Daily Tech Digest by Kannan Subbiah: neocloud

Showing posts with label neocloud. Show all posts

Daily Tech Digest - July 19, 2026

Quote for the day:

“The best startups are the ones that take something that already works and improve it dramatically.” -- Peter Thiel

🎧 Listen to this digest on YouTube Music

▶ Play Audio Digest

Duration: 22 mins • Perfect for listening on the go.

The Refactoring You Keep Deferring Is Not Technical Debt — It’s Architecture Risk

The article argues that many engineering teams mislabel certain long‑postponed refactoring tasks as technical debt when they are actually signs of deeper architectural risk. Technical debt, the author explains, is about how code is written. It creates friction, slows development, and increases the cost of change, but the system still does what it was designed to do. Architecture risk is different: it reflects structural assumptions baked into the system—limits on throughput, data model constraints, or tightly coupled components—that only become visible when the business needs the system to do something new. The piece shows how teams often confuse the two because both appear as “cleanup” work and both get deferred for similar reasons. But the consequences diverge sharply. Technical debt can be addressed gradually, module by module. Architectural constraints often require redesigning entire parts of the system, which demands planning, ownership, and honest communication with stakeholders. The author offers a simple test: if rewriting the code cleanly using the same structure would not remove the limitation, the issue is architectural. The article encourages teams to identify structural assumptions early, map how they limit future directions, and treat high‑impact constraints as real risks rather than backlog chores.

Brain-Machine Interface Identifies, Amplifies Conversations Amid Noise

A new brain-computer system developed by researchers at Columbia University helps people follow specific conversations in noisy environments. Traditional hearing aids often struggle in crowded rooms because they amplify all sounds equally. To solve this, scientists created a device that constantly monitors a person's brain activity alongside surrounding audio to figure out which voice the listener wants to hear. Once it identifies the target, the program automatically turns up the volume on that specific conversation while turning down competing background noise. Researchers tested the technology using four patients who already had electrodes temporarily placed in their brains for other medical reasons. During the trials, the equipment successfully adjusted the audio in real time, even when listeners intentionally shifted their attention from one speaker to another. Participants reported that understanding speech became much easier, and measurements of their pupils confirmed they expended less effort to listen. When the recorded audio was played for people with hearing loss, they also experienced significant improvements in speech clarity. While this early version relies on invasive electrodes to gather high-quality brain signals, the results offer a clear foundation for future hearing devices that might adapt to an individual's focus using less invasive technology and methods.

SABSA framework for risk-driven security architecture: a practical guide for UK SMEs

The SABSA framework helps organizations build a security architecture that directly connects business risks to technical solutions. Unlike a rigid checklist or a product guide, SABSA ensures every security measure has a clear, explainable purpose. It asks fundamental questions about what needs protection, potential threats, and required security properties. This framework is particularly valuable for small and medium-sized enterprises because it encourages pragmatic decision-making, helping to avoid duplicated tools or neglected controls. SABSA utilizes a layered approach that progresses from broad business attributes to specific technical implementations. It starts by defining necessary business qualities, such as availability or confidentiality, and then determines the required security objectives. From there, it outlines logical mechanisms and finally maps them to actual technologies and configurations. This layered method ensures strong traceability, making it easy to justify why a specific control exists. When applying SABSA, businesses should identify their most critical services, analyze potential threats, and define control objectives based on their specific risk appetite. By focusing on proportionate controls that balance protection, usability, and operational cost, small teams can effectively implement SABSA one critical service at a time, resulting in a coherent and practical security design.

The AI coding rollout worked. Now CIOs have a bigger problem

Although artificial intelligence tools are widely used by developers today, the expected massive boost in productivity has yet to materialize. Instead of simply speeding up how fast code is written, these tools are fundamentally changing what developers do every day. Writing code is no longer the primary bottleneck or the most crucial skill. Developers are shifting away from manual programming and spending more of their time designing systems, validating outcomes, and reviewing work generated by the machine. While raw coding speed has improved, companies are discovering that artificial intelligence code often takes much longer to review and contains more security vulnerabilities. This shift also introduces a serious long-term problem for the industry. Routine tasks like bug fixes and writing tests—the exact work that junior developers traditionally used to learn their craft—are now handled by software. If companies stop hiring entry-level engineers because machines can do their work, they will face a severe shortage of experienced senior staff in the coming years. To succeed, organizations must stop focusing solely on how much code is generated. Instead, they need to redesign their development processes around strong governance, clear business outcomes, and new ways to mentor the next generation of engineers.

The Pulse: What can we learn from Bun’s rapid Rust rewrite with AI?

The creator of the Bun software project recently completed a massive code rewrite from the Zig programming language to Rust in just eleven days using artificial intelligence. Originally, Bun relied on Zig, which caused persistent memory errors and system crashes. Rust promised to solve these stability problems by handling computer memory more safely. However, manually rewriting over half a million lines of code would have taken a team of developers at least a year, severely delaying new features and updates. Instead, the team used an advanced artificial intelligence model named Fable to automate the heavy lifting. The process started with strict guidelines, followed by dividing the workload across sixty four independent artificial agents. These agents translated the code, reviewed their work, and resolved thousands of compilation errors while the human developers slept. After a few days of getting the automated tests to pass, the project was finished. Although the computing cost reached one hundred sixty five thousand dollars, it remains significantly cheaper and faster than paying a team of engineers for a year of manual labor. This achievement demonstrates that large software migrations are now highly practical, provided a team maintains strong testing practices and a clear technical strategy.

The vertically integrated neocloud

Iren, once known for Bitcoin mining, has reinvented itself as a builder of very large data centers aimed at supporting AI workloads. The company believes its vertically integrated approach—owning the land, the power infrastructure, and the data centers themselves—lets it move faster and avoid the delays that come from relying on outside colocation providers. After converting its Canadian sites to support AI, Iren is now focused on the US, where it is developing several massive campuses. Its Texas footprint already includes 750MW in Childress, with two Sweetwater sites planned to reach 2GW. Another 1.6GW site is scheduled for Oklahoma in 2028. Keeping these projects geographically close helps the company maintain a stable workforce and contractor base during a period of intense competition for skilled labor. Iren builds and procures equipment ahead of customer commitments, which carries risk but has paid off—most notably through a large cloud contract with Microsoft. Early procurement also helps the company secure scarce components like high‑voltage gear and GPUs. Iren argues that some customers are rethinking their redundancy requirements, especially for AI training, where occasional interruptions are manageable. The company sees its track record of delivering capacity on time as a key advantage in a rapidly expanding and often over‑promising neocloud market.

Sovereign AI: Building AI Where Data, Infrastructure, and Control Stay Aligned

The article explains why many organizations are rethinking how they build and run AI systems, especially when sensitive data and strict regulations are involved. As AI moves from experiments into everyday operations, companies need more control over where data is stored, how models are run, and who can access the underlying infrastructure. The authors describe “sovereign AI” as an approach that keeps data, operations, and governance within clear boundaries rather than relying solely on contractual promises. They outline the kinds of information AI systems generate—such as prompts, embeddings, logs, and model artifacts—and note that these can be just as sensitive as primary business data. The piece argues that sovereignty is not only about compliance; it can help organizations gain trust, reach regulated markets, and scale AI safely. It also lays out architectural principles for maintaining control, including isolation of environments, strict rules for AI‑related data, and choosing an operating model that fits local requirements. The article then shows how Oracle’s cloud offerings support different sovereignty needs, using SoftBank’s Japan‑based deployment as an example of keeping AI infrastructure and operations within national boundaries. Overall, it presents sovereign AI as a practical way to align technology, regulation, and organizational responsibility.

Why Cyber Resilience Is Becoming Critical in AI-Led Enterprise Transformation

As businesses increasingly rely on artificial intelligence to manage everything from customer service to financial forecasting, the approach to digital security must fundamentally change. While these intelligent systems offer significant advantages, they also expose vast amounts of sensitive data and create new vulnerabilities. Traditional security measures designed merely to keep attackers out are no longer sufficient, especially since hostile actors are now using the same advanced tools to launch sophisticated, adaptable attacks. Instead of assuming every threat can be blocked, companies must shift their focus toward complete resilience. This means accepting that breaches will eventually occur and building robust systems that can quickly detect issues, limit the damage, and recover operations without major interruptions. Ensuring the integrity of the data that feeds these systems is critical, as flawed information easily leads to bad decisions and reputational damage. Furthermore, security can no longer be treated as an optional feature added at the end of a project. It must be woven directly into the core design of every network. Because these risks directly impact overall revenue and regulatory compliance, protecting the organization is no longer just a technical issue for the technology department; it has become a central responsibility for the entire leadership team. entire executive. central responsibility for the entire leadership team.

The Future of Age Verification: Your Face Never Leaves Your Device

As governments worldwide enact strict age verification laws for online platforms, facial age estimation has become a popular compliance tool. However, this method traditionally requires sending user photos to external servers, which creates significant privacy risks and attractive targets for data breaches. To solve this problem, a company named Incode has developed a new age verification system that processes facial data entirely on the user's device. By shrinking their artificial intelligence models, they enable everyday devices like smartphones and computers to estimate a user's age locally without ever transmitting or storing the actual image of the face. Only the final age verification result and basic session data are sent to the platform, ensuring privacy through system architecture rather than just written policies. This session data helps block sophisticated fraud attempts, such as deepfakes or camera tampering, without compromising personal biometrics. Alongside this technology, Incode recently invested one hundred million dollars into privacy infrastructure, including the acquisition of Identiq. This partnership allows organizations to share critical fraud intelligence without pooling raw customer data into vulnerable centralized databases. Ultimately, these advancements allow platforms to meet growing legal requirements for age assurance while keeping sensitive biometric data strictly in the hands of the user.

Restoration of a 20-year-old Java “Big Ball of Mud” using AI and Docker

When tasked with modernizing a legacy codebase—in this case, a twenty-year-old Java repository—developers often fall into the "tourist trap." They ask generative artificial intelligence for a quick fix or a modern starter kit. The machine eagerly obliges, offering modern build files and updated dependencies that look pristine but are fundamentally disconnected from the actual architecture. This optimistic approach masks deep structural rot, such as outdated APIs, non-standard directory layouts, and hidden concurrency issues, leading developers down a frustrating path of debugging code that was never meant to be modernized in one step. To succeed, engineers must adopt an "archaeologist" mindset, using artificial intelligence not to generate new code, but to perform a forensic audit. By prompting the tool to analyze the era of the code, structural integrity, data flow, and error handling, developers can accurately assess the system's true health. In this project, the audit revealed a fragile system masquerading as Java, riddled with string-based typing and deceptive test coverage. Rather than immediately refactoring, the correct strategy was complete containment: wrapping the untouched legacy code in a stable Docker environment mimicking its original era. This creates a reliable baseline, proving that artificial intelligence is most effective when constrained by evidence and strict modernization phases.

Daily Tech Digest - July 15, 2026

Quote for the day:

“Always treat your employees exactly as you want them to treat your best customers.” -- Stephen R. Covey

🎧 Listen to this digest on YouTube Music

▶ Play Audio Digest

Duration: 17 mins • Perfect for listening on the go.

AI incidents need a new playbook. Here’s how to build one

Traditional security incident response playbooks are ill-equipped to handle modern AI incidents. While conventional cybersecurity focuses on malicious intrusions and breaches of confidentiality or availability, AI failures often happen simply because a probabilistic model behaves poorly. Issues like hallucinations and bias can occur without any external attack, meaning standard response metrics often miss the core problem entirely until it causes real-world harm. To address this significant gap, organizations must build dedicated AI playbooks that accurately account for both internal model errors and externally induced attacks, such as data poisoning. A mature AI incident response strategy requires a few foundational elements to be truly effective. First, organizations need an AI Bill of Materials to track the underlying components and data within every production system. Second, accessible model cards must be available to provide responders with immediate context on a model's limits. Third, a designated data scientist must be on the incident call tree to analyze real-time behavior. Finally, teams must establish pre-defined rollback thresholds to trigger safe containment or fallback switches without causing unnecessary business disruption. By rewriting detection triggers and involving legal teams early to manage liability risks, companies can proactively secure their AI systems before an incident ever occurs.

Trust Under Attack: Why Resilience and Not Compliance Will Define The Next Generation of Enterprise Security

In a recent interview, Pranay Modi, Chief Information Security Officer at MAS Financial Services, outlines a practical vision for the future of enterprise cybersecurity. He challenges the common belief that people are the weakest link in security; instead, they are simply the most frequent targets. By building a supportive culture where reporting mistakes is safe and security processes are straightforward, organizations can turn their workforce into a powerful defense network. Modi advises that as threats become harder to predict, companies should focus on fundamental, lasting capabilities. These include clear visibility into all digital assets, strict identity management for both humans and machines, and recovery plans that are regularly practiced rather than just documented on paper. He also highlights the growing importance of managing third-party risks and ensuring company boards truly understand their cyber exposure. Crucially, Modi warns against confusing compliance with actual security. Passing an audit is merely a starting point, not a guarantee of safety. He emphasizes that while the daily tasks of cybersecurity can be handed off, the ultimate responsibility for protecting a company's digital trust rests firmly with its executive leadership. The goal is no longer just preventing attacks, but ensuring the organization remains resilient when disruptions inevitably occur.

Why the most dangerous code test failures are invisible

Code testing is essential for modern software quality, but the most dangerous bugs are the ones that remain completely invisible. According to quality assurance engineer Mikhail Golikov, while teams often celebrate catching obvious errors, the true risk lies in failures that never trigger an alarm. These quiet failures typically fall into three main categories: tests that exist but are never executed, unreliable tests that teams learn to ignore, and untested behavior documented only in production logs. Unexecuted tests act as mere documentation rather than actual safety checks. Unreliable or flaky tests are even worse because they condition engineers to dismiss real failures as background noise, effectively lowering the overall trust of the team in their systems. Furthermore, failing to turn real world production logs into test cases leaves a massive gap between what software does in reality and what developers actually monitor. The core issue across all these structural problems is a sheer lack of system visibility, rather than a lack of modern tools. True software quality is not simply defined by having a high total volume of tests or the absence of visible bugs. Instead, it requires the unglamorous work of making sure every failure becomes impossible to ignore, ensuring that real problems reliably turn into clear signals.

The New Face of Fraud: Identity, AI and Digital Trust

This article discusses the changing nature of digital fraud, emphasizing that cybercriminals are shifting their focus from attacking systems to compromising user identities. As digital transactions grow faster and more common, attackers find it easier to blend in using stolen credentials rather than breaking into systems. The author explains that account takeover is a major threat because it allows attackers to bypass alerts and mimic normal behavior, making fraud harder to spot until the damage is done. Phishing attacks are also becoming more personalized and effective, with criminals using AI to craft targeted messages that trick users into giving up their credentials. Once inside, attackers can operate as trusted users. To combat this, the article highlights the importance of identity-centric security. Organizations need to treat every login as a trust decision and continuously verify identities. The piece also notes India's regulatory efforts, such as using AI and shared intelligence to detect fraudulent activities early. For businesses, practical steps include identifying high-risk periods, strengthening identity governance, and testing their response times. Ultimately, the future of fraud prevention lies in combining identity intelligence, AI-driven detection, and behavioral analytics to catch risks before they result in financial loss.

Microsoft’s Secure Boot has been broken for a decade and no one noticed until now

The Ars Technica article discusses a significant security flaw in Microsoft's Secure Boot system that has existed for a decade. ESET researchers found 11 outdated UEFI shim bootloaders signed by Microsoft that allow attackers to bypass Secure Boot entirely. This bypass works on nearly any UEFI-based machine that trusts the Microsoft Corporation UEFI CA 2011 certificate, regardless of the operating system. These forgotten shims are typically used to establish a chain of trust for Linux distributions and other third-party boot software. However, because they are old versions (0.9 and below) they contain known vulnerabilities. Attackers can exploit these flaws by bringing a vulnerable shim to a target system, replacing the existing bootloader, and executing malicious code during the boot sequence. This allows the installation of powerful bootkits like Bootkitty or BlackLotus, which operate below the operating system level and are notoriously difficult to detect and remove. Microsoft addressed this issue by revoking the affected shim certificates in its June 2026 Patch Tuesday update. The revocation prevents these specific vulnerable binaries from being trusted, but the incident highlights the ongoing challenges of managing trust and revocation within the UEFI Secure Boot ecosystem.

‘HalluSquatting’ Compromises AI Coding Agents to Install Malware, Create Botnets

Security researchers from Tel Aviv University, Technion, and Intuit have identified a new cyber threat called "HalluSquatting," which exploits the tendency of generative AI models to hallucinate false information. As developers increasingly rely on AI coding agents to independently write code or install software packages, these assistants sometimes generate incorrect, invalid resource names instead of the intended ones. Hackers can predict these hallucinated names, register them, and attach malicious code to them. When the AI coding assistant unknowingly retrieves the fake package, it installs malware directly into the developer's system, potentially creating large botnets. This method resembles typosquatting, but rather than waiting for humans to mistype a web address, attackers rely on AI agents to make the mistake for them. The technique targets the growing trend of independent applications that execute tasks with little human oversight on modern development teams. In tests against popular AI coding tools like GitHub Copilot and Google Gemini CLI, researchers found that models hallucinated false repository names 85 percent of the time, highlighting a notable security weakness. Ultimately, HalluSquatting bypasses traditional security barriers by blending AI prompt manipulation with conventional malware strategies, representing a serious challenge as AI tools become integrated into software engineering environments.

The Shadow Insider: How AI Agents Are Becoming the New Insider Risk Nobody Is Monitoring

The article discusses a growing security challenge in modern workplaces: the rise of artificial intelligence assistants as a new type of insider risk. Traditionally, security teams have focused on monitoring human employees, contractors, and vendors who have legitimate access to sensitive company systems. However, organizations are now deploying autonomous software agents that perform tasks like reading emails, summarizing documents, and updating customer records. These agents operate as digital workers with their own identities and permissions, often acting without direct human oversight. The main issue is not that these agents are intentionally harmful, but that they quickly accumulate access to multiple systems simultaneously, creating a complex web of permissions. Over time, an agent designed for a simple task might gain access to confidential financial reports or legal documents simply because new tasks require more information. This gradual expansion of access often goes unnoticed because these machine identities do not follow normal human work patterns, making many traditional security monitoring tools completely ineffective. To address this serious problem, security teams must treat every software agent as a managed identity with strict, narrow permissions and closely monitor their behavior beyond basic login events to ensure they firmly remain aligned with their original purpose.

Prompt Privacy Is the New Endpoint Security Problem

As organizations adopt large language models, a new security challenge has emerged: protecting the privacy of prompts. While artificial intelligence offers significant advantages by allowing users to complete tasks using natural language, these inputs often include sensitive information such as trade secrets, credentials, or personal data. If employees submit confidential details into a model without proper safeguards, the information might be retained or used for future training, leading to accidental data exposure. Furthermore, attackers are actively exploiting this vulnerability through prompt injections, where they carefully craft instructions to manipulate the model into revealing hidden system rules, altering its intended behavior, or executing unauthorized commands. This problem extends to modern artificial intelligence agents and browsers, which effectively function as a new type of network endpoint. Because these agents operate autonomously and hold active user sessions, hidden malicious instructions on websites can trick them into compromising systems or authorizing transactions. Traditional security tools are generally unequipped to handle these specific threats. To address these risks, security teams must treat prompts as highly sensitive data. Organizations can better protect their networks by rigorously filtering both inputs and outputs, enforcing strict access privileges for artificial intelligence agents, and closely monitoring all system interactions over time.

'Yellow Teams' Are Defining the Future of AI Security

As the capabilities of artificial intelligence grow, organizations are increasingly relying on "yellow teams" to build robust defenses against emerging threats. Composed primarily of engineers and developers, these specialized teams work closely with both offensive red teams and defensive blue teams to understand and test the limits of advanced AI models, such as Claude Mythos and GPT-5.5. A central responsibility of yellow teams involves developing "harnesses." These are dedicated software frameworks that wrap around an AI model to firmly restrict its permissions, define operational rules, and guide its actions. This essential step focuses the AI's capabilities and ensures it fully understands the specific network context, which drastically reduces false positives during routine security testing. With these carefully refined tools, companies are uncovering a significant number of software vulnerabilities. To handle this influx of information, blue and yellow teams are integrating more deeply than before. Yellow teams are taking a proactive approach by incorporating AI directly into the software development process. This helps engineering departments identify exactly which coding practices need adjustment to prevent security flaws from recurring. By bridging the gap between security analysis and daily engineering work, yellow teams provide a highly practical strategy to protect systems against future attacks.

The neocloud approach to sustainability

The neocloud model offers a practical alternative to massive, centralized data centers by distributing computing resources closer to where people actually use them. Instead of building giant facilities that place heavy, sudden demands on local power grids and water supplies, this approach relies on a network of smaller, interconnected sites. By doing so, it avoids the severe strain that huge building projects often place on communities and utilities. A key environmental benefit of this distributed method is its incremental use of electricity and water. Rather than drawing millions of gallons of water daily for cooling or requiring massive new power plants, these localized centers allow resource consumption to grow gradually and sustainably. Processing data closer to the source also cuts down on the energy required to transmit information over long distances, which inherently improves response times and reliability for users. Furthermore, this localized strategy helps keep data within specific regions, addressing privacy and security concerns without sacrificing performance. Ultimately, spreading out the physical infrastructure makes the growth of advanced computing far more manageable. It aligns technological progress with environmental limits, proving that we can meet modern computing needs without placing an overwhelming burden on our natural resources or local infrastructure.

Daily Tech Digest - February 23, 2026

Quote for the day:

"Prepare, work smarter, Learn from your Mistakes. These are the secret to success!" -- Elizabeth McCormick

What’s wrong (and right) with AI coding agents

“At the scale AI is generating pull requests today, humans simply can’t keep up. You don’t check the accuracy of Excel with an abacus… and in 2026 we shouldn’t expect maintainers to manually inspect machine-speed code without machine-speed assistance,” said Fox. “AI reviews can go deeper than humans in many cases. They don’t get tired, they can reason across large codebases… and they can spot patterns at a scale no individual reviewer can hold in their head. If AI is generating more code, the only viable answer is to use AI to help review and validate it. You have to fight fire with fire.” ... He reminds us that quantity does not always equal quality – especially in the AI-driven world we now live in. He notes that, at least for now, the reality is that AI development tools and ‘vibe coding’ can generate a lot of code very quickly, but code that’s often slower and more memory‑hungry than what a skilled developer would write. ... Although this entire discussion is focused on the now-increasingly-automated command line, it feels like the real focus should be higher and architecture has been mentioned already. “We’re entering a world where, with AI, software changes are propagating faster than governance models can track them. That means AI tools are, plain and simple, accelerating systemic complexity. When an AI agent can generate and deploy changes across interconnected enterprise systems, there’s real danger in the invisible dependencies and downstream effects most orgs can’t fully see,” said Ido Gaver

Identity verification systems are struggling with synthetic fraud

The researchers tied the growth of synthetic identity fraud to the increasing use of AI tools, which can generate convincing fake documents that pass casual inspection. “The biggest risk I see in the next 12 to 18 months is the growing and advancing use of AI. AI is creating fake people, fake voices, and fake documents. Bad actors are using these capabilities to open accounts, take over existing accounts, and impersonate real people in places like bank branches,” Lewis said. ... Financial institutions remain a major target for identity fraud due to access to credit, account funding, and cash movement. A successful fraudster can monetize a single fake or synthetic identity for tens of thousands of dollars before detection, making the sector a frequent target. Online-only retail banks recorded the highest rate of failed identity verification among the financial institution categories in Intellicheck’s dataset. The report also found elevated failure rates across businesses serving underbanked consumers, including check cashing, payday lending, subprime lending, and lease-to-own services. ... AI tools are being used to produce synthetic IDs that are difficult for humans to spot. Lewis said attackers are already using AI and large language models to generate documents that can bypass basic checks. “AI and LLM can create fake ID’s that can easily pass the templating test, old methods don’t work and ID verification service providers can’t rest on their laurels,” Lewis said.

Neoclouds: Meeting demand for AI acceleration

This surge in demand for AI acceleration has seen a surprising benefactor. According to Tiger Research, cryptocurrency mining firms, seeking to reduce their exposure to bitcoin’s volatile pricing, are redirecting their graphics processing unit (GPU) farms toward AI acceleration applications. ... Before the emergence of neoclouds a few years ago, if an organisation wanted to work with AI, it had no choice but to go to a hyperscaler like Amazon Web Services (AWS) or Google. While the hyperscalers offer AI infrastructure as part of their vast public cloud services portfolio, Roy Illsley, chief analyst at Omdia, says the hyperscalers tend to be expensive and, as he recalls, a few years ago, there was very little choice other than Google’s AI offerings. ... AI infrastructure strategies are becoming inherently hybrid and multicloud by design – not as a by-product of supplier sprawl, but as a deliberate response to workload reality. The cloud market is fragmenting along functional lines, and neoclouds occupy a clear and growing role within that landscape. “Neoclouds started as GPU as a service. If you needed GPUs, these companies bought or leased GPUs from Nvidia, and then they would slice them and sell them off to people in smaller groups and bundles,” says Omdia’s Illsley. However, over time, neocloud providers have added software stacks and developed other services to meet the demand of IT buyers who need GPU power and the software stack required for AI training or AI inferencing.

Sam Altman just said what everyone is thinking about AI layoffs

This isn’t the first time industry stakeholders questioned the veracity of AI-related layoffs. A study by Oxford Economics in January this year claimed most layoffs are due to “more traditional drivers” such as overhiring or poor financial performance. ... "While a rising number of firms are pinning job losses on AI, other more traditional drivers of job layoffs are far more commonly cited,” the report said. “What's more, we suspect some firms are trying to dress up layoffs as a good news story rather than bad news, such as past over-hiring." ... “There’s some real displacement by AI of different kinds of jobs,” he said. “We’ll find new kinds of jobs as we do with every tech revolution. I would expect that the real impact of AI doing jobs in the next few years will begin to be palpable.” Altman’s prediction here aligns with research from Gartner and Forrester on the potential impact of AI on the global jobs market. In January, Forrester predicted 10 million jobs could be lost worldwide as enterprise adoption ramps up. ... Despite a string of studies pointing to the contrary, some tech industry figures still believe that AI will eventually render some workers obsolete. In a recent interview with the Financial Times, for example, Microsoft AI CEO Mustafa Suleyman insisted AI will begin replacing “white collar” workers within 18 months. “I think we’re going to have a human-level performance on most if not all professional tasks,” Suleyman told

Jailbreaking the matrix: How researchers are bypassing AI guardrails to make them safer

As AI assistants move from novelty to infrastructure, helping write code, summarizing medical notes and answering customer questions, the biggest question isn't just what these systems can do, but what happens when they are pushed to do what they shouldn't. "By showing exactly how these defenses break, we give AI developers the information they need to build defenses that actually hold up," Jha said. "The public release of powerful AI is only sustainable if the safety measures can withstand real scrutiny, and right now, our work shows that there's still a gap. We want to help close it." ... Focusing on the internal workings of the LLM allows more accurate measurements of failures while encouraging the development of more robust defenses against the failure of safety measures. According to the researchers, HMNS can help reveal whether specific internal pathways, if exploited, could cause a breakdown. That information can guide stronger training, monitoring and defense strategies. ... Understanding the security shortcomings of LLMs is critical as they become more widespread. Companies like Meta, Alibaba and others have released powerful AI models that are available to anyone. While each platform incorporates safety layers meant to keep it from being misused, the UF team has found that those safety layers can be systematically bypassed.

Plan vs. planning: Why continuous planning must traverse time

The problem is not the plan’s quality. The problem is that a plan freezes a moment in time while the organization continues to move through time. Planning, by contrast, must be a continuous discipline, remaining active as assumptions decay, signals emerge and constraints shift. ... Planning exists to test those assumptions continuously, a distinction long recognized in leadership and management literature that separates planning as an ongoing discipline from planning as a static artifact. Plans are optimized for agreement and commitment. Planning is optimized for learning, decision-making and managing consequences in the face of uncertainty. In practice, this means consequences must be visible at the moment of decision, not discovered months later through execution. ... Many enterprises optimize for compliance, predictability and approval at the expense of feedback and adaptation. Learning is pushed downstream, arriving only after outcomes are locked in and costs incurred. Systems theorist Russell Ackoff described this dynamic clearly: “Most organizations are not short of information. They are short of the ability to learn from it.” Continuous planning restores learning by design, not as postmortem analysis, but as pre-decision feedback. Feedback that arrives before commitment changes behavior. Feedback that arrives after execution becomes an explanation. In volatile environments, that timing difference is decisive, which is why scenario planning and structured foresight have re-emerged as critical executive tools.

The rise of AI factories: Powering an era of pervasive intelligence

In India alone, Google is building a gigawatt-scale AI hub in Visakhapatnam. Microsoft is expanding its cloud and AI footprint in Pune and Chennai and creating a new “India South Central” region in Hyderabad. In partnership with NVIDIA, Reliance Jio is developing a major AI data center in Jamnagar for nationwide GPU-as-a-service offerings. TCS is planning a 1-gigawatt AI data center, likely in Gujarat or Maharashtra, to support startups, hyperscalers, and government institutions. And as part of its Stargate project, OpenAI is actively scouting locations in India for what could become one of the largest AI data centers in all of Asia. ... The growth of AI represents a fundamental transformation in how the world builds and operates computing infrastructure. While traditional data centers are designed for general-purpose workloads, AI superclusters are purpose-built facilities that function as industrial-scale intelligence production systems. And their output is defined by new metrics — most notably tokens per watt and tokens per dollar — that quantify the efficiency and productivity of intelligence at scale. ... To deliver the performance at scale that AI requires, silicon designers are increasingly turning to multi-die designs, including 3D integrated circuits (3DIC) and chiplet-based architectures. While these chip designs offer gains that traditional monolithic SoCs cannot achieve cost-effectively, they also introduce significant complexity to the design process.

Cognizant CAIO Babak Hodjat explains how Agentic AI will transform enterprises

One of the things that agentic systems do is they allow for a diversity of data sources because you can actually have an agent responsible for a data source talking to other agents responsible for other data sources. Your interface into this system could be a consolidation of information and decisions that come from these disparate sources. It is the first time that we can actually have a mapping between intent and disparate sources of data and applications. I think that will work well. That kind of design can work well in a country like India with such diversity of data. ... Population-based approaches like genetic algorithms are very good at non-linear optimisation, especially if you are looking at multiple outcomes at the same time. Pretty much every problem that we look at is multi-objective. Every problem that we look at has improved revenue but reduced costs. You look at curing disease but reduce impact on the economy. It is always more than one outcome that we are looking at. In problems like optimisation of power grids or managing urban traffic systems, these are very well-suited algorithms. ... There are two opposing forces when it comes to AI. Scaling laws mean that building bigger is more powerful, and building bigger typically means using more energy. Many companies are looking at green sources for that additional consumption. On the other hand, companies are optimising models to be smaller and less energy-hungry. For multi-agent systems, smaller models can be more cost-effective and greener.

Inference Becomes the Next AI Chip Battleground

Inference has fundamentally different economics and performance requirements than training, said Karl Freund, founder and principal analyst at Cambrian AI Research. Training AI models is a cost center, while inference is a “profit center” that directly generates revenue. Freund and Kimball noted that while GPUs deliver excellent performance, they often carry architectural features optimized for training that don’t always translate to lower latency or higher efficiency in pure inference use cases. Purpose-built inference chips – ASICs and other accelerators – can deliver faster responses, improved energy efficiency, and lower total cost of ownership. ... "As inference workloads exceed the total amount of training workloads in terms of token output, there will be a greater need for diversity because alternative XPU architectures can achieve better efficiency on some specific inferencing tasks,” said Brendan Burke, research director of semiconductors, supply chain, and emerging tech at Futurum Group. ... Inference opportunities span data centers and the edge, and requirements vary widely by workload and deployment. “The inference you do in your autonomous vehicle is far different than the inferencing you do when you’re an online customer service bot,” Kimball said. ... Analysts expect Nvidia to maintain dominance in both training and inference, but diverse requirements create space for specialized solutions to capture share.

Why the CFO's Playbook Belongs on Every CIO's Desk

Recent research from Gartner on how CFOs are allocating budgets gives CIOs insight into what priorities look like across departments, and where technology and AI can help move the needle. The research firm's CFO Report: Q1 2026 finds that while budgets are shifting and AI ambitions are high, enterprise-wide AI success remains an aspiration rather than a reality. ... AI is also changing the conversation on ROI for both finance and technology leaders. "There's a lot more to evaluating the success of some of this investment in technology than simply just ROI, and AI is definitely helping change that," Abbasi said. "AI isn't your traditional asset." Unlike standard hardware expenditures, AI investments don't have predictable depreciation curves, and the ways in which returns on AI investment may show up across the business can vary. They may manifest in time to market, customer satisfaction or competitive positioning, not just in cost savings, Abbasi said. CIOs should be sure to articulate how AI will generate strategic returns rather than focus on pitching it as a capital project. "It changes the way you measure the effectiveness of AI, as well as how you measure your business more holistically," he said. "It's not like a traditional asset because you don't necessarily know what the outcomes are going to be for some of these AI projects."

Daily Tech Digest - October 22, 2025

Quote for the day:

"Good content isn't about good storytelling. It's about telling a true story well." -- Ann Handley

When yesterday’s code becomes today’s threat

A striking new supply chain attack is sending shockwaves through the developer community: a worm-style campaign dubbed “” has compromised at least 187 npm packages, including the that has 2 million hits weekly, and spreading to other maintainers' packages. The malicious payload modifies package manifests, injects malicious files, repackages, and republishes — thereby infecting downstream projects. This incident underscores a harsh reality: even code released weeks, months, or even years ago can become dangerous once a dependency in its chain has been compromised. ... Sign your code: All packages/releases should use cryptographic signing. This allows users to verify the origin and integrity of what they are installing. Verify signatures before use: When pulling in dependencies, CI/CD pipelines, and even local dev setups, include a step to check that the signature matches a trusted publisher and that the code wasn’t tampered with. SBOMs are your map of exposure: If you have a for your project(s), you can query it for compromised packages. Find which versions/packages have been modified — even retroactively — so you can patch, remove, or isolate them. Continuous monitoring of risk posture: It's not enough to secure when you ship. You need alerts when any dependency or component’s risk changes: new vulnerabilities, suspicious behavior, misuse of credentials, or signs that a trusted package may have been modified after release.

Cloud Sovereignty: Feature. Bug. Feature. Repeat!

isn’t just a buzzword anymore, argues Kushwaha. “It’s a real concern for businesses across the world. The pattern is clear. The cloud isn’t a one-size-fits-all solution anymore. Companies are starting to realise that sometimes control, cost, and compliance matter more than convenience.” ... Cloud sovereignty is increasingly critical due to the evolving geopolitical scenario, government and industry-specific regulations, and vendor lock-ins with heavy reliance on . The concept has gained momentum and will continue to do so because technology has become pervasive and critical for running a state/country and any misuse by foreign actors can cause major repercussions, the way Bavishi sees it. Prof. Bhatt captures that true digital sovereignty is a distant dream and achieving this requires a robust ecosystem for decades. This isn’t counterintuitive; it’s evolution, as Kushwaha epitomises. “The cloud’s original promise was one of freedom. Today, when it comes to the cloud, freedom means more control. Businesses investing heavily in digital futures can’t afford to ignore the fine print in hyperscaler contracts or the reach of foreign laws. Sovereignty is the foundation for building safely in a fragmented world.” ... Organisations have recognised the risks of digital dependencies and are looking for better options. There is no turning back, Karlitschek underlines.

Securing AI to Benefit from AI

As organizations begin to integrate AI into defensive workflows, identity security becomes the foundation for trust. Every model, script, or autonomous agent operating in a production environment now represents a new identity — one capable of accessing data, issuing commands, and influencing defensive outcomes. If those identities aren't properly governed, the tools meant to strengthen security can quietly become sources of risk. The emergence of make this especially important. These systems don't just analyze; they may act without human intervention. They triage alerts, enrich context, or trigger response playbooks under delegated authority from human operators. ... AI systems are capable of assisting human practitioners like an intern that never sleeps. However, it is critical for security teams to differentiate what to automate from what to augment. Some tasks benefit from full automation, especially those that are repeatable, measurable, and low-risk if an error occurs. ... , , and are prime candidates for automation. These are data-heavy, pattern-driven processes where consistency outperforms creativity. By contrast, , attribution, and response decisions rely on context that AI cannot fully grasp. Here, AI should assist by surfacing indicators, suggesting next steps, or summarizing findings while practitioners retain decision authority. Finding that balance requires maturity in process design.

The Unkillable Threat: How Attackers Turned Blockchain Into Bulletproof Malware Infrastructure

When EtherHiding emerged in September 2023 as part of the CLEARFAKE campaign, it introduced a chilling reality: attackers no longer need vulnerable servers or hackable domains. They’ve found something far better—a global, decentralized infrastructure that literally cannot be shut down. ... When victims visit the infected page, the loader queries a smart contract on or using a read-only function call. ... Forget everything you know about disrupting cybercrime infrastructure. There is no command-and-control server to raid. No hosting provider to subpoena. No DNS to poison. The malicious code exists simultaneously everywhere and nowhere, distributed across thousands of blockchain nodes worldwide. As long as Ethereum or BNB Smart Chain operates—and they’re not going anywhere—the malware persists. Traditional law enforcement tactics, honed over decades of fighting cybercrime, suddenly encounter an immovable object. You cannot arrest a blockchain. You cannot seize a smart contract. You cannot compel a decentralized network to comply. ... The read-only nature of payload retrieval is perhaps the most insidious feature. When the loader queries the smart contract, it uses functions that don’t create transactions or blockchain records.

New 'Markovian Thinking' technique unlocks a path to million-token AI reasoning

Researchers at have proposed a new technique that makes large language models (LLMs) vastly more efficient when performing complex reasoning. Called Markovian Thinking, the approach allows LLMs to engage in lengthy reasoning without incurring the prohibitive computational costs that currently limit such tasks. The team’s implementation, an environment named , structures the reasoning chain into fixed-size chunks, breaking the scaling problem that plagues very long LLM responses. Initial estimates show that for a 1.5B parameter model, this method can cut the costs of training by more than two-thirds compared to standard approaches. ... The researchers compared this to models trained with the standard . Their findings indicate that the model trained with Delethink could reason up to 24,000 tokens, and matched or surpassed a LongCoT model trained with the same 24,000-token budget on math benchmarks. On other tasks like coding and PhD-level questions, Delethink also matched or slightly beat its LongCoT counterpart. “Overall, these results indicate that Delethink uses its thinking tokens as effectively as LongCoT-RL with reduced compute,” the researchers write. The benefits become even more pronounced when scaling beyond the training budget.

The dazzling appeal of the neoclouds

While their purpose-built design gives them an advantage for AI workloads, neoclouds also bring complexities and trade-offs. Enterprises need to understand where these platforms excel and plan how to integrate them most effectively into broader cloud strategies. Let’s explore why this buzzword demands your attention and how to stay ahead in this new era of cloud computing. ... Neoclouds, unburdened by the need to support everything, are outpacing hyperscalers in areas like agility, pricing, and speed of deployment for AI workloads. A shortage of GPUs and data center capacity also benefits neocloud providers, which are smaller and nimbler, allowing them to scale quickly and meet growing demand more effectively. This agility has made them increasingly attractive to AI researchers, startups, and enterprises transitioning to AI-powered technologies. ... Neoclouds are transforming cloud computing by offering purpose-built, cost-effective infrastructure for AI workloads. Their price advantages will challenge traditional cloud providers’ market share, reshape the industry, and change enterprise perceptions, fueled by their expected rapid growth. As enterprises find themselves at the crossroads of innovation and infrastructure, they must carefully assess how neoclouds can fit into their broader architectural strategies.

Wi-Fi 8 is coming — and it’s going to make AI a lot faster

Unlike previous generations of Wi-Fi that competed on peak throughput numbers, Wi-Fi 8 prioritizes consistent performance under challenging conditions. The specification introduces coordinated multi-access point features, dynamic spectrum management, and hardware-accelerated telemetry designed for AI workloads at the network edge. ... A core part of the Wi-Fi 8 architecture is an approach known as (UHR). This architectural philosophy targets the 99th percentile user experience rather than best-case scenarios. The innovation addresses AI application requirements that demand symmetric bandwidth, consistent sub-5-millisecond latency and reliable uplink performance. ... Wi-Fi 8 introduces (ELR) mode specifically for IoT devices. This feature uses lower data rates with more robust coding to extend coverage. The tradeoff accepts reduced throughput for dramatically improved range. ELR operates by increasing symbol duration and using lower-order modulation. This improves the link budget for battery-powered sensors, smart home devices and outdoor IoT deployments. ... Wi-Fi 8 enhances roaming to maintain sub-millisecond handoff latency. The specification includes improved (FILS) and introduces coordinated roaming decisions across the infrastructure. Access points share client context information before handoff.

Life, death, and online identity: What happens to your online accounts after death?

Today, we lack the tools (protocols) and the regulations to enable digital estate management at scale. Law and regulation can force a change in behavior by large providers. However, lacking effective protocols to establish a mechanism to identify the decedent’s chosen individuals who will manage their digital estate, every service will have to design their own path. This creates an exceptional burden on individuals planning their digital estate, and on individuals who manage the digital estates of the deceased. ... When we set out to write this paper, we wanted to influence the large technology and social media platforms, politicians, regulators, estate planners, and others who can help change the status quo. Further, we hoped to influence standards development organizations, such as the and the Internet Engineering Task Force (IETF), and their members. As standards developers in the realm of identity, we have an obligation to the people we serve to consider identity from birth to death and beyond, to ensure every human receives the respect they deserve in life and in death. Additionally, we wrote the planning guide to help individuals plan for their own digital estate. By giving people the tools to help describe, document, and manage their digital estates proactively, we can raise more awareness and provide tools to help protect individuals at one of the most vulnerable moments of their lives.

5 steps to help CIOs land a board seat

Serving on a board isn’t an extension of an operational role. One issue CIOs face is not understanding the difference between executive management and governance, Stadolnik says. “They’re there to advise, not audit or lead the current company’s CIO,” he adds. In the boardroom, the mandate is to provide strategy, governance, and oversight, not execution. That shift, Stadolnik says, can be jarring for tech leaders who’ve spent their careers driving operational results. ... “There were some broad risk areas where having strong technical leadership was valuable, but it was hard for boards to carve out a full seat just for that, which is why having CIO-plus roles was very beneficial,” says Cullivan. The issue of access is another uphill battle for CIOs. As Payne found, the network effect can play a huge role in seeking a board role. But not every IT leader has the right kind of network that can open the door to these opportunities. ... Boards expect directors to bring scope across business disciplines and issues, not just depth in one functional area. Stadolnik encourages CIOs to utilize their strategic orientation, results focus, and collaborative and influence skills to set themselves up for additional responsibilities like procurement, supply chain, shared services, and others. “It’s those executive leadership capabilities that will unlock broader roles,” he says. Experience in those broader roles bolsters a CIO’s board résumé and credibility.

Microservices Without Meltdown: 7 Pragmatic Patterns That Stick

A good sniff test: can we describe the service’s job in one short sentence, and does a single team wake up if it misbehaves? If not, we’ve drawn mural art, not an interface. Start with a small handful of services you can name plainly—orders, payments, catalog—then pressure-test them with real flows. When a request spans three services just to answer a simple question, that’s a hint we’ve sliced too thin or coupled too often. ... Microservices live and die by their contracts. We like contracts that are explicit, versioned, and backwards-friendly. “Backwards-friendly” means old clients keep working for a while when we add fields or new behaviors. For HTTP APIs, plus consistent error formats makes a huge difference. ... We need timeouts and retries that fit our service behavior, or we’ll turn small hiccups into big outages. For east-west traffic, a or smart gateway helps us nudge traffic safely and set per-route policies. We’re fans of explicit settings instead of magical defaults. ... Each service owns its tables; cross-service read needs go through APIs or asynchronous replication. When a write spans multiple services, aim for a sequence of local commits with compensating actions instead of distributed locks. Yes, we’re describing sagas without the capes: do the smallest thing, record it durably, then trigger the next hop.