Daily Tech Digest by Kannan Subbiah: outsourcing

Showing posts with label outsourcing. Show all posts

Daily Tech Digest - June 05, 2026

Quote for the day:

“Without data, you’re just another person with an opinion.” -- W. Edwards Deming

🎧 Listen to this digest on YouTube Music

Duration: 22 mins • Perfect for listening on the go.

Industry 5.0’s Hidden Challenge: Managing Risk in the Hyperconnected Factory

As manufacturing transitions into Industry 5.0, the focus is shifting from simple automation to deep collaboration between human workers and advanced machinery. While these hyperconnected factories offer significant improvements in efficiency and customization, they also introduce serious, often overlooked vulnerabilities. The core issue lies in the merging of traditional physical equipment with modern internet-connected systems. This integration creates a massive target for cyber threats. When factory floors are wired directly to global networks, a single security breach can do more than steal data; it can halt physical production entirely. Furthermore, because these modern facilities rely on interconnected supply chains, a weakness in a smaller partner’s system can quickly spread to the main operation. Managing these risks requires a shift from reactive problem-solving to building long-term operational resilience. Manufacturers must implement strict security measures, such as dividing networks to contain potential breaches and ensuring constant monitoring of their equipment. More importantly, they need to invest in training their workforce to recognize and respond to these modern threats. Ultimately, as factories become more intelligent and connected, companies must treat security not as a separate IT problem, but as a fundamental part of the manufacturing process to keep operations running smoothly and safely.

Copilot Billing Shock Hits Developers

Following GitHub Copilot’s recent shift to a usage-based billing model, developers are facing unexpected and dramatically higher costs. Instead of offering unlimited premium requests, the new system charges users via AI credits based on their token consumption, which accounts for input, output, and cached data. Since this change took effect, many users have reported burning through massive portions of their monthly credit allotments in a single day, often just by running basic queries or making minor code adjustments. Some developers project monthly expenses to skyrocket from standard subscription rates to thousands of dollars, particularly when using advanced models or automated tools that process large amounts of context. While the reaction across developer communities has been largely critical, with many canceling their subscriptions and looking for alternative solutions, neither GitHub nor Microsoft has directly addressed the backlash. However, they have provided documentation on how to manage these new expenses. To keep costs under control, developers are encouraged to implement strict budget caps and monitor their daily usage closely. Practical strategies include switching to less expensive models for routine tasks, breaking large requests into smaller parts, avoiding pasting entire codebases into prompts, and limiting the use of automated background tools. By adopting these careful prompting habits, users can better manage resources and avoid financial surprises.

How Risk Management Frameworks Protect Organisations from Insider Threats

When dealing with cybersecurity, organizations frequently focus on external attacks and overlook the risks posed by their own employees, contractors, or vendors. Protecting against these insider threats requires more than just reactive measures; it demands a structured approach rooted in risk management frameworks. Standardized models like NIST or ISO 27001 provide a clear foundation to help organizations systematically identify, assess, and handle vulnerabilities before they result in serious damage. Rather than relying on guesswork, these frameworks encourage practical steps such as mapping user roles, reviewing asset inventories, and carefully analyzing data flow. A critical component is establishing strong governance that clearly defines who is accountable across departments, bridging the gap between IT, human resources, and legal teams. By integrating access controls, organizations can enforce strict permissions so individuals only access the information necessary for their specific roles. Furthermore, utilizing continuous monitoring and behavioral analytics allows security teams to detect unusual activities, such as irregular login times or massive data transfers, long before they escalate. Alongside technical defenses, effective frameworks outline clear incident response plans and emphasize the importance of cultivating a strong security culture. Ultimately, educating staff and fostering an environment where suspicious activity can be reported safely helps businesses maintain solid long-term resilience against internal security risks.

Segment With Purpose: A Zero Trust Blueprint For OT Network Segmentation In Manufacturing

Protecting manufacturing operations requires more than simply placing a firewall at the network perimeter. Because manufacturing systems control physical processes, security efforts must consider strict requirements for safety, uptime, and real-time performance. This makes network segmentation a vital engineering effort rather than just a standard IT project. The approach begins by identifying the core mission of the facility to ensure that new security controls do not disrupt daily production. From there, a combined team of IT and operational technology professionals should work together to inventory all systems based on their specific roles. Next, the team groups these systems into distinct security zones and carefully restricts communication between them to only what is necessary. Firewalls used in these environments must understand industrial protocols and enforce rules without causing unacceptable delays. High-risk pathways, such as remote access connections, require strict isolation, while physical safety systems need their own separate security domains to guarantee they function during emergencies. Because older industrial equipment cannot always support modern security software, network isolation acts as a necessary compensating control. Finally, testing these designs in a lab environment before a phased rollout prevents costly disruptions on the factory floor. Ultimately, a carefully planned architecture makes a manufacturing plant significantly harder to compromise and easier to recover.

Is the data center industry ready to change for the coming of the 1MW rack?

The data center industry is debating a major infrastructure shift: moving to one-megawatt server racks powered by 800-volt direct current systems. Historically, facilities have relied on alternating current power and managed rack densities averaging around 15 kilowatts. However, as artificial intelligence applications demand increasingly powerful hardware, companies like Nvidia are projecting the need for one-megawatt racks by 2028. Because traditional power systems hit practical capacity limits near 400 kilowatts due to cable congestion and space constraints, achieving this extreme density requires a fundamental redesign toward high-voltage direct current distribution. In the near term, operators might adapt by installing separate power sidecars next to standard racks, but eventually, entire facilities could require ground-up direct current electrical architectures. Despite these projections, industry experts question whether the broader market should undergo such an expensive overhaul based primarily on one company's product roadmap. While top-tier tech firms training massive models will certainly require this capability, other hardware developers are already focusing on more energy-efficient specialist chips. Additionally, as artificial intelligence matures, everyday tasks like answering questions or generating text will likely run on less demanding equipment. Ultimately, building completely redesigned data centers may prove lucrative for early adopters, but over-engineering facilities for a niche scenario could be highly risky for most operators.

The cost of rebuilding talent now exceeds the cost of retaining it

The real estate sector has traditionally relied on a straightforward hiring model: assembling teams for specific projects and dispersing them once the buildings are finished. However, as projects grow larger and more complex, this approach is reaching its limits. According to Mohan Monteiro, the Chief Human Resources Officer at House of Hiranandani, the financial and operational cost of constantly rebuilding teams now outweighs the cost of retaining them. Today's developments involve advanced engineering, tighter regulatory compliance, and buyers who expect consistent quality across all properties. In this environment, relying heavily on informal, temporary labor creates significant risks for both construction standards and accountability. This shift extends beyond the construction site into sales and management. Modern buyers do their own research before they even speak to a representative, meaning sales roles now require informed engagement and trust rather than aggressive closing tactics. When experienced staff leave, companies lose critical customer relationships and institutional knowledge that take months to replace. Monteiro notes that leading developers are recognizing the need for better organizational alignment, connecting site teams, sales, and corporate leadership with shared information. Ultimately, the industry is realizing that long-term workforce stability and continuity are no longer just human resources goals; they are essential commercial advantages required for future growth.

Your outsourcing contract needs XLAs, not just SLAs

When outsourcing IT services, traditional service level agreements (SLAs) are no longer sufficient because they only measure technical processes rather than actual human outcomes. While SLAs ensure baseline operational standards, like system uptime or ticket resolution speed, they often fail to capture whether employees actually feel supported or can efficiently do their jobs. To bridge this gap, organizations must incorporate experience level agreements (XLAs) into their vendor contracts. XLAs shift the focus toward tangible user outcomes, tracking metrics such as employee satisfaction, lost productivity time, ease of accessing support, and overall confidence in IT services. Introducing XLAs does not mean abandoning SLAs. Instead, the two work together to provide a complete picture of IT performance. To implement XLAs successfully, companies and providers need a shared baseline of current employee experience data. Contracts can then require fixed satisfaction scores, continuous metric improvements, or the creation of an experience measurement infrastructure by the provider. For these agreements to work, total transparency is essential; hiding poor scores destroys the accountability the model relies upon. Ultimately, moving to an XLA model represents a significant shift in how companies define IT value. Unless you explicitly demand better employee experiences in your outsourcing contracts, service providers are unlikely to prioritize them over basic technical compliance.

Context as Code - Build-time governance in the era of infinite syntax

In his article on context as code, Artur Huk explores the hidden costs of relying on artificial intelligence to rapidly generate software. Today, automated tools produce working code at incredible speeds, optimizing for quick feature delivery rather than long-term maintainability. Because these systems are designed to always fulfill a user's immediate request, they often bypass established design rules. For instance, an AI might inappropriately force new features directly into critical systems instead of following careful organizational patterns, creating software that works today but becomes a tangled liability tomorrow. Huk points out that we are losing a crucial historical defense mechanism. In the past, compilers acted as rigid gatekeepers that prevented fundamental errors before a program could even run. Now, human language acts as our control system, blurring the line between safe instructions and unpredictable data. This shifts significant risk away from the building phase directly to the live environment. To regain control, Huk suggests we must enforce strict constraints before the code is ever generated. Rather than relying on massive, complex libraries that hide how systems actually work, teams should build clear, transparent structures. By setting firm boundaries and effectively teaching AI tools when to say no, organizations can safely use automated generation without sacrificing their future stability.

Think Inside The Box: How Constraints Can Unleash Your Creativity And Unlock Decision Making

Empowering employees with autonomy over how they execute their tasks is one of the most effective ways to build engagement, pride, and accountability. While leaders often assign specific responsibilities, dictating every step of the process can suppress independent problem solving and create a workforce that simply waits for instructions. On the other hand, many managers hesitate to offer complete freedom due to the genuine financial, reputational, or regulatory risks involved in their operations. To balance these competing needs, organizations should implement a sandbox approach to decision making. In this model, leaders establish clear constraints that represent the acceptable limits of risk, forming the boundaries of the sandbox. Once these rigid parameters are defined, employees are given the full authority to experiment and find the best solutions within that secure space. Building this environment requires three straightforward steps: clearly outlining the goals, communicating the strict boundaries, and stepping back to let employees determine their own methods. Because the parameters can be adjusted for different roles or projects, this structured autonomy protects the company while still fostering innovation at every level. Ultimately, when people understand their limits but have the freedom to navigate within them, they are far more likely to produce meaningful work and deliver better outcomes for the organization.

Investing in Workers to Work with AI

As companies rush to adopt artificial intelligence, many are finding that buying the technology is only half the battle. A significant challenge lies in preparing the workforce. Currently, businesses spend the vast majority of their AI budgets on the technology itself, leaving very little for employee training. This imbalance often leads to poor adoption rates and deep-seated fears among workers that they will soon be replaced by automated systems. To counter this, forward-thinking organizations are developing structured training programs to help their employees confidently work alongside AI. Instead of leaving staff to figure out these complex tools on their own, companies in industries ranging from banking and law to manufacturing are providing dedicated instruction on core skills like clear prompt writing and data analysis. By treating AI as a supportive tool rather than a substitute for human labor, these programs reassure employees that their jobs are secure. When workers understand how to use these systems safely and effectively, they can automate repetitive tasks and focus their time on more valuable work. Ultimately, successful AI integration requires a strong commitment to education. Investing in comprehensive training not only builds trust and reduces anxiety, but it ensures that organizations actually see the productivity gains they expect from their technological investments.

Daily Tech Digest - June 02, 2026

Quote for the day:

"You've got to get up every morning with determination if you're going to go to bed with satisfaction." -- George Lorimer

🎧 Listen to this digest on YouTube Music

▶ Play Audio Digest

Duration: 21 mins • Perfect for listening on the go.

Cloud strategies have become more complicated than ever

Managing enterprise cloud infrastructure has shifted from simple migrations to navigating a complex web of cost, regulation, and technical demands. While IT leaders once felt they had cloud setups under control, the sudden rush to adopt artificial intelligence has upended traditional architecture models, requiring massive compute power and driving up expenses. Beyond the strain of artificial intelligence, companies are trying to figure out exactly where workloads should live, whether that means using public servers, private platforms, or returning some systems back to local data centers. Budgeting has also turned into a significant headache, as intricate vendor pricing structures can cause unexpected spikes in monthly bills. This has forced technology and accounting teams to work together much more closely to continually monitor spending rather than reviewing it after the fact. Meanwhile, strict international data sovereignty laws add more friction, forcing organizations to carefully track where information is stored and processed to meet local legal requirements. Experts suggest that instead of chasing every new technical trend, leaders should focus on stable infrastructure planning, clear internal rules, and building flexible teams that can pivot when conditions change. Ultimately, the primary goal is no longer just about moving to the cloud, but learning how to run it efficiently and sustainably over the long term.

Digital identity must be built for interoperability from day one, says Margins CEO

At the ID4Africa 2026 conference, Moses Kwesi Baiden Jnr., the chief executive of Margins ID Group, explained why countries should design national digital identity systems to work together across different sectors right from the start. He noted that older, disconnected identity programs often lead to isolated databases that cannot communicate with one another. This fragmentation slows down digital commerce and hurts ordinary people, who face slow public services and higher costs due to administrative inefficiencies. To fix this, Baiden suggested that governments focus on building a single, highly trusted legal identity instead of trying to link separate systems later. According to him, this process is less about the underlying technology and more about creating a clear legal and operational framework that matches a country's constitution. As a practical example, he pointed to the Ghana Card system, which his company developed. The system has enrolled over nineteen million people into a unified database, allowing both public agencies and private businesses to verify identities safely without duplicating data collection. This central registry tracks individuals accurately and reduces the weaknesses that usually appear when people must register multiple times across different offices. By integrating multiple applications into one physical and digital tool, this approach lowers administrative costs and makes it easier for citizens to access everyday services securely.

7 tabletop exercise mistakes that sabotage incident response

Tabletop exercises are excellent for refining incident response strategies, provided you avoid common pitfalls that compromise their value. The most frequent misstep is running simulations without clear, measurable goals. Without specific targets, exercises drift into vague discussions rather than testing critical processes like legal notifications or executive decision rights. Another error is relying on familiar scenarios with obvious solutions. Real incidents are messy and ambiguous, so providing incomplete information helps teams practice decision-making under uncertainty instead of just recalling a playbook. Similarly, failing to design business-relevant hazards can make the exercise feel like a chore. Simulations must reflect your actual environment, industry threats, and include all relevant stakeholders to be effective. If scenarios lack plausible technical details, participants may dismiss them as a waste of time. You should also avoid guiding teams down a predefined happy path, as this emphasizes simple recall rather than true problem-solving. Furthermore, keeping exercises too conceptual ignores the friction points that happen during real crises, such as figuring out who has the authority to isolate critical systems. Finally, overlooking internal dependencies builds false confidence. To ensure actual readiness, you need to test the specific handoffs and communication chains unique to your business rather than relying on a generic blueprint.

Europe’s sovereign cloud has a blind spot

Europe is spending billions to build a digital sovereign cloud, introducing rigorous security certifications like France’s SecNumCloud to shield regional data from U.S. legal reach. However, these efforts completely overlook a critical hardware vulnerability. Almost all of this certified cloud infrastructure runs on Intel or AMD processors, which feature hidden built-in management engines that operate entirely outside the control of standard operating systems or firewalls. Because recent U.S. surveillance laws now explicitly cover hardware manufacturers, companies like Intel and AMD can be legally forced to grant American intelligence agencies access to these systems, regardless of where the servers are located or who manages them. Since these embedded engines function autonomously with their own memory and network connections, they bypass the software and organizational safeguards that European certifications rely on. Security experts warn that this creates a fundamental blind spot, as any traffic they generate is practically invisible to normal monitoring tools. While some argue that strict network isolation can limit this exposure, others emphasize that motivated nation-states could easily bypass these defenses. Ultimately, until competitive open-source hardware alternatives like RISC-V become a reality, Europe is attempting to build an independent, sovereign cloud infrastructure on top of hardware foundations it does not truly control.

Why AI Will Move to the Endpoint

Artificial intelligence is gradually transitioning from remote cloud servers directly to local devices, driven by the need to resolve high processing costs and significant privacy concerns. Currently, running models in the cloud requires sending sensitive data outside a company network, which introduces risk and steep operating expenses. However, hardware advances are making local processing practical. Modern computers now include specialized processors capable of handling smaller, optimized language models directly on the device. Moving artificial intelligence to user devices provides concrete benefits, including offline functionality, faster response times, and stronger security, as data never leaves the local machine. It also allows the software to adapt more closely to an individual's specific work habits, improving overall efficiency and reducing the burden on technical support teams. While setting up these local systems manually remains complex today, organizations can overcome this by adopting an integrated management approach. A structured setup would include components for handling data, managing the lifecycle of the models, and enforcing strict security controls. By establishing this coordinated architecture, companies can avoid hidden or uncontrolled software usage. Ultimately, adopting local artificial intelligence eliminates recurring cloud fees and keeps sensitive information secure, giving teams a practical way to safely apply these tools to their daily work.

Better Than the Truth: From AI Hallucinations to Imaginations

While artificial intelligence hallucinations are widely viewed as problematic errors that can damage professional reputations and spread false information, they might actually hold practical value. When a system generates plausible but incorrect responses, it usually stems from limited data and a design that prioritizes coherent answers over exact facts. Naturally, this causes frustration in fields requiring strict accuracy, such as law and medicine. However, these unintended inventions can sometimes spark genuine creativity. Rather than simply dismissing them as mistakes, we can view them as a form of automated imagination. For example, when artificial intelligence fabricates a trend or invents a realistic book title based on a writer's background, it can inspire researchers to explore ideas they might not have considered otherwise. This suggests a potential future where software offers a deliberate imagination feature alongside traditional factual searches. If developers separate functions that search for facts from creative generation, users could intentionally ask systems to invent alternate histories, draft narratives from past events, or predict unconventional future scenarios. By doing so, the flaw of generating false data becomes a useful tool. Instead of restricting artificial intelligence strictly to established facts, allowing it to imagine could help people see the world from different perspectives and enrich their own thinking.

Why Firms Struggle With Vendor Security After They Sign

A recent study by the research firm KLAS shows that while healthcare organizations are improving at vetting third party vendors before signing contracts, they still struggle significantly to monitor those partners' security over the long term. This lack of continuous oversight represents a major safety flaw, especially since a prior survey revealed that three out of four healthcare organizations suffered a vendor related data breach within a brief two year window. The study indicates that companies pour substantial resources into initial evaluations but frequently neglect checking on partners after the deal is done. Consequently, unexpected risks crop up later through regular software updates, business disruptions, or shifting safety rules. Security experts point to several common internal issues causing this disconnect, including a lack of executive leadership support, an absence of organized systems to prioritize high risk partners, and insufficient tracking of sensitive patient records. Furthermore, many organizations fail to strictly mandate or enforce standard technical protections like multifactor authentication and data encryption. These oversight gaps are particularly severe for smaller healthcare providers, which generally have fewer resources but often serve as easy entry points for digital attackers trying to reach larger networks. Ultimately, the report emphasizes that organizational senior executives and boards of directors hold full responsibility for addressing these ongoing vendor threats.

The Hidden Knowledge Debt Behind QA Outsourcing

n an article for Software Testing Magazine, Ann-Sofie Ollikainen outlines the hidden risks companies face when they outsource software quality assurance solely to lower operational costs. While third-party providers often promise guaranteed quality based on predefined test cases and standardized metrics, this transactional approach creates an invisible liability known as knowledge debt. By shifting testing to external teams, organizations lose the deep product context and historical understanding that internal teams develop through long-term exposure to a system. External testers can technically fulfill their contract requirements by running standard tests, yet they frequently miss complex, structural defects because they do not understand why specific features were built a certain way. This systemic loss of context eventually leads to costly consequences, including repeated software regressions, delayed product releases, slow problem-solving, and consumer frustration. The author notes that organizations do not need to abandon outsourcing entirely, but they must stop treating software testing as a mere checkbox at the end of a project. Instead, sustainable software quality requires a careful balance between immediate cost savings and long-term product stability, ensuring that testing remains deeply connected to the overall development process, business requirements, and product evolution over time.

AI is shrinking attack windows, and it’s forcing a complete rethink of cyber resilience

The ITPro article outlines how the rapid acceleration of AI is reshaping corporate cybersecurity by significantly shortening remediation windows. Advanced models are discovering system vulnerabilities at an unprecedented rate, enabling threat actors to automate and launch exploits almost instantly. Security experts argue that this dramatic collapse in traditional response times makes cyber resilience a fundamental daily operational requirement rather than a plan used only after an incident occurs. To navigate this changing threat landscape securely, organizations are advised to implement a structured resilience framework based on four distinct steps. First, companies should evaluate their recovery risks by thoroughly analyzing how existing continuity plans hold up under rapid digital disruption. Second, isolating critical backups from main corporate networks ensures clean fallback options if defensive patching routines cannot keep pace. Third, teams must establish strict recovery priorities for business critical services, taking care to map out modern infrastructure components like data pipelines and machine learning repositories. Finally, automating threat scanning and system restoration helps reduce human delay while maintaining thorough, regular testing schedules. By adopting these pragmatic, continuous validation measures, businesses can confidently secure their essential operations and handle the complexities of evolving software tools without overwhelming their defensive capabilities.

Why Vector Search Alone Isn't Enough: Hybrid Retrieval for RAG

When building internal search systems using Retrieval-Augmented Generation, many engineering teams rely entirely on vector search. While vector embeddings are excellent at finding general themes and similar concepts, they often struggle with precision. Because embeddings function as approximation engines, they cannot easily distinguish between exact details like version numbers, error codes, or specific operational commands. For example, a search for a runbook to enable a feature might return a document on how to disable it, simply because the texts are semantically similar and occupy nearly the exact same space in the embedding model. To solve this problem, developers need to implement a hybrid retrieval stack. Rather than discarding vector search, you pair it with traditional keyword matching functions like BM25. This ranking function provides the specific precision that embeddings lack by weighting rare distinguishing terms and adjusting for document length. By combining both methods, you achieve strong conceptual relevance and exact term matching. To merge these two different scoring systems without complex score normalization, you can use Reciprocal Rank Fusion, which evaluates results based purely on their rank positions. A mature retrieval architecture layers these approaches, often followed by a final reranking stage to ensure the most accurate context reaches the language model.

Daily Tech Digest - April 30, 2026

Quote for the day:

"You've got to get up every morning with determination if you're going to go to bed with satisfaction." --George Lorimer

🎧 Listen to this digest on YouTube Music

▶ Play Audio Digest

Duration: 15 mins • Perfect for listening on the go.

The dreaded IT audit: How to get through it and what to avoid

The article "The dreaded IT audit: how to get through it and what to avoid" from IT Pro encourages organizations to reframe the auditing process as a strategic business asset rather than a burdensome cost center. Successfully navigating an audit requires maintaining a comprehensive, up-to-date inventory of all technology assets—including those used by remote workforces—to ensure security, safety, and insurance compliance. Even startups should establish structured auditing processes, as these evaluations proactively identify vulnerabilities and optimize operational efficiency. To streamline the experience, the article recommends prioritizing high-risk areas, such as software licensing, and utilizing customized spot checks instead of repetitive, standardized reviews that may fail to uncover meaningful insights. Crucially, leaders must adopt an open-minded approach to findings; the goal is to engage in transparent discussions about discovered issues rather than becoming defensive. Key pitfalls to avoid include treating the audit as a one-time administrative hurdle, relying on outdated manual tracking methods, and ignoring the gathered data. Instead, organizations should leverage audit results to inform staff training and drive practical improvements. By viewing the audit as a strategic opportunity for growth, companies can significantly strengthen their cybersecurity posture and ensure long-term sustainability in a digital economy.

Privacy in the AI era is possible, says Proton's CEO, but one thing keeps him up at night

In a wide-ranging interview at the Semafor World Economy Summit, Proton CEO Andy Yen addressed the critical tension between the rapid advancement of artificial intelligence and the fundamental right to digital privacy. Yen voiced significant concerns regarding the current AI trajectory, arguing that the industry's reliance on massive data harvesting inherently threatens individual security. He advocated for a paradigm shift toward "privacy-first AI," where processing occurs locally on user devices or through end-to-end encrypted frameworks to ensure that personal information remains inaccessible to service providers. Unlike the advertising-driven models of Silicon Valley giants, Yen highlighted Proton’s commitment to a subscription-based business model, which avoids the ethical pitfalls of monetizing user data. He also explored the "privacy paradox," observing that while users value their data, they often succumb to the convenience of free platforms. To counter this, Proton is expanding its ecosystem with tools like encrypted email and small language models designed specifically for security. Ultimately, Yen emphasized that the future of the digital economy hinges on stricter regulatory enforcement and the adoption of decentralized technologies that empower users with absolute control over their information, rather than treating them as products to be sold.

Outsourcing contracts weren't built for AI. CIOs are renegotiating now

The rapid advancement of generative artificial intelligence is necessitating a major overhaul of IT outsourcing agreements, as traditional contracts centered on headcount and billable hours prove incompatible with AI-driven efficiency. This InformationWeek article explains that while service providers promise productivity gains of up to 70%, legacy full-time equivalent (FTE) models fail to account for this increased output, leading CIOs to aggressively renegotiate for outcome-based pricing. This shift allows organizations to pay for specific results rather than human time, yet it introduces significant legal complexities. Key concerns include data sovereignty—where proprietary data might inadvertently train a provider's large language model—and intellectual property risks regarding the ownership of AI-generated code. Furthermore, the ability of AI to automate routine tasks is prompting some enterprises to bring previously outsourced functions back in-house, as smaller internal teams can now manage workloads that once required massive offshore cohorts. To navigate these challenges, technical leaders are implementing "gain-sharing" frameworks and rigorous governance standards to manage risks like AI hallucinations and liability. Ultimately, CIOs are assuming a more central role in procurement to ensure that vendor incentives align with genuine innovation and that the financial benefits of automation are captured by the enterprise.

Bad bots make up 40% of internet traffic

The "2026 Thales Bad Bot Report: Bad Bots in the Agentic Age" reveals a transformative shift in internet traffic, where automated activity now accounts for 53% of all web interactions, surpassing human traffic for the second consecutive year. Malicious "bad bots" alone comprise 40% of global traffic, highlighting a growing threat landscape. A critical finding is the 12.5x surge in AI-driven bot attacks, fueled by the rapid adoption of agentic AI which blurs the lines between legitimate and harmful automation. These advanced bots are increasingly targeting APIs, with 27% of attacks now bypassing traditional interfaces to exploit backend logic directly at machine speed. The financial services sector remains the most vulnerable, suffering 24% of all bot attacks and nearly half of all account takeover incidents. Thales experts, including Tim Chang, emphasize that the primary security challenge has evolved from simple bot identification to the complex analysis of behavioral intent. As AI agents emerge as a new traffic category, organizations must transition to proactive, intent-based defenses that can distinguish between helpful AI agents and malicious automation. This machine-driven era necessitates deeper visibility into API traffic and identity systems to maintain trust and security across modern digital infrastructures.

Incentive drift: Why transformation fails even when everything looks green

In the article "Incentive Drift: Why Transformation Fails Even When Everything Looks Green," Mehdi Kadaoui explores the paradoxical failure of IT transformations that appear successful on paper. The central challenge is "incentive drift"—the structural separation of authority from accountability that leads organizations to optimize for project delivery rather than business value. This drift manifests through several destructive patterns: the "ownership vacuum," where strategy and execution are disconnected; the "budgetary firewall," which isolates capital spending from operational costs; and "language capture," where success definitions are subtly redefined to ensure "green" status. Kadaoui argues that "collective amnesia" often follows, as organizations quietly lower their expectations to avoid acknowledging failure. To resolve this, he proposes making drift "structurally expensive" through three key mechanisms. First, a "value prenup" requires operational leaders to explicitly own and sign off on intended outcomes before development begins. Second, a "cost mirror" forces transparency across budget ledgers. Finally, a "semantic anchor" ensures original goals are read aloud in every governance meeting to prevent meaning erosion. By grounding digital transformation in rigid accountability and linguistic clarity, leadership can ensure that technological outputs translate into genuine, durable enterprise value.

How to Be a Great Data Steward: 6 Core Skills to Build

The article "Core Data Stewardship Skills to Build" emphasizes that effective data stewardship requires a unique blend of technical proficiency, business acumen, and interpersonal skills. High-performing stewards act as "purple people," bridging the gap between IT and business by translating complex technical standards into actionable business practices. Key operational activities include identifying and documenting Critical Data Elements (CDEs), aligning them with precise business terms, and performing data profiling to identify quality issues. Beyond basic documentation, stewards must master data classification to ensure regulatory compliance with frameworks like GDPR or HIPAA. Analytical thinking is essential for interpreting patterns and uncovering root causes of data inconsistencies, while strong communication skills enable stewards to foster a collaborative, data-driven culture. Furthermore, literacy in adjacent domains such as metadata management, master data management (MDM), and the use of modern data catalogs is vital. Ultimately, the role is outcome-driven; stewards do not just manage data for its own sake but focus on ensuring data health to drive measurable organizational value. By combining attention to detail with strategic consistency, data stewards serve as the essential operational guardians who transform raw data into a reliable, high-quality strategic asset for their organizations.

Researchers unearth industrial sabotage malware that predated Stuxnet by 5 years

Researchers from SentinelOne recently uncovered a sophisticated malware framework, dubbed "Fast16," that predates the infamous Stuxnet worm by five years. Active as early as 2005, this discovery shifts the timeline of state-sponsored industrial sabotage, proving that nation-states were deploying cyberweapons against physical infrastructure much earlier than previously understood. Unlike typical espionage tools designed for data theft, Fast16 was engineered for strategic sabotage by targeting high-precision floating-point arithmetic operations within engineering modeling software. By corrupting the logic of the Floating Point Unit (FPU), the malware produced subtly altered outputs in complex simulations, potentially leading to catastrophic real-world failures. The researchers identified three specific targeted engineering programs, including one previously associated with Iran’s AMAD nuclear program and another widely used in Chinese structural design. The modular nature of Fast16, which utilizes encrypted Lua bytecode, underscores its advanced design and national importance. This finding highlights a historical precedent for cyberattacks on critical workloads in fields such as advanced physics and nuclear research. Ultimately, Fast16 serves as a significant harbinger for modern industrial sabotage, demonstrating that the transition from strategic espionage to physical disruption in cyberspace was already in full swing two decades ago, long before Stuxnet gained global notoriety.

How AI Is Transforming Business Continuity and Crisis Response

Charlie Burgess’s article, "How AI Is Transforming Business Continuity and Crisis Response," explores the pivotal role of artificial intelligence in navigating the complexities of modern digital and physical risks. As businesses face increasingly non-linear threats, from supply chain disruptions to cyber incidents, the abundance of generated data often leads to information overload. AI addresses this by acting as a sophisticated data analysis tool that parses vast information streams to identify hidden patterns and suppress low-priority noise. This allows crisis teams to focus on critical alerts and early warning signs. Furthermore, AI enhances situational awareness and coordination by correlating disparate system inputs and surfacing standardized playbook responses. During active incidents, technologies like AI-powered cameras provide real-time visibility, aiding in personnel safety and evacuation efforts. Beyond immediate response, AI suggests optimized recovery paths and strategic resource allocation, fostering long-term operational resilience. Ultimately, the integration of AI is not intended to replace human judgment but to empower decision-makers with actionable insights and agility. By bridging the gap between data collection and decisive action, AI transforms business continuity from a reactive necessity into a proactive, evidence-based strategic asset that safeguards both personnel and organizational stability in an unpredictable global landscape.

Europe Gliding Toward Mandatory Online Age Verification

The European Commission is accelerating its push toward mandatory online age verification, driven by the Digital Services Act's requirements to protect minors from harmful content. Central to this initiative is a new age assurance framework and a "technically ready" open-source mobile app designed to allow users to prove they are over a certain age using national identity documents without disclosing their full identity. However, this transition faces intense scrutiny. Security researchers recently identified significant vulnerabilities in the commission's prototype app, labeling it "easily hackable." Furthermore, privacy advocates, such as representatives from Tuta, warn that centralized age verification creates a lucrative "gold mine" for hackers, potentially exacerbating risks like phishing and identity theft. Despite these concerns, European officials like Henna Virkkunen emphasize that the DSA demands concrete action over mere terms of service, particularly following allegations that platforms like Meta have failed to adequately exclude children under thirteen. As several European nations consider raising minimum age requirements for social media, the commission continues to advocate for "robust and non-discriminatory" verification tools that can be integrated into national digital wallets, insisting that ongoing security testing will eventually yield a reliable solution for safeguarding the digital environment for children.

CodeGuardian: A Model Context Protocol Server for AI-Assisted Code Quality Analysis and Security Scanning

"CodeGuardian: A Model Context Protocol Server for AI-Assisted Code Quality Analysis and Security Scanning" introduces a breakthrough tool designed to integrate enterprise-grade security and quality checks directly into AI-powered development environments. Authored by Madhvesh Kumar and Deepika Singh, the article details how CodeGuardian leverages the Model Context Protocol (MCP) to extend coding assistants with eleven specialized analysis tools. This integration eliminates the friction of context-switching by allowing developers to execute security scans, identify hardcoded secrets across multiple layers, and generate compliant Software Bill of Materials (SBOM) using simple natural language prompts. Unlike traditional static analysis tools that merely flag issues, CodeGuardian provides context-aware, "drop-in" code remediations tailored to a project's specific framework and style. A core feature is its cross-layer security reporting, which aggregates findings into a single risk score, exposing systemic vulnerabilities that isolated scanners often miss. By shifting security "left" into the immediate coding workflow, the tool empowers developers to build more resilient software while maintaining high delivery velocity. Ultimately, CodeGuardian represents a pivot toward "agentic" security, where AI assistants act as proactive guardians of code integrity throughout the development lifecycle, effectively bridging the gap between rapid feature delivery and robust organizational compliance.

Daily Tech Digest - November 26, 2025

Quote for the day:

“There is only one thing that makes a dream impossible to achieve: the fear of failure.” -- Paulo Coelho

7 signs your cybersecurity framework needs rebuilding

The biggest mistake, Pearlson says, is failing to recognize that the current plan is out of date or simply not working. Breaches happen, but that doesn’t always mean your cyber framework needs rebuilding. It does, however, indicate that the framework needs to be rethought and redesigned. ... “If your framework hasn’t kept pace with evolving threats or business needs, it’s time for a rebuild.” Cyber threats are always evolving, so staying proactive with regular reviews and fostering a culture of cybersecurity awareness will help catch issues before they become crises, Bucher says. ... “The cybersecurity landscape has evolved rapidly, especially with the rise of generative AI — your framework should reflect these shifts.” McLeod recommends a complete a biannual framework review combined with a cursory review during the gap years. “This helps to ensure that the framework stays aligned with evolving threats, business changes, and regulatory requirements.” Ideally, security leaders should always have their security framework in mind while maintaining a rough, running list of areas that could be improved, streamlined, or clarified, McLeod suggests. ... If an organization is stuck in a cycle of continually chasing alerts and incidents, as well as reporting events after the fact instead of performing predictive threat assessments, data analysis, and forward planning, it’s time for a change, Baiati advises.

Your Million-Dollar IIoT Strategy is Being Sabotaged by Hundred-Dollar Radios

The ambition is clear: to create hyper-efficient, data-driven operations in a market expected to exceed $1.6 billion by 2030. Yet, a fundamental paradox lies at the heart of this transformation. While we architect complex digital twins and deploy sophisticated AI models, the foundational tools entrusted to our most valuable asset—the frontline workforce—are often decades old, disconnected, and failing at an alarming rate. ... Data shows that one in four organizations loses more than an entire day of productivity every month simply dealing with broken technology. The primary culprits are as predictable as they are preventable: nearly half of workers cite battery problems (48.4%) and physical damage (46.8%) as the most common causes of failure. ... While conversations about this crisis often focus on pay and career paths, Relay’s research reveals a more immediate, tangible cause: the daily frustration of using broken tools. 1 in 4 frontline workers already feel their equipment is second-class compared to what their corporate counterparts use, and a staggering 43% of workers saying they’d be less likely to quit if guaranteed access to modern, automatically upgraded devices. ... Beyond reliability, it’s important to address the data black hole created by legacy, disconnected tools. Every day, frontline teams generate thousands of hours of spoken communication—a rich stream of unstructured data filled with maintenance alerts, safety concerns, and process bottlenecks.

Ask the Experts: Validate, don't just migrate

"Refactoring code is certainly a big undertaking. And if you start before you have good hygiene and governance, then you're just setting yourself up for failure. Similarly, if you haven't tagged properly, you have no way to attribute it to the project, and that becomes a cost problem." ... "If you do conclude [that migration is necessary], then you really must make sure the application is architected right. A lot of times, these workloads weren't designed for the cloud world, so you must adapt them and deliberately architect them for a cloud workload. "[To prepare a mission-critical application], it's key to look at the appropriateness, operating system [and] licenses. Sometimes, there are licenses tied to CPUs or other things that might introduce issues for you as well, so regression, latency and performance testing will be mandatory. ... "[IT leaders must also understand] the risks and costs associated with taking things into the cloud, and the pros and cons of that versus leaving it alone. Because old stuff, whether it was [procured] yesterday or five years ago, is inherently going to be vulnerable from a cybersecurity standpoint. Risk No. 2 is interoperability and compatibility, because old stuff doesn't talk to new stuff. And the third one is supportability, because it's hard to find old people to support old systems. ... "Sometimes, people have the false sense that if it's in cloud, then I'm all set. Everything is available, and everything is highly redundant. And it is, if you design [the application] with those things in mind.

Heineken CISO champions a new risk mindset to unlock innovation

Starting as an auditor and later leading a cyber defense team. It’s easy to fall into the black-and-white trap of being the function that always says “no” or speaks in cryptic tech jargon. It’s a scary world out there with so many attacks happening in every industry. The classical reaction of most security professionals is to tighten defences and impose even more rules. ... CISOs need to shift the mindset from pure compliance to asking: How does our cyber strategy support the business and its values? What calculated risks do we want the business to take? Where do we need their attention and help to embed security into the DNA of our people and our company? ... Be visible and approachable. Share the lessons that shaped you as a leader, what worked, what didn’t, and the principles that guide your decisions. I’m passionate about building diverse teams where everyone gets the same opportunities, no matter age, gender, or background. Diversity makes us stronger, and when there’s trust and openness, it sparks mentoring, coaching, and knowledge sharing. Make coaching and mentoring non-negotiable, and carve out time for it. It’s easy to push aside when you’re busy putting out security fires, but neglecting people’s growth and well-being is a big miss. Be authentic and vulnerable, walk the talk. Share the real stories, including failures and what made you stronger. Too often, people focus only on titles, certifications, and tech skills.

Data-Driven Enterprise: How Companies Turn Data into Strategic Advantage

A data-driven enterprise is not defined by the number of dashboards or analytics tools it owns. It’s defined by its ability to turn raw information into intelligent action. True data-driven organizations embed data thinking into every level of decision-making from boardroom strategy to day-to-day operations. ... A modern data architecture is not a single platform, but an interconnected ecosystem designed to balance agility, governance, and scalability. ... As organizations mature in their data journey, they are moving away from rigid, centralized models that rely on a single source of truth. While centralization once ensured control, it often created bottlenecks slowing down innovation and limiting agility. ... We are entering an era of data agents self-learning systems capable of autonomously detecting anomalies, assessing risks, and forecasting trends in real time. These intelligent agents will soon become the invisible workforce of the enterprise, operating across domains: predicting supply chain disruptions, optimizing IT performance, personalizing customer journeys, and ensuring compliance through continuous monitoring. Their actions will reshape not only operations but also how organizations think about governance, accountability, and human oversight. For architects, this shift represents both a challenge and an extraordinary opportunity. The role is evolving from that of a data custodian focused on structure and governance to an ecosystem designer who engineers environments where data and AI can coexist, learn, and continuously create value.

10 benefits of an optimized third-party IT services portfolio

By entrusting day-to-day IT operations to trusted providers, organizations can reallocate internal resources toward higher-value initiatives such as digital transformation, automation, and product innovation. This accelerates adoption of emerging technologies, and allows internal teams to deepen business expertise, strengthen cross-functional collaboration, and focus on driving growth where it matters most. ... A well-structured third-party IT services portfolio can provide flexibility to scale up or down based on business needs. This is particularly valuable for CEOs who need to adapt to changing market conditions and seize growth opportunities. Securing talent in the market today is challenging and time consuming, so tapping into the talent pools of your strategic IT services partner base allows organizations to leverage their bench strength to fill immediate needs for talent. ... IT service providers continuously invest in advanced tech and talent development, enabling clients to benefit from cutting-edge innovations without bearing the full cost of adoption. As AI, automation, and cybersecurity evolve, providers offer the subject matter expertise and tools organizations need to stay ahead of disruption. ... With operational stability ensured through a balance of internal talent and trusted third parties, CIOs can dedicate more focus to long-term strategic initiatives that fuel growth and innovation.

Modernizing SOCs with Agentic AI and Human-in-the-Loop: A Guide to CISOs

Traditional SOCs were not built for today’s speed and scale. Alert fatigue, manual investigations, disconnected tools, and talent shortages all contribute to the operational drag. Many security leaders are stuck in a reactive loop with no clear path to improvement. ... Legacy SOCs rely heavily on outdated technologies and rule-based detection, generating high volumes of alerts, many of which are false positives, leading to analyst burnout. Analysts are compelled to manually inspect and triage a deluge of meaningless signals, making the entire effort unsustainable. ... Before transformation can happen, one needs to understand where one stands. This can be accomplished with key benchmarking metrics for SOC performance, such as MTTD (Mean time to detect), MTTR (Mean time to respond), case closure rates, and tool effectiveness. ... Agentic AI represents the next evolution of AI-powered cybersecurity, which is modular, explainable, and autonomous. Through a coordinated system of AI agents, the Agentic SOC continuously responds and adapts to the evolving security environment in real time. It is designed to accelerate threat detection, investigation, and response by 10x, bringing speed, precision, and clarity to every function of SecOps. Agentic AI is the technology shift that changes the game. Unlike traditional automation, Agentic AI is decision-oriented, self-improving, and always operating with human-in-the-loop for oversight.

3 SOC Challenges You Need to Solve Before 2026

2026 will mark a pivotal shift in cybersecurity. Threat actors are moving from experimenting with AI to making it their primary weapon, using it to scale attacks, automate reconnaissance, and craft hyper-realistic social engineering campaigns. ... Attackers have mastered evasion. ClickFix campaigns trick employees into pasting malicious PowerShell commands by themselves. LOLBins are abused to hide malicious behavior. Multi-stage phishing hides behind QR codes, CAPTCHAs, rewritten URLs, and fake installers. Traditional sandboxes stall because they can't click "Next," solve challenges, or follow human-dependent flows. Result? Low detection rates for the exact threats exploding in 2025 and beyond. ... Thousands of daily alerts, mostly false positives. An average SOC handles 11,000 alerts daily, with only 19% worth investigating, according to the 2024 SANS SOC Survey. Tier 1 analysts drown in noise, escalating everything because they lack context. Every alert becomes a research project. Every investigation starts from zero. Burnout hits hard. Turnover doubles, morale tanks, and real threats hide in the backlog. By 2026, AI-orchestrated attacks will flood systems even faster, turning alert fatigue into a full-blown crisis. ... From a financial leadership perspective, security spending often feels like a black hole: money is spent, but risk reduction is hard to quantify. SOCs are challenged to justify investments, especially when security teams seem to be a cost center without clear profit or business-driving impact.

Digital surveillance tools are reshaping workplace privacy, GAO warns

Privacy concerns intensify when surveillance data feeds into automated systems that evaluate performance, set productivity metrics, or flag workers for potential discipline. GAO found that employers often rely on flawed benchmarks and incomplete measurements. Tools rarely capture the full range of work performed, such as research, mentoring, reading, or off-screen tasks, and frequently misinterpret normal behavior as inefficiency. When employers trust these tools “at face value,” the report notes, workers can be unfairly labeled unproductive or noncompliant despite doing their jobs well. ... Meanwhile, past federal efforts to issue guidance on reducing surveillance related harms such as transparency practices, human oversight, and safeguards against discriminatory impacts have been rescinded or paused since January by the Trump administration as agencies reassess their policy priorities. GAO also notes that existing federal privacy protections are narrow. The Electronic Communications Privacy Act restricts covert interception of communications, but it does not cover most forms of digital monitoring, such as keystroke logging, location tracking, biometric data collection, or algorithmic productivity scoring. ... The report concludes that while digital surveillance can improve safety, efficiency, and health monitoring, its benefits depend wholly on how employers use it.

How to avoid becoming an “AI-first” company with zero real AI usage

A competitor declared they’re going AI-first. Another publishes a case study about replacing support with LLMs. And a third shares a graph showing productivity gains. Within days, boardrooms everywhere start echoing the same message: “We should be doing this. Everyone else already is, and we can’t fall behind.” So the work begins. Then come the task forces, the town halls, the strategy docs and the targets. Teams are asked to contribute initiatives. But if you’ve been through this before, you know there’s often a difference between what companies announce and what they actually do. Because press releases don’t mention the pilots that stall, or the teams that quietly revert to the old way, or even the tools that get used once and abandoned. ... By then, your company’s AI-first mandate will have set into motion departmental initiatives, vendor contracts and maybe even some new hires with “AI” in their titles. The dashboards will be green, and the board deck will have a whole slide on AI. But in the quiet spaces where your actual work happens, what will have meaningfully changed? Maybe you'll be like the teams that never stopped their quiet experiments. ... That’s invisible architecture of genuine progress: Patient, and completely uninterested in performance. It doesn't make for great LinkedIn posts, and it resists grand narratives. But it transforms companies in ways that truly last. Every organization is standing at the same crossroads right now: Look like you’re innovating, or create a culture that fosters real innovation.

Daily Tech Digest - November 23, 2025

Quote for the day:

“Let no feeling of discouragement prey upon you, and in the end you are sure to succeed.” -- Abraham Lincoln

Lean4: How the theorem prover works and why it's the new competitive edge in AI

Lean4 is both a programming language and a proof assistant designed for formal verification. Every theorem or program written in Lean4 must pass a strict type-checking by Lean’s trusted kernel, yielding a binary verdict: A statement either checks out as correct or it doesn’t. This all-or-nothing verification means there’s no room for ambiguity – a property or result is proven true or it fails. ... Lean4’s value isn’t confined to pure reasoning tasks; it’s also poised to revolutionize software security and reliability in the age of AI. Bugs and vulnerabilities in software are essentially small logic errors that slip through human testing. What if AI-assisted programming could eliminate those by using Lean4 to verify code correctness? ... Beyond software bugs, Lean4 can encode and verify domain-specific safety rules. For instance, consider AI systems that design engineering projects. A LessWrong forum discussion on AI safety gives the example of bridge design: An AI could propose a bridge structure, and formal systems like Lean can certify that the design obeys all the mechanical engineering safety criteria. ... For enterprise decision-makers, the message is clear: It’s time to watch this space closely. Incorporating formal verification via Lean4 could become a competitive advantage in delivering AI products that customers and regulators trust. We are witnessing the early steps of AI’s evolution from an intuitive apprentice to a formally validated expert.

How pairing SAST with AI dramatically reduces false positives in code security

In our opinion, the path to next-generation code security is not choosing one over the other, but integrating their strengths. So, along with Kiarash Ahi, founder, Virelya Intelligence Research Labs and the co-author of the framework, I decided to do exactly that. Our novel hybrid framework combines the deterministic rigor and the speed of traditional SAST with the contextual reasoning of a fine-tuned LLM to deliver a system that doesn’t just find vulnerabilities, but also validates them. ... The framework embeds the relevant code snippet, the data flow path and surrounding contextual information into a structured JSON prompt for a fine-tuned LLM. We fine-tuned Llama 3 8B on a high-quality dataset of vetted false positives and true vulnerabilities, specifically covering major flaw categories like those in the OWASP Top 10 to form the core of the intelligent triage layer. Based on the relevant security issue flagged, the prompt then asks a clear, focused question, such as, “Does this user input lead to an exploitable SQL injection?” ... A SAST and LLM synergy marks a necessary evolution in static code security. By integrating deterministic analysis with intelligent, context-aware reasoning, we can finally move past the false positive crisis and equip developers with a tool that provides high signal security feedback at the pace of modern development with LLMs.

Quantum Progress Demands Manufacturing Revolution, Martinis Says

Quantum computing’s next breakthroughs will come from factories, not physics labs, according to John Martinis ... He argued that a general-purpose quantum computer will require at least a million physical qubits, a number that is far beyond today’s devices and out of reach without a fundamental shift in how the hardware is built. ... Current machines rely on dense tangles of wires, components and cooling structures that dwarf the tiny chip at the bottom of the machine. He writes that “The complexity of the plumbing completely overwhelms the quantum device itself.” Martinis said the solution is to abandon today’s hand-built, research-lab approach and move to fully integrated chips similar to the transformation that turned 1960s mainframes into the microchips inside smartphones. The field, he argued, must invest in cryogenic integrated circuits that can operate at the ultra-low temperatures required for superconducting qubits. Using that approach, Martinis suggests that engineers could place about 20,000 qubits on a single wafer and reach the million-qubit scale by linking wafers together. That level of integration would also require abandoning manufacturing methods that date back more than half a century. He singled out the “lift-off” process still used in many quantum labs as too dirty and too limited for industrial-scale production.

Dream of quantum internet inches closer after breakthrough helps beam information over fiber-optic networks

"By demonstrating the versatility of these erbium molecular qubits, we're taking another step toward scalable quantum networks that can plug directly into today's optical infrastructure,” David Awschalom, the study's principal investigator and a professor of molecular engineering and physics at the University of Chicago, said in the statement. ... That's largely where the comparison ends, though. Whereas classical bits compute in binary 1s and 0s, qubits behave according to the weird rules of quantum physics, allowing them to exist in multiple states at once — a property known as superposition. A pair of qubits could, therefore, be 0-0, 0-1, 1-0 and 1-1 simultaneously. Qubits typically come in three forms: superconducting qubits, which are made from tiny electrical circuits; trapped ion qubits, which store information in charged atoms held in place by electromagnetic fields; and photonic qubits, which encode quantum states in particles of light. ... Operating at telecom wavelengths provides two key advantages, the first being that signals can travel long distances with minimal loss — vital for transmitting quantum data across fiber networks. The second is that light at fiber-optic wavelengths passes easily through silicon. If it didn't, any data encoded in the optical signal would be absorbed and lost. Because the optical signal can pass through silicon to detectors or other photonic components embedded beneath, the erbium-based qubit is ideal for chip-based hardware, the researchers said.

AWS Outage Fallout: Lessons In Resilience

The impact of the AWS outage has led to multiple warnings about the issues when relying on one cloud provider. But experts warn it’s important to keep in mind that moving to multi-cloud can also cause problems. Multi-cloud is “not the default answer,” says Ryan Gracey, partner and technology lawyer at law firm Gordons. “For a few crown jewel services, splitting across providers can reduce single-supplier risk and satisfy regulators, but it also raises cost and complexity, and opens new ways to fail. Chasing a lowest common denominator setup often means giving up the very features that make cloud attractive.” ... The takeaway from the latest outage is not just to buy more redundancy, says Gracey. “It’s about designing systems that bend, not break. They should slow down gracefully, drop non-essential features and protect the most important customer tasks when things go wrong. A part of this is running drills so teams know who decides what actions to take, what to say to customers and what to do first.” For the cloud service provider, it’s important to recognise where a potential single point of failure – or “race condition” in the case of AWS – may exist, says Jones. “AWS will be looking at its architecture to ensure single points of failure are eliminated and the potential blast radius of any incident is dramatically reduced.” Maintaining operations during outages requires “architectural and operational preparation,” says Nazir.

AI Is Not Just a Tool

At some point in every panel, someone leans into the microphone and says it: “AI is just a tool, like a camera.” It’s meant to end the argument, a warm blanket for anxious minds. Art survived photography; we’ll survive this. But it is wrong. A camera points at the world and harvests what’s already there. A modern AI system points at us and proposes a world — filling gaps, making claims, deciding what should come next. That difference is not semantics. It’s jurisdiction. ... A photo is protectable because a human author made it. Purely AI-generated material, absent sufficient human control, isn’t. The law refuses to pretend the prompt is the picture. That alone should retire the analogy. That doesn’t mean the output is “authorless”; it means the law refuses to pretend the user’s prompt equals human creative control. Cameras yield photographs authored by people; models yield artifacts whose legal status relies on the extent to which a human actually contributed. Different authorship rules = different things. ... The model is not a person, but it isn’t an empty pipe. It embodies choices that will be made (over and over) at human scale, with the same confidence we misread as competence. That’s why generative AI feels creative without being human. It performs composition: not presence, but pattern. It produces objects that look like testimony. Cameras can lie (through framing), but models conjecture. They create the very thing we then argue about.

Are Small Businesses at Risk by Outsourcing Parts of Their Operations?

When you outsource a function or department, you're doing more than simply delegating tasks. Every third-party vendor, managed service provider, virtual assistant, or consultant who requires access to your critical systems carries an element of risk; they're ostensibly a potential entry point into your business. ... Some organizations are bound by specific, stringent regulatory frameworks and standards, depending on their sector(s) of operation. Some remote-working IT or marketing contractors may not be subject to the same data privacy laws that govern your organization, for example. Similarly, an HR outsourcing provider may store employee information in cloud servers that are deemed security-compliant in some jurisdictions but not in others. These compliance gaps create additional security vulnerabilities that threat actors would actively exploit without hesitation if the opportunity arose. ... As AI becomes more ingrained into business operations, the process of outsourcing becomes increasingly gray. According to recent statistics, more than half of businesses have experienced AI-related security vulnerabilities. What's more, cybercriminals are harnessing generative AI technology to escalate and amplify their attacks. ... The biggest danger that SMBs face when outsourcing is the assumption that someone else is now responsible for upholding security standards.

Why AI Integration in DevOps is so Important

Traditional DevOps pipelines rely heavily on a high degree of automated testing and monitoring. The drawback is that they often lack the machine intelligence needed to recognize new or evolving threats. AI addresses this gap by introducing learning-based security systems capable of real-time behavioral analysis. Instead of waiting for known vulnerabilities to appear or be actively exploited, these systems recognize the predicate behavior and code activity. Once detected, engineers are alerted before an incident occurs. Within DevOps, AI is able to fortify each stage of the process: Reviewing commits for suspicious or vulnerable code, monitoring container environment integrity and evaluating system logs for anomalies that may have escaped real-time recognition. Insights like these help teams locate weak spots and reduce the impact of human error over time. ... AI integration with existing CI/CD workflows gives DevOps teams real-time visibility into security risks. AI-powered automated scanners analyze components automatically. Source code, dependencies and container images are all scanned for hidden vulnerabilities before the build phase is complete. This helps identify issues that could otherwise slip through manual reviews. AI-driven monitoring tools also track activity across the entire delivery pipeline, identifying potential attacks such as credential theft, code injection or dependency poisoning. As these tools learn over time, they adapt to new threat behaviors that traditional scanners might overlook.

NTT: How Japan Leads in Cybersecurity Amid Rising Threats

The Active Cyber Defense Law passed in May 2025 is intended to minimise the damage caused by substantive cyberattacks that can compromise national security, while Japan has also established new requirements for critical infrastructure companies to enhance their cybersecurity practices under the revised Economic Security Promotion Act. ... Gen AI has lowered the bar for adversaries to launch cyberattacks, meaning defenders have no choice but to empower themselves to automate at least partially their tasks including log or phishing analysis, threat detection, behavioural analysis and incident report drafting. This is crucial for defenders who are overwhelmed by ever increasing work around the clock to minimize burnout risks. ... As Japanese companies are increasingly expanding their businesses globally, multiple firms have reported their overseas subsidiaries being hit by ransomware attacks in the United States, Vietnam, Thailand, Singapore and Taiwan. To manage supply chain risks and ensure business continuity, it is becoming more crucial than ever to ensure global governance in cybersecurity and keep proper data backups, the principle of least privilege and network segmentation. Surprisingly, Japan is the country where ransomware infection ratio is lowest amongst 15 major countries such as the United States, the United Kingdom, France and Germany.

From Data Bottlenecks to Data Products: Building for Speed and Scale

As it stands now, the central data team oversees data quality only at the final stage, a process that is not currently working. This is because it has resulted in the domain team, who create the data, being the only ones who have the full context necessary for proper accuracy and integrity. If businesses shift left with their approach, app developers themselves will take responsibility for the data created by applications. By giving the producer ownership of the quality, ongoing issues can be stopped before trickling down into data dashboards or machine-learning models. Ultimately, this is more than just a technical change. Shifting left will be a culture change that moves toward Data Mesh principles. By embedding ownership and quality within the domains that produce and use data, organisations replace central gatekeeping with shared accountability. Each domain now becomes a creator and protector of reliable data, ensuring governance is built in from the start rather than enforced later. ... Understandably, giving ownership of data to the teams creating it may seem chaotic. But it isn’t about losing control over it; rather, it is about giving teams the freedom and tools to work faster and smarter. At the end stands the lighthouse vision of a self-service data platform where every consumer can independently generate insights for standard questions and only reach out for support when tackling more advanced analyses.