Daily Tech Digest by Kannan Subbiah: managed services

Showing posts with label managed services. Show all posts

Daily Tech Digest - April 26, 2026

Quote for the day:

“The greatest leader is not necessarily the one who does the greatest things. He is the one that gets the people to do the greatest things.” -- Ronald Reagan

🎧 Listen to this digest on YouTube Music

▶ Play Audio Digest

Duration: 19 mins • Perfect for listening on the go.

Where to begin a cloud career

Starting a career in often seems daunting due to perceived barriers like expensive boot camps and complex certifications, but David Linthicum argues that the best entry point is actually through free foundational courses. These no-cost resources allow beginners to gain essential orientation, learning vital concepts such as infrastructure, elasticity, and governance without financial risk. Major providers like , , and offer these learning paths to cultivate a skilled ecosystem of future professionals. By utilizing these introductory materials, learners can compare different platforms to see which best aligns with their career goals — such as choosing Azure for enterprise Windows environments or AWS for startup versatility — before committing to a specific specialization. Linthicum emphasizes that these courses provide a structured progression from broad terminology to mental models, which is more effective than jumping straight into technical tools. Furthermore, he highlights that cloud careers are accessible even to those without coding backgrounds, including roles in security, project delivery, and business analysis. The ultimate strategy is to treat free courses as a launchpad for momentum; by finishing introductory training across multiple providers, aspiring professionals can build the necessary breadth and confidence to pursue more advanced hands-on labs and role-based certifications later.

Cybersecurity Risks Related to the Iran War

In the article "Cybersecurity Risks Related to the Iran War," authors Craig Horbus and Ryan Robinson explore how modern geopolitical tensions between Iran, the United States, and Israel have expanded into a parallel digital battlefield. As conventional military operations escalate, cybersecurity experts and regulators warn that financial institutions and critical infrastructure are facing heightened risks from state-sponsored actors and affiliated hacktivists. Groups like "Handala" have already demonstrated their disruptive capabilities by targeting energy companies and medical providers, using techniques such as , data-wiping malware, and sophisticated phishing campaigns. These adversaries target the financial sector primarily to cause widespread economic instability, erode public confidence, and secure funding for hostile activities through fraudulent transfers or ransomware. Consequently, regulatory bodies like the New York Department of Financial Services are urging institutions to adopt more robust cyber resilience strategies. This includes intensifying network monitoring, enhancing authentication protocols, and strengthening third-party vendor risk management. The article emphasizes that cybersecurity is no longer merely a technical IT concern but a critical legal and strategic obligation. Ensuring that incident response plans can withstand nation-state level threats is essential for maintaining global economic stability in an increasingly volatile digital landscape where physical conflicts and cyber warfare are now inextricably linked.

Vector Database - A Deep Dive

represent a specialized class of data management systems engineered to efficiently store, index, and retrieve high-dimensional vector embeddings, which are numerical representations of unstructured data like text, images, and audio. Unlike traditional relational databases that rely on exact keyword matches and structured schemas, vector databases leverage the "meaning" of data by measuring the mathematical distance between vectors in a multi-dimensional space. This enables powerful semantic search capabilities where the system identifies items with conceptual similarities rather than just literal overlaps. At their core, these databases utilize embedding models to transform raw information into dense vectors, which are then organized using specialized indexing algorithms such as Hierarchical Navigable Small World (HNSW) or Inverted File Index (IVF). These techniques facilitate Approximate Nearest Neighbor (ANN) searches, allowing for rapid retrieval across billions of data points with minimal latency. Consequently, vector databases have become the foundational "long-term memory" for modern AI applications, particularly in Retrieval-Augmented Generation (RAG) workflows and recommendation engines. By bridging the gap between raw unstructured data and machine-interpretable context, they empower developers to build intelligent, scalable systems that can understand and process information at a more human-like level of nuance and complexity, while handling massive datasets through horizontal scaling and efficient sharding strategies.

Reimagining tech infrastructure for (and with) agentic AI

The rapid evolution of agentic AI is compelling chief technology officers to fundamentally reimagine IT infrastructure, moving beyond traditional support layers toward a modular, "mesh-like" backbone that orchestrates autonomous agents. As AI workloads expand, organizations face a critical dual challenge: infrastructure costs are projected to triple by 2030 while budgets remain stagnant, necessitating a shift where AI is used to manage the very systems it inhabits. Successfully scaling agentic AI requires building "agent-ready" foundations characterized by composability, secure APIs, and robust governance frameworks that ensure accountability. High-value impacts are already surfacing in areas like service desk operations, observability, and hosting, where agents can automate up to 80 percent of routine tasks, potentially reducing run-rate costs by 40 percent. This transition demands a significant cultural and operational pivot, shifting the role of IT professionals from manual ticket-based troubleshooting to the supervision and architectural design of intelligent systems. By integrating these autonomous entities into a coherent backbone, enterprises can bridge the gap between experimentation and enterprise-wide scale, transforming infrastructure from a reactive cost center into a dynamic platform for innovation. Those who embrace this agentic shift will secure a significant advantage in speed, resilience, and economic efficiency in the AI-driven era.

Quantum-Safe Security: How Enterprises Can Prepare for Q-Day

The provided page explores the critical necessity for enterprises to transition toward to mitigate the existential threats posed by future quantum computers. Traditional encryption methods, such as RSA and ECC, are increasingly vulnerable to advanced quantum algorithms, most notably , which can efficiently solve the complex mathematical problems that currently protect digital infrastructure. A particularly urgent concern highlighted is the "harvest now, decrypt later" strategy, where adversaries collect encrypted sensitive data today with the intention of deciphering it once powerful quantum technology becomes commercially available. To defend against these emerging risks, the article outlines a strategic preparation roadmap for organizations. This involves achieving "crypto-agility"—the ability to rapidly switch cryptographic standards—and conducting comprehensive inventories of current encryption usage across all systems. Furthermore, enterprises are encouraged to align with evolving standards for post-quantum cryptography (PQC) and prioritize the protection of high-value, long-term assets. By integrating these quantum-resistant algorithms into their security architecture now, businesses can ensure long-term data confidentiality, maintain regulatory compliance, and future-proof their digital operations against the impending "quantum apocalypse." This proactive shift is presented not merely as a technical update, but as a fundamental requirement for maintaining trust and operational continuity in a post-quantum world.

Your Disaster Recovery Plan Doesn’t Account for AI Agents. It Should

The article "Your Disaster Recovery Plan Doesn’t Account for AI Agents. It Should" highlights a critical gap in contemporary business continuity strategies as enterprise adoption of agentic AI accelerates. While Gartner predicts a massive surge in AI agents embedded within applications by 2026, many organizations still rely on legacy governance frameworks that operate at human speeds. These traditional models are ill-equipped for autonomous agents that execute thousands of data accesses instantly, often bypassing standard security alerts. Unlike traditional technical failures with clear timestamps, AI governance failures are often "silent," characterized by over-permissioned agents accessing sensitive datasets over long periods. This leads to an exponential increase in the "blast radius" of potential breaches across cloud and on-premises environments. To mitigate these risks, the author advocates for machine-speed governance that utilizes dynamic, context-aware access controls and just-in-time permissions. By embedding governance directly into the architecture, organizations can transform it from a deployment bottleneck into a recovery accelerant. Such an approach provides the immutable audit trails necessary to drastically reduce the 100-day recovery window typically associated with AI-related incidents. Ultimately, robust governance is presented not as a constraint, but as a prerequisite for sustaining resilient AI innovation.

Cloud Native Platforms Transforming Digital Banking

The financial services industry is undergoing a profound structural revolution as traditional banks transition from rigid, monolithic legacy systems to agile, cloud-native architectures. This shift is centered on the adoption of microservices and containerization, allowing institutions to break down complex applications into independent, modular components. Such an approach enables rapid deployment of updates and innovative fintech services without disrupting core operations, ensuring established banks can effectively compete with nimble startups. Beyond mere speed, cloud-native platforms offer superior security through "" models and immutable infrastructure, which mitigate risks like configuration errors and persistent malware. Furthermore, the integration of open banking APIs and real-time payment processing transforms banks into central hubs within a broader digital ecosystem, providing customers with instant, seamless financial experiences. The scalability of the cloud also provides a robust foundation for Artificial Intelligence, facilitating hyper-personalized "predictive banking" that anticipates user needs. Ultimately, by embracing cloud computing, financial institutions are not only automating compliance through "Policy as Code" but are also building a flexible, future-proof foundation capable of incorporating emerging technologies like blockchain and quantum computing to meet the demands of the modern global economy.

Turning security into a story: How managed service providers use reporting to drive retention and revenue

Managed Service Providers (MSPs) often face the challenge of proving their value because effective cybersecurity is inherently "invisible," resulting in an absence of security breaches that customers may interpret as a lack of necessity for the service. To bridge this gap, MSPs must transition from providing raw technical data to crafting a compelling narrative through strategic reporting. As highlighted by the experiences of industry professionals using SonicWall tools, the core of a successful MSP practice relies on five pillars: monitoring, patch management, configuration oversight, alert response, and, most importantly, reporting. By utilizing automated platforms like Network Security Manager (NSM) and Capture Client, MSPs can produce detailed assessments and audit trails that make their backend efforts tangible to clients. Moving beyond monthly logs to implement Quarterly Business Reviews (QBRs) allows providers to transition from mere vendors to trusted strategic advisors. This shift significantly impacts business outcomes; for instance, MSPs employing regular QBRs often see renewal rates jump from 71% to 96%. Ultimately, by structuring services into clear tiers with documented deliverables, MSPs can use reporting to tell a story of protection. This strategy not only justifies current expenditures but also drives new revenue by fostering client trust and highlighting unmet security needs.

Cybersecurity in the AI age: speed and trust define resilience

In the rapidly evolving digital landscape, cybersecurity has transitioned from a technical hurdle to a strategic imperative where speed and trust are the cornerstones of resilience. According to insights from iqbusiness, the "breakout time" for e-crime—the window an attacker has to move laterally within a system—has plummeted from nearly ten hours in 2019 to just 29 minutes today, necessitating near-instantaneous responses. This urgency is exacerbated by artificial intelligence, which serves as a double-edged sword; while it empowers attackers to craft sophisticated phishing campaigns and malicious code, it also provides defenders with automated tools to filter noise and prioritize threats. However, the rise of "shadow AI" and a lack of visibility into unsanctioned tools pose significant risks to data integrity. To combat these threats, the article advocates for a "Zero Trust" architecture—where every interaction, whether by human or machine, is verified—and the adoption of robust frameworks like the NIST Cybersecurity Framework 2.0. Ultimately, modern cyber resilience depends on more than just defensive technology; it requires a proactive organisational culture, strong leadership, and the seamless integration of AI into security strategies. By prioritising visibility and governance, businesses can navigate the complexities of the AI age while maintaining the trust of their stakeholders and partners.

Architecture strategies for monitoring workload performance

Monitoring for performance efficiency within the Azure Well-Architected Framework is a critical process focused on observing system behavior to ensure optimal resource utilization and responsiveness. This discipline involves a continuous cycle of collecting, analyzing, and acting upon telemetry data to detect performance bottlenecks before they impact end users. Effective monitoring begins with comprehensive instrumentation, which captures diverse data points such as metrics, logs, and distributed traces from both the application and underlying infrastructure. By establishing clear performance baselines, architects can define what constitutes "normal" behavior, allowing them to identify subtle degradations or sudden spikes in resource consumption. Azure provides powerful tools like Azure Monitor and Application Insights to facilitate this visibility, offering capabilities for real-time alerting and deep-dive diagnostic analysis. Key metrics, including throughput, latency, and error rates, serve as essential indicators of system health. Furthermore, a robust monitoring strategy emphasizes the importance of historical data for long-term trend analysis and capacity planning, ensuring that the architecture can scale effectively to meet evolving demands. Ultimately, performance monitoring is not a one-time setup but an ongoing practice that informs optimization efforts, validates architectural changes, and maintains a high level of efficiency throughout the entire software development lifecycle.

Daily Tech Digest - January 02, 2026

Quote for the day:

“If your ship doesn’t come in, swim out to meet it!” -- Jonathan Winters

Delivering resilience and continuity for AI

Think of it as , suggests as most enterprises underestimate the strain AI puts on connectivity and compute. won’t deliver what AI needs and CIOs need to think about these and other things in a more integrated way to make AI successful. “You have to look at your , , , and ,” he says. “If you have environments not set up for highly transactional, GPU-intensive environments, you’re going to have a problem,” Saroff warns. “And having very fragmented infrastructure means you need to pull data and integrate multiple different systems, especially when you start to look at agentic AI.” ... Making AI scale will almost certainly mean taking a hard look at your . Every database adds features for AI. And lakehouses promise you can bring operational data and analytics together without affecting the SLAs of production workloads. Or you can go further with data platforms like Azure Fabric that bring in to use for AI applications. If you’ve already tried different approaches, you likely need to rearchitect your data layer to get away from the operational sprawl of fragmented , where every data hand-off between separate vector stores, , and introduces latency and governance gaps. Too many points of failure make it hard to deliver high availability guarantees.

Technological Disruption: Strategic Inflection Points From 2026 - 2036

From a defensive standpoint, will provide continuous surveillance, , and at a scale unattainable by human analysts. Simultaneously, attackers will utilize AI to create , execute , and exploit holes at machine speed. The outcome will be an environment where cyber war progresses more rapidly than conventional command-and-control systems can regulate. As we approach 2036, the primary concern will be rather than AI capacity. ... From 2026 to 2030, enterprises will increasingly recognize that is vital. The move to post-quantum cryptography standards means that old systems, especially those in critical infrastructure, financial services, and government networks, need to be fully inventoried, evaluated, and upgraded. By the early 2030s, will transcend cryptography, impacting optimization, materials science, logistics, and national security applications. ... In the forthcoming decade, will transition from compliance-based evaluations to ongoing risk intelligence. Transparency methods, including software bills of materials, , and real-time , will evolve into standard expectations rather than just best practices. Supply chain resilience will strategically impact national competitiveness.

True agentic AI is years away - here's why and how we get there

We're not there yet. We're not even close. Today's bots are limited to chat interactions and often fail outside that narrow operating context. For example, what Microsoft calls an "agent" in the Microsoft 365 productivity suite, probably the best-known instance of an agent, is simply a way to automatically generate a Word document. Market data shows that agents haven't taken off. ... Simple automations can certainly bring about benefits, such as assisting a call center operator or rapidly handling numerous invoices. However, a growing body of scholarly and technical reports has highlighted the limitations of today's agents, which have failed to advance beyond these basic automations. ... Before agents can live up to the "fully autonomous code" hype of Microsoft and others, they must overcome two primary technological shortcomings. Ongoing research across the industry is focused on these two challenges: Developing a approach to designing agents; and Re-engineering AI's use of memory -- not just memory chips such as , but the whole phenomenon of storing and retrieving information. Reinforcement learning, which has been around for decades, has demonstrated striking results in enabling AI to carry out tasks over a very long time horizon. ... On the horizon looms a significant shift in reinforcement learning itself, which could be a boon or further complicate matters. Can AI do a better job of designing reinforcement learning than humans?

Why Developer Experience Matters More Than Ever in Banking

Effective AI assistance, in fact, meets developers where they are—or where they work. Some prefer a , others live inside an , and still others rely heavily on sample code and . A strong supports all of these modes, using AI to surface accurate, context-aware guidance without forcing developers into a single workflow. When AI reinforces clarity, it becomes a force multiplier. ... As AI-assisted development becomes more common, the quality of documentation takes on new importance. Because it is no longer read only by humans, documentation increasingly serves as the knowledge base that enables AI agents that help developers search, generate, and validate code. When documentation is vague or poorly structured, it introduces confusion, often in ways that actively undermine developer confidence. ... In highly regulated environments, developers want, and expect, guardrails—but not at the expense of speed and consistency. One of the most effective ways to balance those demands is by codifying business rules and compliance requirements directly into the platform, rather than relying on manual, human-driven review at key milestones. Talluri describes this approach as “”: embedding rules, validations, and regional requirements into the system so developers receive immediate, actionable prompts and feedback as they work. ... The business case for exceptional developer experience rests on a simple truth: trust drives productivity.

AI-powered testing for strategic leadership

Nearly half of teams still release untested code due to time pressure, creating fragile systems and widening risk exposure. further compound this, making modernisation difficult and slowing down automated validation,” he said. also introduces new vulnerabilities. Without strong validation pipelines, testing quickly becomes the bottleneck of transformation. Developers often view testing as tedious, and with modern codebases spanning multiple interconnected applications, the challenge intensifies. At the same time, misalignment between leadership and engineering teams leads to unclear priorities and rushed decisions. While the pace of development already feels fast, it is only set to accelerate. To overcome barriers, CIOs can adopt that reduces dependence on fragile code-level automation and cuts ongoing maintenance. This approach can reduce manual effort by 80%–90% and enables non-technical experts to participate through . For Wong, strong governance is vital. This entails that avoids hallucinations and supports safe, transparent validation. Instead of becoming autonomous, AI can act as a co-pilot working alongside developers. “By aligning teams, modernising toolchains, and embedding guardrails, CIOs can shift from reactive firefighting to proactive, AI-driven quality engineering,” he said.

The Architect’s Dilemma: Choose a Proven Path or Pave Your Own Way?

Platforms and frameworks are like paved roads that may help a team progress faster on their journey, with well-defined "exit ramps" or extension points where a team can extend the platform to meet their needs, but they come with side-effects that may make them undesirable. Teams need to decide when, if ever, they need to leave the path others have paved and find their own way by developing extensions to the platform or framework, or by developing new platforms or frameworks. The challenge teams face when they use platforms or frameworks as the basis for their software architectures is to choose the "paved road" (platform or framework) that gets them closest to their desired destination with minimal diversions or new construction. ... Many platform decisions are innocuous and can be accepted and ignored when they don’t affect the that the team needs to meet. The only way to know whether the decisions are harmful is through experiments that expose when the platform is failing to meet the goals of the system. Since the decisions made by the platform developers are often undocumented and/or unknowable, it’s imperative that teams be able to test their system (including the platforms on which they are built) to make sure that their architectural goals (i.e. QARs) are being met. ... Using the "paved road" metaphor, the provides a proven path but it does not take the team where they need to go. When this happens, they have no choice but to either start extending the platform (if they can), finding a different platform, or building their own platform.

Supply chains, AI, and the cloud: The biggest failures (and one success) of 2025

By compromising a single target with a large number of downstream users—say a cloud service or maintainers or developers of widely used open source or proprietary software—attackers can infect potentially millions of the target’s downstream users. ... Another significant security story cast both and as the villains. Both companies were caught exploiting an Android weakness that allowed them to de-anonymize visitors so years of their browsing histories could be tracked. The covert tracking—implemented in the Meta Pixel and Yandex Metrica trackers—allowed Meta and Yandex to bypass core security and privacy protections provided by both the Android operating system and browsers that run on it. ... The outage with the biggest impact came in October, when a single point of failure inside ’s sprawling network took out vital services worldwide. It lasted 15 hours and 32 minutes. The root cause that kicked off a chain of events was a software bug in the software that monitors the stability of load balances by, among other things, periodically creating new DNS configurations for endpoints within the . A race condition—a type of bug that makes a process dependent on the timing or sequence of events that are variable and outside the developers’ control—caused a key component inside the network to experience “unusually high delays needing to retry its update on several of the DNS endpoint,” Amazon said in a post-mortem.

The Evolving Cybersecurity Challenge for Critical Infrastructure

is providing cybercriminal groups with the opportunity to target critical infrastructure. Operators, and regulators, are wrestling with new technology and new manufacturers, outside the traditional . “With the geopolitical tensions and the way that the world will look in maybe a few years, they're starting to scratch their heads and think, ‘okay, is it secure? Is it safe? How was it developed? Is there any remote access? How is it being configured?’ There are things that are being done now, that will have an effect in a few years’ time,” cautioned Daniel dos Santos, head of security research at . Given the lifespans of operational technology, installing insecure equipment now can have long-term consequences. Meanwhile, CISOs face dealing with older hardware that was not designed for modern threats. Even where vendors release patches, operators do not always apply them, either because of concerns about business interruption, or a lack of visibility. ... Threats to CNI are not likely to abate in 2026. Legislators are putting more emphasis on cyber resilience and directives, such as the , will improve the security of connected devices. But these upgrades take time. “Threats from criminal groups continue to grow exponentially,” said , CTO at OT security specialists .

The changing role of the MSP: What does this mean for security?

hold a unique position within the IT ecosystem, as they are often responsible for managing and supporting the IT infrastructures, cloud services, and of many different organizations. These trusted partners often have privileged access to the inner workings of the organizations they support, including access to the critical systems, sensitive information, and intellectual property of their clients. ... Research shows that over half of MSP leaders globally believe that their customers are at more risk today than this time last year when it comes to cyber threats, with AI-based attack vectors, ransomware/malware, and insider threats the most commonly faced threats. As a result of this uptick in threats, more organizations than ever are leaning on MSPs for cyber support. In fact, in 2025, 84% of MSPs managed either their clients’ cyber infrastructure or their cyber and IT estates combined. This increased significantly, from 64% the previous year. What this shows is that SMEs are realising that they cannot handle cybersecurity alone, turning to MSPs for additional help. Cybersecurity is no longer an optional extra or add-on; it’s becoming a core, expected service for MSPs. MSP leaders are transitioning from general IT support to becoming essential cybersecurity guardians. ... MSPs that adapt by investing in specialized cybersecurity expertise, advanced technologies, and a proactive security posture will thrive, becoming indispensable partners to businesses navigating the complex world of cyber risk.

What’s next for Azure containers?

Until now, even though Azure has had deep support, you’ve had to bring your own eBPF tools and manage them yourself, which does require expertise to run at scale. Not everyone is a , and with tools like providing a managed environment for cloud-native applications, having a managed eBPF environment is an important upgrade. The new provides a quick way of getting that benefit in your applications, using it for host routing and significantly reducing the overhead that comes with . ... let Azure lock down container features to reduce the risk of compromised container images affecting other users. At the same time, it’s working to secure the underlying host OS, which for ACI is . allows Microsoft to lock that image down, providing an immutable host OS. However, those SELinux policies don’t cross the boundary into containers, leaving their userspace vulnerable. ... Having a policy-driven approach to security helps quickly remediate issues. If, say, a common container layer has a vulnerability, you can build and verify a patch layer and deploy it quickly. There’s no need to patch everything in the container, only the relevant components. Microsoft has been doing this for OS features for some time now as part of its internal , and it’s extending the process to common runtimes and libraries, building patches with updated packages for tools like Python.

Daily Tech Digest - August 19, 2025

Quote for the day:

“A great person attracts great people and knows how to hold them together. “ -- Johann Wolfgang von Goethe

What happens when penetration testing goes virtual and gets an AI coach

Researchers from the University of Bari Aldo Moro propose using Cyber Digital Twins (CDTs) and generative AI to create realistic, interactive environments for cybersecurity education. Their framework simulates IT, OT, and IoT systems in a controlled virtual space and layers AI-driven feedback on top. The goal is to improve penetration testing skills and strengthen understanding of the full cyberattack lifecycle. At the center of the framework is the Red Team Knife (RTK), a toolkit that integrates common penetration testing tools like Nmap, theHarvester, sqlmap, and others. What makes RTK different is how it walks learners through the stages of the Cyber Kill Chain model. It prompts users to reflect on next steps, reevaluate earlier findings, and build a deeper understanding of how different phases connect. ... This setup reflects the non-linear nature of real-world penetration testing. Learners might start with a network scan, move on to exploitation, then loop back to refine reconnaissance based on new insights. RTK helps users navigate this process with suggestions that adapt to each situation. The research also connects this training approach to a broader concept called Cyber Social Security, which focuses on the intersection of human behavior, social factors, and cybersecurity.

7 signs it’s time for a managed security service provider

When your SOC team is ignoring 300 daily alerts and manually triaging what should be automated, that’s your cue to consider an MSSP, says Toby Basalla, founder and principal data consultant at data consulting firm Synthelize. When confusion reigns, who in the SOC team knows which red flag actually means something? Plus, if you’re depending on one person to monitor traffic during off-hours, and that individual is out sick, what happens then? ... Organizations typically realize they need an MSSP when their internal team struggles to keep pace with alerts, incident response, or compliance requirements, says Ensar Seker, CISO at SOCRadar, where he specializes in threat intelligence, ransomware mitigation, and supply chain security. This vulnerability becomes particularly evident after a close call or audit finding, when gaps in visibility, threat detection, or 24/7 coverage become undeniable. ... Many smaller enterprises simply can’t afford the cost of a full-time cybersecurity staff, or even a single dedicated expert. This leaves such organizations particularly vulnerable to all types of attacks. An MSSP can significantly help such organizations by providing a full array of services, including 24/7 monitoring, threat detection, incident response, and access to a broad range of specialized security tools and expertise. “They bring economies of scale, proactive threat intelligence, and a deep understanding of best practices,” Young says.

Cyber Security Responsibilities of Roles Involved in Software Development

Building secure software is crucial as a vulnerable software would be an easy target for the cyber criminals to exploit. There are people, process and technology forming part of the software supply chain and it is very important that all of these plays a role in securing the supply chain. While process and technology play the role of enablers, it is people who should buy-in and adapt to the mindset of ensuring security in every aspect of their routine work. ... This includes developers implementing secure coding techniques, security teams identifying vulnerabilities, and everyone involved staying updated on the latest threats and best practices to prevent potential security breaches. Whatever said and done, the root cause of a vulnerability in a software ultimately boils down to people, because someone somewhere had missed something and thus a security defect creeps in to the supply chain and shows up as a vulnerability. It could be a missed requirement by the Business Analyst or a simple coding mistake by a developer. So, everyone involved in the software development right from gathering requirements to deployment of the software in production environment need to have the sense of cyber security in what they do. Even those involved in support and maintenance of software systems also has a role in keeping the software secure.

Build Boringly Reliable ai Into Your DevOps

Observability for ai is different because “correctness” isn’t binary and inputs are messy. We focus on three pillars: live service metrics, evaluation metrics (task success, hallucination rate), and lineage. The first pillar looks like any microservice: we scrape metrics and trace request/response cycles. We prefer OpenTelemetry for traces because we can tag spans with prompt IDs, model routes, and experiment flags. The benefit is obvious when a perf spike happens and you can isolate it to “experiment=prompt_v17.” ... Costs don’t explode; they creep—one verbose chain-of-thought at a time. We price every inference the same way we price a SQL query: tokens in, tokens out, latency, and downstream work. For a customer-support deflection bot, we discovered that truncating history to the last 6 messages cut average tokens by 41% with no measurable drop in solved-rate over 30 days. That was an easy win. Harder wins come from selective routing: ship easy tasks to a small, fast model; escalate only when confidence is low. ... Data quality makes or breaks ai results. Before we debate model choices, we sanitize inputs, enforce schemas, and redact PII. You don’t want a customer’s credit card to become part of your “context.” We’ve had great results with a lightweight validation layer in the request path and daily batch checks on the source corpora.

Why Training Won’t Solve the Citizen Developer Security Problem

In most organizations, security training is a core component of cybersecurity frameworks and often a compliance requirement. Helping employees recognize and respond to cyber threats significantly reduces human error, the leading cause of security breaches. That said, traditional security training for technically inclined IT staff and developer teams is already a formidable challenge. Rolling out training for citizen developers—employees with little to no formal IT or security background— is exponentially harder for several reasons ... It’s a well-known fact: security training has always struggled to deliver lasting behavioral change. For two decades, employees have been told, “Don’t click suspicious links in emails.” Yet, click rates on phishing emails remain stubbornly high. Why? Human error is persistent, so training alone is not enough. In response, businesses are layering technology — advanced email gateways, sandboxing, Endpoint Detection and Response (EDR), and real-time URL scanning — around users to compensate for their inevitable lapses in judgment. ... Unfortunately, traditional AppSec tools fall short for no-code apps, which aren’t built line by line and rely on proprietary logic inaccessible to standard code scans. Even with access, interpreting their risks demands specialized cybersecurity expertise, rendering traditional code-scanning tools ineffective.

6 signs of a dying digital transformation

“It’s a fundamental disconnect where the technology being implemented simply isn’t delivering the promised improvements to operations, customer experience, or competitive advantage.” This indicator, he notes, often reveals itself as a growing cynicism within the organization, with teams feeling like they’re simply “doing digital” for its own sake without a clear understanding of the “why” or seeing any real positive impact. ... When users aren’t interested or feel no need to use the transformation’s new tools or applications, it indicates a disconnect between the users, their goals, and actual business outcomes, says Aparna Achanta, IBM Consulting’s cybersecurity strategist and AI governance and transformation leader. To successfully address this issue, Achanta recommends aligning digital transformation with the overall business vision, making sure that the voices of end-users and customers are being heard. ... Strong business leadership, and a willingness to admit mistakes, are essential to digital transformation success, Hochman says. “Too often, enterprises run away from failure.” He notes that such moments are actually golden opportunities to break paradigms and try new approaches. “The more failures a company speaks openly about, the more innovation occurs.” ... “Adoption is the oxygen of transformation,” he says.

Why Master Data Management Is Even More Important Now

There is a mindset shift that must happen to get people to buy into the cost and the overhead of managing the data in a way that's going to be usable, Thompson says. “It’s knowing how to match technology up with a set of business processes, internal culture, commitment to do things properly and tie [that] to a business outcome that makes sense,” he says. “[T]he level of maturity of some good companies is bad. They’re just bad at managing their data assets.” ... “[MDM] has very real business consequences, and I think that's the part that we can all do better is to start talking about the business outcome, because these business outcomes are so serious and so easy to understand that it shouldn't be hard to get business leaders behind it,” says Thompson. “But if you try to get business leaders behind MDM, it sounds like you want to undertake a science project with their help. It’s not about the MDM, it’s about the business outcome that you can get if you do a great job at MDM.” ... In older organizations, MDM maturity tends to be unevenly distributed. The core data tends to be fairly well organized and managed, but the rest isn’t. The age-old problem of data ownership and a reticence to share data doesn’t help. “The notion of data mesh [is] I’ll manage this piece, and you manage that piece. We’ll be disconnected but we can connect, and you can use it, but don’t mess with it. It’s mine,” says Landry.

How to Future-Proof Your Data and AI Strategy

The earlier you find a software bug, the less expensive it is to fix and the less negative customer impact it has – this is a basic principle of software development. And the value of a shift-left approach becomes even more apparent when applied to data privacy in the age of AI. If you use personal information to train models and realize later that you shouldn’t have, the only solution is to roll back the model, which also rolls back the value of the system and the competitive advantage it was intended to deliver. ... Companies need a scalable approach to determine where to go deep and where to move quickly. Prioritize based on impact by applying stricter controls where AI is high-risk or high-stakes, such as projects where AI is core to the functionality of new solutions or segments of the business. Apply lighter-touch governance where risk is low and build scalable policies that align governance intensity with business context, risk appetite, and innovation goals. ... Future-proofing your data and AI strategy is more than having the right tools and processes; it’s a mindset. If your approach isn’t designed for scalability and agility, it can quickly become a source of friction. A rigid, compliance-focused model makes even the best tools feel ineffective and can result in governance being seen as a bottleneck rather than a value driver.

The Unavoidable ‘SCREAM’: Why Enterprise Architecture Must Transform for the Organization of Tomorrow

In an era where every discussion, whether personal or organizational, is steeped in the pervasive influence of AI and data, one naturally questions the true state of Enterprise Architecture (EA) within most organizations today. Too often, we observe situational chaos and a predominantly reactive posture, where EA teams find themselves supporting hasty executive decisions in a culture of order-taking. Businesses, in turn, perceive Information Technology as slow to deliver, while IT teams, grappling with a perceived lack of business understanding, struggle to demonstrate timely value. This dynamic often leads to organizations becoming vendor-driven, with core architectural management often unaddressed. Despite this, there’s no doubt that the demand for Enterprise Architecture is surging. However, the existing challenges—from the sheer breadth of required skillsets and knowledge to the overwhelming abundance of frameworks to choose from—frequently plunge EA practices into moments of SCREAM: Situational Chaotic Realities of Enterprise Architecture Management. However, among these challenges, there persists a profound desire for adaptive design and resilient enterprise architecture. Significant architectural efforts are indeed undertaken across organizations of all sizes. The equilibrium that every organization truly needs, however, often feels elusive.

Microsoft Morphs Fusion Developers To Full Stack Builders

Citizen development is a thorny subject; allowing business “laypersons” to impact the way software application code is structured, aligned and executed is an unpopular concept with command line purists who would prefer to keep the suits at arm’s length, if not further. ... The central argument from Silver and Cunningham is that it’s really tough to teach businesspeople to code and, equally tough to teach software engineers the principles of business operations. The Redmond pair suggest that Microsoft Power Platform will provide the “scaffolding” for full-stack teams to fuse (yes, okay, we’re not using that word anymore) their two previously quite separate working environments. ... To make full-stack development a reality inside any given organization, Microsoft has said that there will need to be a degree of initial investment into engineering systems and context. This, then, would be the scaffolding. Redmond suggests that new applications will emerge that are architected to support natural language development, augmentation and modification. With boundaries, safeguards and guardrails in place to oversee what AI agents can do when left in the hands of businesspeople, software systems will need to be engineered with enough meta-knowledge to understand the business context of the decisions that might be made without breaking other parts of the system.

Daily Tech Digest - July 28, 2024

India's tech revolution fuels the rise of the managed services industry

Companies, eager to leverage cloud computing, AI, and improved solutions, are seeking reliable partners to manage the complexity. With a massive talent pool of STEM graduates, dynamic IT infrastructure, and supportive policies, the world is looking towards India to serve as a primary player in this space. India's arduous journey to becoming a global tech giant is the result of decades of investment of time, money, and energy into meticulously planning and taking continuous strides. Companies from around the world are shifting significant parts of their IT and business spend to India to drive cost optimisation. ... The pandemic acted as a catalyst for a revolution in managed IT services. Agility, resilience, and enhanced cybersecurity became critical overnight and the rise in remote work led to a surge in demand for managed services. Cybersecurity concerns also skyrocketed both during and after the pandemic and innovation in data handling was imperative. Consequently, many companies are pivoting towards managed service providers to strengthen their computing power, data analysis, and cybersecurity measures.

5 Innovatinve Cybersecurity Measures App Developers Should Incorporate in the Digital Transformation Race

The impending era of quantum computing will give the expected boost to digital transformation; however, this technological innovation to classic computing poses a significant challenge to traditional encryption methods due to its exceptional computing power that hackers can leverage to launch unprecedented brute force attacks that can decrypt passwords and crack encryptions in seconds or minutes. App developers must integrate post-quantum cryptographic features to withstand the computational power of quantum computers. ... By incorporating ZTNA and multifactor authentication (MFA), app developers can proactively prevent data breaches by thoroughly verifying the trustworthiness of any user or device trying to access the organization's networks. The multifactor authentication feature adds a layer of security to VPN access by requiring multiple verification forms; users’ verification methods can include passwords, unique OTP codes sent to mobile devices, or biometric authentication, such as fingerprint, eye scan, voice recognition, hand geometry, or facial recognition, before granting network access.

How to Use Self-Healing Code to Reduce Technical Debt

The idea of self-healing code with LLMs is exciting, but balancing automation and human oversight is still crucial. Manual reviews are necessary to ensure AI solutions are accurate and meet project goals, with self-healing code drastically reducing manual efforts. Good data housekeeping is vital, and so is ensuring that teams are familiar with best practices to ensure optimal data management for feeding AI technology, including LLMs and other algorithms. This is particularly important for cross-department data sharing, with best practices including conducting assessments, consolidations, and data governance and integration plans to improve projects. None of this could take place without enabling continuous learning across your staff. To encourage teams to use these opportunities, leaders should carve out dedicated time for training workshops that offer direct access to the latest tools. These training sessions could be oriented around certifications like those from Amazon Web Services (AWS), which can significantly incentivize employees to enhance their skills. By doing this, a more efficient and innovative software development environment can be achieved.

Chaos Management in Software: A Guide on How to Conduct it

When too much development occurs too soon, this is one symptom that chaos may be present in an organization. Growth is usually beneficial, but not when it causes chaos and confusion. Companies also exhibit indications of disorder when they overstretch their operational capacity or resources, such as money or people, creating an unstable atmosphere for both employees and consumers. ... In the work environment, we can see how it can negatively and positively affect our output. It is essential to be in a healthy work environment that offers employees the opportunity to succeed and be rewarded for their achievements. The problem with chaos is that it can cause an unhealthy work environment, negatively affecting the worker’s productivity, quality of work, and physical health. Chaos in the workplace also impacts team building because when people are in a chaotic space, they cannot focus on anything other than how they feel at that moment. We have all been there – that one time when we did not get enough sleep, or the project was due tomorrow morning, or we needed to wake up early to get that presentation done before your meeting started.

CIOs must reassess cloud concentration risk post-Crowdstrike

Cloud concentration risk is now arising when these enterprises rely worryingly on a single cloud service provider (CSP) for all their critical business needs. In effect this has shifted reliance on their own data center to now storing all data, running all applications on a single cloud infrastructure. Cloud concentration risk is then fully realized when any one incident, like the CrowdStrike outage, can disrupt your entire operation. With enterprises increasingly dependent on the same applications and cloud providers, this can be devastating at scale, as we’ve seen with CrowdStrike. Such a scenario extends to security breaches and other events that can have more systemic impact on countries and industries. ... Toavoid the dangers of cloud concentration risk, a multi-cloud strategy,in which business workloads are spread across multiple cloud providers, is vital. With a multi-cloud strategy in place, when one provider has an issue, your operations in the other clouds can keep things running. The alternate is to adopt a hybrid cloudapproach,combiningprivate and public cloud. This gives you more control over proprietary and sensitive data whilst still having all the benefits of public cloud scalability.

With ‘Digital Twins,’ The Doctor Will See You Now

Doctors who use the system can not only measure the usual stuff, like pulse and blood pressure, but also spy on the blood’s behavior inside the vessel. This lets them observe swirls in the bloodstream called vortices and the stresses felt by vessel walls — both of which are linked to heart disease. ... We drew a lot from the way they were already optimizing graphics for these computers: The 3D mesh file that we create of the arteries is really similar to what they make for animated characters. The way you move a character’s arm and deform that mesh is the same way you would put in a virtual stent. And the predictions are not just a single number that you want to get back. There’s a quantity called “wall shear stress,” which is just a frictional force on the wall. We’ve shown that when doctors can visualize that wall shear stress at different parts of the artery, they may actually change the length of the stent that they choose. It really informs their decisions. We’ve also shown that, in borderline cases, vorticity is associated with long-term adverse effects. So doctors can see where there’s high vorticity. It could help doctors decide what type of intervention is needed, like a stent or a drug.

What Are the Five Pillars of Data Resilience?

The first is the most basic one: Do you have data backed up in the right way? That seems very straightforward, but you’d be shocked by how many companies don’t have the right backup strategy in place. And that’s vital because our research tells us that 93% of ransomware attackers go for the backups first. ... So, the second pillar is, can you recover quickly from a breach? What’s your recovery strategy, and can you get to your recovery time objective and recovery point objective? Third is data freedom, which is not often talked about. There are many instances where you’ll just need to change your tech stack. You may see a better tech solution, or companies may just change their posture. No matter what choice you make, you need your data to travel with you with minimal fuss. ecurity is fourth. Do you have the right malware protection? Are you able to detect changing patterns, even of your own employees to mitigate insider threats? And there’s obviously table stakes, like multifactor authentication, end-to-end security, etc. And then the last pillar we look at is data intelligence.

Navigating the Future with Cloud-Ready, Customer-Centric Innovations

One of CFOS’s most transformative aspects is its cloud-based infrastructure. SCC realised that the traditional on-premises servers were becoming a bottleneck, limiting scalability and flexibility. By moving to the cloud, SCC gained the ability to dynamically scale resources according to demand, reducing upfront costs and minimising maintenance challenges. This shift optimised resource utilisation and provided a more agile platform for future growth and technological advancements. “Transitioning from on-premises servers to a cloud solution significantly enhanced SCC’s operational strategy,” Lee revealed. “Previously, managing and scaling physical servers posed challenges, particularly in cost and availability of relevant skill-sets, solutions and resources.” The cloud integration resolved these challenges by enabling SCC to scale resources as needed. This approach enhanced cost efficiency and allowed the organisation to quickly adapt to changing demands. By transitioning to the cloud, SCC was able to manage resources dynamically, accommodating peak loads and supporting future growth without the limitations of physical infrastructure.

The Ultimate Roadmap to Modernizing Legacy Applications

First, organizations should conduct an assessment of their application portfolios to determine which apps are eligible for modernization, whether that be containerization, cloud migration, refactoring or another route. This can help government IT leaders prioritize which apps to upgrade. It also gives teams a comprehensive picture of the entire application portfolio: performance, health, average age, security gaps, container construction and more. “Having an inventory of all of your applications can help you avoid duplicative investments and paint a clearer picture of how that application fits into your organization’s long-term strategy,” says Greg Peters, founder of strategic application modernization assessment (SAMA) at CDW. ... The next critical step is to map dependencies before beginning the actual modernization. “Even a minor change to the functionality of a core system can have major downstream effects, and failing to account for any dependencies on legacy apps slated for modernization can lead to system outages and business interruptions,” Hitachi Solutions notes.

Fully Homomorphic Encryption (FHE) with silicon photonics – the future of secure computing

FHE requires specialist hardware and considerable amounts of processing power, leading to high energy consumption and increased costs. However, FHE enabled by silicon photonics — using light to transmit data — offers a solution that could make FHE more scalable and efficient. Current electronic hardware solutions systems are reaching their limits, struggling to handle the large volumes of data and meet the demands of FHE. However, silicon photonics can significantly enhance data processing speed and efficiency, reduce energy consumption and lead to large-scale implementation of FHE. This can unlock numerous possibilities for data privacy across various sectors, including healthcare, finance and government, in areas such as AI, data collaboration and blockchain. This could potentially lead to significant progress in medical research, fraud detection and enable large scale collaboration across industries and geographies. ... FHE is set to transform the future of secure computing and data security. By enabling computations on encrypted data, FHE offers new levels of protection for sensitive information, addressing critical challenges in privacy, cloud security, regulatory compliance, and data sharing.

Quote for the day:

“The road to success and the road to failure are almost exactly the same.” -- Colin R. Davis

Daily Tech Digest - May 27, 2024

10 big devops mistakes and how to avoid them

“One of the significant challenges with devops is ensuring seamless communication and collaboration between development and operations teams,” says Lawrence Guyot, president of IT services provider Empowerment through Technology & Education (ETTE). ... Ensuring the security of the software supply chain in a devops environment can be challenging. “The speed at which devops teams operate can sometimes overlook essential security checks,” Guyot says. “At ETTE, we addressed this by integrating automated security tools directly into our CI/CD pipeline, conducting real-time security assessments at every stage of development.” This integration not only helped the firm identify vulnerabilities early, but also ensured that security practices kept pace with rapid deployment cycles, Guyot says. ... “Aligning devops with business goals can be quite the hurdle,” says Remon Elsayea, president of TechTrone IT Services, an IT solutions provider for small and mid-sized businesses. “It often seems like the rapid pace of devops initiatives can outstrip the alignment with broader business objectives, leading to misaligned priorities,” Elsayea says.

Why We Need to Get a Handle on AI

A recent World Economic Forum report also found a widening cyber inequity, which is accelerating the profound impact of emerging technologies. The path forward therefore demands strategic thinking, concerted action, and a steadfast commitment to cyber resilience. Again, this isn’t new. Organizations of all sizes and maturity levels have often struggled to maintain the central tenets of organizational cyber resilience. At the end of the day, it is much easier to use technology to create malicious attacks than it is to use technology to detect such a wide spectrum of potential attack vectors and vulnerabilities. The modern attack surface is vast and can overwhelm an organization as they determine how to secure it. With this increased complexity and proliferation of new devices and attack vectors, people and organizations have become a bigger vulnerability than ever before. It is often said that humans are the biggest risk when it comes to security and deepfakes can more easily trick people into taking actions that benefit the attackers. Therefore, what questions should security teams be asking to protect their organization?

Demystifying cross-border data transfer compliance for Indian enterprises

The variability of these laws introduces complex compliance issues. As Indian enterprises expand globally, the significance of robust data compliance management escalates. Organizations like ours assist companies worldwide with customized solutions tailored to the complexities of cross-border data transfer compliance. We ensure that businesses not only meet international data protection standards but also enhance their data governance practices through our comprehensive suite of tools. The evolution of India’s data localization policies could significantly influence global digital diplomacy. Moving from strict data localization to permitting certain cross-border data flows aligns India more closely with global digital trade norms, potentially enhancing its relationships with major markets like the US and EU. India is proactively revising its legal frameworks to better address the intricacies of cross-border data transfers within the realm of data privacy, especially for businesses. The forthcoming DPDPA regulations aim to balance the need for data protection with the operational requirements of digital commerce and governance.

Digital ID adoption: Implementation and security concerns

Digital IDs are poised to revolutionize sectors that rely heavily on secure and efficient identity verification. ... “As the Forrester experts note in the study, the complexities and disparities of global implementation across various landscapes highlight the strategic necessity of adopting a hybrid approach to digital IDs. Moreover, there is no single, universally accepted set of global standards for digital IDs that applies across all countries and sectors. Therefore, the large number of companies at the stage of active implementation demonstrates a growing need for frameworks and guidelines that aim to foster interoperability, security, and privacy across different digital ID systems,” said Ihar Kliashchou, CTO at Regula. “The good news is that several international organizations and standards bodies — New Technology Working Group in the International Civil Aviation Organization, the International Organization for Standardization (ISO), etc. — are working towards those standards. This seems to be a case in which slow and steady wins the race,” concluded Kliashchou.

Forrester: Preparing for the era of the AI PC

AI PCs are now disrupting the cloud-only AI model to bring that processing to local devices running any OS. But what is an AI PC exactly? Forrester defines an AI PC as a PC embedded with an AI chip and algorithms specifically designed to improve the experience of AI workloads across the computer processing unit (CPU), graphics processing unit (GPU) and neural processing unit (NPU). ... An AI PC also offers a way to improve the collaboration experience. Dedicated AI chipsets will improve the performance of classic collaboration features, such as background blur and noise, by sharing resources across CPUs, GPUs and NPUs. On-device AI offers the ability to render a much finer distinction between the subject and the blurred background. More importantly, the AI PC will also enable new use cases, such as eye contact correction, portrait blur, auto framing, lighting adjustment and digital avatars. Another benefit of AI chipsets on PCs is that they provide the means to optimise device performance and longevity. Previous AI use cases were feasible on PCs, but they drained the battery quickly. The addition of an NPU will help preserve battery life while employees run sustained AI workloads.

Gartner Reveals 5 Trends That Will Make Software Engineer

Herschmann said that while there is a worry that AI could eliminate coding jobs instead of just enhancing them, that worry is somewhat unfounded. "If anything, we believe there's going to be a need for more developers, which may at first seem a little counterintuitive, but the reality is that we're still in the early stages of all of this," he said. "While generative AI is quite impressive in the beginning, if you dig a little bit deeper, you realize it's shinier than it really is," Herschmann said. So instead of replacing developers, AI will be more of a partner to them. ... Coding is just a small part of a developer's role. There are a lot of other things they need to do, such as keep the environment running, configuration work, and so on. So it makes sense to have a platform engineering team to take some of this work off developers' plates so they can focus on building the product, according to Herschmann. "Along with that though comes a potential scaling effect because you can then provide that same environment and the skills of that team to others as you scale up," he said.

Beyond blockchain: Unlocking the potential of Directed Acyclic Graphs (DAGs)

DAGs are a type of data structure that uses a topological ordering, allowing for multiple branches that converge but do not loop back on themselves. Imagine a network of interconnected highways where each transaction can follow its own distinct course, branching off and joining forces with other transactions as required. This structure enables simultaneous transactions, eliminating the need for sequential processing, which is a bottleneck in traditional blockchain systems. ... One of the notable challenges of traditional blockchain technology is its scalability. DAGs address this issue by allowing more transactions to be processed in parallel, significantly increasing throughput, a key advantage for real-time applications in commodity trading and supply chain management. DAGs are more energy-efficient than proof-of-work blockchains, as they do not require substantial computational power for intensive mining activities, aligning with global and particularly India’s increasing focus on sustainable technological solutions. But the benefits of DAGs don’t stop here. Imagine a scenario where a shipment of perishable goods is delayed due to unforeseen circumstances, such as adverse weather conditions.

Pioneering the future of personalised experiences and data privacy in the digital age

Zero-party data (ZPD) is at the core of Affinidi's strategy and is crucial for businesses navigating consumer interactions. ZPD refers to information consumers willingly share with companies for specific benefits, such as personalised offers and services. Consider an avid traveller who frequently books trips online. He might share his travel preferences with a travel company, such as favourite destinations, preferred accommodation types, and activity interests. This data allows the company to tailor its offerings precisely to his tastes. For instance, if he loves beach destinations and luxury hotels, the company can send him personalised travel packages featuring exclusive beach resorts with premium amenities. ... As data privacy regulations tighten, businesses must prioritise consented and accurate data sources, reducing legal risks and dependence on external data pools. Trust can be viewed as a currency, altering customers' loyalty and buying decisions. A survey by PWC showed that 33% of customers pay a premium to companies because they trust them.

Shut the back door: Understanding prompt injection and minimizing risk

You don’t have to be an expert hacker to attempt to misuse an AI agent; you can just try different prompts and see how the system responds. Some of the simplest forms of prompt injection are when users attempt to convince the AI to bypass content restrictions or ignore controls. This is called “jailbreaking.” One of the most famous examples of this came back in 2016, when Microsoft released a prototype Twitter bot that quickly “learned” how to spew racist and sexist comments. More recently, Microsoft Bing (now “Microsoft Co-Pilot) was successfully manipulated into giving away confidential data about its construction. Other threats include data extraction, where users seek to trick the AI into revealing confidential information. Imagine an AI banking support agent that is convinced to give out sensitive customer financial information, or an HR bot that shares employee salary data. And now that AI is being asked to play an increasingly large role in customer service and sales functions, another challenge is emerging. Users may be able to persuade the AI to give out massive discounts or inappropriate refunds.

Say goodbye to break-and-fix patches

A ‘break-and-fix’ mindset can be necessary in emergency situations, but it can also make things worse. While it can be tempting to view maintenance work as adding little value, failing to address these problems properly will only create future issues as you accumulate tech debt. Fixing those issues will require more resources — time, money, skills — that will undoubtedly hurt your organization. ... Tech debt is one of those “invisible issues” hiding in IT systems. Opting for quick fixes to solve immediate issues, rather than undertaking comprehensive upgrades might seem cost-effective and straightforward at first. However, over time, the accumulation of these patches contributes significantly to tech debt. ... Despite the potential consequences of inadequate and reactive maintenance, adopting a more proactive approach can be challenging for many businesses. Economic pressures and budgetary constraints are forcing leaders to reduce expenses and ‘do more with less’ — this leads to situations where areas not traditionally viewed as value-adding (like maintenance) are deprioritized. This is where managed services can help.

Quote for the day:

''Smart leaders develop people who develop others, don't waste your time on those who won't help themselves.'' -- John C Maxwell