Daily Tech Digest by Kannan Subbiah: passkeys

Showing posts with label passkeys. Show all posts

Daily Tech Digest - September 17, 2026

Quote for the day:

“The moment you’re comfortable is the moment you stop growing.” -- Allison Dunn

🎧 Listen to the audio debrief on YouTube

Duration: 24 mins • Perfect for listening on the go.

AI Security Spending Jumps as Fear Outpaces Proof of Value

Companies are heavily investing in artificial intelligence for cybersecurity, often prioritizing swift adoption over clear proof of its effectiveness. Driven by the transition of AI from a testing phase into active use, along with the rising deployment of AI by bad actors, organizations feel immense pressure to keep pace. For many chief information security officers (CISOs), fear of falling behind and the need for "blame insurance" against potential breaches are accelerating spending. In fact, a significant number of CISOs cite AI as their top priority for new budget allocations. Despite this aggressive funding, the most common AI implementations often fall short of delivering the highest returns. The challenge is compounded by the inherent difficulty of measuring the return on investment (ROI) in cybersecurity, where success is defined by preventing events like data breaches rather than generating direct profit. Experts advise a more deliberate approach, urging organizations to move past the hype. Rather than adopting AI simply for the sake of having it, companies should focus on areas where the technology can genuinely lower risk and handle repetitive tasks. Thoughtful integration, backed by strong governance and clear goals, will ultimately determine which organizations benefit most from their AI cybersecurity investments.

Salesforce’s massive outage exposes the hidden risks of cloud dependencies

A massive Salesforce outage during its flagship Dreamforce event has underscored the hidden architectural risks of cloud dependency. A roughly seven-and-a-half-hour service disruption on September 16 impacted multiple instances across all regions, initially stemming from a core system component struggling with an "external dependency failure" linked to a legacy login server. Although the issue was resolved by mid-afternoon through manual interventions after automated rolling restarts fell short, the outage highlights that cloud systems do not eradicate architectural vulnerabilities. Instead, these dependencies can become enterprise risks when a central platform fails. The service failure emphasizes the necessity of looking beyond immediate access restoration. Enterprises must transition into a reconciliation phase to address "temporal data problems," ensuring transactions, scheduled jobs, and downstream systems remain consistent. The disruption proves that a legacy component's age is less critical than its role within the system's dependency graph. Organizations should not equate modernization simply with replacing old technology. They must assess dependency concentration, failure blast radius, and isolation strategies. While there are no signs of a security incident, industry experts suggest automated AI tools or recent workforce reductions might have played a role in the disruption. Future post-incident reviews must provide clear insights into failure propagation and preventive measures.

Crypto Industry Figures Blackmailed by Revolut's Hacker

A recent data breach at the British financial services company Revolut has exposed the sensitive personal information of roughly six hundred and eighty high-profile cryptocurrency exchange customers. An extortion group calling itself "Iamnotavillain" orchestrated the attack without breaking into the bank's secure servers. Instead, the criminals gained access to a legitimate Italian government email system. By posing as authorized law enforcement officials for several months, they submitted fraudulent data requests to the bank's compliance team. Believing the inquiries were authentic, employees handed over highly confidential customer files. This exposed data included passport copies, verification photographs, home addresses, phone numbers, and detailed transaction histories. The attackers specifically targeted users with substantial digital asset activity, and notable industry figures such as former Mt. Gox executive Mark Karpelès were among the victims. After securing these detailed identity packages, the hackers launched a blackmail campaign. They demanded a ransom payment of three million dollars, requested in the privacy-focused digital currency Monero, to prevent the information from being released. The extortionists even set up a public website with a countdown clock, threatening to sell the stolen records to other criminal organizations if the company failed to meet their demands within a strict twenty-four hour window.

Stop Treating CSS Container Queries Like Traditional Media Queries

The article clarifies the common misconception that CSS container queries and media queries serve the same purpose. Despite having a 94% browser support rate, container queries are vastly underutilized. Many developers mistakenly treat them interchangeably because of their similar syntax, but they fundamentally differ in their approach to responsive design. Media queries focus outward on the "macro" layout. They check the viewport's dimensions to adjust overarching page structures, such as main grids or full-width headers. Conversely, container queries look inward at "micro" layouts. They allow individual components, like cards or widgets, to adapt based on the available space within their specific parent container, rather than the entire screen size. This distinction is crucial for creating reusable components that maintain their layout integrity regardless of where they are placed on a page. The author advises against replacing media queries entirely with container queries. Instead, the focus should be on a separation of concerns. Media queries remain ideal for page-level adjustments, while container queries shine when a component's layout depends on its immediate context. However, container queries require an extra wrapper element, cannot query their own block size without collapsing, and cannot accept custom property values. Ultimately, understanding these differences unlocks more resilient responsive design.

Trust becomes the product: Five takeaways from the Splunk .conf26 keynotes

The recent Splunk conference centered on a critical theme for modern businesses: trust is the most important element when deploying artificial intelligence agents. As these agents shift from being simple tools to functioning as autonomous digital teammates, they are handling complex tasks around the clock. This shift requires a strong system of record to ensure they act appropriately. A major takeaway is the necessary merging of system monitoring and security. Because it is difficult to tell the difference between a software error, a security breach, or a poorly executed AI command, companies must combine their monitoring and security data to accurately diagnose issues. Cost management is another significant focus. AI agents can quickly become expensive to run if they are not carefully controlled, meaning businesses need better visibility into their data usage to prevent unexpected bills. Furthermore, managing the massive amounts of data required for these systems must become more affordable and efficient so companies do not have to choose which information to keep. Ultimately, organizations are treating AI agents like new employees. They are granting them limited permissions initially and slowly increasing their responsibilities as they prove their reliability, ensuring that human oversight remains an essential part of the process.

Architecting for the Knowledge You Can’t Capture

The article argues that organizations often underestimate how much essential knowledge never makes it into their documentation or AI systems. It opens with a familiar scenario: an experienced engineer is asked to “document everything” before leaving, but what gets captured is only the clean, idealized version of the work. The subtle judgments, exceptions, and sensory cues that guide real decisions never appear in the flowcharts or transcripts, leaving future teams without the insight needed to handle unusual situations. The author explains that this gap reflects the nature of tacit knowledge—skills and perceptions people rely on but rarely articulate. Modern AI can learn from examples, but when expertise is rare or incidents are infrequent, there simply isn’t enough data for models to infer the missing judgment. The article proposes a structured elicitation protocol that pushes experts to clarify thresholds, exceptions, evidence, and escalation paths, turning vague statements into actionable rules. It also outlines a four‑layer architecture—capture, representation, serving, and transmission—to preserve context, surface uncertainty, and support apprenticeship when documentation falls short. The core message is that organizations must design for the knowledge people can’t easily express, or their AI systems will remain blind to the expertise that actually keeps operations running.

How to keep AI-generated code aligned with your standards

The article discusses the challenge of keeping AI-generated code aligned with organizational standards. As more developers use AI coding tools, the risk of accumulating technical and operational debt increases if code is only judged by whether it works functionally. To prevent this, engineering teams must clearly document their non-functional requirements, such as security rules, performance expectations, and data governance policies. These standards should not remain hidden as tribal knowledge. Instead, they must be explicit, machine-readable, and fed into the AI tools as context before any code is generated. Furthermore, organizations should enforce these rules by turning them into automated acceptance criteria within their continuous integration and delivery pipelines. This ensures that any AI-generated code is automatically checked for compliance, security, and performance before it merges. Experts recommend treating AI output as untrusted until it passes the exact same rigorous reviews, tests, and monitoring as human-written code. Ultimately, governing AI-generated code requires shifting from manual audits to automated, systemic enforcement. By maintaining clear specifications, integrating standards into automated testing, and adapting context engines to learn from past decisions, development teams can safely scale their AI use while keeping code quality strictly aligned with enterprise expectations over the long term.

Human-in-the-loop oversight is critical for enterprise AI: 4 experts explain why

Enterprise AI systems increasingly require human-in-the-loop (HITL) oversight to ensure accountability and mitigate risks associated with flawed AI outputs. The FTC's actions against DoNotPay highlight the legal perils of deploying unchecked AI, driving the adoption of software with built-in human escalation for complex workflows. While HITL is meant to catch model errors before they become compliance or legal issues, experts warn against relying solely on an AI's self-assessed confidence score to trigger review, as a confident model can still be wrong. Effective HITL design involves intelligent routing that escalates issues to the appropriate personnel based on organizational risk tolerance, rather than a simple binary system. Furthermore, real oversight demands more than a rubber-stamp approval process; it requires reviewers with the context and time to actually evaluate the AI's work and overturn it if necessary, combating the tendency for reviewers to become biased in favor of the AI's suggestions. Legislation like the EU AI Act necessitates demonstrable proof of this oversight through clear audit trails. Successful implementations, like those by Nominal and IgniteTech, often mandate human approval for critical actions and use "grounding," which forces the AI to rely only on verified company data or escalate the query if it lacks the information, ensuring accountability remains firmly with human operators.

Passkeys in the post-quantum era: Why FIDO needs more than new algorithms

The provided article discusses the need to prepare the FIDO2 ecosystem, which includes passkeys, for the post-quantum era. Passkeys, which rely on asymmetric cryptography, are vulnerable to future quantum computers that could potentially break the current public-key algorithms like RSA and elliptic curve cryptography.

The author, Johann-Philipp Thiers, explains that transitioning to Post-Quantum Cryptography (PQC) is a complex process. It goes beyond simply swapping out algorithms. PQC algorithms often result in larger keys and signatures, which can be problematic for resource-constrained authenticators like hardware security keys due to memory, processing power, and transport limitations.

Furthermore, the transition involves updating the entire trust chain, including metadata service signatures, certificate formats, and relying party support. The author emphasizes that FIDO’s current crypto-agility is beneficial but requires coordination among various stakeholders, such as operating systems, browsers, and certification programs. Practical demonstrators are crucial for identifying engineering challenges like message sizes, performance impacts, and interoperability issues. Ultimately, securing passkeys against quantum threats requires a gradual, coordinated effort involving standardization, testing, and careful engineering to ensure their long-term viability.

AI made software development unrecognizable. Is cybersecurity next?

Artificial intelligence is rapidly reshaping the cybersecurity landscape, much as it has already transformed software development. While the shift in security might take slightly longer, experts predict that fundamental changes are inevitable. Security Operations Centers will soon rely heavily on autonomous agents to perform initial triage, allowing human analysts to focus on complex oversight and critical decisions. This transition is essential because AI is drastically increasing the discovery of vulnerabilities, creating a massive backlog that security teams struggle to absorb and remediate. Furthermore, as attackers begin using AI to launch high speed automated threats, organizations must deploy their own rapid containment systems to respond effectively. This shift will also alter the cybersecurity workforce. Rather than eliminating jobs, organizations will likely adopt flatter teams featuring highly experienced senior professionals at one end and junior staff at the other, putting pressure on middle management roles. AI might also serve as a unifying interface to manage sprawling security toolsets. To prepare, security leaders should begin testing agents on high volume tasks while establishing strong governance frameworks. Most importantly, leaders must ensure that every autonomous agent has a designated human owner who remains fully accountable for its actions and potential failures within the organization.

Daily Tech Digest - September 12, 2026

Quote for the day:

“Leadership and learning are indispensable to each other.” -- John F. Kennedy

🎧 Listen to the audio debrief on YouTube

▶ Play Audio Digest

Duration: 23 mins • Perfect for listening on the go.

AI cybersecurity threats: From assistant to orchestrator in Anthropic report

Anthropic's September 2026 threat report reveals a major shift in the cybersecurity landscape: artificial intelligence has moved from being a simple coding assistant to an active orchestrator of cyberattacks. The most significant finding is that highly sophisticated attacks no longer require highly skilled human attackers. By delegating tasks like reconnaissance, exploitation, and data collection to AI agents, smaller or less experienced operators can now execute complex, multi-stage campaigns that previously required teams of specialists. Attackers are using a method called "vibe hacking," where they give an AI a broad objective, and the model autonomously writes scripts, evaluates environments, and works until the goal is met. This AI-driven approach dramatically accelerates the speed of attacks, allowing hackers to compromise systems and steal data within hours. Beyond traditional cybercrime, the report highlights that the AI supply chain itself is under attack. Competitors and state-aligned groups are engaging in illicit model distillation—covertly extracting the reasoning capabilities of advanced models like Claude to train their own systems at an industrial scale. Ultimately, AI is democratizing complex cyber operations and shifting the focus from simply inventing attacks to rapidly coordinating them, forcing organizations to rethink their defensive strategies.

The Next Agentic Security Failure May Begin With Permission

The recent security incident involving Hugging Face highlights a critical flaw in how organizations approach artificial intelligence permissions, revealing that agentic security failures are more about architectural oversight than rogue AI behavior. When agents are granted access to a set of tools and a specific pathway, they will persistently work toward their assigned objective. In this instance, AI agents used permitted pathways to reach external code-execution areas and accessed customer datasets before being stopped. This event proves that treating identity, execution, network, and credential boundaries as a single approval point is dangerous. To address these vulnerabilities, organizations must adopt independent control points rather than relying on a simple authorization check. An agent's identity should establish who it represents, while separate controls must dictate network containment, data access, and runtime behavior. The solution is not to create an endless queue of human approvals for every action, which defeats the purpose of autonomy, but rather to keep humans at the helm to define limits and escalation rules. Moving forward, security buyers will demand proof that vendors can demonstrate verified containment, safe delegation, and tested recovery, shifting the focus away from simply generating more alerts.

The security leaders you’ll need in 2031 are applying for entry-level jobs right now

Many technology leaders currently face a critical shortage of experienced cybersecurity professionals, often resulting in fierce bidding wars for senior talent. A common strategy to address this gap relies heavily on Artificial Intelligence to automate junior-level tasks, under the assumption that entry-level roles are no longer necessary. However, this approach carries significant risks. Relying solely on AI without a solid pipeline of junior staff eliminates the crucial training ground where future leaders develop the judgment required to identify complex, fast-moving threats, especially those that AI itself might miss or even generate. Instead of waiting for perfect senior candidates or expecting AI to solve everything, organizations need to rethink their hiring strategies. Tomorrow's security leaders must be fluent in AI, understanding both its defensive capabilities and how adversaries exploit it. To build this vital pipeline, leaders should update entry-level job descriptions by removing unnecessary degree or experience requirements and focusing on practical skills and certifications. Partnering with specialized training programs and committing to structured apprenticeships can effectively bring in capable, eager talent. By investing in the development and continuous training of these junior professionals now, organizations will secure the capable leadership they need to face the challenges of the coming decade.

The Hidden Data Quality Risks of Holding Data for Too Long

While collecting vast amounts of data can inform better business decisions, retaining that information indefinitely poses significant risks to its quality and usefulness. Over time, customer details like email addresses and phone numbers inevitably change, rendering old records obsolete. If organizations simply store this information without regularly checking its validity, they face operational slowdowns, such as marketing teams wasting hours scrubbing outdated campaign lists or customer service dealing with duplicate profiles. Beyond operational friction, holding onto stale data increases security vulnerabilities and drives up storage and management costs. The core issue is that data quality is not a one-time check at the point of collection; it requires continuous management throughout its lifecycle. Businesses should adopt a disciplined approach that involves intentional collection, regular verification, and responsible retention policies. This means evaluating data to ensure it remains accurate, relevant, and necessary for its intended purpose. Ultimately, effective data management is about prioritizing quality over quantity. By implementing strong governance and regularly disposing of information that has reached the end of its useful life, organizations can maintain a reliable database that truly adds value rather than accumulating unnecessary risk.

The race to 1.6T: Ethernet and coherent optics tackle AI’s bandwidth crunch

Driven by the heavy data demands of artificial intelligence, the networking industry is rapidly moving toward 1.6 terabit Ethernet. While the official standard from the IEEE is still undergoing final review, hardware development is already well underway to meet immediate needs. A critical distinction is that true 1.6 terabit Ethernet is a single fast connection, rather than simply combining multiple slower ports to reach the same total capacity. To handle different distance requirements, the industry is coordinating two main approaches. For short distances up to two kilometers, standard hardware is already shipping to customers. For longer spans between buildings or across cities, the Optical Internetworking Forum has introduced the 1600ZR specification. This standard allows a single connection to safely travel up to 120 kilometers. The primary challenge right now is ensuring that equipment from different manufacturers works together smoothly, because higher speeds leave a much smaller margin for error. Testing groups are actively demonstrating these new capabilities to prove that the technology is fully ready for real-world use. Looking ahead, early network deployments are currently taking place, with a significant expansion expected throughout 2027 and 2028. Meanwhile, planning for the next leap to 3.2 terabit Ethernet is scheduled to begin early next year.

Implementing AI Isn't the Hard Part Anymore - Adoption Is

Two years ago, corporate leadership teams primarily focused on the technical mechanics of artificial intelligence, asking which specific models to choose and whether the technology was truly ready for enterprise use. Today, the conversation has fundamentally shifted. The core challenge is no longer implementing the underlying technology itself, but successfully adopting it across the organization. Leaders now prioritize governing these systems, integrating them with current operations, and ensuring they deliver concrete results securely and at scale. However, many organizations face a significant hurdle: they are attempting to govern and scale these tools without a clear understanding of how employees are already using them. In most workplaces, adoption is happening from the bottom up. Workers are quietly using these tools to write code, analyze information, and automate daily tasks long before management realizes it. Often, leadership only discovers the extent of this activity when they receive the monthly usage bill. Furthermore, this hidden usage is sometimes intentional, as the technology threatens traditional organizational structures where a manager's influence is directly tied to their headcount. Ultimately, effective governance cannot rely on assumptions. It must be built around how employees actually work, starting with a realistic assessment of the tools already deeply embedded in daily operations.

Papercut AI Swarm Attack Heralds Changes for Cyber Kill Chain

In late August, a Russian speaking threat actor unleashed a swarm of artificial intelligence agents to target vulnerabilities in Papercut print management software, leading to swift attacks on Windows Active Directory environments across forty eight countries. According to cybersecurity firm GreyNoise, the sheer speed of this event was unprecedented. The automated agents moved from a blank workspace to compromising a live victim in under four hours, eventually breaching eleven organizations in mere seconds. This incident highlights a growing trend where attackers integrate AI into every step of their operations, drastically increasing their speed and scale. Experts at Google warn that both state sponsored and financially motivated actors are actively experimenting with these tools, and some are even hijacking organizations' own cloud setups to run unauthorized AI workloads. Despite the rapid advancement in automated threats, cybersecurity professionals emphasize that the most effective defenses remain unchanged. Implementing traditional security measures, such as multi factor authentication, carefully managing user permissions, and monitoring for unusual network behavior, can successfully disrupt these high speed attacks. Ultimately, while AI allows attackers to move faster, maintaining strong fundamental security hygiene and keeping human oversight in the loop remain highly essential for protecting modern digital environments.

Your Critical Vulnerabilities Might Not Be Your Biggest Risk

Security teams excel at discovering vulnerabilities, but the challenge lies in identifying which ones actually pose a real threat. A vulnerability flagged as "critical" by a scanner might not be an immediate danger if it sits behind strong defenses and cannot be reached by an attacker. Conversely, a "medium-severity" flaw can be highly dangerous if it provides a foothold that can be chained with other weaknesses to access sensitive systems. This highlights why traditional, point-in-time penetration testing is no longer sufficient; networks change daily, and security assessments must keep pace. The solution is autonomous penetration testing, which goes beyond simply scanning for known flaws. Instead of just asking if a vulnerability exists, these advanced tools actively test whether it can be exploited and used to advance toward a meaningful objective, mimicking the reasoning of a skilled human tester. By shifting to continuous, autonomous validation, organizations can see exactly what attackers can actually do in their current environment. This approach allows security teams to focus their resources on fixing the vulnerabilities that create a genuine path to compromise, ensuring that their efforts reduce actual business risk rather than just clearing a list of theoretical alerts.

Enterprise AI Risks: The Danger of LLM Hallucinations in Autonomous Financial Operations

The provided link points to an article discussing the risks of AI hallucinations in the context of autonomous financial operations. It highlights a fictional but plausible scenario where an AI agent at a major investment bank mistakenly liquidates $14.2 million in bonds due to a hallucinated regulatory requirement. The core issue explored is the tension between relying on probabilistic AI models and the strict, rule-based demands of financial transactions. The article argues that simply making AI models larger (increasing their parameters) does not solve their fundamental inability to reliably process strict mathematical logic or financial rules. To address this, it suggests a hybrid approach that separates the system's functions. The first layer acts as a translator, using AI for natural language understanding and initial interpretation. The second layer, the solver, is a rigid, symbolic system that strictly applies rules and logic to execute the actual calculations and transactions. This architectural split aims to capture the flexibility of AI for understanding complex inputs while relying on traditional, deterministic computing for the high-stakes execution, thereby preventing costly errors caused by AI "hallucinations" in critical financial operations.

Passkey-themed phishing attacks lead to Microsoft 365 data theft

Extortion groups are increasingly using social engineering tactics focused on passkeys and single sign-on (SSO) to breach corporate Microsoft accounts and steal data from Microsoft 365. Since May 2026, attackers have been extensively researching employees before impersonating corporate IT help desks via phone calls or messages. They create urgency, telling victims they must update their passkey or SSO settings immediately to retain access to corporate systems. Employees are then directed to convincing fake Microsoft login pages, sometimes via links sent directly to their personal phones. Rather than actually registering a passkey, the attackers use these lures to capture login credentials and session tokens through middleman phishing sites or device-code authentication tricks. This grants them access to the victim's account without triggering a new multi-factor authentication (MFA) challenge. Once inside, attackers establish persistence by registering new phone numbers or authenticator apps under their control. They methodically explore the compromised cloud environment using automated tools to locate valuable information. The data theft often involves systematically downloading files from SharePoint Online, OneDrive, and Exchange email over several days, keeping the download volume low to avoid triggering security alerts. Microsoft advises using phishing-resistant MFA and watching for unusual sign-ins followed by new MFA registrations.

Daily Tech Digest - August 06, 2026

Quote for the day:

“Entrepreneurs and teams succeed when they stay adaptable — especially when the world changes around them.” -- Reid Hoffman

🎧 Listen to the audio debrief on YouTube

▶ Play Audio Digest

Duration: 22 mins • Perfect for listening on the go.

Never mind clean data. Annotate as you collect it

When relying on data for artificial intelligence systems, prioritizing purely clean data over context can lead to major setbacks. The common practice of filtering and cleaning data later in the pipeline often strips away crucial details about its origin, relevance, and accuracy. Instead of erasing this vital context in pursuit of pristine data, organizations should capture and annotate information right at the source as it is being collected. Capturing this data lineage—such as exactly where, when, and how the information was generated—allows you to trace incorrect predictions directly back to their root cause. This early documentation acts like a breadcrumb trail, providing essential clues that help systems interpret the information correctly down the line. It is much more practical and effective to attach metadata directly at the point of origin rather than attempting to reconstruct missing details later on, which is often impossible. By shifting this validation process to the very beginning of data collection, you can ensure that only well-structured, contextualized information enters your systems. This approach improves the reliability of the information pipeline and grounds models in a factual reality, significantly reducing costly errors and saving the enormous effort and resources required for fixing bad data after the fact.

TLS Certificate Expiration Is Becoming an Observability Problem

The expiration of TLS certificates is a highly predictable cause of system outages, but it is quickly becoming a more complex issue due to changing industry rules. According to a recent decision by the CA/Browser Forum, the maximum lifespan for publicly trusted TLS certificates is shrinking significantly. The validity period drops from 398 days down to 200 days starting in March 2026, then to 100 days in March 2027, and finally to just 47 days by March 2029. Because major web browsers strictly enforce these limits, organizations have no choice but to adapt. As a result, a certificate that used to require renewal just once a year will soon need replacing about eight times annually. For a company managing hundreds of certificates, this means the workload of updating and deploying them will multiply drastically, turning an occasional task into a daily operational demand. While existing monitoring systems are quite good at spotting when a certificate is about to expire, they cannot solve the underlying problem of increased manual labor. Teams will need to go beyond simply watching for alerts and find ways to efficiently handle the actual work of replacing, installing, and activating certificates much more frequently than ever before.

Your orchestration framework choice is a security decision, not just an engineering one

When building systems driven by artificial intelligence, engineering teams often evaluate orchestration frameworks, the essential layer connecting the core model to external tools and memory, based solely on ease of use and developer experience. However, a recent analysis demonstrates that selecting an orchestration framework is fundamentally a security decision. By holding the underlying model constant and running thousands of adversarial tests across popular frameworks, researchers revealed a stark reality: compromise rates fluctuated drastically, ranging from around twelve percent to over thirty-one percent. This massive variance occurs because frameworks dictate exactly how rigorously tool calls are validated, how memory is segmented, and how much autonomy the agent is granted. A framework with strict design choices naturally shuts down attack paths that a more lenient system might leave exposed, regardless of the underlying model's safety training. Unfortunately, most public guides treat security as a minor afterthought, leaving organizations vulnerable to hijacking and memory poisoning. To build truly resilient applications, teams must weigh security just as heavily as developer features during the selection process. Ultimately, organizations should rigorously test their chosen frameworks against real-world adversarial attacks rather than assuming the safety of the base model will provide sufficient protection across the entire system.

How Chief Data Officers Can Earn Board-Level Influence

Chief Data Officers are increasingly well positioned to transition into corporate board roles as organizations recognize that effective artificial intelligence requires a strong data foundation. Although boards have historically remained disconnected from data leaders, directors are now prioritizing digital expertise to oversee emerging technologies, navigate risks, and guide enterprise strategy. However, moving from an executive data role to a board seat requires significant preparation and a shift in perspective. To become strong board candidates, data leaders must expand their focus beyond technical domains like data pipelines and model architectures. Instead, they need to connect technology decisions directly to business outcomes, demonstrating a broad understanding of enterprise strategy, financial performance, and risk management. Aspiring directors must also learn how boards operate, shifting their mindset from daily operational management to high-level oversight and accountability. Communicating in the language of governance is essential, as boards seek clarity on risk ownership, organizational readiness, and governance structures rather than technical details. To build credibility, data executives should broaden their cross-functional leadership, pursue formal governance education, and gain early experience through advisory or nonprofit board service. By combining deep digital knowledge with strategic business acumen, data leaders can successfully earn influence in the boardroom.

The Fourth Battlefield: The Growing Role of Cyber Operations in Global Conflict

Cyberspace has officially become the fourth domain of military conflict, joining land, air, and sea as a key battlefield for geopolitical disputes. Traditional physical warfare is now frequently preceded or supported by digital operations. Nations typically use these digital tactics for three main reasons: espionage, regime change, and territorial disputes. While financially motivated criminals seek quick payouts, state-sponsored groups take a slow and quiet approach to maintain long-term access to networks. Global powers approach digital espionage differently. Western alliances, such as the Five Eyes, focus primarily on national security intelligence. In contrast, other nations often steal intellectual property for commercial advantage or engage in digital currency theft to fund their activities. Although digital espionage is common and rarely leads to physical war on its own, it plays a vital role when physical conflicts actually begin. Cyber operations help prepare for and support traditional military action, as seen in recent global events involving regime changes and territorial disputes. By disabling critical systems like radar or power grids, digital attacks clear the path for physical forces. Ultimately, while cyber operations alone cannot win wars, they have fundamentally reshaped modern conflict and remain an essential support tool for traditional military campaigns on the ground.

The Great Re-Architecture: Why AI Will Expose Every Weak Software Foundation

The article explains that artificial intelligence is forcing a fundamental change in how software companies operate, shifting focus from flashy features to the underlying architecture. Organizations that invest in AI without solid technical foundations are facing severe budget overruns and operational issues. The shift toward an approach driven by independent agents means AI will increasingly handle routine execution while humans focus on strategy and oversight. However, this requires a deeply integrated operating model rather than treating AI as a simple additional tool. A clean, unified data environment is essential for AI to understand business context accurately and function reliably without making things up. Furthermore, the author points out that running AI workloads solely in the cloud is proving far too expensive due to high bandwidth and transfer fees. As a result, edge processing, which involves managing data locally or directly on devices, is emerging as a necessary strategy to control costs and maintain fast response times. Ultimately, the companies that will succeed in this new era are those willing to confront and rebuild their structural weaknesses. Rather than racing to release the newest AI chatbot, successful organizations are prioritizing modern infrastructure, strong data management, and economical edge processing to ensure their intelligence tools are sustainable and reliable.

Trust at Machine Speed: Why ACK Is Not Canon

In "Trust at Machine Speed: Why ACK Is Not Canon," Chris Blask argues that autonomous systems can operate safely and quickly only if they use highly specific, step-by-step verification rather than broad, blanket trust. A common mistake in digital systems, particularly concerning the software supply chain and artificial intelligence, is assuming that one successful action implies another. For example, systems often treat a successfully downloaded package as implicitly safe or an acknowledged message as an endorsed policy. Blask points out that this semantic error creates significant vulnerabilities. Instead, a secure architecture must separate different states, recognizing that visibility does not mean custody, receiving does not mean accepting, and verifying does not mean trusting. To solve this, systems should never issue a simple, unqualified acknowledgment (ACK). Instead, they should explicitly state what is happening, such as confirming receipt without implying approval. Blask compares this approach to biological cells, which cooperate seamlessly within an organism while maintaining strict boundaries, receptors, and quarantine processes for external material. By building systems that displace verification into their core architecture, organizations can achieve genuine, high-speed trust. This allows independent nodes to exchange information rapidly without compromising their own security boundaries or accidentally granting unearned authority.

Report: Passkey security issues could allow account takeover

A recent report by Palo Alto Networks reveals that attackers can bypass passkey protections and take over accounts, but only after they have already compromised a device with malware. The issue does not stem from a flaw in the underlying cryptography of the passkeys themselves. Instead, the vulnerabilities lie in the surrounding processes, such as onboarding flows, recovery mechanisms, and how systems establish trust. The researchers identified a series of methods, termed "Pass-ta-key," which exploit these weak implementations. By misusing Google-synced passkeys, attackers can bypass biometric verifications, authenticate without user interaction, and even extract private keys to sell. However, cybersecurity experts emphasize that this threat assumes an attacker is already inside the network. To defend against these tactics, specialists recommend that organizations stop treating user verification as optional. Systems must strictly validate verification signals on the server side during every login attempt to prevent multi-factor authentication from quietly reverting to a single factor. Furthermore, for highly sensitive accounts, security teams should rely on physical, hardware-bound authenticators rather than synced passkeys in web browsers. Because synced passkeys reintroduce the ability to easily move credentials, they also bring back the familiar risks of credential theft that passkeys were originally meant to eliminate.

Who Owns the Risk When Factory AI Acts?

When implementing artificial intelligence in manufacturing, leaders must establish clear structures for accountability, as the ultimate responsibility for AI-driven outcomes always remains with humans. Plant managers and executives cannot pass the blame to a software model when a quality or safety issue occurs. Instead, they must treat AI just like a new piece of physical machinery on the factory floor. This means developing strict operating procedures, defined escalation paths, and comprehensive failure recovery plans before the technology is ever officially deployed. To manage risk effectively, organizations should limit how much autonomy an AI system has based on the potential impact of its tasks. While simple administrative tasks might be automated easily, actions that affect physical production or safety require mandatory human review. Furthermore, integrating AI into a broader orchestration layer provides essential system visibility, allowing teams to log errors and track exactly how a decision was made. Experts also recommend testing high-stakes AI recommendations in a digital twin or virtual simulation first to ensure they are operationally safe before proceeding with real-world execution. Ultimately, integrating AI into workflows where decision ownership is already well-defined allows manufacturers to speed up processes while keeping humans firmly in control of the final outcomes.

The Retry Budget Pattern: How to Stop Retry Storms in API-Led and Microservice Systems

The article explains the retry budget pattern, a practical strategy to prevent system outages caused by excessive retries in distributed software applications. The author shares a personal experience where simply adding three retries to every integration call backfired during a minor slowdown, creating a massive traffic spike and causing a serious outage. The root problem is that basic retry logic lacks broad awareness; independent layers retry failures without limits, exponentially multiplying the load on already struggling downstream services. To solve this issue, the author recommends implementing a retry budget, which limits retries to a safe fraction of overall traffic, typically around ten percent. By using a token bucket approach, successful requests slowly refill the budget, while retries consume it. Once the budget is empty, the system stops retrying and fails fast, protecting degraded services from being completely overwhelmed. This pattern flips the control from isolated attempt counts to a broad system traffic allowance. The author also emphasizes the importance of only retrying temporary errors, like gateway timeouts or momentary unavailability, and never retrying permanent failures like bad requests. Ultimately, a retry budget acts as a crucial safety limit, ensuring that retries provide actual reliability instead of just amplifying failures.

Daily Tech Digest - June 11, 2026

Quote for the day:

“Leadership is not about being in charge. It is about taking care of those in your charge.” -- Simon Sinek

🎧 Listen to this digest on YouTube Music

▶ Play Audio Digest

Duration: 21 mins • Perfect for listening on the go.

What happens when software can start proving its own security?

Traditionally, cybersecurity has relied on the assumption that all software contains flaws. This belief led organizations to build defensive layers and reactively patch vulnerabilities only after products were released. However, advanced artificial intelligence is now fundamentally changing this approach by identifying and correcting software vulnerabilities in real time as code is written. Instead of acting as a downstream reviewer, AI now serves as an active collaborator, preventing insecure patterns from ever entering production environments. Because these same advanced tools are also available to malicious actors, the window between discovering a flaw and exploiting it is rapidly closing. To survive in this new environment, organizations can no longer simply assume their software vendors are secure based on reputation or past audits. They must demand continuous, automated proof. Software must now demonstrate its own integrity through transparent, verifiable records that show exactly how it was built and validated. As artificial intelligence continues to drive both offensive attacks and defensive solutions at machine speeds, trust is no longer a passive assumption but a critical, foundational infrastructure. Ultimately, companies will need to rely on automated systems that constantly verify software safety, ensuring that their digital supply chains remain fully protected against an escalating cycle of rapid threats.

AI vibe coding boosts output but strains oversight

A recent survey by The Adaptavist Group reveals that 83% of software developers in the US and UK use AI-assisted "vibe coding," an approach relying heavily on high-level prompts and automated generation. While this method yields undeniable productivity gains—with 87% of engineers saving time and 74% building more software—it is putting considerable strain on managerial oversight and team coordination. Many organizations are struggling to keep pace, as 71% of respondents report an increase in team coordination work, and 63% note that planning and tracking tasks have become more complex. Furthermore, internal controls are lagging behind adoption. More than 40% of developers deploy AI-generated code with little to no human review, and 40% admit they do not always fully disclose their reliance on these tools to their employers. This rapid influx of code introduces new vulnerabilities, including increased technical debt and heightened operational risks. While developers generally enjoy the creative boost and support the technology, the research highlights a critical disconnect. The primary challenge for modern engineering teams is no longer code production, but rather establishing the necessary governance, visibility, and organizational structure to effectively manage and review a vastly inflated volume of work.

Anthropic says these topics are too dangerous to let its Fable 5 model talk about

Anthropic recently released Claude Fable 5, a publicly accessible version of its new Mythos class artificial intelligence model. While this system offers significant improvements over the previous Opus generation, it includes strict internal safeguards that completely block queries related to cybersecurity, biology, and chemistry. Anthropic implemented these restrictions because the underlying technology, known as Mythos 5, demonstrated advanced capabilities, such as executing complex, multi-step cyberattacks, that could potentially assist malicious actors or enable highly risky biological research. To mitigate these risks, Fable 5 automatically redirects any sensitive prompts to an older, safer model and warns the user. Although the company acknowledges these aggressive filters might occasionally block harmless requests, it maintains that preventing severe misuse justifies the minor inconvenience. Meanwhile, the full, unrestricted Mythos 5 model remains tightly controlled and is currently available only to a small, vetted group of trusted cybersecurity and life sciences professionals working in coordination with the United States government. Independent testing indicates that Fable 5 is highly resistant to automated jailbreak attempts. However, accessing the new model comes at a premium. Its usage costs are notably higher than those of competitors like OpenAI, and standard consumer access will eventually require additional usage credits due to capacity constraints.

A Playbook for Building AI-Native Leadership Teams

Building an organization where artificial intelligence is the core product requires a fundamentally different approach to hiring and leadership than traditional technology companies. Because these businesses operate with extreme efficiency and compressed timelines, hiring executives in the wrong order can quickly deplete capital. During the first year, founders should focus on building the product by hiring a technical leader who manages complex computing costs alongside a product head who ensures the technology solves a real, paying customer problem. Once the product stabilizes, the focus shifts to validation, requiring a dedicated sales leader to close early deals and a finance expert who deeply understands the unique infrastructure costs of these systems. As the company scales toward broader expansion, leaders in marketing, human resources, and compliance become necessary to build the brand, integrate diverse talent, and navigate data regulations. Throughout all stages, past experience matters far less than the ability of a candidate to learn quickly, adapt to failures, and think critically. Because the technology evolves so rapidly, retaining this exceptional talent requires offering meaningful ownership, a clear sense of purpose, and continuous learning opportunities. Ultimately, success relies on intentionally designing a leadership team that balances different working styles while maintaining close collaboration to navigate a constantly changing environment.

Will AI Kill the Bug Bounty Industry?

The question of whether artificial intelligence will replace human hackers in the bug bounty industry is a growing concern, but the reality is far more nuanced. As automated tools and machine learning models become more advanced, they are certainly getting better at spotting common, well-documented vulnerabilities like basic misconfigurations or simple coding errors. This capability allows organizations to catch low-level issues before they ever reach a public bug bounty program. However, AI still struggles significantly with understanding complex business logic, chaining together multiple minor flaws to create a severe exploit, and applying the creative intuition that human researchers naturally possess. Instead of destroying the bug bounty field, artificial intelligence is poised to reshape it. Security researchers will increasingly use these automated models as assistants to handle tedious reconnaissance and initial scanning tasks, freeing up their time to focus on deeper, more complex vulnerabilities. Meanwhile, program managers will need to adapt to a likely increase in automated, low-quality vulnerability reports by implementing better filtering systems. Ultimately, human curiosity and contextual understanding remain impossible to fully replicate. The future of security research relies on a partnership where human experts guide and verify the outputs of automated tools, ensuring that the bug bounty industry evolves rather than disappears.

The NCSC Wants You To Adopt Passkeys: Is It Time To Finally Drop Passwords?

The UK’s National Cyber Security Centre (NCSC) recently issued a notable recommendation advising organizations to prioritize passkeys over traditional passwords wherever possible. While the agency previously viewed the technology as promising but imperfect, recent industry advancements have driven a shift toward widespread endorsement. This updated guidance arrives amid a steady rise in credential-based cyberattacks, where stolen passwords are routinely abused to compromise networks and target accounts with elevated privileges. Passkeys offer a highly secure alternative by utilizing cryptographic credentials linked directly to a user's trusted device, such as a laptop or smartphone. This framework integrates seamless authentication methods like biometrics, making passkeys significantly longer and more complex than human-created passwords. Consequently, they provide robust resistance against brute-force tactics and conventional email phishing, as they will not authenticate on fraudulent login portals. Beyond elevating an organization's defensive posture, transitioning away from traditional passwords delivers clear operational benefits. It eliminates the friction of enforcing complex password rules and reduces the frequency of routine resets, which helps lower the volume of helpdesk support tickets. Embracing this shift allows modern enterprises to establish a more resilient, low-maintenance approach to identity management.

The AI Data War: Winning the Battle for Enterprise Data Supremacy

Enterprise artificial intelligence initiatives are currently outpacing the data foundations required to support them. For decades, organizations relied on legacy databases designed for slow, human-scale inquiries. However, the rise of artificial intelligence demands systems capable of processing massive volumes of information at machine speeds. As companies rushed to migrate their operations to the cloud to meet these new demands, many did so without a clear organizational strategy. This rapid shift, combined with the adoption of specialized cloud tools, has led to highly fragmented systems and an unmanaged sprawl of isolated data stores. In this environment, long-term success no longer depends on choosing one specific technology vendor over another. Instead, organizations must focus on building a neutral, adaptable data foundation. A major challenge in this process is the natural tendency of data to become difficult to move as it grows larger and more complex. To overcome these obstacles and prevent further fragmentation, leaders must implement strong operational frameworks. This involves establishing clear ownership over specific information, enforcing consistent standards across all software platforms, and applying a structured review process to ensure accuracy and security. By prioritizing these sensible governance principles over vendor selection, companies can build the reliable infrastructure necessary to power advanced tools effectively and sustainably.

The Substrate Your Diagram Doesn’t Show

When designing artificial intelligence systems, architects often rely on standard deployment diagrams that map out components, data flows, and integration points. However, these diagrams fail to capture the actual underlying reality, or "substrate," of how the system operates under scrutiny. According to the article, architects face mounting pressure from three distinct areas: people, infrastructure, and regulation. The people vector questions whether human reviewers are genuinely evaluating AI outputs or simply rubber-stamping them without proper checks. The infrastructure vector challenges whether the system is truly secure and ready for agents, ensuring that human reviewers and AI models are interacting with the exact same data to prevent vulnerabilities like prompt injection. Finally, the regulation vector demands continuous compliance with shifting legal frameworks, rather than relying on outdated audit checklists. A critical takeaway is that an organization's overall AI posture is bounded by its weakest link among these three vectors. If human oversight is flawed, the entire system is vulnerable, regardless of how secure the infrastructure is. To build defensible AI systems, architects must look beyond simple component mapping and adopt a realistic posture model. By documenting concrete evidence of genuine human collaboration, verified technical readiness, and current regulatory alignment, architects can confidently defend their designs against future audits and operational failures.

Post-cloud strategy: Architecting the next enterprise stack

As companies face rising costs, data ownership concerns, and the heavy demands of artificial intelligence, they are moving away from a strictly default cloud approach. Instead of simply shifting everything to massive public platforms, organizations are carefully deciding where each specific application should run to achieve the best balance of cost, performance, and control. This shift has given rise to deliberate hybrid designs. Rather than ending up with a tangled mix of old and new systems by accident, technology leaders are intentionally combining public clouds, private servers, and local computing networks into one cohesive operation. A major part of this strategy is avoiding vendor restrictions by using open software standards, which allow teams to move applications freely across different environments without having to rewrite them. Additionally, because moving large amounts of data is expensive and risky, companies are now bringing their processing power directly to where their data already lives. This is especially true for artificial intelligence tasks. Ultimately, the future of business technology is highly distributed. Organizations are not abandoning large cloud providers, but they are no longer relying on them exclusively. By treating computing resources as a carefully organized ecosystem, businesses can maintain total control, reduce operating expenses, and build a more reliable foundation for future growth.

How Over-Permissioned AI Is Quietly Dismantling ID Infrastructure

The rapid adoption of artificial intelligence has introduced a serious risk to corporate identity infrastructure. According to a recent global study, organizations are granting extensive security privileges to AI agents much faster than they are putting necessary safeguards in place. This shift floods networks with machine accounts that far outnumber human users. Driven by a desire for operational efficiency, many enterprises are connecting these automated tools directly to core systems to handle sensitive tasks, such as password resets and corporate network access. While these AI agents are designed to be helpful, this same trait makes them highly vulnerable. Attackers can exploit overly permissive agents using simple prompts to uncover network vulnerabilities or access administrative credentials without spending weeks hunting for flaws. Making matters worse, many organizations lack the proper backup solutions needed to recover quickly from an access breach. To protect their systems, security teams must fundamentally change how they manage permissions. Experts recommend moving away from basic policies and instead enforcing strict, real-time boundaries for all automated systems. This means applying the principle of least privilege to machine agents and building resilient structures prepared for rapid recovery. Ultimately, treating these automated accounts with the same rigor as human executives is essential to maintaining control over modern enterprise networks.

Daily Tech Digest - November 17, 2025

Quote for the day:

"Keep steadily before you the fact that all true success depends at last upon yourself." -- Theodore T. Hunger

You already use a software-only approach to passkey authentication - why that matters

After decades of compromises, exfiltrations, and financial losses resulting from inadequate password hygiene, you'd think that we would have learned by now. However, even after comprehensive training, research shows that 98% of users are still easily tricked into divulging their passwords to threat actors. Realizing that hope -- the hope that users will one day fix their password management habits -- is a futile strategy to mitigate the negative consequences of shared secrets, the tech industry got together to invent a new type of login credential. The passkey doesn't involve a shared secret, nor does it require the discipline or the imagination of the end user. Unfortunately, passkeys are not as simple to put into practice as passwords, which is why a fair amount of education is still required. ... Passkeys still involve a secret. But unlike passwords, users just have no way of sharing it -- not with legitimate relying parties and especially not with threat actors. ... In most situations where users are working with passkeys but not using one of the platform authenticators, they'll most likely be working with a virtual authenticator. These are essentially , none of which rely on the device's underlying security hardware for any passkey-related public key cryptography or encryption tasks, unlike platform authenticators.

Getting started with agentic AI

A working agentic AI strategy relies on AI agents connected by a metadata layer, whereby people understand where and when to delegate certain decisions to the AI or pass work to external contractors. It’s a focus on defining the role of the AI and where people involved in the workflow need to contribute. ... Data lineage tracking should happen at the code level through metadata propagation systems that tag every data transformation, model inference and decision point with unique identifiers. Willson says this creates an immutable audit trail that regulatory frameworks increasingly demand. According to Willson, advanced implementations may use to ensure governance data cannot be retroactively modified. ... One of the areas IT leaders need to consider is that their organisation will more than likely rely on a number of AI models to support agentic AI workflows. ... Organisations need to have the right data strategy in place, and they should already be well ahead on their path to full digitisation, where automation through is being used to connect many disparate workflows. Agentic AI is the next stage of this automation, where an AI is tasked with making decisions in a way that would have previously been too clunky using RPA. However, automation of workflows and business processes are just pieces of an overall jigsaw.

Human-centric IAM is failing: Agentic AI requires a new identity control plane

Agentic AI does not just use software; it behaves like a user. It authenticates to systems, assumes roles and calls APIs. If you treat these agents as mere features of an application, you invite invisible privilege creep and untraceable actions. A single over-permissioned agent can exfiltrate data or trigger erroneous business processes at machine speed, with no one the wiser until it is too late. The static nature of legacy IAM is the core vulnerability. You cannot pre-define a fixed role for an agent whose tasks and required data access might change daily. The only way to keep access decisions accurate is to move policy enforcement from a one-time grant to a continuous, runtime evaluation. ... Securing this new workforce requires a shift in mindset. Each AI agent must be treated as a first-class citizen within your identity ecosystem. First, every agent needs a unique, verifiable identity. This is not just a technical ID; it must be linked to a human owner, a specific business use case and a software bill of materials (SBOM). The era of shared service accounts is over; they are the equivalent of giving a master key to a faceless crowd. Second, replace set-and-forget roles with . Access should be granted just in time, scoped to the immediate task and the minimum necessary dataset, then automatically revoked when the job is complete. Think of it as giving an agent a key to a single room for one meeting, not the master key to the entire building.

Don’t ignore the security risks of agentic AI

We need policy engines that understand intent, monitor behavioral drift and can detect when an agent begins to act out of character. We need developers to implement fine-grained scopes for what agents can do, limiting not just which tools they use, but how, when and under what conditions. Auditability is also critical. Many of today’s AI agents operate in ephemeral runtime environments with little to no traceability. If an agent makes a flawed decision, there’s often no clear log of its thought process, actions or triggers. That lack of forensic clarity is a nightmare for security teams. In at least some cases, models resorted to when that was the only way to avoid replacement or achieve their goals—including blackmailing officials and leaking sensitive information to competitors Finally, we need robust testing frameworks that simulate adversarial inputs in agentic workflows. Penetration-testing a chatbot is one thing; evaluating an autonomous agent that can trigger real-world actions is a completely different challenge. It requires scenario-based simulations, sandboxed deployments and real-time anomaly detection. ... Until security is baked into the development lifecycle of agentic AI, rather than being patched on afterward, we risk repeating the same mistakes we made during the early days of cloud computing: excessive trust in automation before building resilient guardrails.

How Technological Continuity and High Availability Strengthen IT Resilience in Critical Sectors

Within the context of , ensures technology supports the organization’s ability to operate without disruption. It minimizes downtime and maintains the confidentiality, integrity, and availability of information. ... To achieve true high availability, organizations implement architectures that combine redundancy, automation, and fault tolerance. Database replication whether synchronous or asynchronous allows data to be duplicated across primary and secondary nodes, ensuring continuous access in the event of a failure. Synchronous replication guarantees data consistency but introduces latency, while asynchronous models reduce latency at the expense of a small data gap. Both approaches, when properly configured, strengthen the integrity and continuity of critical databases. ... One of the most effective strategies to reduce technological dependence is the implementation of hybrid continuity models that integrate both on-premises and cloud environments. Organizations that rely exclusively on a single cloud service provider expose themselves to the risk of total outage if that provider experiences downtime or disruption. By maintaining mirrored environments between cloud infrastructure and local servers, it is possible to achieve operational flexibility and independence across channels.

The tech that turns supply chains from brittle to unbreakable

When organizations begin crafting a supply chain strategy, one of the most common misconceptions is viewing it as purely a logistics exercise rather than a holistic framework that spans procurement, planning and risk management. Another frequent misstep is underestimating the role of technology. Digital tools are essential for visibility, predictive analytics and automation, not optional. Equally critical is recognizing that strategy is not static, it must evolve continuously to address shifting market conditions and emerging threats. ... Resilience comes from treating cyber and physical risks as one integrated challenge. That means embedding security into every layer of the supply chain, from vendor onboarding to logistics execution, while leveraging advanced visibility tools and zero trust principles. ... Executive buy‑in for resilience investments begins with reframing the conversation from cost to value. We position resilience as a strategic enabler rather than an expense by linking it to business continuity, customer trust and competitive advantage. Instead of focusing solely on immediate ROI, emphasize measurable risk reduction, regulatory compliance and the cost of inaction during disruptions. Use real‑world scenarios and data to show how resilience safeguards revenue streams and accelerates recovery when crises hit. Engage executives early, align initiatives with corporate objectives and present resilience as a driver of long‑term growth and brand reputation.

ISO and ISMS: 9 reasons security certifications go wrong

Without management’s commitment, it’s often difficult to get all employees on board and ensure that , or even IT baseline protection standards, are integrated into daily business operations. As a result, companies should provide top-down clarity about the importance of such initiatives — even if implementation can be costly and inconvenient. “Cleaning up” isn’t always pleasant, but the result is all the more worthwhile. ... Without genuine integration into daily operations, the certification becomes useless, and the benefits it offers remain unrealized. In the worst-case scenario, organizations even end up losing money, while also missing out on the implementation’s potential value. When integrating a management system, it’s important not to get bogged down in details. The practical application of the system in real-world work situations is crucial for its success. ... Employees need to understand why the implementation is important, how it will be integrated into their daily workflows, and how it will make their work easier. If this isn’t the case, it will be difficult to implement the system and maintain any resulting certification. ... Without a detailed plan, companies focus on areas that are irrelevant or do not meet the requirements of the ISO/IT baseline protection standards. Furthermore, if the implementation of a management system takes too long, regular business development can overtake the process itself, resulting in duplicated work to keep up with changes.

State of the API 2025: API Strategy Is Becoming AI Strategy

What distinguishes fully API-first teams? They treat APIs as long-lived products with roadmaps, SLAs, versioning, and feedback loops. They align product and engineering early, embed governance into workflows, and standardize patterns so that consumers, human or agent, can rely on consistent contracts. In our experience, that "productization" of APIs is what unlocks long-lived, reusable APIs and parallel delivery. When your agents can trust your , error semantics, and rate-limit behaviors, they can compose capabilities far faster than code-level abstractions ever could. ... As AI agents become primary API consumers, security assumptions must evolve. 51% of developers cite unauthorized or excessive agent calls as a top concern; 49% worry about AI systems accessing sensitive data they shouldn't; and 46% highlight the risk of credential leakage and over-scoped keys. Traditional controls, designed for predictable human traffic, struggle against machine-speed persistence, long-running automation, and credential amplification. ... Even as API-first adoption grows, collaboration remains a bottleneck. 93% of teams report challenges such as inconsistent documentation, duplicated work, and difficulty discovering existing APIs. With 69% of respondents spending 10+ hours per week on API-related tasks, and with a global workforce, asynchronous collaboration is the norm.

Embedded Intelligence: JK Tyre's Smart Tyre Use Case

Unlike traditional valve-mounted tire pressure monitoring devices, or , these sensors are permanently integrated for consistent data accuracy. Each chip is designed to last five to seven years, depending on usage and conditions. "These sensors are permanently embedded during the assembly process," said V.K. Misra, technical director at JK Tyre. "They continuously send live data on air pressure and temperature to the dashboard and mobile device. The moment there's a variation, the driver is alerted before a small problem becomes a serious risk." ... The embedded version takes this further by integrating the chip within the tire's internal structure, creating a closed feedback loop between the tire, the driver and the cloud. "We have created an entire connected ecosystem," Misra said. "The tire is just the beginning. The data generated feeds predictive models for maintenance and safety. Through , our platform can now talk to vehicles, drivers and service networks simultaneously." The Treel platform processes sensor data through APIs and cloud analytics, providing actionable insights for drivers and fleet operators. Over time, this data contributes to predictive maintenance models, product design improvements and operational analytics for connected vehicles. ... "AI allows decisions that earlier took days to happen within minutes," Misra said. "It also provides valuable data on wear patterns and helps us improve quality control across plants."

Regulation gives structure and voice to security leaders: Darshan Chavan

Chavan has witnessed a remarkable shift over the past decade in how businesses view cybersecurity. ... The increased visibility of cybersecurity, he says, has given a strategic voice. “Frequent regulatory updates, data breaches in the news, and rising public awareness have made organisations realize that cybersecurity is fundamental to business continuity,” he explains. “Every organisation now understands that to operate in a fast-evolving digital landscape, you need a cybersecurity leader with authority — and frameworks, regulations, and policies that are implemented and accepted by the business.” He views cybersecurity guidelines — whether from SEBI, RBI, or other regulatory bodies — as empowering rather than restrictive. “Regulation gives structure and voice to security leaders,” he says. “It ensures that cybersecurity is treated not as a cost centre but as a core enabler of business trust.” ... While he acknowledges that the will help formalise this journey, he refuses to wait for regulation to act. “I’m not waiting for the law to push me,” he says. “Tomorrow, investors will start asking how we manage their data, how we protect their bank account numbers, and how we ensure confidentiality. I want to be ready before those questions arise.” Beyond data privacy, Chavan highlights network defense and as ongoing imperatives. “