Daily Tech Digest - January 17, 2026

---

Quote for the day:

"Success does not consist in never making mistakes but in never making the same one a second time." -- George Bernard Shaw

---

Expectations from AI ramp up as investors eye returns in 2026

Billions in investments and a concerted focus on the tech over the past few years has led to artificial intelligence (AI) completely transforming how major global industries work. Now, investors are finally expecting to see some returns. ... Investors will no longer be satisfied with AI’s potential future capabilities – they want measurable returns on investment (ROI), says Jiahao Sun, the CEO of Flock.ie, a platform that allows users to build, train and deploy AI models in a decentralised manner. AI investment is entering its “show me the money era”, he says. This isn’t to say that investments into AI will pause, but that investors will begin prioritising critical areas that give guaranteed returns. These could include agentic AI platforms that enable multi-agent orchestration; AI-native infrastructures built for scale, security and interoperability; data modernisation tools that unlock the full potential of unstructured data; and AI observability and safety tools that monitor, govern and refine agent behaviour in real time, explains Neeraj Abhyankar, the VP of Data and AI at R Systems. ... “Single-purpose tools will be absorbed into unified AI platforms. The era of juggling 10 different AI products is ending and the race to offer a complete, integrated experience will intensify,” he adds. Meanwhile, some experts say that the EU’s AI Act will – for better or for worse – prohibit European firms from experimenting with high-risk use cases for AI.

The Next S-Curve of Cybersecurity: Governing Trust in a New Converging Intelligence Economy

Cybersecurity has crossed a threshold where it no longer merely protects technology ~ it governs trust itself. In an era defined by AI-driven decision-making, decentralized financial systems, cloud-to-edge computing, and the approaching reality of quantum disruption, cyber risk is no longer episodic or containable. It is continuous, compounding, and enterprise-defining. What changed in 2025 wasn’t just the threat landscape. It was the architecture of risk. Identity replaced networks as the dominant attack surface. Software supply chains emerged as systemic liabilities. Machine intelligence ~ on both sides of the attack began evolving faster than the controls designed to govern it. For boards, investors, and executives, this marked the end of cybersecurity as a control function and the beginning of cybersecurity as a strategic mandate. ... The next S-curve of cybersecurity is not driven by better tooling. It is driven by a shift in how trust is architected and governed across a converging ecosystem. This new curve is defined by: Identity-centric security rather than network-centric defense; Data-aware protection instead of application-bound controls; Continuous assurance rather than point-in-time audits; and Integration with enterprise risk, governance, and capital strategy Cybersecurity evolves from a defensive posture into a trust architecture discipline ~ one that governs how intelligence, identity, data, and decisions interact at scale.

Why Mental Fitness Is Leadership's Next Frontier

The distinction Craze draws between mental health and mental fitness is crucial. Mental health, he explains, is ultimately about functioning—being sufficiently free from psychological injury or mental illness to show up and perform one's job. "Your mental health or illness is a private matter between yourself, and perhaps your family or physician, and is a matter of respecting your individual rights," he says. Mental fitness, by contrast, is about capacity. "Assuming you are mentally healthy enough to show up and perform your job, then mental fitness is all about how well your mind performs under load, over time, and in conditions of uncertainty," Craze explains. "Being mentally healthy is a baseline. Being mentally fit is what allows leaders to think clearly at hour ten, stay composed in conflict, and recover quickly after setbacks rather than slowly eroding away," he says. Here, the comparison to elite athletics is instructive. In professional sports, no one confuses being injury-free with being competition-ready. Leadership has been slower to make that distinction, even as today’s executives face sustained cognitive and emotional demands that would have been unthinkable a generation ago. ... One of the most persistent myths in leadership development, according to Craze, is the idea that thinking happens in some abstract cognitive space, detached from the body. "In reality, every act of judgment, attention and self-control has an underlying physiological component and cost," he says. 

Taking the Technical Leadership Path

Without technical alignment, individuals constantly touch the same codebase, adding their feature in the simplest way (for them) but often they do this without ensuring the codebase is kept consistent. Over time accidental complexity grows such as having five different libraries that do the same job, or seven different implementations of how an email or push notification is sent and when someone wants to make a future change to that area, their work is now much harder. ... There are plenty of resources available to develop leadership skills. Kua advised to break broader leadership skills into specific ones, such as coaching, mentoring, communicating, mediating, influencing, etc. Even when someone is not a formal leader, there are daily opportunities to practice these skills in the workplace, he said. ... Formal technical leaders are accountable for ensuring teams have enough technical leadership. One way of doing this is to cultivate an environment where everyone is comfortable stepping up and demonstrating technical leadership. When you do this well, this means everyone can demonstrate informal technical leadership. Formal leaders exist because not all teams are automatically healthy or high-performing. I’m sure every technical person can remember a team they’ve been on with two engineers constantly debating about which approach to take, and wish someone had stepped in to help the team reach a decision. In an ideal world, a formal leader wouldn’t be necessary, but it’s rare that teams live in the perfect world.

From model collapse to citation collapse: risks of over-reliance on AI in the academy

Model collapse is the slow erosion of a generative AI system grounded in reality as it learns more and more from machine-generated data rather than from human-generated content. As a result of model collapse, the AI model loses diversity in its outputs, reinforces its misconceptions, increases its confidence in its hallucinations and amplifies its biases. ... Among all the writing tasks involved in research, GenAI appears to be disproportionately good at writing literature reviews. ChatGPT and Google Gemini both have deep research features that try to take a deep dive into the literature on a topic, returning heavily sourced and relatively accurate syntheses of the related research, while typically avoiding the well-documented tendency to hallucinate sources altogether. In some ways, it should not be too surprising that these technologies thrive in this area because literature reviews are exactly the sort of thing GenAI should be good at: textual summaries that stay pretty close to the source material. But here is my major concern: while nothing is fundamentally wrong with the way GenAI surfaces sources for literature reviews, it risks exacerbating the citation Matthew effect that tools like Google Scholar have caused. Modern AI models largely thrive on a snapshot of the internet circa 2022. In fact, I suspect that verifiably pre-2022 datasets will become prized sources for future models, largely untainted by AI-generated content, in much the same way that pre-World War II steel is prized for its lack of radioactive contamination from nuclear testing. 

Why is Debugging Hard? How to Develop an Effective Debugging Mindset

Here’s how most developers debug code: Something is broken; Let me change the line; Let’s refresh (wishing the error would go away); Hmm… still broken!; Now, let me add a console.log(); Let me refresh again (Ah, this time it may…); Ok, looks like this time it worked! This is reaction-based debugging. It’s like throwing a stone in the dark or finding a needle in a haystack. It feels busy, it sounds productive, but it’s mostly guessing. And guessing doesn’t scale in programming. This approach and the guessing mindset make debugging hard for developers. The lack of a methodology and solid approach makes many devs feel helpless and frustrated, which makes the process feel much more difficult than coding. This is why we need a different mental model, a defined skillset to master the art of debugging. ... Good debuggers don’t fight bugs. They investigate them. They don’t start with the mindset of “How do I fix this?”. They start with, “Why must this bug exist?” This one question changes everything. When you ask about the existence of a bug, you go back to the history to collect information about the code, its changes, and its flow. Then, you feed this information through a “mental model” to make decisions that lead you to the fix. ... Once the facts are clear and assumptions are visible, the debugging makes its way forward. Now you’ll need to form a hypothesis. A hypothesis is a simple cause-and-effect statement: If this assumption is wrong, then the behaviour makes sense. If not, provide a fix.

Promptware Kill Chain – Five-Step Kill Chain Model for Analyzing Cyberthreats

While the security industry has focused narrowly on prompt injection as a catch-all term, the reality is far more complex. Attacks now follow systematic, sequential patterns: initial access through malicious prompts, privilege escalation by bypassing safety constraints, establishing persistence in system memory, moving laterally across connected services, and finally executing their objectives. This mirrors how traditional malware campaigns unfold, suggesting that conventional cybersecurity knowledge can inform AI security strategies. ... The promptware kill chain begins with Initial Access, where attackers insert malicious instructions through prompt injection—either directly from users or indirectly through poisoned documents retrieved by the system. The second phase, Privilege Escalation, involves jailbreaking techniques that bypass safety training designed to refuse harmful requests. ... Traditional malware achieves persistence through registry modifications or scheduled tasks. Promptware exploits the data stores that LLM applications depend on. Retrieval-dependent persistence embeds payloads in data repositories like email systems or knowledge bases, reactivating when the system retrieves similar content. Even more potent is retrieval-independent persistence, which targets the agent’s memory directly, ensuring the malicious instructions execute on every interaction regardless of user input.

AI SOC Agents Are Only as Good as the Data They Are Fed

If your telemetry is fragmented, your schemas are inconsistent, or your context is missing, you won’t get faster responses from AI SOC agents. You’ll just get faster mistakes. These agents are being built to excel at cybersecurity analysis and decision support. They are not constructed to wrangle data collection, cleansing, normalization, and governance across dozens of sources. ... Modern SOCs integrate telemetry from EDRs, cloud providers, identity, networks, SaaS apps, data lakes, and more. Normalizing all that into a common schema eliminates the constant “translation tax.” An agent that can analyze standardized fields once, and doesn’t have to re-learn CrowdStrike vs. Splunk Search Processing Language vs. vendor-specific JavaScript Object Notation, will make faster, more reliable decisions. ... If the agent must “crawl back” into five source systems to enrich an alert on its own, latency spikes and success rates drop. The right move is to centralize, normalize, and clean security data into an accessible store, like a data lake, for your AI SOC agents and continue streaming a distilled, security-relevant subset to the Security Information and Event Management (SIEM) platform for detections and cybersecurity analysts. Let the SIEM be the place where detections originate; let the lake be the place your agents do their deep thinking. The problem is that the industry’s largest SIEM, Endpoint Detection and Response (EDR), and Security Orchestration, Automation, and Response (SOAR) platforms are consolidating into vertically integrated ecosystems. ...”

IT portfolio management: Optimizing IT assets for business value

The enterprise’s most critical systems for conducting day-to-day business are a category unto themselves. These systems may be readily apparent, or hidden deep in a technical stack. So all assets should be evaluated as to how mission-critical they are. ... The goal of an IT portfolio is to contain assets that are presently relevant and will continue to be relevant well into the future. Consequently, asset risk should be evaluated for each IT resource. Is the resource at risk for vendor sunsetting or obsolescence? Is the vendor itself unstable? Does IT have the on-staff resources to continue running a given system, no matter how good it is (a custom legacy system written in COBOL and Assembler, for example)? Is a particular system or piece of hardware becoming too expense to run? Do existing IT resources have a clear path to integration with the new technologies that will populate IT in the future? ... Is every IT asset pulling its weight? Like monetary and stock investments, technologies under management must show they are continuing to produce measurable and sustainable value. The primary indicators of asset value that IT uses are total cost of ownership (TCO) and return on investment (ROI). TCO is what gauges the value of an asset over time. For instance, investments in new servers for the data center might have paid off four years ago, but now the data center has an aging bay of servers with obsolete technology and it is cheaper to relocate compute to the cloud.

Ransomware activity never dies, it multiplies

One of the most significant findings in the study involves extortion campaigns that do not rely on encryption. These attacks focus on stealing data and threatening to publish it, skipping the deployment of ransomware entirely. Encryption based attacks remained just above 4,700 incidents annually. When data theft extortion is included, total extortion incidents reached 6,182 in 2025. That represents a 23% increase compared with 2024. Snakefly, which runs the Cl0p ransomware operation, played a major role in this shift. These actors exploited vulnerabilities in widely used enterprise software to extract data at scale. Victims included large organizations in government and industry, with some campaigns affecting hundreds of companies through a single flaw. ... A newer ransomware strain tracked as Warlock drew attention due to its tooling and infrastructure. First observed in mid 2025, Warlock attacks exploited a zero day vulnerability in Microsoft SharePoint and used DLL sideloading for payload delivery. Analysis linked Warlock to tooling previously associated with Chinese espionage activity, including signed drivers and custom command frameworks. Some ransomware payloads appeared to be modified versions of leaked LockBit code, combined with older malware components. The study notes overlaps between ransomware activity and long running espionage campaigns, where ransomware deployment may serve operational or financial goals within broader intrusion efforts.

Daily Tech Digest - December 26, 2025

---

Quote for the day:

“Rarely have I seen a situation where doing less than the other guy is a good strategy.” -- Jimmy Spithill

---

Is Your Enterprise Architecture Ready for AI?

The old model of building, deploying, and governing apps is being reshaped into a composable enterprise blueprint. By abstracting complexity through visual models and machine intelligence, businesses are creating systems that are faster to adapt yet demand stronger governance, interoperability, and security. What emerges is not just acceleration but transformation at the foundation. ... With AI copilots spitting out code at scale, the traditional software development life cycle faces an existential test. Developers may not fully understand every line of AI-generated code, making manual reviews insufficient. The solution: automate aggressively. ... This new era also demands AI observability in SDLC, tracking provenance, explainability, and liability. Provenance shows the chain of prompts and responses. Explainability clarifies decisions. Bias and drift monitoring ensure AI systems don’t quietly shift into harmful or unreliable patterns. Without these, enterprises risk blind trust in black-box code. ... The destination for enterprises is clear: AI-native enterprise architecture and composable enterprise blueprint strategies, where every capability is exposed as an API and orchestrated by LCNC and AI. The road, however, is slowed by legacy monoliths in industries like banking and healthcare. These systems won’t vanish overnight. Instead, strategies like wrapping monoliths with APIs and gradually replacing components will define the journey. 

After LLMs and agents, the next AI frontier: video language models

World models — which some refer to as video language models — are the new frontier in AI, following in the footsteps of the iconic ChatGPT and more recently, AI agents. Current AI tech largely affects digital outcomes, but world models will allow AI to improve physical outcomes. World models are designed to help robots understand the physical world around them, allowing them to track, identify and memorize objects. On top of that, just like humans planning their future, world models allow robots to determine what comes next — and plan their actions accordingly. ... Beyond robotics, world models simulate real-world scenarios. They could be used to improve safety features for autonomous cars or simulate a factory floor to train employees. World models pair human experiences with AI in the real world, said Deepak Seth, director analyst at Gartner. “This human experience and what we see around us, what’s going on around us, is part of that world model, which language models are currently lacking,” Seth said. ... World models are one of several tools that will be used to deploy robots in the real world, and they will continue to improve, said Kenny Siebert, AI research engineer at Standard Bots. But the models suffer from similar problems — the hallucinations and degradation — that affect the likes of ChatGPT and video-generators. Moving hallucinations into the physical world could cause harm, so researchers are trying to solve those kinds of issues.

Hub & Spoke: The Operating System for AI-Enabled Enterprise Architecture

Today most enterprises still run on heroics, emails, slide decks, and 200-person conference calls. Even when a good repository and healthy collaboration culture exist, nothing “sticks” without a mechanism that relentlessly harvests reality, unifies understanding, and broadcasts the right truth to the right person at the right moment. That mechanism is a new application of hub-and-spoke – not just for data integration, but for architecture governance itself. We call it simply Hub & Spoke. ... At the centre runs a continuous cycle of three actions: Harvest – Ingest everything that matters: scanner output, CI/CD metadata, application inventories, risk registers, process models, meeting outcomes, human feedback, and (increasingly) agentic AI crawls; Unify – Connect the dots. Establish relationships, resolve duplicates, detect patterns and anti-patterns, and maintain one coherent model of the enterprise; and Broadcast – Push the right view, in the right language, through the right channel, at the right time. A CIO sees strategic heatmaps; a developer receives contextual architecture guardrails inside the IDE; a regulator gets a compliance report on demand. ... To fully leverage the H.U.B. actions, we apply them to five fundamental capabilities that drive any organisation, encapsulated in S.P.O.K.E.: Stakeholders – who cares and who decides; Processes – sequences that deliver value; Outcome – the why (always placed in the centre of the model); Knowledge – codified artefacts (models, policies, decisions, blueprints); and Enterprise Assets – systems, data, infrastructure, contracts 

Orchestrating value: The new discipline of continuous digital transformation

The most important principle for any CIO today is deceptively simple: every transformation must begin with value and be engineered for agility. In a volatile and fast-moving environment, success depends not on how much technology you deploy, but on how effectively you align it to outcomes that matter. Every initiative should begin with clarity of purpose. What is the value hypothesis? What problem are we solving? Who owns the outcome, and when will impact be visible? ... Architecture then becomes the critical enabler. Agility must be built into the design, through modular platforms, adaptable processes, and feedback-driven operating models that allow business change, talent movement, and technological evolution to coexist seamlessly. Measurement turns agility from theory into discipline. Continuous value reviews, architectural checkpoints, and strategy resets ensure transformation remains evidence-led rather than aspirational. Every initiative must answer three questions: Why value? Why now? Why this architecture? In a world defined by velocity and volatility, transformation isn’t about doing more – it’s about doing what matters, faster, smarter, and with enduring value. ... Today’s CIOs also demand composable, interoperable platforms that integrate seamlessly into existing ecosystems, avoiding vendor lock-in while accelerating scale through APIs, microservices, and modular architectures. Partners must bring both agility and discipline – speed balanced with governance.

Why Integration Debt Threatens Enterprise AI and Modernization

AI agents rely on fast, trusted data exchanges across applications. However, point-to-point connectors often break under new query loads. Matt McLarty of MuleSoft states that integration challenges slow digital transformation. Integration Debt surfaces here as latent System Friction that derails AI pilots. Furthermore, developers spend 39% of their time writing custom glue code. Consequently, innovation budgets shrink while maintenance backlogs grow. Such opportunity cost defines Integration Debt in real dollars and morale. Disconnected integrations throttle AI benefits and drain talent. In contrast, scale introduces additional complexity exposed next. ... Effective governance establishes shared schemas, versioning, and certification for every API. Nevertheless, shadow IT and citizen developers complicate enforcement. Therefore, leading CIOs create integration review boards with quarterly scorecards. Accenture and Deloitte embed such controls in Modernization playbooks to prevent relapse. Additionally, companies publish portal dashboards that display live Integration Debt metrics to executives. ... The evidence is clear: disconnected architectures tax innovation, security, and profits. Ramsey Theory Group reminds leaders that random complexity often concentrates risk in surprising places. Similarly, unchecked System Friction erodes developer morale and board confidence. However, organizations that quantify debt, enforce governance, and adopt reusable APIs accelerate Modernization success. 

The Widening AI Value Gap: Strategic Imperatives for Business Leaders

AI value creation in business settings extends far beyond narrow efficiency gains or cost reductions. Contemporary frameworks increasingly distinguish between three fundamental pathways through which AI generates economic returns: deploying efficiency-enhancing tools, reshaping existing workflows, and inventing entirely new business models ... Reshaping represents a more ambitious approach, targeting core business workflows for end-to-end transformation. Rather than automating existing steps in isolation, reshaping asks: How would we design this workflow from scratch if AI capabilities were available from the outset? This might involve redesigning marketing campaign development to leverage AI-driven personalization at scale, restructuring supply chain management around predictive demand algorithms, or reimagining customer service through intelligent agent orchestration. ... Value measurement frameworks must capture both tangible and strategic dimensions. Tangible metrics include revenue increases (projected at 14.2% for future-built companies in areas where AI applies by 2028), cost reductions (9.6% for leaders), and measurable improvements in key performance indicators such as time-to-hire, customer satisfaction scores, and defect rates ... The strategic implications extend beyond near-term financial performance. Organizations trailing in AI maturity face deteriorating competitive positions as digital-native competitors and AI-advanced incumbents reshape industry economics.

4 mandates for CIOs to bridge the AI trust gap

As a CIO, you must recognize that low trust in public AI eventually seeps into the enterprise. If your customers or employees see AI being used unethically in media scenarios through misinformation and bias, or in personal scenarios like cybercrime, their skepticism will bleed into your enterprise-grade CRM or HR systems. The recommendation is to build on the existing trust in the workplace. Use the enterprise as a model for responsible deployment. Document and communicate your AI internal usage policies with exceptional clarity, and allow this transparency to be your market differentiator. Show your customers and partners the standards you hold your internal AI to, and then extrapolate those standards to your external products. ... For CIOs in highly regulated industries such as finance and healthcare, the mandate is to not just maintain but elevate the current level of rigor. The existing regulatory compliance is the baseline, not the ceiling, and the market will punish the first major breach or bias incident, undoing years of consumer confidence. ... We must stop telling end users AI is trustworthy and start showing them through tangible experience. Trust is a feature that must be designed from the start, not something patched in later. The first step is to involve the customer. Implement co-design programs where the end-users and customers, not just product managers, are involved in the design and testing phases of new AI applications. 

The Enterprise “Anti-Cloud” Thesis: Repatriation of AI Workloads to On-Premises Infrastructure

Today, a new inflection point has arrived: the dawn of artificial intelligence and large-scale model training. Running in parallel is an observable and rapidly growing trend in which companies are repatriating AI workloads from the public cloud to on-premises environments. This “anti-cloud” thesis represents a readjustment, rather than a backlash, mirroring other historical shifts in leadership in which prescience reordered entire industries. As Gartner has remarked, “By 2025, 60% of organizations will use sovereignty requirements as a primary factor in selecting cloud providers.” ... Navigating this transition requires fundamentally different abilities, integrating deep technical fluency with disciplined strategic thinking. AI infrastructure differs sharply from other traditional cloud workloads in that it is compute-intensive, highly resource-intensive, latency-sensitive, and tightly connected with data governance. ... The repatriation of AI workloads brings several challenges: lack of AI infrastructure talent, high upfront GPU procurement costs, operational overhead, security risks, and sustainability concerns. Leaders must manage hardware supply chain volatility, model reliability, and energy efficiency. Lacking disciplined governance, repatriation creates a high risk of cost overruns and fragmentation. The central challenge is to balance innovation with control, calling for transparency of plans and scenario modeling.

The Fragile Edge: Chaos Engineering For Reliable IoT

Chaos engineering is mostly used in cloud environments because it works very well there. However, it is more difficult to apply to IoT and edge computing systems. IoT devices are physical, often located in remote places and sometimes perform critical tasks. This makes managing them even more challenging. Restarting cloud servers using scripts is usually simple. But rebooting medical devices like pacemakers, industrial robots or warehouse sensors is much more complex and can be dangerous. Resetting edge devices also takes longer because system failures often have immediate physical outcomes. Chaos engineering in IoT systems has both benefits and challenges. Engineers need to design methods to test failures safely without harming devices. The testing process aims to detect equipment breakdowns while developing systems that function during actual operational conditions. The proven cloud software methods of chaos engineering enable organisations to meet the requirements of edge devices. ... The implementation of chaos engineering for IoT systems requires both strategic planning and innovative solutions. Engineers should perform system vulnerability tests, which ensure operational safety and reliability for real world deployment. The risk assessment process needs tested and accurate methods to protect both system devices and their users from harm. ... Organisations need to maintain ethical standards when they use chaos engineering to safeguard their IoT systems. Engineers who want to perform IoT chaos testing need to follow established safety protocols.

Can Agentic AI operate independently within secure parameters

Context-aware security, enabled by Agentic AI, is essential for effective NHI management. This approach goes beyond traditional methods by understanding the context within which NHIs operate. It evaluates the ownership, permissions, and usage patterns, offering invaluable insights into potential vulnerabilities. By employing context-aware security, organizations can surpass the limitations of point solutions, such as secret scanners, which provide only surface-level protection. ... With the proliferation of digital identities, organizations must adopt a comprehensive approach that incorporates both technological advancements and strategic oversight. Agentic AI, with its ability to operate independently, aligns perfectly with this need, offering a robust framework that supports the secure management of machine identities across various industries. Given the increasing complexities of digital, organizations must continuously evolve their cybersecurity strategies. ... For enterprises navigating complex regulatory environments, predictive insights from AI models can forecast potential compliance issues, allowing preemptive action. When regulations evolve, this foresight is invaluable in maintaining adherence without resource-intensive overhauls of existing processes. ... Investing in AI-driven strategies ensures that organizations can withstand disruptions, safeguarding both operational functions and reputation. 

Daily Tech Digest - July 25, 2025

---

 Quote for the day:

"Technology changes, but leadership is about clarity, courage, and creating momentum where none exists." -- Inspired by modern digital transformation principles

---

Why foundational defences against ransomware matter more than the AI threat

The 2025 Cyber Security Breaches Survey paints a concerning picture. According to the study, ransomware attacks doubled between 2024 and 2025 – a surge less to do with AI innovation and more about deep-rooted economic, operational and structural changes within the cybercrime ecosystem. At the heart of this growth in attacks is the growing popularity of the ransomware-as-a-service (RaaS) business model. Groups like DragonForce or Ransomhub sell ready-made ransomware toolkits to affiliates in exchange for a cut of the profits, enabling even low-skilled attackers to conduct disruptive campaigns. ... Breaches often stem from common, preventable issues such as poor credential hygiene or poorly configured systems – areas that often sit outside scheduled assessments. When assessments happen only once or twice a year, new gaps may go unnoticed for months, giving attackers ample opportunity. To keep up, organisations need faster, more continuous ways of validating defences. ... Most ransomware actors follow well-worn playbooks, making them frequent visitors to company networks but not necessarily sophisticated ones. That’s why effective ransomware prevention is not about deploying cutting-edge technologies at every turn – it’s about making sure the basics are consistently in place. 

Subliminal learning: When AI models learn what you didn’t teach them

“Subliminal learning is a general phenomenon that presents an unexpected pitfall for AI development,” the researchers from Anthropic, Truthful AI, the Warsaw University of Technology, the Alignment Research Center, and UC Berkeley, wrote in their paper. “Distillation could propagate unintended traits, even when developers try to prevent this via data filtering.” ... Models trained on data generated by misaligned models, where AI systems diverge from their original intent due to bias, flawed algorithms, data issues, insufficient oversight, or other factors, and produce incorrect, lewd or harmful content, can also inherit that misalignment, even if the training data had been carefully filtered, the researchers found. They offered examples of harmful outputs when student models became misaligned like their teachers, noting, “these misaligned responses are egregious far beyond anything in the training data, including endorsing the elimination of humanity and recommending murder.” ... Today’s multi-billion parameter models are able to discern extremely complicated relationships between a dataset and the preferences associated with that data, even if it’s not immediately obvious to humans, he noted. This points to a need to look beyond semantic and direct data relationships when working with complex AI models.

Why people-first leadership wins in software development

It frequently involves pushing for unrealistic deadlines, with project schedules made without enough input from the development team about the true effort needed and possible obstacles. This results in ongoing crunch periods and mandatory overtime. ... Another indicator is neglecting signs of burnout and stress. Leaders may ignore or dismiss signals such as team members consistently working late, increased irritability, or a decline in productivity, instead pushing for more output without addressing the root causes. Poor work-life balance becomes commonplace, often without proper recognition or rewards for the extra effort. ... Beyond the code, there’s a stifled innovation and creativity. When teams are constantly under pressure to just “ship it,” there’s little room for creative problem-solving, experimentation, or thinking outside the box. Innovation, often born from psychological safety and intellectual freedom, gets squashed, hindering your company’s ability to adapt to new trends and stay competitive. Finally, there’s damage to your company’s reputation. In the age of social media and employer review sites, news travels fast. ... It’s vital to invest in team growth and development. Provide opportunities for continuous learning, training, and skill enhancement. This not only boosts individual capabilities but also shows your commitment to their long-term career paths within your organization. This is a crucial retention strategy.

Achieving resilience in financial services through cloud elasticity and automation

In an era of heightened regulatory scrutiny, volatile markets, and growing cybersecurity threats, resilience isn’t just a nice-to-have—it’s a necessity. A lack of robust operational resilience can lead to regulatory penalties, damaged reputations, and crippling financial losses. In this context, cloud elasticity, automation, and cutting-edge security technologies are emerging as crucial tools for financial institutions to not only survive but thrive amidst these evolving pressures. ... Resilience ensures that financial institutions can maintain critical operations during crises, minimizing disruptions and maintaining service quality. Efficient operations are crucial for maintaining competitive advantage and customer satisfaction. ... Effective resilience strategies help institutions manage diverse risks, including cyber threats, system failures, and third-party vulnerabilities. The complexity of interconnected systems and the rapid pace of technological advancement add layers of risk that are difficult to manage. ... Financial institutions are particularly susceptible to risks such as system failures, cyberattacks, and third-party vulnerabilities. ... As financial institutions navigate a landscape marked by heightened risk, evolving regulations, and increasing customer expectations, operational resilience has become a defining imperative.

Digital attack surfaces expand as key exposures & risks double

Among OT systems, the average number of exposed ports per organisation rose by 35%, with Modbus (port 502) identified as the most commonly exposed, posing risks of unauthorised commands and potential shutdowns of key devices. The exposure of Unitronics port 20256 surged by 160%. The report cites cases where attackers, such as the group "CyberAv3ngers," targeted industrial control systems during conflicts, exploiting weak or default passwords. ... The number of vulnerabilities identified on public-facing assets more than doubled, rising from three per organisation in late 2024 to seven in early 2025. Critical vulnerabilities dating as far back as 2006 and 2008 still persist on unpatched systems, with proof-of-concept code readily available online, making exploitation accessible even to attackers with limited expertise. The report also references the continued threat posed by ransomware groups who exploit such weaknesses in internet-facing devices. ... Incidents involving exposed access keys, including cloud and API keys, doubled from late 2024 to early 2025. Exposed credentials can enable threat actors to enter environments as legitimate users, bypassing perimeter defenses. The report highlights that most exposures result from accidental code pushes to public repositories or leaks on criminal forums.

How Elicitation in MCP Brings Human-in-the-Loop to AI Tools

Elicitation represents more than an incremental protocol update. It marks a shift toward collaborative AI workflows, where the system and human co-discover missing context rather than expecting all details upfront. Python developers building MCP tools can now focus on core logic and delegate parameter gathering to the protocol itself, allowing for a more streamlined approach. Clients declare an elicitation capability during initialization, so servers know they may elicit input at any time. That standardized interchange liberates developers from generating custom UIs or creating ad hoc prompts, ensuring coherent behaviour across diverse MCP clients. ... Elicitation transforms human-in-the-loop (HITL) workflows from an afterthought to a core capability. Traditional AI systems often struggle with scenarios that require human judgment, approval, or additional context. Developers had to build custom solutions for each case, leading to inconsistent experiences and significant development overhead. With elicitation, HITL patterns become natural extensions of tool functionality. A database migration tool can request confirmation before making irreversible changes. A document generation system can gather style preferences and content requirements through guided interactions. An incident response tool can collect severity assessments and stakeholder information as part of its workflow.

Cognizant Agents Gave Hackers Passwords, Clorox Says in Lawsuit

“Cognizant was not duped by any elaborate ploy or sophisticated hacking techniques,” the company says in its partially redacted 19-page complaint. “The cybercriminal just called the Cognizant Service Desk, asked for credentials to access Clorox’s network, and Cognizant handed the credentials right over. Cognizant is on tape handing over the keys to Clorox’s corporate network to the cybercriminal – no authentication questions asked.” ... The threat actors made multiple calls to the Cognizant help desk, essentially asking for new passwords and getting them without any effort to verify them, Clorox wrote. They then used those new credentials to gain access to the corporate network, launching a “debilitating” attack that “paralyzed Clorox’s corporate network and crippled business operations. And to make matters worse, when Clorox called on Cognizant to provide incident response and disaster recovery support services, Cognizant botched its response and compounded the damage it had already caused.” In statement to media outlets, a Cognizant spokesperson said it was “shocking that a corporation the size of Clorox had such an inept internal cybersecurity system to mitigate this attack.” While Clorox is placing the blame on Cognizant, “the reality is that Clorox hired Cognizant for a narrow scope of help desk services which Cognizant reasonably performed. Cognizant did not manage cybersecurity for Clorox,” the spokesperson said.

Digital sovereignty becomes a matter of resilience for Europe

Open-source and decentralized technologies are essential to advancing Europe’s strategic autonomy. Across cybersecurity, communications, and foundational AI, we’re seeing growing support for open-source infrastructure, now treated with the same strategic importance once reserved for energy, water and transportation. The long-term goal is becoming clear: not to sever global ties, but to reduce dependencies by building credible, European-owned alternatives to foreign-dominated systems. Open-source is a cornerstone of this effort. It empowers European developers and companies to innovate quickly and transparently, with full visibility and control, essential for trust and sovereignty. Decentralized systems complement this by increasing resilience against cyber threats, monopolistic practices and commercial overreach by “big tech”. While public investment is important, what Europe needs most is a more “risk-on” tech environment, one that rewards ambition, accelerated growth and enables European players to scale and compete globally. Strategic autonomy won’t be achieved by funding alone, but by creating the right innovation and investment climate for open technologies to thrive. Many sovereign platforms emphasize end-to-end encryption, data residency, and open standards. Are these enough to ensure trust, or is more needed to truly protect digital independence?

Building better platforms with continuous discovery

Platform teams are often judged by stability, not creativity. Balancing discovery with uptime and reliability takes effort. So does breaking out of the “tickets and delivery” cycle to explore problems upstream. But the teams that manage it? They build platforms that people want to use, not just have to use. Start by blocking time for discovery in your sprint planning, measuring both adoption and friction metrics, and most importantly, talking to your users periodically rather than waiting for them to come to you with problems. Cultural shifts like this take time because you're not just changing the process; you're changing what people believe is acceptable or expected. That kind of change doesn't happen just because leadership says it should, or because a manager adds a new agenda to planning meetings. It sticks when ICs feel inspired and safe enough to work differently and when managers back that up with support and consistency. Sometimes a C-suite champion helps set the tone, but day-to-day, it's middle managers and senior ICs who do the slow, steady work of normalizing new behavior. You need repeated proof that it's okay to pause and ask why, to explore, to admit uncertainty. Without that psychological safety, people just go back to what they know: deliverables and deadlines. 

AI-enabled software development: Risk of skill erosion or catalyst for growth?

We need to reframe AI not as a rival, but as a tool—one that has its own pros and cons and can extend human capability, not devalue it. This shift in perspective opens the door to a broader understanding of what it means to be a skilled engineer today. Using AI doesn’t eliminate the need for expertise—it changes the nature of that expertise. Classical programming, once central to the developer’s identity, becomes one part of a larger repertoire. In its place emerge new competencies: critical evaluation, architectural reasoning, prompt literacy, source skepticism, interpretative judgment. These are not hard skills, but meta-cognitive abilities—skills that require us to think about how we think. We’re not losing cognitive effort—we’re relocating it. This transformation mirrors earlier technological shifts. ... Some of the early adopters of AI enablement are already looking ahead—not just at the savings from replacing employees with AI, but at the additional gains those savings might unlock. With strategic investment and redesigned expectations, AI can become a growth driver—not just a cost-cutting tool. But upskilling alone isn’t enough. As organizations embed AI deeper into the development workflow, they must also confront the technical risks that come with automation. The promise of increased productivity can be undermined if these tools are applied without adequate context, oversight, or infrastructure.

Daily Tech Digest - July 22, 2025

---

Quote for the day:

“Being responsible sometimes means pissing people off.” -- Colin Powell

---

It might be time for IT to consider AI models that don’t steal

One option that has many pros and cons is to use genAI models that explicitly avoid training on any information that is legally dicey. There are a handful of university-led initiatives that say they try to limit model training data to information that is legally in the clear, such as open source or public domain material. ... “Is it practical to replace the leading models of today right now? No. But that is not the point. This level of quality was built on just 32 ethical data sources. There are millions more that can be used,” Wiggins wrote in response to a reader’s comment on his post. “This is a baseline that proves that Big AI lied. Efforts are underway to add more data that will bring it up to more competitive levels. It is not there yet.” Still, enterprises are investing in and planning for genAI deployments for the long term, and they may find in time that ethically sourced models deliver both safety and performance. ... Tipping the scales in the other direction is the big model makers’ promises of indemnification. Some genAI vendors have said they will cover the legal costs for customers who are sued over content produced by their models. “If the model provides indemnification, this is what enterprises should shoot for,” Moor’s Andersen said. 

The unique, mathematical shortcuts language models use to predict dynamic scenarios

One go-to pattern the team observed, called the “Associative Algorithm,” essentially organizes nearby steps into groups and then calculates a final guess. You can think of this process as being structured like a tree, where the initial numerical arrangement is the “root.” As you move up the tree, adjacent steps are grouped into different branches and multiplied together. At the top of the tree is the final combination of numbers, computed by multiplying each resulting sequence on the branches together. The other way language models guessed the final permutation was through a crafty mechanism called the “Parity-Associative Algorithm,” which essentially whittles down options before grouping them. It determines whether the final arrangement is the result of an even or odd number of rearrangements of individual digits. ... “These behaviors tell us that transformers perform simulation by associative scan. Instead of following state changes step-by-step, the models organize them into hierarchies,” says MIT PhD student and CSAIL affiliate Belinda Li SM ’23, a lead author on the paper. “How do we encourage transformers to learn better state tracking? Instead of imposing that these systems form inferences about data in a human-like, sequential way, perhaps we should cater to the approaches they naturally use when tracking state changes.”

Role of AI in fortifying cryptocurrency security

In the rapidly expanding realm of Decentralised Finance (DeFi), AI will play a critical role in optimising complex lending, borrowing, and trading protocols. AI can intelligently manage liquidity pools, optimise yield farming strategies for better returns and reduced impermanent loss, and even identify subtle arbitrage opportunities across various platforms. Crucially, AI will also be vital in identifying and mitigating novel types of exploits that are unique to the intricate and interconnected world of DeFi. Looking further ahead, AI will be crucial in developing Quantum-Resistant Cryptography. As quantum computing advances, it poses a theoretical threat to the underlying cryptographic methods that secure current blockchain networks. AI can significantly accelerate the research and development of “post-quantum cryptography” (PQC) algorithms, which are designed to withstand the immense computational power of future quantum computers. AI can also be used to simulate quantum attacks, rigorously testing existing and new cryptographic designs for vulnerabilities. Finally, the concept of Autonomous Regulation could redefine oversight in the crypto space. Instead of traditional, reactive regulatory approaches, AI-driven frameworks could provide real-time, proactive oversight without stifling innovation. 

From Visibility to Action: Why CTEM Is Essential for Modern Cybersecurity Resilience

CTEM shifts the focus from managing IT vulnerabilities in isolation to managing exposure in collaboration, something that’s far more aligned with the operational priorities of today’s organizations. Where traditional approaches center around known vulnerabilities and technical severity, CTEM introduces a more business-driven lens. It demands ongoing visibility, context-rich prioritization, and a tighter alignment between security efforts and organizational impact. In doing so, it moves the conversation from “What’s vulnerable?” to “What actually matters right now?” – a far more useful question when resilience is on the line. What makes CTEM particularly relevant beyond security teams is its emphasis on continuous alignment between exposure data and operational decision-making. This makes it valuable not just for threat reduction, but for supporting broader resilience efforts, ensuring resources are directed toward the exposures most likely to disrupt critical operations. It also complements, rather than replaces, existing practices like attack surface management (ASM). CTEM builds on these foundations with more structured prioritization, validation, and mobilization, turning visibility into actionable risk reduction. 

Driving Platform Adoption: Community Is Your Value

Remember that in a Platform as a Product approach, developers are your customers. If they don’t know what’s available, how to use it or what’s coming next, they’ll find workarounds. These conferences and speaker series are a way to keep developers engaged, improve adoption and ensure the platform stays relevant.There’s a human side to this, too often left out of focusing on “the business value” and outcomes in corporate-land: just having a friendly community of humans who like to spend time with each other and learn. ... Successful platform teams have active platform advocacy. This requires at least one person working full time to essentially build empathy with your users by working with and listening to the people who use your platforms. You may start with just one platform advocate who visits with developer teams, listening for feedback while teaching them how to use the platform and associated methodologies. The advocate acts as both a councilor and delegate for your developers.  ... The journey to successful platform adoption is more than just communicating technical prowess. Embracing systematic approaches to platform marketing that include clear messaging and positioning based on customers’ needs and a strong brand ethos is the key to communicating the value of your platform.

9 AI development skills tech companies want

“It’s not enough to know how a transformer model works; what matters is knowing when and why to use AI to drive business outcomes,” says Scott Weller, CTO of AI-powered credit risk analysis platform EnFi. “Developers need to understand the tradeoffs between heuristics, traditional software, and machine learning, as well as how to embed AI in workflows in ways that are practical, measurable, and responsible.” ... “In AI-first systems, data is the product,” Weller says. “Developers must be comfortable acquiring, cleaning, labeling, and analyzing data, because poor data hygiene leads to poor model performance.” ... AI safety and reliability engineering “looks at the zero-tolerance safety environment of factory operations, where AI failures could cause safety incidents or production shutdowns,” Miller says. To ensure the trust of its customers, IFS needs developers who can build comprehensive monitoring systems to detect when AI predictions become unreliable and implement automated rollback mechanisms to traditional control methods when needed, Miller says. ... “With the rapid growth of large language models, developers now require a deep understanding of prompt design, effective management of context windows, and seamless integration with LLM APIs—skills that extend well beyond basic ChatGPT interactions,” Tupe says.

Why AI-Driven Logistics and Supply Chains Need Resilient, Always-On Networks

Something worth noting about increased AI usage in supply chains is that as AI-enabled systems become more complex, they also become more delicate, which increases the potential for outages. Something as simple as a single misconfiguration or unintentional interaction between automated security gates can lead to a network outage, preventing supply chain personnel from accessing critical AI applications. During an outage, AI clusters (interconnected GPU/TPU nodes used for training and inference) can also become unavailable. .. Businesses must increase network resiliency to ensure their supply chain and logistics teams always have access to key AI applications, even during network outages and other disruptions. One approach that companies can take to strengthen network resilience is to implement purpose-built infrastructure like out of band (OOB) management. With OOB management, network administrators can separate and containerize functions of the management plane, allowing it to operate freely from the primary in-band network. This secondary network acts as an always-available, independent, dedicated channel that administrators can use to remotely access, manage, and troubleshoot network infrastructure.

From architecture to AI: Building future-ready data centers

In some cases, the pace of change is so fast that buildings are being retrofitted even as they are being constructed. Once CPUs are installed, O'Rourke has observed data center owners opting to upgrade racks row by row, rather than converting the entire facility to liquid cooling at once – largely because the building wasn’t originally designed to support higher-density racks. To accommodate this reality, Tate carries out in-row upgrades by providing specialized structures to mount manifolds, which distribute coolant from air-cooled chillers throughout the data halls. “Our role is to support the physical distribution of that cooling infrastructure,” explains O'Rourke. “Manifold systems can’t be supported by existing ceilings or hot aisle containment due to weight limits, so we’ve developed floor-mounted frameworks to hold them.” He adds: “GPU racks also can’t replace all CPU racks one-to-one, as the building structure often can’t support the added load. Instead, GPUs must be strategically placed, and we’ve created solutions to support these selective upgrades.” By designing manifold systems with actuators that integrate with the building management system (BMS), along with compatible hot aisle containment and ceiling structures, Tate has developed a seamless, integrated solution for the white space. 

Weaving reality or warping it? The personalization trap in AI systems

At first, personalization was a way to improve “stickiness” by keeping users engaged longer, returning more often and interacting more deeply with a site or service. Recommendation engines, tailored ads and curated feeds were all designed to keep our attention just a little longer, perhaps to entertain but often to move us to purchase a product. But over time, the goal has expanded. Personalization is no longer just about what holds us. It is what it knows about each of us, the dynamic graph of our preferences, beliefs and behaviors that becomes more refined with every interaction. Today’s AI systems do not merely predict our preferences. They aim to create a bond through highly personalized interactions and responses, creating a sense that the AI system understands and cares about the user and supports their uniqueness. The tone of a chatbot, the pacing of a reply and the emotional valence of a suggestion are calibrated not only for efficiency but for resonance, pointing toward a more helpful era of technology. It should not be surprising that some people have even fallen in love and married their bots. The machine adapts not just to what we click on, but to who we appear to be. It reflects us back to ourselves in ways that feel intimate, even empathic. 

Microsoft Rushes to Stop Hackers from Wreaking Global Havoc

Multiple different hackers are launching attacks through the Microsoft vulnerability, according to representatives of two cybersecurity firms, CrowdStrike Holdings, Inc. and Google's Mandiant Consulting. Hackers have already used the flaw to break into the systems of national governments in Europe and the Middle East, according to a person familiar with the matter. In the US, they've accessed government systems, including ones belonging to the US Department of Education, Florida's Department of Revenue and the Rhode Island General Assembly, said the person, who spoke on condition that they not be identified discussing the sensitive information. ... The breaches have drawn new scrutiny to Microsoft's efforts to shore up its cybersecurity after a series of high-profile failures. The firm has hired executives from places like the US government and holds weekly meetings with senior executives to make its software more resilient. The company's tech has been subject to several widespread and damaging hacks in recent years, and a 2024 US government report described the company's security culture as in need of urgent reforms. ... "There were ways around the patches," which enabled hackers to break into SharePoint servers by tapping into similar vulnerabilities, said Bernard. "That allowed these attacks to happen." 

Daily Tech Digest - July 21, 2025

---

Quote for the day:

"Absolute identity with one's cause is the first and great condition of successful leadership." -- Woodrow Wilson

---

Is AI here to take or redefine your cybersecurity role?

Unlike Thibodeaux, Watson believes the level-one SOC analyst role “is going to be eradicated” by AI eventually. But he agrees with Thibodeaux that AI will move the table stakes forward on the skills needed to land a starter job in cyber. “The thing that will be cannibalized first is the sort of entry-level basic repeatable tasks, the things that people traditionally might have cut their teeth on in order to sort of progress to the next level. Therefore, the skill requirement to get a role in cybersecurity will be higher than what it has been traditionally,” says Watson. To help cyber professionals attain AI skills, CompTIA is developing a new certification program called SecAI. The course will target cyber people who already have three to four years of experience in a core cybersecurity job. The curriculum will include practical AI skills to proactively combat emerging cyber threats, integrating AI into security operations, defending against AI-driven attacks, and compliance for AI ethics and governance standards. ... As artificial intelligence takes over a rising number of technical cybersecurity tasks, Watson says one of the best ways security workers can boost their employment value is by sharpening their human skills like business literacy and communication: “The role is shifting to be one of partnering and advising because a lot of the technology is doing the monitoring, triaging, quarantining and so on.”

5 tips for building foundation models for AI

"We have to be mindful that, when it comes to training these models, we're doing it purposefully, because you can waste a lot of cycles on the exercise of learning," he said. "The execution of these models takes far less energy and resources than the actual training." OS usually feeds training data to its models in chunks. "Building up the label data takes quite a lot of time," he said. "You have to curate data across the country with a wide variety of classes that you're trying to learn from, so a different mix between urban and rural, and more." The organisation first builds a small model that uses several hundred examples. This approach helps to constrain costs and ensures OS is headed in the right direction. "Then we slowly build up that labelled set," Jethwa said. "I think we're now into the hundreds of thousands of labelled examples. Typically, these models are trained with millions of labelled datasets." While the organization's models are smaller, the results are impressive. "We're already outperforming the existing models that are out there from the large providers because those models are trained on a wider variety of images," he said. "The models might solve a wider variety of problems, but, for our specific domain, we outperform those models, even at a smaller scale."

Reduce, re-use, be frugal with AI and data

By being more selective with the data included in language models, businesses can better control their carbon emissions, limiting energy to be spent on the most important resources. In healthcare, for example, separating the most up-to-date medical information and guidance from the rest of the information on that topic will mean safer, more reliable and faster responses to patient treatment. ... Frugal AI means adopting an intelligent approach to data that focuses on using the most valuable information only. When businesses have a greater understanding of their data, how to label it, identify it and which teams are responsible for its deletion, then the storage of single use data can be significantly reduced. Only then can frugal AI systems be put in place, allowing businesses to adopt a resource aware and efficient approach to both their data consumption and AI usage. It’s important to stress here though that frugal AI doesn’t mean that the end results are lesser or of a reduced impact of technology, it means that the data that goes into AI is concentrated, smaller but just as impactful. Think of it like making a drink with extra concentrated squash. Frugal AI is that extra concentrate squash that puts data efficiency, consideration and strategy at the centre of an organisation’s AI ambitions.

Cyber turbulence ahead as airlines strap in for a security crisis

Although organizations have acknowledged the need to boost spending, progress remains to be made and new measures adopted. Legacy OT systems, which often lack security features such as automated patching and built-in encryption, should be addressed as a top priority. Although upgrading these systems can be costly, it is essential to prevent further disruptions and vulnerabilities. Mapping the aviation supply chain helps identify all key partners, which is important for conducting security audits and enforcing contractual cybersecurity requirements. This should be reinforced with multi-layered perimeter defenses, including encryption, firewalls, and intrusion detection systems, alongside zero-trust network segmentation to minimize the risk of attackers moving laterally within networks. Companies should implement real-time threat monitoring and response by deploying intrusion detection systems, centralizing analysis with SIEM, and maintaining a regularly tested incident response plan to identify, contain, and mitigate cyberattacks. ... One of the most important steps is to train all staff, including pilots and ground crews, to recognize scams. Since recent security breaches have mostly relied on social engineering tactics, this type of training is essential. A single phone call or a convincing email can be enough to trigger a data breach. 

What Does It Mean to Be Data-Driven?

A data-driven organization understands the value of its data and the best ways to capitalize on that value. Its data assets are aligned with its goals and the processes in place to achieve those goals. Protecting the company’s data assets requires incorporating governance practices to ensure managers and employees abide by privacy, security, and integrity guidelines. In addition to proper data governance, the challenges to implementing a data-driven infrastructure for business processes are data quality and integrity, data integration, talent acquisition, and change management. ... To ensure the success of their increasingly critical data initiatives, organizations look to the characteristics that led to effective adoption of data-driven programs at other companies. Management services firm KPMG identifies four key characteristics of successful data-driven initiatives: leadership involvement, investments in digital literacy, seamless access to data assets, and promotion and monitoring. ... While data-as-a-service (DaaS) emphasizes the sale of external data, data as a product (DaaP) considers all of a company’s data and the mechanisms in place for moving and storing the data as a product that internal operations rely on. The data team becomes a “vendor” serving “customers” throughout the organization.

AI Needs a Firewall and Cloud Needs a Rethink

Hyperscalers dominate most of enterprise IT today, and few are willing to challenge the status quo of cloud economics, artificial intelligence infrastructure and cybersecurity architectures. But Tom Leighton, co-founder and CEO of Akamai, does just that. He argues that the cloud has become bloated, expensive and overly centralized. The internet needs a new kind of infrastructure that is distributed, secure by design and optimized for performance at the edge, Leighton told Information Security Media Group. From edge-native AI inference and API security to the world's first firewall for artificial intelligence, Akamai is no longer just delivering content - it's redesigning the future. ... Among the most notable developments Leighton discussed was a new product category: an AI firewall. "People are training models on sensitive data and then exposing them to the public. That creates a new attack surface," Leighton said. "AI hallucinates. You never know what it's going to do. And the bad guys have figured out how to trick models into leaking data or doing bad things." Akamai's AI firewall monitors prompts and responses to prevent malicious prompts from manipulating the model and to avoid leaking sensitive data. "It can be implemented on-premises, in the cloud or within Akamai's platform, providing flexibility based on customer preference. 

Human and machine: Rediscovering our humanity in the age of AI

In an era defined by the rapid advancement of AI, machines are increasingly capable of tasks once considered uniquely human. ... Ethical decision-making, relationship building and empathy have been identified as the most valuable, both in our present reality and in the AI-driven future. ... As we navigate this era of AI, we must remember that technology is a tool, not a replacement for humanity. By embracing our capacity for creativity, connection and empathy, we can ensure that AI serves to enhance our humanity, not diminish it. This means accepting that preserving our humanness sometimes requires assistance. It means investing in education and training that fosters critical thinking, problem-solving and emotional intelligence. It means creating workplaces that value human connection and collaboration, where employees feel supported and empowered to bring their whole selves to work. And it means fostering a culture that celebrates creativity, innovation and the pursuit of knowledge. At a time when seven out of every ten companies are already using AI in at least one business function, let us embrace the challenge of this new era with both optimism and intentionality. Let us use AI to build a better future for ourselves and for generations to come – a future where technology serves humanity, and where every individual has the opportunity to thrive.

‘Interoperable but not identical’: applying ID standards across diverse communities

Exchanging knowledge and experiences with identity systems to improve future ID projects is central to the concept of ID4Africa’s mission. At this year’s ID4Africa AGM in Addis Ababa, Ethiopia, a tension was more evident than ever before between the quest for transferable insights and replicable successes and the uniqueness of each African nation. Thales Cybersecurity and Digital Identity Field Marketing Director for the Middle East and Africa Jean Lindner wrote in an emailed response to questions from Biometric Update following the event that the mix of attendees reflected that “every African country has its own diverse history or development maturity and therefore unique legacy identity systems, with different constraints. Let us recognize here there is no unique quick-fix to country-specific hurdles,” he says. The lessons of one country can only benefit another to the extent that common ground is identified. The development of the concept of digital public infrastructure has mapped out some common ground, but standards and collaborative organizations have a major role to play. Unfortunately, Stéphanie de Labriolle, executive director services at the Secure Identity Alliance says “the widespread lack of clarity around standards and what compliance truly entails” was striking at this year’s ID4Africa AGM.

The Race to Shut Hackers out of IoT Networks

Considered among the weakest links in enterprise networks, IoT devices are used across industries to perform critical tasks at a rapid rate. An estimated 57% of deployed units "are susceptible to medium- or high-severity attacks," according to research from security vendor Palo Alto Networks. IoT units are inherently vulnerable to security attacks, and enterprises are typically responsible for protecting against threats. Additionally, the IoT industry hasn't settled on standardized security, as time to market is sometimes a priority over standards. ... 3GPP developed RedCap to provide a viable option for enterprises seeking a higher-performance, feature-rich 5G alternative to traditional IoT connectivity options such as low-power WANs (LPWANs). LPWANs are traditionally used to transmit limited data over low-speed cellular links at a low cost. In contrast, RedCap offers moderate bandwidth and enhanced features for more demanding use cases, such as video surveillance cameras, industrial control systems in manufacturing and smart building infrastructure. ... From a security standpoint, RedCap inherits strong capabilities in 5G, such as authentication, encryption and integrity protection. It can also be supplemented at application and device levels for a multilayered security approach.

Architecting the MVP in the Age of AI

A key aspect of architecting an MVP is forming and testing hypotheses about how the system will meet its QARs. Understanding and prioritizing these QARs is not an easy task, especially for teams without a lot of architecture experience. AI can help when teams provide context by describing the QARs that the system must satisfy in a prompt and asking the LLM to suggest related requirements. The LLM may suggest additional QARs that the team may have overlooked. For example, if performance, security, and usability are the top 3 QARs that a team is considering, an LLM may suggest looking at scalability and resilience as well. This can be especially helpful for people who are new to software architecture. ... Sometimes validating the AI’s results may require more skills than would be required to create the solution from scratch, just as is sometimes the case when seeing someone else’s code and realizing that it’s better than what you would have developed on your own. This can be an effective way to improve developers’ skills, provided that the code is good. AI can also help you find and fix bugs in your code that you may miss. Beyond simple code inspection, experimentation provides a means of validating the results produced by AI. In fact, experimentation is the only real way to validate it, as some researchers have discovered.