frameworks applied to human-written scripts. Zalzberg notes that the evolution of the engineering role shifts focus toward critical thinking, strategic decision-making, and "evaluation"—a statistical method for assessing AI performance. Beyond technical management, the article highlights how cultural attitudes toward risk influence AI adoption rates across different regions. Ultimately, Zalzberg argues that AI maturity is defined by a balanced approach: leveraging the speed of automation while ensuring that sensitive decisions—such as pricing or critical architecture—are governed by human judgment and a centralized gateway to manage security and costs effectively.

Daily Tech Digest - February 28, 2026

Quote for the day:

"Stories are the single most powerful weapon in a leader's arsenal." -- Howard Gardner

AI ambitions collide with legacy integration problems

Many enterprises have moved beyond experimentation and are preparing for formal deployment. The survey found that 85% have begun adopting AI or expect to do so within the next 12 months. Respondents also reported efforts to formalise AI governance, reflecting greater attention to risk, accountability and oversight. ... Integration sits at the centre of that tension. AI initiatives often depend on clean data, consistent definitions and reliable access across multiple applications, requirements that legacy estates can complicate. The survey links these constraints to compliance risks, including data retention, access controls and auditability across connected systems. ... Security and privacy concerns featured prominently. Data privacy across systems was cited as a top risk by 49% of respondents, while 48% said they were concerned about third parties handling sensitive data. The results highlight the difficulty of managing information flows when AI systems interact with multiple internal applications and external providers. Governance approaches varied. Fewer than half (47%) said board-level reporting forms part of risk management for AI and related technology work, suggesting uneven executive oversight as AI moves into operational settings where incidents can carry regulatory and reputational consequences. ... Despite pressure to move quickly on AI initiatives, respondents said engineering quality remains a priority.

Striking the Right Balance Between Automation and Manual Processes in IT

Rather than thinking of applying AI wherever possible and over-automating, leaders should think about the most beneficial uses of the technology and begin implementation of the technology in those areas first before expanding further. Automation is a powerful tool, but humans are the most powerful tool in the IT stack. Let’s discuss how today’s IT leaders can strike the right balance between automation and manual processes. ... Even with the many benefits of automation, human-led processes still reign supreme in certain areas. For example, optimal IT operations happen at the intersection of tools and teamwork. IT teams must still foster a collaborative culture, working with other departments to ensure cross team visibility and alignment on business goals. While the latest AI technology can help in these efforts, ultimately, humans must do this collaborative work. Team dynamics can also be complex at times. Conflict resolution and major team decisions are not things that automation can solve. Moreover, if there is a critical system issue, DBAs must be able to work with IT leaders to resolve this issue and forge a path forward. Finally, manual processes are often necessitated by convoluted workflows. Many DBA teams have workflows in which every step is a set of if-then-else decisions, with each possible outcome also encumbered with many if-then decisions cascading through multiple levels of decisions.

Translating data science capabilities into business ROI

The fundamental challenge in demonstrating data science ROI is that most analytics infrastructure feels optional until it becomes essential. During normal operations, executives tolerate delays in reporting and gaps in visibility. During a crisis, those same gaps become existential threats. ... The turning point came when I realized we weren’t facing a data problem or a technology problem. We were facing a decision-making problem. Our leadership needed to maintain operational stability for a multi-trillion-dollar asset manager during unprecedented disruption. Every day without visibility meant delayed decisions, missed opportunities, and compounding uncertainty. ... Speed-to-value often trumps technical sophistication. The COVID dashboard taught me this lesson definitively. We could have spent months building a comprehensive data warehouse with sophisticated ETL pipelines and machine learning-powered forecasting. Instead, we focused ruthlessly on the minimum viable solution that executives needed immediately. ... Strategic positioning creates a disproportionate impact. I served as strategic architect for a major product repositioning — a multi-million-dollar initiative essential for our competitive positioning. My data-backed strategies produced immediate, quantifiable market share gains and resulted in substantially larger deal sizes and accelerated acquisition rates that fundamentally altered our market position.

The reliability cost of default timeouts

Many widely used libraries and systems default to infinite or extremely large timeouts. In Java, common HTTP clients treat a timeout of zero as “wait indefinitely” unless explicitly configured. In Python, requests will wait indefinitely unless a timeout is set explicitly. The Fetch API does not define a built-in timeout at all. These defaults aren’t careless. They’re intentionally generic. Libraries optimize for the correctness of a single request because they can’t know what “too slow” means for your system. Survivability under partial failure is left to the application. ... Long timeouts can also mask deeper design problems. If a request regularly times out because it returns thousands of items, the issue isn’t the timeout itself. It’s missing pagination or poor request shaping. By optimizing for individual request success, teams unintentionally trade away system-level resilience. ... A timeout defines where a failure is allowed to stop. Without timeouts, a single slow dependency can quietly consume threads, connections and memory across the system. With well-chosen timeouts, slowness stays contained instead of spreading into a system-wide failure. ... A timeout is a decision about value. Past a certain point, waiting longer does not improve user experience. It increases the amount of wasted work a system performs after the user has already left. A timeout is also a decision about containment. Without bounded waits, partial failures turn into system-wide failures through resource exhaustion: blocked threads, saturated pools, growing queues and cascading latency.

From dashboards to decisions: How streaming data transforms vertical software

For years, the standard for vertical software has been the nightly sync. You collect data all day, run a massive batch job at 2:00 AM, and provide your customers with a clean report the next morning. In a world of 2026, that delay is becoming a liability rather than a best practice. ... Data streaming isn’t just about moving bits faster; it’s about changing the fundamental value proposition of your application. Instead of being a system of record that tells a user what happened, your software becomes a system of agency that tells them what is happening right now. This shift requires a mental move away from static databases toward event-driven architectures. You’re no longer just storing a “state” (like current inventory); you’re capturing every “event” (every scan, every sale, every sensor ping) that leads to that state. ... One of the biggest mistakes I see software leaders make is treating real-time data as a “table stakes” feature that they give away for free. Streaming infrastructure is expensive to run and even more expensive to maintain. If you bake these costs into your standard subscription without a clear monetization strategy, you’ll watch your gross margins shrink as your customers’ data volumes grow. ... When you process data at the edge, you’re also solving the “data gravity” problem. Sending thousands of high-frequency sensor pings from a factory floor to the cloud just to filter out the noise is a waste of bandwidth and money.

MCP leaves much to be desired when it comes to data privacy and security

From a data privacy standpoint, one of the major issues is data leakage, while from a security perspective, there are several things that may cause issues, including prompt injections, difficulty in distinguishing between verified and unverified servers, and the fact that MCP servers sit below typical security controls. ... Fulkerson went on to say that runtime execution is another issue, and legacy tools for enforcing policies and privacy are static and don’t get enforced at runtime. When you’re dealing with non-deterministic systems, there needs to be a way to verifiably enforce policies at runtime execution because the blast radius of runtime data access has outgrown the protection mechanisms organizations have. He believes that confidential AI is the solution to these problems. Confidential AI builds on the properties of confidential computing, which involves using hardware that has an encrypted cache, allowing data and inference to be run inside an encrypted environment. While this helps prove that data is encrypted and nobody can see it, it doesn’t help with the governance challenge, which is where Fulkerson says confidential AI comes in. Confidential AI treats everything as a resource with its own set of policies that are cryptographically encoded. For example, you could limit an agent to only be able to talk to a specific agent, or only allow it to communicate with resources on a particular subnet.

3 Ways OT-IT Integration Helps Energy and Utilities Providers Modernize Grid Operations

Increasingly, energy providers are turning to digital twins to model and simulate critical infrastructure across generation, transmission and distribution environments. By feeding live telemetry from supervisory control and data acquisition systems, intelligent electronic devices and other OT assets into IT-based simulation platforms, utilities can create real-time digital replicas of substations, turbines, transformers and even entire grid segments. This enables teams to test load-balancing strategies, maintenance schedules or DER integrations without disrupting service. ... Private 5G networks offer a compelling alternative. Designed for high reliability and low latency, private 5G can operate effectively in interference-heavy environments such as substations or generation facilities. When paired with TSN, utilities can achieve deterministic, sub-millisecond communication between protection systems, controllers and analytics platforms. ... Federated machine learning allows utilities to train AI models locally at the edge — analyzing equipment performance, detecting anomalies and refining predictive maintenance strategies — without centralizing raw operational data. For industries such as energy and oil, remote sites can run local anomaly detection models tailored to site-specific conditions, while still sharing insights that strengthen enterprisewide safety and operational protocols.

Even if AI demand fades, India need not worry - about data centres

AI pushes rack densities from ~5–10kW to 50–100kW+, making liquid cooling, greater power capacity, and purpose‑built ‘AI‑ready’ Data Centre campuses essential — whether for regional training clusters or dense inference. What makes a Data Centre AI-ready is the ability to support advanced cooling, predictable scalability and direct access to clouds, networks and partners in a sustainable manner. ... In India, enterprises are rapidly adopting hybrid and multi-cloud architectures as they modernise their digital infrastructure. Domestic enterprises, particularly in BFSI and broking, are moving away from in-house data centres toward third-party colocation facilities to gain scalability, efficient interconnection with their required ecosystem, operational efficiency and access to specialised talent. This shift is being further accelerated by distributed AI, hybrid multi-cloud architectures and a growing focus on sustainability. ... India’s Data Centre market is distinctive because of the scale of its digital consumption, combined with the early stage of ecosystem development. India generates a significant share of global data, yet its installed data centre capacity remains comparatively low, creating strong long-term growth potential. This growth is now being amplified by hyperscalers and AI-led demand. India aims to become a USD 1 T digital economy by 2028. It is already making significant progress, supported by the country’s thriving startup ecosystem, the third largest in the world, and initiatives like Startup India.

Surprise! The One Being Ripped Off by Your AI Agent Is You

It’s now happening all the time: in the sale of location data and browsing histories to brokers who assemble and sell our highly personal profiles, and in DOGE’s and other data grabs across the federal government, where housing, tax, and health information is being weaponized for immigration enforcement or misleading voter fraud “investigations.” With AI agents, it just gets worse. Data betrayal is an even more intimate act. Yet the people who granted OpenClaw access to their accounts were making a reasonable choice—to use a powerful tool on their behalf. ... The data aggregation capabilities of AI add another dimension of risk that rarely gets even a mention, but represent a change in scale that adds up to a sea change, making someone marketed as “productivity” software a menacing vector for data weaponization. The same capabilities that make agents useful—synthesizing enormous amounts of information across sources and acting autonomously across platforms with persistence and memory—make them extraordinarily powerful instruments for state surveillance and targeted repression. An autocratic government could build dossiers on dissidents, journalists, or voters from financial records, social media, location data, and communications metadata, acting in real time: micro-targeting people with persuasion campaigns, swarming targets with coordinated social media attacks, engineering entrapment schemes, or flagging individuals based on patterns no court ever authorized.

What makes Non-Human Identities in AI secure

By aligning security goals with technological advancements, NHIs offer a tangible solution to the challenges posed by AI and cloud-based architectures. Forward-thinking organizations are leveraging this strategic advantage to stay ahead of potential threats, ensuring that their digital remain both protected and resilient. ... Can businesses effectively integrate Non-Human Identities across diverse sectors? Where industries such as financial services, healthcare, and travel become increasingly dependent on digital transformation, the need for securing NHIs is paramount. Each sector presents unique challenges and requirements that necessitate tailored approaches to NHI management. In financial services, for example, the emphasis might be on protecting transactional data, while healthcare organizations focus on safeguarding patient information. Thus, versatile solutions that accommodate varying security demands while maintaining robust protection standards are essential. ... What greater role can NHIs play where emerging technologies unfold? The growing intersection of AI and IoT devices creates a complex web of interactions that requires robust security measures. Non-Human Identities provide a framework for securely managing the myriad connections and transactions occurring between devices. In IoT networks, NHIs authenticate and authorize communication between endpoints, thus safeguarding the integrity of both data and operations.

Daily Tech Digest - December 25, 2025

Quote for the day:

"When I dare to be powerful - to use my strength in the service of my vision, then it becomes less and less important whether I am afraid." -- Audre Lorde

Declaring Quantum Christmas Advantage: How Quantum Computing Could Optimize The Holidays

If logistics is about moving stuff, gaming is about moving minds. And quantum computing’s influence here is more playful, at least for now. At the intersection of quantum and gaming, researchers are experimenting with quantum-inspired procedural content generation. Essentially, this is using hybrid quantum-classical approaches to generate game worlds, rules and narratives that are bigger and more complex than traditional methods allow. ... The holiday shopping season — part retail frenzy, part seasonal ritual and part absolute bottom-line need for business survival — is another area where quantum computing’s optimization chops could shine in a future-looking Christmas playbook. Retailers are beginning to explore how quantum optimization could help with workforce scheduling, inventory planning, dynamic pricing, and promotion planning, all classic holiday headaches for brick-and-mortar and online merchants alike, according to a D-Wave report. ... Finally, an esoteric — but perhaps way more festive — application of quantum tech would be using it for holiday analytics and personalization. Imagine real-time gift-recommendation engines that use quantum-accelerated models to process massive datasets instantly, teasing out patterns and preferences that help retailers suggest the perfect present for even the hardest-to-buy-for relative.

How Today’s Attackers Exploit the Growing Application Security Gap

Zero-day vulnerabilities in applications are quite common these days, even in well-supported and mature technologies. But most zero-days aren’t that fancy. Attackers regularly exploit some common errors developers make. A good resource to learn from about this is the OWASP Top 10, which was recently updated to cover the latest application security gaps. The main issue on the list is broken access controls, which happens when the application doesn’t properly enforce who can access what. In reality, this translates into bad actors being able to view or manipulate data and functionality they shouldn’t have access to. Next on the list are security misconfigurations. These are simple to tune, but given the vast number of environments, services, and cloud platforms most applications span, they are difficult to maintain at scale. A common example are exposed admin interfaces, which opens the door to credential-related attacks, particularly brute-forcing. Software supply chain failures add another layer of risk. Modern applications rely heavily on open-source libraries, APIs, packages, container images, and CI/CD components. Any of these can introduce vulnerabilities or malicious code into production. A single compromised dependency can impact thousands of downstream applications. For application developers and enthusiasts, it is highly recommended to study the entries in the OWASP Top 10, along with related OWASP lists such as the API Security Top 10 and emerging AI security guidance.

Data governance key to AI security

Cybersecurity was once built to respond. Today, the response alone is no longer enough. We believe security must be predictive, adaptive, and intelligent. This belief led to the creation of the Digital Vaccine, an evolution of Managed Security Services (MSSP) designed for an AI-first, quantum-ready world. "Much like a biological vaccine, Digital Vaccine continuously identifies new and unknown attack patterns, learns from every attempted breach, and builds defence mechanisms before damage occurs," he explained. The urgency is real, according to the experts, because post-quantum risks will soon render many of today's encryption methods ineffective, exposing sensitive data that was once considered secure. At the same time, AI-powered cyber threats are becoming autonomous, faster, and more targeted-operating at machine speed and scale. ... Almost every AI is built on data. "It is transforming data into knowledge. Once it is learned, we cannot remove it. So what is being fed into the data and LLModels? No governance policies exist as of today," pointed out Krishnadas. Cybersecurity was once built to respond. Today, the response alone is no longer enough. We believe security must be predictive, adaptive, and intelligent. This belief led to the creation of the Digital Vaccine, an evolution of Managed Security Services (MSSP) designed for an AI-first, quantum-ready world.

How the AI era is driving the resurgence in disaggregated storage

As AI workloads surge and accelerated computing takes the center stage, data center architectures and storage systems must keep pace with the increasing demand for memory and compute. Yet, the fast and ever-evolving high-performance computing (HPC) and AI systems have different requirements for the various IT infrastructure hardware components. While they require Central Processing Unit (CPU) and Graphic Processing Unit (GPU) nodes to be refreshed every couple of years to keep up with the AI workload demands, storage solutions like high-capacity HDDs come with longer warranties (up to five years), are therefore built to last several years longer, and don’t need to be refreshed as often. Based on this, more and more organizations are moving storage out of the server and embracing disaggregated infrastructures to avoid wasting resources. ... In the AI era and ZB age, IT leaders need more from their storage systems. They are looking for scalable, low-risk solutions that can evolve with them, delivering an optimized cost per Terabyte ($/TB), better energy-efficiency per TB (kW/TB), improved storage density, high-quality, and trust to perform at scale. Disaggregated storage can be a solution that offers precisely this flexibility of demand-driven scaling to meet the individual requirements of data center workloads and business needs. ... With disaggregated storage, enterprises can embrace AI and HPC while no longer being tethered to HCI architectures.

OpenAI admits prompt injection is here to stay as enterprises lag on defenses

OpenAI, the company deploying one of the most widely used AI agents, confirmed publicly that agent mode “expands the security threat surface” and that even sophisticated defenses can’t offer deterministic guarantees. For enterprises already running AI in production, this isn’t a revelation. It’s validation — and a signal that the gap between how AI is deployed and how it’s defended is no longer theoretical. None of this surprises anyone running AI in production. What concerns security leaders is the gap between this reality and enterprise readiness. ... OpenAI pushed significant responsibility back to enterprises and the users they support. It’s a long-standing pattern that security teams should recognize from cloud shared responsibility models. The company recommends explicitly using logged-out mode when the agent doesn't need access to authenticated sites. It advises carefully reviewing confirmation requests before the agent takes consequential actions like sending emails or completing purchases. And it warns against broad instructions. "Avoid overly broad prompts like 'review my emails and take whatever action is needed,'" OpenAI wrote. "Wide latitude makes it easier for hidden or malicious content to influence the agent, even when safeguards are in place." The implications are clear regarding agentic autonomy and its potential threats. The more independence you give an AI agent, the more attack surface you create.

The 3-Phase Framework for Turning a Cyberattack Into a Strategic Advantage

Typically, a lot of companies will panic and then look for a scapegoat when faced with a crisis. Maersk opted to realize that the root cause of the problem was not just a virus. Leaders accepted that they were bang average in terms of how they handled cybersecurity. The company also accepted that what happened may have been due to a cultural problem internally that needed to be fixed. While malware was a cause of issues, they also understood that their culture played a part, as security was seen as something that IT dealt with and not a core business thing. ... Maersk succeeded in strengthening customer trust and communication as it turned what could have been a defeat into a competitive advantage. Rather than trying to sugarcoat, they were very transparent and quickly informed customers of what was happening in the journey to recovery. Instead of telling customers, “we failed you,” they opted for a stance of “we are being tested, and we are in this together.” ... After a data disaster, your aim should not just be to recover, but you must also aim to build an “antifragile” organization that can come out stronger after a major challenge. An important step is to ensure that you fully internalize the lessons. When Maersk had to act, it did not just fix the problem. Instead, it embedded a new security system into its future planning. Accountability was added to all teams. Resilience should not just be something you aim for or use in a one-time project.

Leadership And The Simple Magic Of Getting Lost

There’s a part of the brain called the hippocampus that’s deeply tied to memory and spatial reasoning. It’s what helps us build internal maps of the world. It helps us recognize patterns, landmarks, distance and direction. It lights up when we have to figure things out for ourselves. When we follow turn-by-turn directions all the time, something subtle shifts. We’re not really navigating anymore. We’re just ... complying. It's efficient, yes. But also quieter, mentally. There’s growing concern among neuroscientists that when we outsource too much of this kind of thinking, we may be weakening one of the core systems tied to memory and long-term brain health. The research is still unfolding. Nothing is fully settled. But there’s enough there that it’s worth paying attention. Because the brain, like the body, works on a simple principle: Use it or lose it. ... This is why, every once in a while, I’ll let myself get a little lost on purpose. Not dangerously. Not recklessly. Just less optimized. I’ll take a different road. Walk through a neighborhood I don’t know. Let the uncertainty stretch a little. Let my brain build the map instead of borrowing one. This is the same skill we build in children when we’re teaching them how to find their way, but inside companies, it shows up as orientation. When you’re facing something unfamiliar—a new market, a hard strategic turn, a problem no one has quite named yet—your job isn’t to hand your team a route. It’s to give them landmarks: Here’s what we know. Here’s what can’t change.

Gen AI Paradox: Turning Legacy Code Into an Asset

Legacy modernization for decades was unglamorous and often postponed until the pain of technical debt surpassed the risks of migration. There is $2.41 trillion in technical debt in the United States alone. Seventy percent of workloads still run on-premises, and 70% of legacy IT software for Fortune 500 companies was developed over 20 years ago. ... It's not just about wishful thinking but is also driven by internal organizational dynamics. When we launched AWS Transform, after processing over a billion lines of code, we estimated it saved customers about 800,000 hours of manual work. But for a CIO, the true measure often relates to capacity. We observe organizations saving up to 80% in manual effort. This doesn't only mean cost reductions, but also avoiding the need to increase headcount for maintenance. For instance, I spoke with a technology leader managing a smaller team of about 200 people. His dilemma was: "Do I invest in building new functions, or do I maintain and modernize?" He told his team he wouldn't add a single person for modernization. They have to use tools to accomplish it. Using these tools, he completed a .NET transformation of 800,000 lines of code in two weeks, a project he estimated would typically take six months. The justification for the CIO is simple: save time and redirect 20% to 30% of the budget previously spent on tech debt toward innovation.

5 stages to observability maturity

The first requirement is coherence. Companies must move away from fragmented tooling and build unified telemetry pipelines capable of capturing logs, metrics, traces, and model signals in a consistent way. For many, this means embracing open standards such as OpenTelemetry and consolidating data sources so AI systems have a complete picture of the environment. ... The second requirement is business alignment. Enterprises that successfully evolve from monitoring to observability, and from observability to autonomous operations, do so because they learn to articulate the relationship between technical signals and business outcomes. Leaders want to understand not just the number of errors thrown by a microservice, but customers affected, the revenue at stake, or the SLA exposure if the issue persists. ... A third element is AI governance. As Nigam says, AI models change character over time, so observability must extend into the AI layer, providing real-time visibility into model behavior and early signs of instability. Companies that rely more heavily on AI must also accept a new operational responsibility to ensure the AI itself remains reliable, auditable, and secure. Finally, organizations must learn to construct guardrails for automation. Casanova and Woodside both say the shift to autonomous operations isn’t an overnight leap but a progressive widening of the boundary between what humans review and what machines handle automatically.

In the race to be AI-first, discipline matters more than speed

In an environment defined by uncertainty, economic volatility, cyber threats, supply-chain shocks, Srivastava believes resilience must be architected deliberately into the IT ecosystem. “We create an ecosystem that is so frugal that even if there are funding cuts or crisis situations, operations continue to run,” he explains. The objective is simple and uncompromising, the business must not stop. Digital initiatives may slow down, but the organisation itself should remain operational, regardless of external disruption. This focus on frugality is not about austerity. It is about discipline. “Resilience is not built when times are good,” Srivastava says. “It’s built when you assume disruption is inevitable.” ... Despite the complexity of modern IT stacks, Srivastava is unequivocal about where the real difficulty lies. “Technology is the easiest piece to crack,” he says. “Digital transformation is one of the most abused terms in the industry. Digital is easy. Transformation is hard.” Enterprises, he notes, are usually successful at acquiring tools, platforms, and licenses. “Everything that money can buy…tools, people, licenses…falls into place,” he says. What money cannot buy, however, is where transformation often breaks down to mindset shifts, adoption, ownership, and behavioural change. This challenge is particularly acute in manufacturing.

Daily Tech Digest - December 04, 2025

Quote for the day:

"The most difficult thing is the decision to act, the rest is merely tenacity." -- Amelia Earhart

Software Supply Chain Risks: Lessons from Recent Attacks

Modern applications are complex tapestries woven from proprietary code, open-source libraries, third-party APIs, and countless development tools. This interconnected web is the , and it has become one of the most critical—and vulnerable—attack surfaces for organizations globally. Supply chain attacks are particularly insidious because they exploit trust. Organizations implicitly trust the code they import from reputable sources and the tools their developers use daily. Attackers have recognized that it's often easier to compromise a less-secure vendor or a widely-used open-source project than to attack a well-defended enterprise directly. Once an attacker infiltrates a supply chain, they gain a "force multiplier" effect. A single malicious update can be automatically pulled and deployed by thousands of downstream users, granting the attacker widespread access instantly. Recent high-profile attacks have shattered the illusion of a secure perimeter, demonstrating that a single compromised component can have catastrophic, cascading effects. ... The era of blindly trusting software components is over. The software supply chain has become a primary battleground for cyberattacks, and the consequences of negligence are severe. By learning from recent attacks and proactively implementing robust security measures like , secure pipelines, and rigorous vendor vetting, organizations can significantly reduce their risk and build more resilient, trustworthy software.

Building Bridges, Not Barriers: The Case for Collaborative Data Governance

The preserves existing structure while improving coordination among teams through shared standards and processes. This is now more critical to be able to take advantage of AI systems. The collaborative model is an alternative with many benefits for organizations whose central governance bodies – like finance, IT, data and risk – operate in silos. Complex digital and data initiatives, as well as regulatory and ethical concerns, often span multiple domains, making close coordination across departments a necessity. While the collaborative data governance model can be highly effective for complex organizations, there are situations where it may not be appropriate. ... Rather than taking a centralized approach to managing data among multiple governance domains, a federated approach allows each domain to retain its authority while adhering to shared governance standards. In other words, local control with organization-wide cohesion. ... The collaborative governance model is a framework that promotes accessible systems and processes to the organization, rather than a series of burdensome checks and red tape. In other words, under this model, data governance is viewed as an enabler, not a blocker. ... Using effective tools such as data catalogs, policy management and collaboration spaces, shared platforms streamline governance processes and enable seamless communication and cooperation between teams.

China Researches Ways to Disrupt Satellite Internet

In an academic paper published in Chinese last month, researchers at two major found that the communications provided by satellite constellations could be jammed, but at great cost: To disrupt signals from the to a region the size of would require 1,000 to 2,000 drones, according to a research paper cited in a report in the South China Morning Post. ... against satellites are being embraced because they pose less risk of collateral damage and are less likely to escalate tensions, says Clayton Swope, deputy director for the at the Center for Strategic and International Studies (CSIS), a Washington, DC-based policy think tank. ... The constellations are resilient to disruptions. The latest research into jamming constellation-satellite networks was published in the Chinese peer-reviewed journal Systems Engineering and Electronics on Nov. 5 with a title that translates to "Simulation research of distributed jammers against mega-constellation downlink communication transmissions," the SCMP reported. ... China is not just researching ways to disrupt communications for rival nations, but also is developing its own constellation technology to benefit from the same distributed space networks that makes Starlink, , and others so reliable, according to the CSIS's Swope.

The Legacy Challenge in Enterprise Data

As companies face extreme complexity with multiple and disparate analytical data assets models owned by the line of business analysts, the decision-making becomes challenging when moving to cloud-based data systems for transformation and migration. Where both options are challenging, this is not a one-size-fits-all solution, and careful consideration is needed when making the decision, as this involves millions of dollars and years of critical work. ... are long journeys, not short projects. Programs typically span 18 to 24 months, cover hundreds of terabytes of data, and touch dozens of business domains. A single cutover is too risky, while endless pilots waste resources. Phased execution is the only sustainable approach. High-value domains are prioritized to demonstrate progress. Legacy and cloud often run in parallel until validation is complete. Automated validation, DevOps pipelines, and AI-assisted SQL conversion accelerate progress. To avoid burnout, teams are structured with a mix of full-time employees who work closely with business users and managed services that provide technical scale. ... Governance must be embedded from the start. Metadata catalogs track lineage and ownership. Automated validation ensures quality at every stage, not just at cutover. Role-based access controls, encryption, and masking enforce compliance.

Through the Looking Glass: Data Stewards in the Realm of Gondor

Data Stewards are sought-after individuals today. I have seen many “data steward” job postings over the last six months and read much discussion about the role in various periodicals and postings. I have always agreed with my editor’s conviction that everyone is a data steward, accountable for the data they create, manage, and use. Nevertheless, the role of data steward, as a job and as a career, has established itself in the view of many companies as essential to improving data governance and management. ... “Information Stewardship” is a concept like and may even predate it, based on my brief survey of articles on these topics. Trevor gives an excellent summary of the essence of stewardship in this context: Stewardship requires the acceptance by the user that the information belongs to the organization as a whole, not any one individual. The information should be shared as needed and monitored for changes in value. ... Data Stewards “own” data, or to be more precise, Data Stewards are responsible for the data owned by the enterprise. If the enterprise is the old-world Lord’s Estate, then the Data Stewardship Team consists of the people who watch over the lifeblood of the estate, including the shepherds who make sure the data is flowing smoothly from field to field, safe from internal and external predators, safe from inclement weather, and safe from disease. ...

Scaling Cloud and Distributed Applications: Lessons and Strategies

Scaling extends beyond simply adding servers. When scaling occurs, the fundamental question is whether the application requires scaling due to genuine customer demand or whether upstream services experiencing queuing issues slow system response. When threads wait for responses and cannot execute, pressure increases on CPU and memory resources, triggering elastic scaling even though actual demand has not grown. ... Architecture must extend beyond documentation. Creating opinionated architecture templates assists teams in building applications that automatically inherit architectural standards. Applications deploy automatically using manifest-based definitions, so that teams can focus on business functionality rather than infrastructure tooling complexities. ... represents a highly effective practice of systematically rebuilding infrastructure each sprint. Automated processes clean up running instances regularly. This approach enhances security by eliminating configuration drift. When drift exists or patches require application, including zero-day vulnerability fixes, all updates can be systematically incorporated. Extended operation periods create stale resources, performance degradation, and security vulnerabilities. Recreating environments at defined intervals (weekly or bi-weekly) occurs automatically.

Why Synthetic Data Will Decide Who Wins the Next Wave of AI

Why is suddenly so important? The simple answer is that AI has begun bumping into a glass ceiling. Real-world data doesn’t extend far enough to cover all the unlikely edge cases or every scenario that we want our models to live through. Synthetic data allows teams to code in the missing parts directly. Developers construct situations as needed. ... Building synthetic data holds the key to filling the gap when the quality or volume of data needed by AI models is not good enough, but the process to create this data is not easy. Behind the scenes, there’s an entire stack working together. We are talking about simulation engines, generative models like and , large language models (LLMs) for text-based domains. All this creates virtual worlds for training. ... The organizations most affected by the growing need for synthetic data are those that operate in high-risk areas where there is no actual data, or the act of finding it is inefficient. Think of fully autonomous vehicles that can’t simply wait for every dangerous encounter to occur in traffic. Doctors working on a cure for rare diseases but can’t call on thousands of such cases. Trading firms that can’t wait for just the right market shock for their AI models. These teams can turn synthetic data to give them a lesson from situations that are simply not possible (or practical) in real life.

How ABB’s Approach to IT/OT Ensures Cyber Resilience

The convergence of IT and OT creates new vulnerabilities as previously isolated control systems now require integration with enterprise networks. ABB addresses this by embedding security architecture from the start rather than retrofitting it later. This includes proper network segmentation, validated patching protocols and granular access controls that enable safe data connectivity while protecting operational technology. ... On the security front, AI-driven monitoring can identify anomalous patterns in network traffic and system behavior that might indicate a breach attempt, spotting threats that traditional rule-based systems would miss. However, it's crucial to distinguish between embedded AI and . Embedded AI in our products optimises processes with predictable, explainable outcomes. This same principle applies to security: AI systems that monitor for threats must be transparent in how they reach conclusions, allowing security teams to understand and validate alerts rather than trusting a black box. ... Secure data exchange protocols, multi-factor authentication on remote access points and validated update mechanisms all work together to enable the connectivity that require while maintaining security boundaries. The key is recognising that digital transformation and security are interdependent. Organisations investing millions in AI, digital twins or automation while neglecting cybersecurity are building on sand.

Building an MCP server is easy, but getting it to work is a lot harder

"The true power of remote MCP is realized through centralized '' where these servers are registered and managed. This model delivers the essential guardrails that enterprises require," Shrivastava said. That said, agent gateways do come with their own caveats. "While gateways provide security, managing a growing ecosystem of dozens or even hundreds of registered MCP tools introduces a new challenge: orchestration," he said. "The most scalable approach is to add another layer of abstraction: organizing toolchains into 'topics' based on the 'job to be done.'" ... "When a large language model is granted access to multiple external tools via the protocol, there is a significant risk that it may choose the wrong tool, misuse the correct one, or become confused and produce nonsensical or irrelevant outputs, whether through classic hallucinations or incorrect tool use," he explained. ... MCP's scaling limits also present a huge obstacle. The scaling limits exist "because the protocol was never designed to coordinate large, distributed networks of agents," said James Urquhart, field CTO and technology evangelist at , a provider of products that orchestrate and deploy autonomous AI agents. MCP works well in small, controlled environments, but "it assumes instant responses between agents," he said -- an unrealistic expectation once systems grow and "multiple agents compete for processing time, memory or bandwidth."

The quantum clock is ticking and businesses are still stuck in prep mode

The report highlights one of the toughest challenges. Eighty one percent of respondents said their crypto libraries and hardware security modules are not prepared for . Many use legacy systems that depend on protocols designed long before quantum threats were taken seriously. Retrofitting these systems is not a simple upgrade. It requires changes to how keys are generated, stored and exchanged. Skills shortages compound the problem. Many security teams lack experience in testing or deploying post quantum algorithms. Vendor dependence also slows progress because businesses often cannot move forward until external suppliers update their own tooling. ... Nearly every organization surveyed plans to allocate budget toward post quantum projects within the next two years. Most expect to spend between six and ten percent of their cybersecurity budgets on research, tooling or deployment. Spending levels differ by region. More than half of plan to invest at least eleven percent, far higher than the and . ... Contractual requirements from customers and partners are seen as the strongest motivator for adoption. Industry standards rank near the top of the list across most sectors. Many respondents also pointed to upcoming regulations and mandates as drivers. Security incidents ranked surprisingly low in the US, suggesting that market and policy signals hold more influence than hypothetical attack scenarios.

Daily Tech Digest - October 28, 2025

Quote for the day:

"Ideas are easy, implementation is hard." -- Guy Kawasaki

India’s AI Paradox: Why We Need Cloud Sovereignty Before Model Sovereignty

As is clear, cloud sovereignty is the new pillar supporting national security and having control over infrastructure, data, and digital operations. It has the capacity to safeguard the country’s national interests, including (but not limited to) industrial data, citizen information, and AI workloads. For India, specifically, building a sovereign digital infrastructure guarantees continuity and trust. It gives the country power to enforce its own data laws, manage computing resources for homegrown AI systems, and stay insulated from the tremors of foreign policy decisions or transnational outages. It’s the digital equivalent of producing energy at home—self-reliant, secure, and governed by national priorities. ... Sovereign infrastructure is less a matter of where data sits and more about who controls it and how securely it is managed. With connected systems, AI workloads spread across networks. This makes it imperative for security to be built into every layer and stage. As systems grow more connected and AI workloads spread across networks, security needs to be built into every layer of technology, not added as an afterthought. That’s where edge computing and modern cloud-security frameworks come in. ... There is a real cost involved in neglecting cloud sovereignty. If our AI models continue to depend upon infrastructure that lies outside our jurisdiction, any changes in foreign regulations might suddenly restrict access to critical training datasets.

Do CISOs need to rethink service provider risk?

Security leaders face mounting pressure from boards to provide assurance about third-party risks, while services provider vetting processes are becoming more onerous — a growing burden for both CISOs and their providers. At the same time, AI is becoming integrated into more business systems and processes, opening new risks. CISOs may be forced to rethink their vetting processes with partners to maintain a focus on risk reduction while treating partnerships as a shared responsibility. ... When looking to engage a services provider, his vetting process starts with building relationships first and then working towards a formal partnership and delivery of services. He believes dialogue helps establish trust and transparency and underpin the partnership approach. “A lot of that is ironed out in that really undocumented process. You build up those relationships first, and then the transactional piece comes after that.” ... “If your questions stop once the form is complete, you’ve missed the chance to understand how a partner really thinks about security,” Thiele says. “You learn a lot more from how they explain their risk decisions than from a yes/no tick box.” Transparency and collaboration are at the heart of stronger partnerships. “You can’t outsource accountability, but you can become mature in how you manage shared responsibility,” Thiele says. ... With AI, Cruz has started to monitor vendors acquiring ISO 42001 certification for AI governance. “It’s a trend I’m seeing in some of the work that we’re doing,” she says.

The Silent Technical Debt: Why Manual Remediation Is Costing You More Than You Think

A far more challenging and costly form of this debt has silently embedded itself into the daily operations of nearly every software development team, and most leaders don’t even have a line item for it. This liability is remediation debt: The ever-growing cost of manually fixing vulnerabilities in the open source components that form the backbone of modern applications. For years, we’ve accepted this process as a necessary chore. A scanner finds a flaw, an alert is sent, and a developer is pulled from their work to hunt down a patch. ... The complexity doesn’t stop there. The report reveals that 65% of manual remediation attempts for a single critical vulnerability require updating at least five additional “transitive” dependencies, or a dependency of a dependency. This is the dreaded “dependency conundrum” that developers lament, where fixing one problem creates a cascade of new compatibility issues. ... It’s time to reframe our way of dealing with this: the goal is not just to find vulnerabilities faster but to remediate them instantly. The path forward lies in shifting from manual labor to intelligent remediation. This means evolving beyond tools that simply populate dashboards with problems and embracing platforms that solve them at their source. Imagine a system where a vulnerability is identified, and instead of creating a ticket, the platform automatically builds, tests, and delivers a fully patched and compatible version of the necessary component directly to the developer.

AI Isn’t Coming for Data Jobs – It’s Coming for Data Chaos

Data chaos arises when organizations lose control of their information landscape. It’s the confusion born from fragmentation, duplication, and inconsistency when multiple versions of “truth” compete for authority. Poor data quality and disconnected data governance processes often amplify this chaos. This chaos manifests as conflicting reports, inaccurate dashboards, mismatched customer profiles, and entire departments working from isolated datasets that refuse to align. ... Recent industry analyses reveal an accelerating imbalance in the data economy. While nearly 90% of the world’s data has been generated in just the past two years, data professionals and data stewards represent only about 3% of the enterprise workforce, creating a widening gap between information growth and the human capacity to govern it. ... Data chaos doesn’t just strain systems, it strains people. As enterprises struggle to keep pace with growing data volume and complexity, the very professionals tasked with managing it find themselves overwhelmed by maintenance work. ... When applied strategically, AI can transform the data management lifecycle from ingestion to governance reducing human toil and freeing engineers to focus on design, quality, and strategy. Paired with an intelligent data catalog, these systems make information assets instantly discoverable and reusable across business domains. AI-driven data classification tools now tag, cluster, and prioritize assets automatically, reducing manual oversight.

Why IT projects still fail

Failure today means an IT project doesn’t deliver expected benefits, according to CIOs, project leaders, researchers, and IT consultants. Failure can also mean a project doesn’t produce returns, runs so late as to be obsolete when completed, or doesn’t engage users who then shun it in response. ... IT leaders and now business leaders, too, get enamored with technologies, despite years of admonishments not to do so. The result is a misalignment between the project objectives and business goals, experienced CIOs and veteran project managers say. ... Stettler says a business owner with clear accountability is needed to ensure that business resources are available when required as well as to ensure process changes and worker adoption happen. He notes that having CIOs — instead of a business owner — try to make those things happen “would be a tail-wagging-the-dog scenario.” ... “Executives need to make more time and engage across all levels of the program. They can’t just let the leaders come talk to them. They need to do spot checks and quality reviews of deliverable updates, and check in with those throughout the program,” Stettler says. “And they have to have the attitude of ‘Bring stuff to me when I can be helpful.’” ... Phillips acknowledges that project teams don’t usually overlook entire divisions, but they sometimes fail to identify and include all the stakeholders they should in the project process. Consequently, they miss key requirements to include, regulations to consider, and opportunities to capitalize on.

The Human Plus AI Quotient: Inside Ascendion's strategy to make AI an amplifier of human talent

Technical skills evolve—mainframes lasted forty years, client-server about twenty, and digital waves even less. Skills will come and go, so we focus on candidates with a strong willingness to learn and invest in themselves. That’s foundational. What’s changed now is the importance of being open to AI. We don’t require deep AI expertise at the outset, but we do look for those who are ready to embrace it. This approach explains why our workforce is so quick to adapt to AI—it’s ingrained in how we hire and develop our people. ... The war for talent has always existed—it’s just the scale and timing that change. For us, the quality of work and the opportunities we provide are key to retention. Being fundamentally an AI-first company is a big differentiator, and our “AI-first” mindset is wired into our DNA. Our employees see a real difference in how we approach projects, always asking how AI can add value. We’ve created an environment that encourages experimentation and learning, and the IP our teams develop—sometimes even around best practices for AI adoption—becomes part of our organisational knowledge base. ... The good news is that for a large cross-section of the workforce, "skilling in AI" is not about mastery of mathematics; it's about improving English writing skills to prompt effectively. We often share prompt libraries with clients because the ability to ask the right question and interpret the output is a significant win.

Recruitment Class: What CIOs Want in Potential New Hires

Candidates should be comfortable operating in a very complex, deep digital ecosystem, Avetisyan said. Now, digital fluency means much more than knowing how to use a certain tool that is currently popular, including AI tools. There needs to be an awareness of the broader implications and responsibilities that come with implementing AI. "It's about integrating AI responsibly and designing for accessibility," Avetisyan said -- both of which represent big challenges that must be tackled and kept continuously top of mind. AI should elevate user experiences. ... There's still a need to demonstrate technical skills with human skills such as problem-solving, communication, and ethical awareness, she said. "You can't just be an exceptional coder and right away be effective in our organization if you don't understand all these other aspects," she said. One more thing: While vibe coding -- letting AI shoulder much or most of the work -- is a buzzy concept, she said she is not ready to turn her shop of developers into vibe coders. A more grounded approach to teaching AI fluency is -- or should be -- the educational mission. ... As for programming? A programmer is still a programmer, but the job has evolved to become more strategic, Ruch said. Technical talent will be needed; however, the first few revisions of code will be pre-written based on the specifications given to AI, he said.

Do programming certifications still matter?

“Certifications are shifting from a checkbox to a compass. They’re less about proving you memorized syntax and more about proving you can architect systems, instruct AI coding assistants, and solve problems end-to-end,” says Faizel Khan, lead AI engineer at Landing Point, an executive search and recruiting firm. ... Certifications really do two things, Khan adds. “First, they force you to learn by doing,” he says. “If you’re taking AWS Solutions Architect or Terraform, you don’t pass by guessing—you plan, build, and test systems. That practice matters. Second, they act as a public signal. Think of it like a micro-degree. You’re not just saying, ‘I know cloud.’ You’re showing you’ve crossed a bar that thousands of other engineers recognize.” But there are cons, too. “In tech, employers don’t just want credentials, they want proof you can deliver,” says Kevin Miller, CTO at IFS. “Programming certifications can be a valuable indicator of your baseline knowledge and competencies, especially if you’re early in your career or pivoting into tech, but their importance is dwindling.” ... “I’m more interested in a candidate’s attitude and aptitude: what problems they’ve solved, what they’ve built, and how they’ve approached challenges,” Watts says. “Certifications can show commitment and discipline, and they’re especially useful in highly specialized roles. But I’m cautious when someone presents a laundry list of certifications with little evidence of real-world application.”

Guarding the Digital God: The Race to Secure Artificial Intelligence

Securing an AI is fundamentally different from securing a traditional computer network. A hacker doesn’t need to breach a firewall if they can manipulate the AI’s “mind” itself. The attack vectors are subtle, insidious, and entirely new. ... The debate over whether people or AI should lead this effort presents a false choice. The only viable path forward is a deep, symbiotic partnership. We must build a system where the AI is the frontline soldier and the human is the strategic commander. The guardian AI should handle the real-time, high-volume defense: scanning trillions of data points, flagging suspicious queries, and patching low-level vulnerabilities at machine speed. The human experts, in turn, must set the strategy. They define the ethical red lines, design the security architecture, and, most importantly, act as the ultimate authority for critical decisions. If the guardian AI detects a major, system-level attack, it shouldn’t act unilaterally; it should quarantine the threat and alert a human operator who makes the final call. ... The power of artificial intelligence is growing at an exponential rate, but our strategies for securing it are lagging dangerously behind. The threats are no longer theoretical. The solution is not a choice between humans and AI, but a fusion of human strategic oversight and AI-powered real-time defense. For a nation like the United States, developing a comprehensive national strategy to secure its AI infrastructure is not optional.

Managing legacy medical devices that can no longer be patched

First, hospitals need to recognize that it is rarely possible to instantaneously remove a medical device, but what you can do is build a wall around that device so that only trusted, validated network traffic will be able to reach the device. Secondly, close collaboration with vendors is critical to understand available upgrade paths. Most vendors don’t want customers running legacy technologies that heighten security risk. From my perspective, if a device is too old to be secured, that’s a serious concern. Collaborate with your providers early and be transparent about budget and timeline constraints. This enables vendors to design a phased roadmap for replacing legacy systems, steadily reducing security risk over time. ... We can take a cue from manufacturing, where cyber resilience is essential to limiting the impact of attacks on the production line and broader ecosystem. No single breach should be able to bring down the entire operation. Yet many organizations still run forgotten, outdated systems. It’s critical to retire legacy assets, streamline the environment, and continuously identify and manage risk. ... We’ve seen meaningful progress when dozens of technology vendors pledged to self-regulate and build cyber resilience into their products from the outset. Unfortunately, that momentum has slowed. In my experience, however, the strongest gains often come from non‑legislative, industry‑led initiatives, when organizations voluntarily choose to prioritize security.