Daily Tech Digest by Kannan Subbiah: model

Showing posts with label model. Show all posts

Daily Tech Digest - August 03, 2026

Quote for the day:

“Treat employees like they make a difference, and they will.” -- Jim Goodnight

🎧 Listen to the audio debrief on YouTube

▶ Play Audio Digest

Duration: 23 mins • Perfect for listening on the go.

Stop graphing everything: When GraphRAG actually beats vector RAG

The article discusses the recent trend of using knowledge graphs for modern artificial intelligence applications and advises against using them for absolutely every project. While these graphs offer useful ways to connect different pieces of information, they also introduce significant costs, added complexity, and ongoing maintenance demands. For most everyday needs, standard vector retrieval remains the more sensible and efficient option. This traditional method works very well for direct questions where the system simply needs to find existing text with a similar meaning. Still, there are specific situations where a graph approach clearly performs better than standard methods. The main benefit of using a graph system appears when a task involves complex reasoning with multiple steps. If a project requires connecting scattered details across massive amounts of data or understanding deep networks of relationships, such as tracking company ownership or untangling legal documents, a graph structure becomes necessary. The main takeaway is to look closely at what your project actually requires before paying for a new, complex database setup. By saving graph tools for problems that truly need them and using standard retrieval for direct questions, development teams can build capable systems without taking on needless expenses or technical burdens.

Why AI Code Risk Must Be a Line Item in Every Organization's Budget

As artificial intelligence increasingly writes our software, organizations are restructuring their budgets to treat security testing tools as essential infrastructure rather than mere compliance checkboxes. A recent survey reveals that the primary bottleneck in software development has shifted from writing code to reviewing and validating it. With AI generating massive volumes of code, human review capacity is struggling to keep pace. Almost half of the organizations surveyed are already running AI generated code in production, yet many admit that AI introduced issues, such as security vulnerabilities, unintended dependencies, and performance problems, regularly slip through the cracks. These challenges have drawn the attention of legal, compliance, and leadership teams, prompting the creation of new policies and more rigorous review processes. Additionally, relying heavily on AI poses a long term risk to the development of junior engineers, who lose valuable learning opportunities. Despite these hurdles, the productivity gains and cost reductions are too significant to ignore. However, simply purchasing more security tools is not quite enough. To safely manage this transition, organizations need cross disciplinary visibility into their codebases. By understanding exactly how software changes from week to week, teams can confidently harness this speed without sacrificing system reliability.

Zero Trust drives biometrics in physical access security

Organizations are increasingly applying the concept of continuous verification to physical security, recognizing that protecting a building is just as important as protecting a digital network. Historically, physical access relied on perimeter defense, assuming anyone inside a facility could be trusted. This approach is no longer effective against modern threats. When companies invest heavily in digital safeguards but neglect physical entry points, they leave critical assets vulnerable to unauthorized access. To bridge this gap, organizations are adopting biometric identification methods, such as fingerprint and facial recognition. Unlike traditional keys or access cards, which can be easily lost, shared, or stolen, biometrics provide a reliable link between the authorized identity and the actual person requesting entry. However, simply adding a biometric scanner to a standard door does not prevent unauthorized individuals from following someone inside. Effective security requires a layered approach that combines identity checks with controlled movement through specialized portals or gates. By creating multiple verification points, facilities ensure that if one security measure fails, others are in place to prevent a breach. This comprehensive strategy is now expanding beyond highly restricted data centers into standard office buildings, providing reliable and straightforward access control for our modern corporate environments today.

The Bull And Bear Case For Digital Design In The Age Of AI

In "The Bull And Bear Case For Digital Design In The Age Of AI," Andy Budd explores how artificial intelligence shifts the balance of power for digital designers. For years, designers have argued they could produce better work if organizational barriers like limited engineering time or rigid product roadmaps were removed. The optimistic bull case suggests AI grants this wish. By enabling designers to prototype, write copy, and build working models independently, AI reduces their reliance on permission from others. Strong designers can evolve into hybrid leaders with direct influence over product outcomes, rather than simply making screens. Conversely, the pessimistic bear case argues that this newfound independence also removes a convenient excuse for weak work. When designers can build their own solutions, they must own the results. Additionally, AI empowers product managers and engineers to bypass design teams entirely by generating plausible interfaces that look decent but lack careful thought. This could narrow the designer's role to mere maintenance and cleanup. Ultimately, Budd suggests both futures will unfold simultaneously. The best designers will use AI to increase their agency and impact, while average practitioners may find their roles shrinking or replaced as the industry demands genuine product judgment over superficial polish.

Crisis Leadership in 2026: Why Organizational Resilience Has Become the New Measure of Trust

In 2026, organizational resilience has evolved from a purely operational checklist into a critical measure of leadership and trust. Historically, companies focused on how fast they could recover systems during a crisis. Today, stakeholders look far beyond basic business continuity to evaluate how leaders communicate, adapt, and make decisions under pressure. Resilience is now recognized as a broad leadership skill rather than just an IT or operations duty. A major shift is the interconnected nature of modern crises. What starts as a technical glitch can rapidly snowball into financial, reputational, and operational challenges. To navigate this effectively, trust must be built well before a crisis hits. A company's overall credibility during a disruption draws heavily on its past behavior and consistent transparency with the public. Furthermore, while technology like artificial intelligence aids in crisis monitoring, it also fuels new risks like deepfakes and rapid misinformation, making human judgment more vital than ever. Leaders cannot rely on speed alone; they must show adaptability and empathy. Crucially, a crisis does not end when systems come back online. Stakeholders watch closely to see if organizations learn from their mistakes and follow through on long-term improvements. Ultimately, true organizational resilience means sustaining confidence through continual change.

FinAI & Managing AI Costs: Innovation, Production, and Lifecycle

This episode of the StarCIO podcast focuses on the emerging practice of FinAI, which involves strategically managing the costs associated with artificial intelligence. As organizations increasingly adopt AI, they often face unexpected expenses across different stages of development. The discussion highlights the importance of tracking these costs carefully, from the initial innovation and experimentation phases right through to full scale production. Rather than just focusing on the technology itself, leaders need to understand the financial implications of the entire AI lifecycle. This includes the computing power required for training models, the ongoing expenses of running them, and the resources needed for continuous monitoring and updates. By applying financial operations principles to artificial intelligence, companies can make more informed decisions about which projects to pursue and how to allocate their budgets effectively. The podcast suggests that successful AI initiatives require a balanced approach, where innovation is encouraged but guided by clear financial visibility and accountability. Ultimately, mastering FinAI allows organizations to maximize the true value of their investments while avoiding the budget overruns that often derail complex technology projects. Managing the complete lifecycle ensures that artificial intelligence delivers real business benefits without compromising financial stability or essential long-term growth objectives.

The Massive AI Security Hole Your CISO Doesn't Know About

Many security teams mistakenly apply traditional software security checks to modern artificial intelligence deployments, leaving a significant vulnerability unchecked. While conventional systems are predictable, language models process unpredictable natural language, rendering standard defenses like input validation and traditional data loss prevention ineffective. Most chief information security officers ensure the infrastructure is secure but completely overlook the model itself. Consequently, these models are exposed to unique risks such as indirect prompt injections, where hidden instructions in standard documents trick the model into extracting internal data. Another major oversight is granting AI agents broad permissions rather than limiting their access to specific tasks, essentially creating an internal threat without a clear audit trail. Furthermore, models can inadvertently leak sensitive information through normal conversation, and employees often expose company data by using unsanctioned consumer AI tools. To actually secure these deployments, organizations must fundamentally adapt their approach. This involves strictly limiting the permissions of AI agents, treating any data the model retrieves as potentially malicious, and implementing strict controls on what the model can send outward. Additionally, conducting specialized adversarial testing and providing approved internal AI tools will help close these gaps, ensuring the system is genuinely secure from the inside out.

Managing your supplier risk isn't a deadline. It's about your resilience

The Digital Operational Resilience Act is shifting how financial technology companies in the United Kingdom approach third-party risk. While many organizations view compliance as a completed checklist of policies and questionnaires, true operational security requires a deeper understanding of the supplier ecosystem. Financial technology firms rely heavily on external connections, such as cloud infrastructure and payment systems, meaning every external connection introduces a potential vulnerability. Rather than treating regulations as a mere compliance exercise, organizations should use them as frameworks to build practical resilience. This involves fully mapping technology dependencies, identifying concentration risks, updating contracts to reflect actual risk levels, and rigorously testing incident response plans in realistic scenarios. Organizations that understand their data flows and supply chain dependencies do more than satisfy regulatory requirements; they establish reliable foundations that build trust with institutional clients and partners. As regulatory enforcement becomes more rigorous following the initial implementation phase, superficial compliance is no longer adequate. Companies must transition from treating supplier risk as a deadline to viewing it as a core management priority. Genuine resilience means knowing exactly what happens if a critical supplier fails and having the proven capacity to maintain continuity during an actual incident, ensuring long-term operational stability.

AI is making cybersecurity fundamentals more important than ever

The rise of artificial intelligence in cyberattacks has led many to believe we need entirely new defensive playbooks. However, industry experts argue that AI actually makes traditional cybersecurity fundamentals more critical than ever. Rather than inventing entirely novel vulnerability classes, AI empowers attackers to execute familiar techniques—like social engineering, credential theft, and exploiting unpatched software—at unprecedented speed and scale. Because AI systems can continuously scan for misconfigurations and weak access controls, long-standing security debt is now a severe liability. To defend against these rapidly automated threats, organizations must double down on basic practices such as multifactor authentication, zero-trust architectures, routine system patching, and proper identity management. These foundational controls efficiently block entire categories of attacks, preventing modern adversaries from easily penetrating sensitive digital environments. While generative AI introduces specific new risks like prompt injection, most immediate threats still rely on conventional technical oversights. Furthermore, relying solely on AI for corporate defense without dedicated human oversight is a dangerous trap. Security professionals must clearly understand core principles to verify AI-generated recommendations and ensure that automated tools function correctly. Ultimately, the most effective strategy pairs a strong foundation of basic security hygiene with the massive scale of defensive AI, preserving essential human accountability.

Keeping Proprietary Data Out of AI Training Models

As artificial intelligence becomes a standard part of business operations, companies face a serious new risk: the accidental sharing of their private information. When employees use AI tools, the data they enter can sometimes be absorbed into the system's training models. According to legal experts, the primary danger here is the permanent loss of trade secrets and intellectual property. If your company's private strategies or customer details are used to train a public AI model, that information could eventually benefit your competitors. Currently, many organizations handle this risk poorly by keeping their legal, security, and purchasing teams in separate silos. This separation often allows hidden AI features in standard software updates to slip through the cracks. To fix this, companies must adopt a unified, cross-functional approach to reviewing new technology. Most importantly, businesses cannot rely on simple opt-out buttons or marketing promises to protect their assets. Chief Information Officers and legal teams must demand strict, written guarantees in their vendor contracts. These agreements must clearly state that no company data, including prompts and inputs, will be used to train or improve any AI models. Furthermore, companies must secure the right to independently audit vendors to ensure complete and ongoing compliance.

Daily Tech Digest - January 17, 2026

Quote for the day:

"Success does not consist in never making mistakes but in never making the same one a second time." -- George Bernard Shaw

Expectations from AI ramp up as investors eye returns in 2026

Billions in investments and a concerted focus on the tech over the past few years has led to artificial intelligence (AI) completely transforming how major global industries work. Now, investors are finally expecting to see some returns. ... Investors will no longer be satisfied with AI’s potential future capabilities – they want measurable returns on investment (ROI), says Jiahao Sun, the CEO of Flock.ie, a platform that allows users to build, train and deploy AI models in a decentralised manner. AI investment is entering its “show me the money era”, he says. This isn’t to say that investments into AI will pause, but that investors will begin prioritising critical areas that give guaranteed returns. These could include agentic AI platforms that enable multi-agent orchestration; AI-native infrastructures built for scale, security and interoperability; data modernisation tools that unlock the full potential of unstructured data; and AI observability and safety tools that monitor, govern and refine agent behaviour in real time, explains Neeraj Abhyankar, the VP of Data and AI at R Systems. ... “Single-purpose tools will be absorbed into unified AI platforms. The era of juggling 10 different AI products is ending and the race to offer a complete, integrated experience will intensify,” he adds. Meanwhile, some experts say that the EU’s AI Act will – for better or for worse – prohibit European firms from experimenting with high-risk use cases for AI.

The Next S-Curve of Cybersecurity: Governing Trust in a New Converging Intelligence Economy

Cybersecurity has crossed a threshold where it no longer merely protects technology ~ it governs trust itself. In an era defined by AI-driven decision-making, decentralized financial systems, cloud-to-edge computing, and the approaching reality of quantum disruption, cyber risk is no longer episodic or containable. It is continuous, compounding, and enterprise-defining. What changed in 2025 wasn’t just the threat landscape. It was the architecture of risk. Identity replaced networks as the dominant attack surface. Software supply chains emerged as systemic liabilities. Machine intelligence ~ on both sides of the attack began evolving faster than the controls designed to govern it. For boards, investors, and executives, this marked the end of cybersecurity as a control function and the beginning of cybersecurity as a strategic mandate. ... The next S-curve of cybersecurity is not driven by better tooling. It is driven by a shift in how trust is architected and governed across a converging ecosystem. This new curve is defined by: Identity-centric security rather than network-centric defense; Data-aware protection instead of application-bound controls; Continuous assurance rather than point-in-time audits; and Integration with enterprise risk, governance, and capital strategy Cybersecurity evolves from a defensive posture into a trust architecture discipline ~ one that governs how intelligence, identity, data, and decisions interact at scale.

Why Mental Fitness Is Leadership's Next Frontier

The distinction Craze draws between mental health and mental fitness is crucial. Mental health, he explains, is ultimately about functioning—being sufficiently free from psychological injury or mental illness to show up and perform one's job. "Your mental health or illness is a private matter between yourself, and perhaps your family or physician, and is a matter of respecting your individual rights," he says. Mental fitness, by contrast, is about capacity. "Assuming you are mentally healthy enough to show up and perform your job, then mental fitness is all about how well your mind performs under load, over time, and in conditions of uncertainty," Craze explains. "Being mentally healthy is a baseline. Being mentally fit is what allows leaders to think clearly at hour ten, stay composed in conflict, and recover quickly after setbacks rather than slowly eroding away," he says. Here, the comparison to elite athletics is instructive. In professional sports, no one confuses being injury-free with being competition-ready. Leadership has been slower to make that distinction, even as today’s executives face sustained cognitive and emotional demands that would have been unthinkable a generation ago. ... One of the most persistent myths in leadership development, according to Craze, is the idea that thinking happens in some abstract cognitive space, detached from the body. "In reality, every act of judgment, attention and self-control has an underlying physiological component and cost," he says.

Taking the Technical Leadership Path

Without technical alignment, individuals constantly touch the same codebase, adding their feature in the simplest way (for them) but often they do this without ensuring the codebase is kept consistent. Over time accidental complexity grows such as having five different libraries that do the same job, or seven different implementations of how an email or push notification is sent and when someone wants to make a future change to that area, their work is now much harder. ... There are plenty of resources available to develop leadership skills. Kua advised to break broader leadership skills into specific ones, such as coaching, mentoring, communicating, mediating, influencing, etc. Even when someone is not a formal leader, there are daily opportunities to practice these skills in the workplace, he said. ... Formal technical leaders are accountable for ensuring teams have enough technical leadership. One way of doing this is to cultivate an environment where everyone is comfortable stepping up and demonstrating technical leadership. When you do this well, this means everyone can demonstrate informal technical leadership. Formal leaders exist because not all teams are automatically healthy or high-performing. I’m sure every technical person can remember a team they’ve been on with two engineers constantly debating about which approach to take, and wish someone had stepped in to help the team reach a decision. In an ideal world, a formal leader wouldn’t be necessary, but it’s rare that teams live in the perfect world.

From model collapse to citation collapse: risks of over-reliance on AI in the academy

Model collapse is the slow erosion of a generative AI system grounded in reality as it learns more and more from machine-generated data rather than from human-generated content. As a result of model collapse, the AI model loses diversity in its outputs, reinforces its misconceptions, increases its confidence in its hallucinations and amplifies its biases. ... Among all the writing tasks involved in research, GenAI appears to be disproportionately good at writing literature reviews. ChatGPT and Google Gemini both have deep research features that try to take a deep dive into the literature on a topic, returning heavily sourced and relatively accurate syntheses of the related research, while typically avoiding the well-documented tendency to hallucinate sources altogether. In some ways, it should not be too surprising that these technologies thrive in this area because literature reviews are exactly the sort of thing GenAI should be good at: textual summaries that stay pretty close to the source material. But here is my major concern: while nothing is fundamentally wrong with the way GenAI surfaces sources for literature reviews, it risks exacerbating the citation Matthew effect that tools like Google Scholar have caused. Modern AI models largely thrive on a snapshot of the internet circa 2022. In fact, I suspect that verifiably pre-2022 datasets will become prized sources for future models, largely untainted by AI-generated content, in much the same way that pre-World War II steel is prized for its lack of radioactive contamination from nuclear testing.

Why is Debugging Hard? How to Develop an Effective Debugging Mindset

Here’s how most developers debug code: Something is broken; Let me change the line; Let’s refresh (wishing the error would go away); Hmm… still broken!; Now, let me add a console.log(); Let me refresh again (Ah, this time it may…); Ok, looks like this time it worked! This is reaction-based debugging. It’s like throwing a stone in the dark or finding a needle in a haystack. It feels busy, it sounds productive, but it’s mostly guessing. And guessing doesn’t scale in programming. This approach and the guessing mindset make debugging hard for developers. The lack of a methodology and solid approach makes many devs feel helpless and frustrated, which makes the process feel much more difficult than coding. This is why we need a different mental model, a defined skillset to master the art of debugging. ... Good debuggers don’t fight bugs. They investigate them. They don’t start with the mindset of “How do I fix this?”. They start with, “Why must this bug exist?” This one question changes everything. When you ask about the existence of a bug, you go back to the history to collect information about the code, its changes, and its flow. Then, you feed this information through a “mental model” to make decisions that lead you to the fix. ... Once the facts are clear and assumptions are visible, the debugging makes its way forward. Now you’ll need to form a hypothesis. A hypothesis is a simple cause-and-effect statement: If this assumption is wrong, then the behaviour makes sense. If not, provide a fix.

Promptware Kill Chain – Five-Step Kill Chain Model for Analyzing Cyberthreats

While the security industry has focused narrowly on prompt injection as a catch-all term, the reality is far more complex. Attacks now follow systematic, sequential patterns: initial access through malicious prompts, privilege escalation by bypassing safety constraints, establishing persistence in system memory, moving laterally across connected services, and finally executing their objectives. This mirrors how traditional malware campaigns unfold, suggesting that conventional cybersecurity knowledge can inform AI security strategies. ... The promptware kill chain begins with Initial Access, where attackers insert malicious instructions through prompt injection—either directly from users or indirectly through poisoned documents retrieved by the system. The second phase, Privilege Escalation, involves jailbreaking techniques that bypass safety training designed to refuse harmful requests. ... Traditional malware achieves persistence through registry modifications or scheduled tasks. Promptware exploits the data stores that LLM applications depend on. Retrieval-dependent persistence embeds payloads in data repositories like email systems or knowledge bases, reactivating when the system retrieves similar content. Even more potent is retrieval-independent persistence, which targets the agent’s memory directly, ensuring the malicious instructions execute on every interaction regardless of user input.

AI SOC Agents Are Only as Good as the Data They Are Fed

If your telemetry is fragmented, your schemas are inconsistent, or your context is missing, you won’t get faster responses from AI SOC agents. You’ll just get faster mistakes. These agents are being built to excel at cybersecurity analysis and decision support. They are not constructed to wrangle data collection, cleansing, normalization, and governance across dozens of sources. ... Modern SOCs integrate telemetry from EDRs, cloud providers, identity, networks, SaaS apps, data lakes, and more. Normalizing all that into a common schema eliminates the constant “translation tax.” An agent that can analyze standardized fields once, and doesn’t have to re-learn CrowdStrike vs. Splunk Search Processing Language vs. vendor-specific JavaScript Object Notation, will make faster, more reliable decisions. ... If the agent must “crawl back” into five source systems to enrich an alert on its own, latency spikes and success rates drop. The right move is to centralize, normalize, and clean security data into an accessible store, like a data lake, for your AI SOC agents and continue streaming a distilled, security-relevant subset to the Security Information and Event Management (SIEM) platform for detections and cybersecurity analysts. Let the SIEM be the place where detections originate; let the lake be the place your agents do their deep thinking. The problem is that the industry’s largest SIEM, Endpoint Detection and Response (EDR), and Security Orchestration, Automation, and Response (SOAR) platforms are consolidating into vertically integrated ecosystems. ...”

IT portfolio management: Optimizing IT assets for business value

The enterprise’s most critical systems for conducting day-to-day business are a category unto themselves. These systems may be readily apparent, or hidden deep in a technical stack. So all assets should be evaluated as to how mission-critical they are. ... The goal of an IT portfolio is to contain assets that are presently relevant and will continue to be relevant well into the future. Consequently, asset risk should be evaluated for each IT resource. Is the resource at risk for vendor sunsetting or obsolescence? Is the vendor itself unstable? Does IT have the on-staff resources to continue running a given system, no matter how good it is (a custom legacy system written in COBOL and Assembler, for example)? Is a particular system or piece of hardware becoming too expense to run? Do existing IT resources have a clear path to integration with the new technologies that will populate IT in the future? ... Is every IT asset pulling its weight? Like monetary and stock investments, technologies under management must show they are continuing to produce measurable and sustainable value. The primary indicators of asset value that IT uses are total cost of ownership (TCO) and return on investment (ROI). TCO is what gauges the value of an asset over time. For instance, investments in new servers for the data center might have paid off four years ago, but now the data center has an aging bay of servers with obsolete technology and it is cheaper to relocate compute to the cloud.

Ransomware activity never dies, it multiplies

One of the most significant findings in the study involves extortion campaigns that do not rely on encryption. These attacks focus on stealing data and threatening to publish it, skipping the deployment of ransomware entirely. Encryption based attacks remained just above 4,700 incidents annually. When data theft extortion is included, total extortion incidents reached 6,182 in 2025. That represents a 23% increase compared with 2024. Snakefly, which runs the Cl0p ransomware operation, played a major role in this shift. These actors exploited vulnerabilities in widely used enterprise software to extract data at scale. Victims included large organizations in government and industry, with some campaigns affecting hundreds of companies through a single flaw. ... A newer ransomware strain tracked as Warlock drew attention due to its tooling and infrastructure. First observed in mid 2025, Warlock attacks exploited a zero day vulnerability in Microsoft SharePoint and used DLL sideloading for payload delivery. Analysis linked Warlock to tooling previously associated with Chinese espionage activity, including signed drivers and custom command frameworks. Some ransomware payloads appeared to be modified versions of leaked LockBit code, combined with older malware components. The study notes overlaps between ransomware activity and long running espionage campaigns, where ransomware deployment may serve operational or financial goals within broader intrusion efforts.

Daily Tech Digest - December 26, 2025

Quote for the day:

“Rarely have I seen a situation where doing less than the other guy is a good strategy.” -- Jimmy Spithill

Is Your Enterprise Architecture Ready for AI?

The old model of building, deploying, and governing apps is being reshaped into a composable enterprise blueprint. By abstracting complexity through visual models and machine intelligence, businesses are creating systems that are faster to adapt yet demand stronger governance, interoperability, and security. What emerges is not just acceleration but transformation at the foundation. ... With AI copilots spitting out code at scale, the traditional software development life cycle faces an existential test. Developers may not fully understand every line of AI-generated code, making manual reviews insufficient. The solution: automate aggressively. ... This new era also demands AI observability in SDLC, tracking provenance, explainability, and liability. Provenance shows the chain of prompts and responses. Explainability clarifies decisions. Bias and drift monitoring ensure AI systems don’t quietly shift into harmful or unreliable patterns. Without these, enterprises risk blind trust in black-box code. ... The destination for enterprises is clear: AI-native enterprise architecture and composable enterprise blueprint strategies, where every capability is exposed as an API and orchestrated by LCNC and AI. The road, however, is slowed by legacy monoliths in industries like banking and healthcare. These systems won’t vanish overnight. Instead, strategies like wrapping monoliths with APIs and gradually replacing components will define the journey.

After LLMs and agents, the next AI frontier: video language models

World models — which some refer to as video language models — are the new frontier in AI, following in the footsteps of the iconic ChatGPT and more recently, AI agents. Current AI tech largely affects digital outcomes, but world models will allow AI to improve physical outcomes. World models are designed to help robots understand the physical world around them, allowing them to track, identify and memorize objects. On top of that, just like humans planning their future, world models allow robots to determine what comes next — and plan their actions accordingly. ... Beyond robotics, world models simulate real-world scenarios. They could be used to improve safety features for autonomous cars or simulate a factory floor to train employees. World models pair human experiences with AI in the real world, said Deepak Seth, director analyst at Gartner. “This human experience and what we see around us, what’s going on around us, is part of that world model, which language models are currently lacking,” Seth said. ... World models are one of several tools that will be used to deploy robots in the real world, and they will continue to improve, said Kenny Siebert, AI research engineer at Standard Bots. But the models suffer from similar problems — the hallucinations and degradation — that affect the likes of ChatGPT and video-generators. Moving hallucinations into the physical world could cause harm, so researchers are trying to solve those kinds of issues.

Hub & Spoke: The Operating System for AI-Enabled Enterprise Architecture

Today most enterprises still run on heroics, emails, slide decks, and 200-person conference calls. Even when a good repository and healthy collaboration culture exist, nothing “sticks” without a mechanism that relentlessly harvests reality, unifies understanding, and broadcasts the right truth to the right person at the right moment. That mechanism is a new application of hub-and-spoke – not just for data integration, but for architecture governance itself. We call it simply Hub & Spoke. ... At the centre runs a continuous cycle of three actions: Harvest – Ingest everything that matters: scanner output, CI/CD metadata, application inventories, risk registers, process models, meeting outcomes, human feedback, and (increasingly) agentic AI crawls; Unify – Connect the dots. Establish relationships, resolve duplicates, detect patterns and anti-patterns, and maintain one coherent model of the enterprise; and Broadcast – Push the right view, in the right language, through the right channel, at the right time. A CIO sees strategic heatmaps; a developer receives contextual architecture guardrails inside the IDE; a regulator gets a compliance report on demand. ... To fully leverage the H.U.B. actions, we apply them to five fundamental capabilities that drive any organisation, encapsulated in S.P.O.K.E.: Stakeholders – who cares and who decides; Processes – sequences that deliver value; Outcome – the why (always placed in the centre of the model); Knowledge – codified artefacts (models, policies, decisions, blueprints); and Enterprise Assets – systems, data, infrastructure, contracts

Orchestrating value: The new discipline of continuous digital transformation

The most important principle for any CIO today is deceptively simple: every transformation must begin with value and be engineered for agility. In a volatile and fast-moving environment, success depends not on how much technology you deploy, but on how effectively you align it to outcomes that matter. Every initiative should begin with clarity of purpose. What is the value hypothesis? What problem are we solving? Who owns the outcome, and when will impact be visible? ... Architecture then becomes the critical enabler. Agility must be built into the design, through modular platforms, adaptable processes, and feedback-driven operating models that allow business change, talent movement, and technological evolution to coexist seamlessly. Measurement turns agility from theory into discipline. Continuous value reviews, architectural checkpoints, and strategy resets ensure transformation remains evidence-led rather than aspirational. Every initiative must answer three questions: Why value? Why now? Why this architecture? In a world defined by velocity and volatility, transformation isn’t about doing more – it’s about doing what matters, faster, smarter, and with enduring value. ... Today’s CIOs also demand composable, interoperable platforms that integrate seamlessly into existing ecosystems, avoiding vendor lock-in while accelerating scale through APIs, microservices, and modular architectures. Partners must bring both agility and discipline – speed balanced with governance.

Why Integration Debt Threatens Enterprise AI and Modernization

AI agents rely on fast, trusted data exchanges across applications. However, point-to-point connectors often break under new query loads. Matt McLarty of MuleSoft states that integration challenges slow digital transformation. Integration Debt surfaces here as latent System Friction that derails AI pilots. Furthermore, developers spend 39% of their time writing custom glue code. Consequently, innovation budgets shrink while maintenance backlogs grow. Such opportunity cost defines Integration Debt in real dollars and morale. Disconnected integrations throttle AI benefits and drain talent. In contrast, scale introduces additional complexity exposed next. ... Effective governance establishes shared schemas, versioning, and certification for every API. Nevertheless, shadow IT and citizen developers complicate enforcement. Therefore, leading CIOs create integration review boards with quarterly scorecards. Accenture and Deloitte embed such controls in Modernization playbooks to prevent relapse. Additionally, companies publish portal dashboards that display live Integration Debt metrics to executives. ... The evidence is clear: disconnected architectures tax innovation, security, and profits. Ramsey Theory Group reminds leaders that random complexity often concentrates risk in surprising places. Similarly, unchecked System Friction erodes developer morale and board confidence. However, organizations that quantify debt, enforce governance, and adopt reusable APIs accelerate Modernization success.

The Widening AI Value Gap: Strategic Imperatives for Business Leaders

AI value creation in business settings extends far beyond narrow efficiency gains or cost reductions. Contemporary frameworks increasingly distinguish between three fundamental pathways through which AI generates economic returns: deploying efficiency-enhancing tools, reshaping existing workflows, and inventing entirely new business models ... Reshaping represents a more ambitious approach, targeting core business workflows for end-to-end transformation. Rather than automating existing steps in isolation, reshaping asks: How would we design this workflow from scratch if AI capabilities were available from the outset? This might involve redesigning marketing campaign development to leverage AI-driven personalization at scale, restructuring supply chain management around predictive demand algorithms, or reimagining customer service through intelligent agent orchestration. ... Value measurement frameworks must capture both tangible and strategic dimensions. Tangible metrics include revenue increases (projected at 14.2% for future-built companies in areas where AI applies by 2028), cost reductions (9.6% for leaders), and measurable improvements in key performance indicators such as time-to-hire, customer satisfaction scores, and defect rates ... The strategic implications extend beyond near-term financial performance. Organizations trailing in AI maturity face deteriorating competitive positions as digital-native competitors and AI-advanced incumbents reshape industry economics.

4 mandates for CIOs to bridge the AI trust gap

As a CIO, you must recognize that low trust in public AI eventually seeps into the enterprise. If your customers or employees see AI being used unethically in media scenarios through misinformation and bias, or in personal scenarios like cybercrime, their skepticism will bleed into your enterprise-grade CRM or HR systems. The recommendation is to build on the existing trust in the workplace. Use the enterprise as a model for responsible deployment. Document and communicate your AI internal usage policies with exceptional clarity, and allow this transparency to be your market differentiator. Show your customers and partners the standards you hold your internal AI to, and then extrapolate those standards to your external products. ... For CIOs in highly regulated industries such as finance and healthcare, the mandate is to not just maintain but elevate the current level of rigor. The existing regulatory compliance is the baseline, not the ceiling, and the market will punish the first major breach or bias incident, undoing years of consumer confidence. ... We must stop telling end users AI is trustworthy and start showing them through tangible experience. Trust is a feature that must be designed from the start, not something patched in later. The first step is to involve the customer. Implement co-design programs where the end-users and customers, not just product managers, are involved in the design and testing phases of new AI applications.

The Enterprise “Anti-Cloud” Thesis: Repatriation of AI Workloads to On-Premises Infrastructure

Today, a new inflection point has arrived: the dawn of artificial intelligence and large-scale model training. Running in parallel is an observable and rapidly growing trend in which companies are repatriating AI workloads from the public cloud to on-premises environments. This “anti-cloud” thesis represents a readjustment, rather than a backlash, mirroring other historical shifts in leadership in which prescience reordered entire industries. As Gartner has remarked, “By 2025, 60% of organizations will use sovereignty requirements as a primary factor in selecting cloud providers.” ... Navigating this transition requires fundamentally different abilities, integrating deep technical fluency with disciplined strategic thinking. AI infrastructure differs sharply from other traditional cloud workloads in that it is compute-intensive, highly resource-intensive, latency-sensitive, and tightly connected with data governance. ... The repatriation of AI workloads brings several challenges: lack of AI infrastructure talent, high upfront GPU procurement costs, operational overhead, security risks, and sustainability concerns. Leaders must manage hardware supply chain volatility, model reliability, and energy efficiency. Lacking disciplined governance, repatriation creates a high risk of cost overruns and fragmentation. The central challenge is to balance innovation with control, calling for transparency of plans and scenario modeling.

The Fragile Edge: Chaos Engineering For Reliable IoT

Chaos engineering is mostly used in cloud environments because it works very well there. However, it is more difficult to apply to IoT and edge computing systems. IoT devices are physical, often located in remote places and sometimes perform critical tasks. This makes managing them even more challenging. Restarting cloud servers using scripts is usually simple. But rebooting medical devices like pacemakers, industrial robots or warehouse sensors is much more complex and can be dangerous. Resetting edge devices also takes longer because system failures often have immediate physical outcomes. Chaos engineering in IoT systems has both benefits and challenges. Engineers need to design methods to test failures safely without harming devices. The testing process aims to detect equipment breakdowns while developing systems that function during actual operational conditions. The proven cloud software methods of chaos engineering enable organisations to meet the requirements of edge devices. ... The implementation of chaos engineering for IoT systems requires both strategic planning and innovative solutions. Engineers should perform system vulnerability tests, which ensure operational safety and reliability for real world deployment. The risk assessment process needs tested and accurate methods to protect both system devices and their users from harm. ... Organisations need to maintain ethical standards when they use chaos engineering to safeguard their IoT systems. Engineers who want to perform IoT chaos testing need to follow established safety protocols.

Can Agentic AI operate independently within secure parameters

Context-aware security, enabled by Agentic AI, is essential for effective NHI management. This approach goes beyond traditional methods by understanding the context within which NHIs operate. It evaluates the ownership, permissions, and usage patterns, offering invaluable insights into potential vulnerabilities. By employing context-aware security, organizations can surpass the limitations of point solutions, such as secret scanners, which provide only surface-level protection. ... With the proliferation of digital identities, organizations must adopt a comprehensive approach that incorporates both technological advancements and strategic oversight. Agentic AI, with its ability to operate independently, aligns perfectly with this need, offering a robust framework that supports the secure management of machine identities across various industries. Given the increasing complexities of digital, organizations must continuously evolve their cybersecurity strategies. ... For enterprises navigating complex regulatory environments, predictive insights from AI models can forecast potential compliance issues, allowing preemptive action. When regulations evolve, this foresight is invaluable in maintaining adherence without resource-intensive overhauls of existing processes. ... Investing in AI-driven strategies ensures that organizations can withstand disruptions, safeguarding both operational functions and reputation.

Daily Tech Digest - July 25, 2025

Quote for the day:

"Technology changes, but leadership is about clarity, courage, and creating momentum where none exists." -- Inspired by modern digital transformation principles

Why foundational defences against ransomware matter more than the AI threat

The 2025 Cyber Security Breaches Survey paints a concerning picture. According to the study, ransomware attacks doubled between 2024 and 2025 – a surge less to do with AI innovation and more about deep-rooted economic, operational and structural changes within the cybercrime ecosystem. At the heart of this growth in attacks is the growing popularity of the ransomware-as-a-service (RaaS) business model. Groups like DragonForce or Ransomhub sell ready-made ransomware toolkits to affiliates in exchange for a cut of the profits, enabling even low-skilled attackers to conduct disruptive campaigns. ... Breaches often stem from common, preventable issues such as poor credential hygiene or poorly configured systems – areas that often sit outside scheduled assessments. When assessments happen only once or twice a year, new gaps may go unnoticed for months, giving attackers ample opportunity. To keep up, organisations need faster, more continuous ways of validating defences. ... Most ransomware actors follow well-worn playbooks, making them frequent visitors to company networks but not necessarily sophisticated ones. That’s why effective ransomware prevention is not about deploying cutting-edge technologies at every turn – it’s about making sure the basics are consistently in place.

Subliminal learning: When AI models learn what you didn’t teach them

“Subliminal learning is a general phenomenon that presents an unexpected pitfall for AI development,” the researchers from Anthropic, Truthful AI, the Warsaw University of Technology, the Alignment Research Center, and UC Berkeley, wrote in their paper. “Distillation could propagate unintended traits, even when developers try to prevent this via data filtering.” ... Models trained on data generated by misaligned models, where AI systems diverge from their original intent due to bias, flawed algorithms, data issues, insufficient oversight, or other factors, and produce incorrect, lewd or harmful content, can also inherit that misalignment, even if the training data had been carefully filtered, the researchers found. They offered examples of harmful outputs when student models became misaligned like their teachers, noting, “these misaligned responses are egregious far beyond anything in the training data, including endorsing the elimination of humanity and recommending murder.” ... Today’s multi-billion parameter models are able to discern extremely complicated relationships between a dataset and the preferences associated with that data, even if it’s not immediately obvious to humans, he noted. This points to a need to look beyond semantic and direct data relationships when working with complex AI models.

Why people-first leadership wins in software development

It frequently involves pushing for unrealistic deadlines, with project schedules made without enough input from the development team about the true effort needed and possible obstacles. This results in ongoing crunch periods and mandatory overtime. ... Another indicator is neglecting signs of burnout and stress. Leaders may ignore or dismiss signals such as team members consistently working late, increased irritability, or a decline in productivity, instead pushing for more output without addressing the root causes. Poor work-life balance becomes commonplace, often without proper recognition or rewards for the extra effort. ... Beyond the code, there’s a stifled innovation and creativity. When teams are constantly under pressure to just “ship it,” there’s little room for creative problem-solving, experimentation, or thinking outside the box. Innovation, often born from psychological safety and intellectual freedom, gets squashed, hindering your company’s ability to adapt to new trends and stay competitive. Finally, there’s damage to your company’s reputation. In the age of social media and employer review sites, news travels fast. ... It’s vital to invest in team growth and development. Provide opportunities for continuous learning, training, and skill enhancement. This not only boosts individual capabilities but also shows your commitment to their long-term career paths within your organization. This is a crucial retention strategy.

Achieving resilience in financial services through cloud elasticity and automation

In an era of heightened regulatory scrutiny, volatile markets, and growing cybersecurity threats, resilience isn’t just a nice-to-have—it’s a necessity. A lack of robust operational resilience can lead to regulatory penalties, damaged reputations, and crippling financial losses. In this context, cloud elasticity, automation, and cutting-edge security technologies are emerging as crucial tools for financial institutions to not only survive but thrive amidst these evolving pressures. ... Resilience ensures that financial institutions can maintain critical operations during crises, minimizing disruptions and maintaining service quality. Efficient operations are crucial for maintaining competitive advantage and customer satisfaction. ... Effective resilience strategies help institutions manage diverse risks, including cyber threats, system failures, and third-party vulnerabilities. The complexity of interconnected systems and the rapid pace of technological advancement add layers of risk that are difficult to manage. ... Financial institutions are particularly susceptible to risks such as system failures, cyberattacks, and third-party vulnerabilities. ... As financial institutions navigate a landscape marked by heightened risk, evolving regulations, and increasing customer expectations, operational resilience has become a defining imperative.

Digital attack surfaces expand as key exposures & risks double

Among OT systems, the average number of exposed ports per organisation rose by 35%, with Modbus (port 502) identified as the most commonly exposed, posing risks of unauthorised commands and potential shutdowns of key devices. The exposure of Unitronics port 20256 surged by 160%. The report cites cases where attackers, such as the group "CyberAv3ngers," targeted industrial control systems during conflicts, exploiting weak or default passwords. ... The number of vulnerabilities identified on public-facing assets more than doubled, rising from three per organisation in late 2024 to seven in early 2025. Critical vulnerabilities dating as far back as 2006 and 2008 still persist on unpatched systems, with proof-of-concept code readily available online, making exploitation accessible even to attackers with limited expertise. The report also references the continued threat posed by ransomware groups who exploit such weaknesses in internet-facing devices. ... Incidents involving exposed access keys, including cloud and API keys, doubled from late 2024 to early 2025. Exposed credentials can enable threat actors to enter environments as legitimate users, bypassing perimeter defenses. The report highlights that most exposures result from accidental code pushes to public repositories or leaks on criminal forums.

How Elicitation in MCP Brings Human-in-the-Loop to AI Tools

Elicitation represents more than an incremental protocol update. It marks a shift toward collaborative AI workflows, where the system and human co-discover missing context rather than expecting all details upfront. Python developers building MCP tools can now focus on core logic and delegate parameter gathering to the protocol itself, allowing for a more streamlined approach. Clients declare an elicitation capability during initialization, so servers know they may elicit input at any time. That standardized interchange liberates developers from generating custom UIs or creating ad hoc prompts, ensuring coherent behaviour across diverse MCP clients. ... Elicitation transforms human-in-the-loop (HITL) workflows from an afterthought to a core capability. Traditional AI systems often struggle with scenarios that require human judgment, approval, or additional context. Developers had to build custom solutions for each case, leading to inconsistent experiences and significant development overhead. With elicitation, HITL patterns become natural extensions of tool functionality. A database migration tool can request confirmation before making irreversible changes. A document generation system can gather style preferences and content requirements through guided interactions. An incident response tool can collect severity assessments and stakeholder information as part of its workflow.

Cognizant Agents Gave Hackers Passwords, Clorox Says in Lawsuit

“Cognizant was not duped by any elaborate ploy or sophisticated hacking techniques,” the company says in its partially redacted 19-page complaint. “The cybercriminal just called the Cognizant Service Desk, asked for credentials to access Clorox’s network, and Cognizant handed the credentials right over. Cognizant is on tape handing over the keys to Clorox’s corporate network to the cybercriminal – no authentication questions asked.” ... The threat actors made multiple calls to the Cognizant help desk, essentially asking for new passwords and getting them without any effort to verify them, Clorox wrote. They then used those new credentials to gain access to the corporate network, launching a “debilitating” attack that “paralyzed Clorox’s corporate network and crippled business operations. And to make matters worse, when Clorox called on Cognizant to provide incident response and disaster recovery support services, Cognizant botched its response and compounded the damage it had already caused.” In statement to media outlets, a Cognizant spokesperson said it was “shocking that a corporation the size of Clorox had such an inept internal cybersecurity system to mitigate this attack.” While Clorox is placing the blame on Cognizant, “the reality is that Clorox hired Cognizant for a narrow scope of help desk services which Cognizant reasonably performed. Cognizant did not manage cybersecurity for Clorox,” the spokesperson said.

Digital sovereignty becomes a matter of resilience for Europe

Open-source and decentralized technologies are essential to advancing Europe’s strategic autonomy. Across cybersecurity, communications, and foundational AI, we’re seeing growing support for open-source infrastructure, now treated with the same strategic importance once reserved for energy, water and transportation. The long-term goal is becoming clear: not to sever global ties, but to reduce dependencies by building credible, European-owned alternatives to foreign-dominated systems. Open-source is a cornerstone of this effort. It empowers European developers and companies to innovate quickly and transparently, with full visibility and control, essential for trust and sovereignty. Decentralized systems complement this by increasing resilience against cyber threats, monopolistic practices and commercial overreach by “big tech”. While public investment is important, what Europe needs most is a more “risk-on” tech environment, one that rewards ambition, accelerated growth and enables European players to scale and compete globally. Strategic autonomy won’t be achieved by funding alone, but by creating the right innovation and investment climate for open technologies to thrive. Many sovereign platforms emphasize end-to-end encryption, data residency, and open standards. Are these enough to ensure trust, or is more needed to truly protect digital independence?

Building better platforms with continuous discovery

Platform teams are often judged by stability, not creativity. Balancing discovery with uptime and reliability takes effort. So does breaking out of the “tickets and delivery” cycle to explore problems upstream. But the teams that manage it? They build platforms that people want to use, not just have to use. Start by blocking time for discovery in your sprint planning, measuring both adoption and friction metrics, and most importantly, talking to your users periodically rather than waiting for them to come to you with problems. Cultural shifts like this take time because you're not just changing the process; you're changing what people believe is acceptable or expected. That kind of change doesn't happen just because leadership says it should, or because a manager adds a new agenda to planning meetings. It sticks when ICs feel inspired and safe enough to work differently and when managers back that up with support and consistency. Sometimes a C-suite champion helps set the tone, but day-to-day, it's middle managers and senior ICs who do the slow, steady work of normalizing new behavior. You need repeated proof that it's okay to pause and ask why, to explore, to admit uncertainty. Without that psychological safety, people just go back to what they know: deliverables and deadlines.

AI-enabled software development: Risk of skill erosion or catalyst for growth?

We need to reframe AI not as a rival, but as a tool—one that has its own pros and cons and can extend human capability, not devalue it. This shift in perspective opens the door to a broader understanding of what it means to be a skilled engineer today. Using AI doesn’t eliminate the need for expertise—it changes the nature of that expertise. Classical programming, once central to the developer’s identity, becomes one part of a larger repertoire. In its place emerge new competencies: critical evaluation, architectural reasoning, prompt literacy, source skepticism, interpretative judgment. These are not hard skills, but meta-cognitive abilities—skills that require us to think about how we think. We’re not losing cognitive effort—we’re relocating it. This transformation mirrors earlier technological shifts. ... Some of the early adopters of AI enablement are already looking ahead—not just at the savings from replacing employees with AI, but at the additional gains those savings might unlock. With strategic investment and redesigned expectations, AI can become a growth driver—not just a cost-cutting tool. But upskilling alone isn’t enough. As organizations embed AI deeper into the development workflow, they must also confront the technical risks that come with automation. The promise of increased productivity can be undermined if these tools are applied without adequate context, oversight, or infrastructure.

Daily Tech Digest - July 22, 2025

Quote for the day:

“Being responsible sometimes means pissing people off.” -- Colin Powell

It might be time for IT to consider AI models that don’t steal

One option that has many pros and cons is to use genAI models that explicitly avoid training on any information that is legally dicey. There are a handful of university-led initiatives that say they try to limit model training data to information that is legally in the clear, such as open source or public domain material. ... “Is it practical to replace the leading models of today right now? No. But that is not the point. This level of quality was built on just 32 ethical data sources. There are millions more that can be used,” Wiggins wrote in response to a reader’s comment on his post. “This is a baseline that proves that Big AI lied. Efforts are underway to add more data that will bring it up to more competitive levels. It is not there yet.” Still, enterprises are investing in and planning for genAI deployments for the long term, and they may find in time that ethically sourced models deliver both safety and performance. ... Tipping the scales in the other direction is the big model makers’ promises of indemnification. Some genAI vendors have said they will cover the legal costs for customers who are sued over content produced by their models. “If the model provides indemnification, this is what enterprises should shoot for,” Moor’s Andersen said.

The unique, mathematical shortcuts language models use to predict dynamic scenarios

One go-to pattern the team observed, called the “Associative Algorithm,” essentially organizes nearby steps into groups and then calculates a final guess. You can think of this process as being structured like a tree, where the initial numerical arrangement is the “root.” As you move up the tree, adjacent steps are grouped into different branches and multiplied together. At the top of the tree is the final combination of numbers, computed by multiplying each resulting sequence on the branches together. The other way language models guessed the final permutation was through a crafty mechanism called the “Parity-Associative Algorithm,” which essentially whittles down options before grouping them. It determines whether the final arrangement is the result of an even or odd number of rearrangements of individual digits. ... “These behaviors tell us that transformers perform simulation by associative scan. Instead of following state changes step-by-step, the models organize them into hierarchies,” says MIT PhD student and CSAIL affiliate Belinda Li SM ’23, a lead author on the paper. “How do we encourage transformers to learn better state tracking? Instead of imposing that these systems form inferences about data in a human-like, sequential way, perhaps we should cater to the approaches they naturally use when tracking state changes.”

Role of AI in fortifying cryptocurrency security

In the rapidly expanding realm of Decentralised Finance (DeFi), AI will play a critical role in optimising complex lending, borrowing, and trading protocols. AI can intelligently manage liquidity pools, optimise yield farming strategies for better returns and reduced impermanent loss, and even identify subtle arbitrage opportunities across various platforms. Crucially, AI will also be vital in identifying and mitigating novel types of exploits that are unique to the intricate and interconnected world of DeFi. Looking further ahead, AI will be crucial in developing Quantum-Resistant Cryptography. As quantum computing advances, it poses a theoretical threat to the underlying cryptographic methods that secure current blockchain networks. AI can significantly accelerate the research and development of “post-quantum cryptography” (PQC) algorithms, which are designed to withstand the immense computational power of future quantum computers. AI can also be used to simulate quantum attacks, rigorously testing existing and new cryptographic designs for vulnerabilities. Finally, the concept of Autonomous Regulation could redefine oversight in the crypto space. Instead of traditional, reactive regulatory approaches, AI-driven frameworks could provide real-time, proactive oversight without stifling innovation.

From Visibility to Action: Why CTEM Is Essential for Modern Cybersecurity Resilience

CTEM shifts the focus from managing IT vulnerabilities in isolation to managing exposure in collaboration, something that’s far more aligned with the operational priorities of today’s organizations. Where traditional approaches center around known vulnerabilities and technical severity, CTEM introduces a more business-driven lens. It demands ongoing visibility, context-rich prioritization, and a tighter alignment between security efforts and organizational impact. In doing so, it moves the conversation from “What’s vulnerable?” to “What actually matters right now?” – a far more useful question when resilience is on the line. What makes CTEM particularly relevant beyond security teams is its emphasis on continuous alignment between exposure data and operational decision-making. This makes it valuable not just for threat reduction, but for supporting broader resilience efforts, ensuring resources are directed toward the exposures most likely to disrupt critical operations. It also complements, rather than replaces, existing practices like attack surface management (ASM). CTEM builds on these foundations with more structured prioritization, validation, and mobilization, turning visibility into actionable risk reduction.

Driving Platform Adoption: Community Is Your Value

Remember that in a Platform as a Product approach, developers are your customers. If they don’t know what’s available, how to use it or what’s coming next, they’ll find workarounds. These conferences and speaker series are a way to keep developers engaged, improve adoption and ensure the platform stays relevant.There’s a human side to this, too often left out of focusing on “the business value” and outcomes in corporate-land: just having a friendly community of humans who like to spend time with each other and learn. ... Successful platform teams have active platform advocacy. This requires at least one person working full time to essentially build empathy with your users by working with and listening to the people who use your platforms. You may start with just one platform advocate who visits with developer teams, listening for feedback while teaching them how to use the platform and associated methodologies. The advocate acts as both a councilor and delegate for your developers. ... The journey to successful platform adoption is more than just communicating technical prowess. Embracing systematic approaches to platform marketing that include clear messaging and positioning based on customers’ needs and a strong brand ethos is the key to communicating the value of your platform.

9 AI development skills tech companies want

“It’s not enough to know how a transformer model works; what matters is knowing when and why to use AI to drive business outcomes,” says Scott Weller, CTO of AI-powered credit risk analysis platform EnFi. “Developers need to understand the tradeoffs between heuristics, traditional software, and machine learning, as well as how to embed AI in workflows in ways that are practical, measurable, and responsible.” ... “In AI-first systems, data is the product,” Weller says. “Developers must be comfortable acquiring, cleaning, labeling, and analyzing data, because poor data hygiene leads to poor model performance.” ... AI safety and reliability engineering “looks at the zero-tolerance safety environment of factory operations, where AI failures could cause safety incidents or production shutdowns,” Miller says. To ensure the trust of its customers, IFS needs developers who can build comprehensive monitoring systems to detect when AI predictions become unreliable and implement automated rollback mechanisms to traditional control methods when needed, Miller says. ... “With the rapid growth of large language models, developers now require a deep understanding of prompt design, effective management of context windows, and seamless integration with LLM APIs—skills that extend well beyond basic ChatGPT interactions,” Tupe says.

Why AI-Driven Logistics and Supply Chains Need Resilient, Always-On Networks

Something worth noting about increased AI usage in supply chains is that as AI-enabled systems become more complex, they also become more delicate, which increases the potential for outages. Something as simple as a single misconfiguration or unintentional interaction between automated security gates can lead to a network outage, preventing supply chain personnel from accessing critical AI applications. During an outage, AI clusters (interconnected GPU/TPU nodes used for training and inference) can also become unavailable. .. Businesses must increase network resiliency to ensure their supply chain and logistics teams always have access to key AI applications, even during network outages and other disruptions. One approach that companies can take to strengthen network resilience is to implement purpose-built infrastructure like out of band (OOB) management. With OOB management, network administrators can separate and containerize functions of the management plane, allowing it to operate freely from the primary in-band network. This secondary network acts as an always-available, independent, dedicated channel that administrators can use to remotely access, manage, and troubleshoot network infrastructure.

From architecture to AI: Building future-ready data centers

In some cases, the pace of change is so fast that buildings are being retrofitted even as they are being constructed. Once CPUs are installed, O'Rourke has observed data center owners opting to upgrade racks row by row, rather than converting the entire facility to liquid cooling at once – largely because the building wasn’t originally designed to support higher-density racks. To accommodate this reality, Tate carries out in-row upgrades by providing specialized structures to mount manifolds, which distribute coolant from air-cooled chillers throughout the data halls. “Our role is to support the physical distribution of that cooling infrastructure,” explains O'Rourke. “Manifold systems can’t be supported by existing ceilings or hot aisle containment due to weight limits, so we’ve developed floor-mounted frameworks to hold them.” He adds: “GPU racks also can’t replace all CPU racks one-to-one, as the building structure often can’t support the added load. Instead, GPUs must be strategically placed, and we’ve created solutions to support these selective upgrades.” By designing manifold systems with actuators that integrate with the building management system (BMS), along with compatible hot aisle containment and ceiling structures, Tate has developed a seamless, integrated solution for the white space.

Weaving reality or warping it? The personalization trap in AI systems

At first, personalization was a way to improve “stickiness” by keeping users engaged longer, returning more often and interacting more deeply with a site or service. Recommendation engines, tailored ads and curated feeds were all designed to keep our attention just a little longer, perhaps to entertain but often to move us to purchase a product. But over time, the goal has expanded. Personalization is no longer just about what holds us. It is what it knows about each of us, the dynamic graph of our preferences, beliefs and behaviors that becomes more refined with every interaction. Today’s AI systems do not merely predict our preferences. They aim to create a bond through highly personalized interactions and responses, creating a sense that the AI system understands and cares about the user and supports their uniqueness. The tone of a chatbot, the pacing of a reply and the emotional valence of a suggestion are calibrated not only for efficiency but for resonance, pointing toward a more helpful era of technology. It should not be surprising that some people have even fallen in love and married their bots. The machine adapts not just to what we click on, but to who we appear to be. It reflects us back to ourselves in ways that feel intimate, even empathic.

Microsoft Rushes to Stop Hackers from Wreaking Global Havoc

Multiple different hackers are launching attacks through the Microsoft vulnerability, according to representatives of two cybersecurity firms, CrowdStrike Holdings, Inc. and Google's Mandiant Consulting. Hackers have already used the flaw to break into the systems of national governments in Europe and the Middle East, according to a person familiar with the matter. In the US, they've accessed government systems, including ones belonging to the US Department of Education, Florida's Department of Revenue and the Rhode Island General Assembly, said the person, who spoke on condition that they not be identified discussing the sensitive information. ... The breaches have drawn new scrutiny to Microsoft's efforts to shore up its cybersecurity after a series of high-profile failures. The firm has hired executives from places like the US government and holds weekly meetings with senior executives to make its software more resilient. The company's tech has been subject to several widespread and damaging hacks in recent years, and a 2024 US government report described the company's security culture as in need of urgent reforms. ... "There were ways around the patches," which enabled hackers to break into SharePoint servers by tapping into similar vulnerabilities, said Bernard. "That allowed these attacks to happen."