Daily Tech Digest - July 13, 2026

---

Quote for the day:

“An entrepreneur is someone who jumps off a cliff and builds a plane on the way down.” -- Reid Hoffman

---

🎧 Listen to this digest on YouTube Music

▶ Play Audio Digest

Duration: 19 mins • Perfect for listening on the go.

AI in the Boardroom: What Directors Must Now Govern

The boardroom conversation around artificial intelligence has shifted from deciding whether to experiment to figuring out how to successfully govern the technology. While many company directors now use AI for their personal productivity, using a specific tool is vastly different from overseeing its safe and strategic deployment across an entire organization. As AI becomes deeply embedded in strategy, supply chains, and daily operations, it brings complex new risks, particularly in cybersecurity and external vendor management. Importantly, when an AI system makes a flawed decision or causes harm, accountability cannot be outsourced to a vendor or the algorithm itself; it remains firmly with the human leaders and the board. Currently, a significant expertise gap exists, with most boards lacking even one literate director, let alone a collective understanding of the topic. However, boards do not need to hire software engineers or data scientists. Instead, they need directors capable of asking sharp questions, evaluating risk, and connecting these new initiatives to broader business strategy. To close this gap, boards should focus on raising the technical literacy of all members rather than relying on a single expert. Practical first steps include auditing current usage, defining clear oversight responsibilities, establishing audit trails for automated decisions, and bringing in seasoned advisors to evaluate the overall management approach.

The Implementation Gap: Why Africa’s Digital Strategies Rarely Become Digital Reality

Despite having no shortage of ambitious national digital strategies, data protection laws, and broadband policies, African nations frequently struggle to turn these plans into reality. This persistent issue is known as the implementation gap. Governments often celebrate the launch of new policies but fail to dedicate the same energy to executing them. A major part of the problem is the false belief that simply purchasing new technology equals true digital transformation. In reality, buying new software means very little without also redesigning outdated business processes and improving institutional capabilities. The article identifies seven main hurdles holding back progress. First, shifting political leadership often disrupts long-term projects. Second, many public institutions still rely on old, paper-based administrative structures. Third, procurement focuses too much on acquiring technology instead of improving public outcomes. Fourth, government digital systems are often fragmented and unable to share information with each other. Fifth, cybersecurity is typically treated as a delayed afterthought rather than a built-in priority. Sixth, governments fail to invest enough in training civil servants and citizens to use these new tools. Finally, institutions frequently repeat the mistakes of past projects instead of learning from them. To succeed, the focus must shift from launching more strategies to building capable institutions that can steadily deliver real, lasting public value.

Upskilling for Emerging Industries Affected by Data Science

As data science transforms global industries, the demand and compensation for skilled professionals continue to rise. However, this well-paying field is also becoming highly competitive, meaning that simply landing a job is no longer enough to guarantee your long-term security in the workforce. To build a lasting career, continuous learning is essential to avoid falling behind in a rapidly shifting job market. The pace of rapid technological advancements dictates that traditional skills can very quickly become outdated, while brand new roles in specialized areas like artificial intelligence, renewable energy, cybersecurity, and blockchain consistently emerge. To succeed in these newer positions, data scientists must cultivate core traits such as adaptability, critical thinking, clear communication, and creativity. Employers actively seek out individuals who possess a growth mindset and can quickly adjust to new tools and complex challenges. Professionals can stay competitive by embracing varied educational strategies. This includes enrolling in targeted online courses through accessible educational platforms, attending industry workshops, and connecting with experienced mentors for personalized guidance. Additionally, volunteering for projects outside your normal duties and engaging with professional networks can provide practical experience. By treating your education as an ongoing journey, you can protect your career and easily pivot into new opportunities as the landscape changes.

Australian developers are losing half their day, most leaders have no idea

Australian software developers are currently spending the vast majority of their working hours on tasks outside of actual coding. Although engineering leaders often believe their teams are highly productive, studies show developers spend a mere sixteen percent of their day writing software. The rest of their time is consumed by navigating security protocols, complex deployment processes, and infrastructure monitoring. This significant gap between leadership perception and daily reality represents a major hidden cost for businesses today. The problem is heavily compounded by a lack of clear visibility into how software performs in live environments. When engineers cannot easily identify the root cause of system issues, they are forced to spend hours troubleshooting rather than creating new features. Furthermore, the rapid integration of artificial intelligence tools is adding a new layer of operational complexity. While artificial intelligence can speed up initial development, it also introduces unpredictable behaviors and risks that are very difficult to manage without proper oversight. To fix this ongoing productivity drain, organizations need to securely connect system performance data directly to developer workflows. By giving engineering teams clear, real-time insights into system health and AI behavior, leaders can reduce daily friction, minimize time wasted on resolving errors, and give developers their time back to focus on building reliable software.

Accountable Intelligence: Why India must get healthcare AI right

While artificial intelligence is transforming many industries, its role in healthcare carries significantly higher stakes. In most fields, an AI mistake causes mere inconvenience; in medicine, it can impact human lives. For this reason, India must adopt healthcare AI with strict accountability and clinical evidence. The country faces unique medical challenges, including a vast population, rising chronic diseases, and a divide in urban-rural access. AI offers practical solutions, such as quickly analyzing X-rays or flagging early signs of conditions like diabetic retinopathy, helping shift the system from reactive treatments to proactive care. However, achieving these benefits requires the right approach. AI is not meant to replace doctors. Instead, it serves as a valuable support system that reduces administrative workloads and highlights patterns that busy medical professionals might miss. To succeed in India, AI models cannot simply be imported; they must be trained and validated using diverse local data to ensure accuracy across different regions and demographics. Furthermore, developers must prioritize data privacy, clinical oversight, and transparent patient consent. Building genuine trust requires health technology companies to focus on proven clinical outcomes rather than just technological potential. Ultimately, the future of medicine is doctors and AI working together to strengthen patient care.

The AI Governance Gap: Why Traditional Security Controls Are Falling Behind

Traditional enterprise security was designed for a predictable world where applications behaved consistently and network traffic passed through centralized checkpoints. These conventional governance models are failing because artificial intelligence operates completely differently. AI is dynamic, changes based on user prompts, and is increasingly embedded directly into approved tools like productivity suites and web browsers. Because these interactions bypass traditional network filters, organizations face a massive visibility gap. They often cannot tell how AI is being used, what sensitive data is being shared, or what actions autonomous agents are taking on their behalf. Attempting to manage this by simply blocking unapproved AI apps is ineffective and often drives employees toward hidden shadow AI use. To close this gap, companies must move away from static application checklists and adopt source-level monitoring. This approach focuses on capturing real-time interactions, such as the exact prompts users send, the specific data flowing in, and the models' direct responses, right where the activity occurs. By prioritizing continuous, context-aware visibility over outright restriction, businesses can identify risky behavior regardless of which specific tool is being used. As AI becomes deeply woven into everyday workflows, effective governance will depend entirely on tracking how information moves through these intelligent systems rather than just monitoring standard network traffic.

On AI Ethics: Why Prompt Engineering Needs a Moral Compass

As the practice of giving instructions to artificial intelligence—often called prompt engineering—grows in demand, the need for a strong moral compass is becoming increasingly clear. Simply training an AI model well is not enough; the specific instructions given to these systems can independently create significant ethical dilemmas. Harmful prompts can easily amplify existing biases, expose private information, generate convincing misinformation, or be used for malicious exploitation. Recent guidance from Pope Leo XIV highlights that AI must serve humanity rather than concentrate power, warning against a purely profit-driven approach and calling for shared standards of social justice and accountability. The real-world consequences of poor AI ethics are already visible across multiple fields. Researchers note that mental health chatbots routinely violate established ethical standards through deceptive empathy and poor crisis management. Furthermore, AI tools are creating complex, hidden security threats, as automated programs operate within approved workflows but still execute harmful actions. Because the speed of modern AI adoption is entirely unprecedented, technology and security professionals can no longer assume a system is safe just because it functions as designed. Moving forward, organizations must actively govern how their AI behaves, clearly define ethical boundaries, and closely monitor both human and machine activities to properly protect their daily operations.

Claude Security Risks: What Your Security Team Needs to Know

Using AI tools like Claude in the workplace presents serious security challenges for companies, extending far beyond the software itself. The primary danger comes from how employees use the tool. When workers paste full reports, large spreadsheets, or confidential documents into the platform for analysis, they unknowingly expose sensitive company information and intellectual property. Because these bulk uploads happen without internal oversight, companies lose track of their data, which can lead to major compliance and audit failures. Another significant issue is context leakage. Information shared in one conversation can easily influence the answers generated in later sessions. If a team discusses proprietary processes or confidential insights, those details might unintentionally surface in future responses within shared workspaces. Furthermore, the boundaries between different types of accounts are often blurred. Employees frequently switch between personal accounts, shared team spaces, and official enterprise environments. This lack of clear separation weakens overall data governance, allowing regulated or sensitive information to drift outside of approved, secure areas. Ultimately, these blind spots create serious vulnerabilities, including accidental data disclosure and incomplete legal responses. To protect their assets, businesses must recognize that the most significant risk lies in unmonitored human behavior and a lack of clear access boundaries.

Manual Workarounds as Operational Risk Get Louder

When employees constantly create manual workarounds to bypass clunky systems, they are not simply trying to be difficult; they are attempting to keep the business moving forward. However, these temporary fixes quickly evolve into significant operational risks over time. Once a shortcut becomes a regular habit, it replaces official workflows and creates undocumented, fragile systems. These shadow processes—like hidden spreadsheets or email approvals—mask the true state of operations and create severe vulnerabilities, especially when they involve financial data or regulatory compliance. Furthermore, workarounds often rely entirely on a single person's memory, creating a dangerous dependency that falls apart if that individual leaves or during a major emergency. To protect the organization, leaders must view these side paths not as employee indiscipline, but as clear signals of failing internal infrastructure. Rather than demanding people work harder, management needs to thoroughly audit these hidden habits and address the core root causes of the friction. Every workaround that is allowed to continue must be assigned a specific owner, given a strict review date, and carefully evaluated for its overall business impact. By replacing these fragile, manual patches with permanently improved systems, organizations can maintain clear visibility, ensure steady control, and safely scale their daily operations.

Beyond Physical Security. Why FMs are strategic risk leaders

Facility management is no longer just about maintaining physical buildings. Because organizations face increasingly complex threats, from severe weather and cyberattacks to global supply chain delays, the roles of facility management and security are rapidly merging. Today, a company's facilities are critical environments that directly impact business operations, employee well-being, and overall corporate reputation. This shift requires facility leaders to step into highly strategic roles. They must now deeply understand risk assessment, crisis planning, and how to effectively integrate new technologies to keep operations running smoothly during emergencies. Instead of working in isolation, these professionals collaborate closely with security, IT, human resources, and executive teams to build a strong defense against potential disruptions. Smart building systems and advanced monitoring tools help identify problems early, but they require skilled people and clear rules to be truly effective. Furthermore, resilience is no longer treated as a separate emergency plan; it is becoming a daily habit woven into how companies choose suppliers, design workspaces, and manage their environmental footprint. Employees also expect to feel safe and supported in their daily work environments. By combining daily operational excellence with long-term strategic planning, modern facility leaders help organizations protect their staff, maintain steady operations, and ensure lasting stability.

Daily Tech Digest - June 14, 2026

---

Quote for the day:

“If you think compliance is expensive, try non‑compliance.” -- Paul McNulty

---

🎧 Listen to this digest on YouTube Music

▶ Play Audio Digest

Duration: 24 mins • Perfect for listening on the go.

Segmentation Works for OT If Operators Are Paying Attention

Network segmentation remains a foundational strategy for securing operational technology, but its ultimate effectiveness relies heavily on active and continuous human oversight. Many organizations mistakenly view network segmentation as a static, one-time project designed during a workshop, rather than as an ongoing operational practice that evolves over time. This fixed mindset creates dangerous security gaps, as real-world industrial environments change quickly while network diagrams remain completely outdated. Furthermore, the practical execution of traditional segmentation and newer microsegmentation models faces severe real-world hurdles. Traditional firewalls are frequently undermined by user convenience workarounds, such as technicians introducing unmanaged, internet-connected personal laptops onto the factory floor, or by unpatched vulnerabilities within the firewalls themselves. Meanwhile, microsegmentation is regularly impossible to implement because older legacy infrastructure cannot accommodate security software agents or survive the disruptive downtime required for vital updates. Compounding the issue, companies often overuse segmentation by dumping too many diverse industrial systems into a single isolated zone, meaning one compromised machine can expose the entire segment. To fix these systemic flaws, security experts recommend adopting enforceable policies that continuously verify user access. Operators must look past static blueprints, regularly auditing endpoint logs and identifying unrecognizable addresses to catch unauthorized connections before clever attackers can exploit them.

In Conversation with Simon Stone and Simon Barrows: Adventures in Architecture as Code

As organizations grow in scale and speed, traditional architecture diagrams often become outdated, subjective, and disconnected from actual operations. A recent interview with Simon Stone and Simon Barrows explores the transition from relying on these static diagrams to adopting Architecture as Code, a method that treats architectural knowledge as living, version-controlled data. This shift is increasingly practical today because modern artificial intelligence can efficiently gather and organize data from various scattered sources. By keeping architecture as structured data, teams can automatically generate up-to-date diagrams on demand, test for consistency, and cleanly link business strategies directly to technology investments. This approach changes the architect's role from drawing static pictures to managing data quality, working more like a software engineer. Instead of constantly updating documents, architects can rely on automated tests for routine checks and focus their time on complex decisions. However, converting old, fragmented documents into a single, reliable dataset remains a significant challenge. To succeed, the speakers advise starting small. Rather than attempting a massive overhaul all at once, organizations should identify a specific, high-value problem to solve first. By focusing on a clear initial use case, companies can build a solid foundation and gradually expand their structured architecture, ultimately creating a more transparent, efficient, and well-aligned technical environment.

10 Indispensable Prompts Our Team Refuses to Build Without

The recent Google Cloud blog post highlights a collection of practical prompts that their engineering teams rely on to build better software. Rather than using AI just to write code faster, these developers use specific prompts to challenge their own assumptions and catch mistakes early. The shared prompts cover a wide range of everyday programming tasks. For example, some developers ask the AI to act as a strict architect to help refine product requirements without making the design too complex. Others use it to run thorough code reviews, instructing the tool to grade their work on a harsh scale to ensure systems are truly reliable. There are also prompts designed to build testing plans, clean up unused code and forgotten comments, check software permissions for compliance, and weigh the pros and cons of different technical choices. Additionally, the team uses prompts to automatically review code changes and identify potential flaws in code that was generated by AI itself. Ultimately, the article suggests that treating AI as a critical partner rather than a simple code generator helps developers release software with greater confidence. By routinely asking hard questions and checking for hidden weaknesses, engineering teams can improve the overall quality of their work and avoid unexpected failures.

AI Governance in Enterprise Adoption: Why Trust Will Define the Next Wave of Innovation

Artificial intelligence is steadily moving from isolated experiments into the daily operations of the financial services sector. As companies integrate these systems into everything from fraud detection to customer service, the primary challenge is no longer about the technology itself, but rather about building institutional trust. With the arrival of more autonomous systems, financial organizations must handle complex new risks that go beyond simple technical errors. These risks involve broad operational dependencies, data security, and the complications of unapproved tool usage by employees. Because of this, companies are shifting away from unrestricted public tools and moving toward carefully governed internal environments. Setting clear rules and maintaining structured oversight should not be viewed as an obstacle to progress. Instead, sensible governance provides the necessary foundation for organizations to innovate safely and reliably. By establishing clear boundaries and maintaining accountability, businesses give their teams the confidence to adopt new capabilities while assuring regulators and customers that their data remains secure. Ultimately, the companies that succeed in this new landscape will not necessarily be the fastest to implement the latest tools. They will be the ones that recognize safe, transparent, and continuous oversight as a strategic advantage, proving that responsible management is a fundamental requirement for sustainable growth in modern finance.

Rethinking MDR as Attackers and Defenders Embrace AI

Traditional managed detection and response models are struggling to keep pace with modern cybersecurity threats. Historically, these services relied on human analysts to monitor networks and investigate potential issues. However, as attackers increasingly use advanced automation to launch faster and more complex campaigns, human-led teams simply cannot process the massive volume of alerts generated daily. Because of this, analysts are forced to prioritize severe warnings, leaving roughly sixty percent of alerts unreviewed. Unfortunately, attackers know this and deliberately hide their activity within these overlooked, low-severity notifications. Furthermore, the quality of human investigation can vary depending on shift times and workload, leading to inconsistent security outcomes. To address these vulnerabilities, organizations are moving toward automated systems. In this new approach, computers automatically investigate every single alert, regardless of its initial severity rating or the time of day. Instead of acting as a simple filter, the system conducts a deep, technical analysis of all warnings in seconds, providing a consistent and thorough review. This allows human security teams to shift their focus from manual discovery to making informed decisions based on the system's verified findings. Ultimately, adopting this automated approach ensures complete alert coverage, eliminates blind spots, and provides organizations with full ownership of their own network data.

The Intelligent Factory: Navin Nathani on How Manufacturing’s Next Competitive Edge Is Being Built on Data, Resilience, and Industrial AI

In modern manufacturing, competitive advantage no longer relies solely on scale and cost, but on the speed and quality of broad company decisions. Navin Nathani emphasizes that navigating current disruptions requires connected operations rather than delayed reporting. To achieve this, technology is shifting from a supportive background function to the core operating system of the business. Organizations are focusing on practical technology updates, such as modernizing resource planning software and moving information storage to the internet. These practical upgrades establish stability and build trust among employees, making them more open to further changes. As office networks and factory machinery converge, manufacturing plants become more connected, which necessitates a stronger focus on security to protect production from emerging online threats. Furthermore, the industry is gradually adopting artificial intelligence for specific applications like anticipating equipment repairs and better supply planning. Rather than serving as a replacement for human workers, this technology acts as a useful assistant that helps identify patterns and prevent equipment failures before they occur. However, successful implementation relies heavily on maintaining disciplined processes and accurate data. Ultimately, the future of manufacturing lies in using connected information to shift from reacting to problems to preventing them, ensuring that daily operations remain stable in an unpredictable environment.

​Knowing When To Let Go Is A Leadership Skill

In her article, Kendra MacDonald explains that true leadership requires knowing when to persevere and when to simply let go. Drawing from her personal experiences with family planning, she notes that while society often celebrates grit and determination, effective leaders must also exercise clear judgment. They need to recognize whether their ongoing efforts are actually helpful or just delaying an inevitable outcome. MacDonald highlights that some situations and relationships cannot be repaired, and forcing people to agree is not always the answer. Instead, she advises leaders to accept differences as realities rather than problems to solve. When setbacks occur, it is essential to learn from them without taking the failure personally or letting emotions cloud objective facts. Furthermore, she stresses the importance of facing difficult conversations directly, as avoiding them only prolongs frustration for everyone involved. Honest communication, even when disappointing, is far more useful than giving false hope. Most importantly, MacDonald points out that holding onto the wrong opportunity or strategy drains team energy. By walking away from poorly fitting client relationships or unworkable strategies, leaders create space for fresh ideas and better matches. Ultimately, stepping back from a failing path is not a lack of resilience; rather, it is often the clearest demonstration of confident leadership.

The Real Cost of Unclear Technology Ownership

Unclear technology ownership is a direct threat to a company's operational stability and financial health. When no single person is accountable for a specific technology, organizations suffer from chronic delays, wasted spending, and repeated audit failures. Teams might look busy with meetings and project updates, but without a clear decision maker, this activity often hides a lack of actual progress. The costs show up as hidden labor, duplicated efforts, and lingering security vulnerabilities. This lack of ownership usually breaks down in critical areas like access management, data reporting, and vendor relationships. When systems fail or security incidents occur, fragmented responsibility means no one knows who should act first. As a result, small problems quickly escalate into costly crises. Furthermore, when executives and board members receive vague answers or see the same issues repeatedly, they quickly lose trust in the team's ability to manage risk. To fix this, companies do not need massive new programs. Instead, they must assign one accountable executive to each major risk area and give them the real authority to make decisions and control budgets. Organizations should establish a clear path for reporting bad news and ensure that board updates focus on actionable decisions rather than just listing activities. Clear ownership replaces confusion with stable, reliable progress.

AI Is Here to Stay. The Real Challenge Is Operating It Securely

Artificial intelligence is now a standard tool for writing software, with AI-generated code already running in major projects like OpenStack. However, its rapid adoption introduces significant operational and security challenges. Because AI produces code so quickly, human reviewers struggle to keep up, making it harder to ensure software remains secure and maintainable. Even more concerning is the rise of autonomous AI agents. Organizations often grant these agents broad permissions to access production environments, ignoring decades of security practices like the principle of least privilege. While AI capabilities advance rapidly, security features like containment and auditing lag behind. To operate AI securely, teams must apply proven engineering practices. First, organizations should use automated gating systems like Zuul. By testing how new code interacts with dependencies before it merges, gating prevents errors from reaching production. This acts as a vital check against the high volume of AI-written code. Second, teams should use strong hardware isolation, such as Kata Containers, to protect sensitive information. Standard containers share a core operating system, posing security risks in shared environments. Kata provides lightweight virtual machine isolation, ensuring data processed by an agent remains secure. Ultimately, enforcing strict access limits, adopting automated quality checks, and maintaining reliable backups are essential steps for operating AI safely.

Security in the Post-Mythos Era

The emergence of advanced artificial intelligence capable of instantly discovering and exploiting software vulnerabilities has fundamentally shifted the timeline of cybersecurity. While the core principles of network defense remain unchanged, the sheer speed at which new threats materialize means organizations can no longer rely on software patching as their primary shield. Because AI systems can weaponize flaws in minutes, human-driven patching cycles simply cannot keep pace. To survive, organizations must adopt a layered strategy that holds strong when patching inevitably falls behind. The first critical step is returning to basic system hardening. This means strictly enforcing multi-factor authentication, removing unnecessary network services, and dividing networks into isolated segments to prevent attackers from moving freely. When preventive measures fail, robust detection and response systems serve as the vital safety net. Security teams must assume some attacks will break through and focus on identifying the behavioral signs of an intruder, rather than relying solely on known threat lists. Finally, organizations must actively test these defenses. Regularly checking network boundaries and practicing response plans ensures that controls work in reality, not just on paper. AI has accelerated the speed of risk, making foundational preparation and rigorous testing the most reliable path to security.

Daily Tech Digest - September 05, 2025

---

Quote for the day:

"Little minds are tamed and subdued by misfortune; but great minds rise above it." -- Washington Irving

---

Understanding Context Engineering: Principles, Practices, and Its Distinction from Prompt Engineering

Context engineering is the strategic design, management, and delivery of relevant information—or “context”—to AI systems in order to guide, constrain, or enhance their behavior. Unlike prompt engineering, which primarily focuses on crafting effective input prompts to direct model outputs, context engineering involves curating, structuring, and governing the broader pool of information that surrounds and informs the AI’s decision-making process. In practice, context engineering requires an understanding of not only what the AI should know at a given moment but also how information should be prioritized, retrieved, and presented. It encompasses everything from assembling relevant documents and dialogue history to establishing policies for data inclusion and exclusion. ...  While there is some overlap between the two domains, context engineering and prompt engineering serve distinct purposes and employ different methodologies. Prompt engineering is concerned with the formulation of the specific text—the “prompt”—that is provided to the model as an immediate input. It is about phrasing questions, instructions, or commands in a way that elicits the desired behavior or output from the AI. Successful prompt engineering involves experimenting with wording, structure, and sometimes even formatting to maximize the performance of the language model on a given task.

How AI and Blockchain Are Transforming Tenant Verification in India

While artificial intelligence provides both intelligence and speed, Blockchain technology provides the essential foundation of trust and security. Blockchain functions as a permanent digital record – meaning that once information is set, it can’t be changed or deleted by third parties. This feature is particularly groundbreaking for ensuring a safe and clear rental history. Picture this: the rental payments and lease contracts of your tenants could all be documented as ‘smart contracts’ using Blockchain technology. ... The combination of AI and Blockchain signifies a groundbreaking transformation, enabling tenants to create ‘self-sovereign identities’ on the Blockchain — digital wallets that hold their verified credentials, which they fully control. When searching for rental properties, tenants can conveniently provide prospective landlords with access to certain details about themselves, such as their history of timely payments and police records. AI leverages secure and authentic Blockchain data to produce an immediate risk score for landlords to assess, ensuring a quick and reliable evaluation. This cohesive approach guarantees that AI outcomes are both rapid and trustworthy, while the decentralized nature of Blockchain safeguards tenant privacy by removing the necessity for central databases that may become susceptible over time.

Adversarial AI is coming for your applications

New research from Cato Networks threat intelligence report, revealed how threat actors can use a large language model jailbreak technique, known as an immersive world attack, to get AI to create infostealer malware for them: a threat intelligence researcher with absolutely no malware coding experience managed to jailbreak multiple large language models and get the AI to create a fully functional, highly dangerous, password infostealer to compromise sensitive information from the Google Chrome web browser. The end result was malicious code that successfully extracted credentials from the Google Chrome password manager. Companies that create LLMs are trying to put up guardrails, but clearly GenAI can make malware creation that much easier. AI-generated malware, including polymorphic malware, essentially makes signature-based detections nearly obsolete. Enterprises must be prepared to protect against hundreds, if not thousands, of malware variants. ... Enterprises can increase their protection by embedding security directly into applications at the build stage: this involves investing in embedded security that is mapped to OWASP controls; such as RASP, advanced Whitebox cryptography, and granular threat intelligence. IDC research shows that organizations protecting mobile apps often lack a solution to test them efficiently and effectively. 

Top Pitfalls to Avoid When Responding to Cyber Disaster

Moving too quickly following an attack can also prompt staff to respond to an intrusion without first fully understanding the type of ransomware that was used. Not all ransomware is created equal and knowing if you were a victim of locker ransomware, double extortion, ransomware-as-a-service, or another kind of attack can make all the difference in how to respond because the goal of the attacker is different for each. ... The first couple hours after a ransomware incident is identified are critical. In those immediate hours, work quickly to identify and isolate affected systems and disconnect compromised devices from the network to prevent the ransomware from spreading further. Don’t forget to also preserve forensic evidence as you go, such as screenshots, relevant logs, anything to inform future law enforcement investigations or legal action. Once that has been done, notify the key stakeholders and the cyber insurance provider. ... After the dust settles, analyze how the attack was able to occur and put in place fixes to keep it from happening again. Identify the initial access point and method, and map how the threat actor moved through the network. What barriers were they able to move past, and which held them back? Are there areas where more segmentation is needed to reduce the attack surface? Do any security workflows or policies need to be modified?

How to reclaim control over your online shopping data

“While companies often admit to sharing user data with third parties, it’s nearly impossible to track every recipient. That lack of control creates real vulnerabilities in data privacy management. Very few organizations thoroughly vet their third-party data-sharing practices, which raises accountability concerns and increases the risk of breaches,” said Ian Cohen, CEO of LOKKER. The criminal marketplace for stolen data has exploded in recent years. In 2024, over 6.8 million accounts were listed for sale, and by early 2025, nearly 2.5 million stolen accounts were available at one point. ... Even limited purchase information can prove valuable to criminals. A breach exposing high-value transactions, for example, may suggest a buyer’s financial status or lifestyle. When combined with leaked addresses, that data can help criminals identify and target individuals more precisely, whether for fraud, identity theft, or even physical theft. ... One key mechanism is the right to be forgotten, a legal principle allowing individuals to request the removal of their personal data from online platforms. The European Union’s GDPR is the strongest example of this principle in action. While not as comprehensive as the GDPR, the US has some privacy protections, such as the California Consumer Privacy Act (CCPA), which allow residents to access or delete their personal data.

Mind the Gap: Agentic AI and the Risks of Autonomy

The ink is barely dry on generative AI and AI agents, and now we have a new next big thing: agentic AI. Sounds impressive. By the time this article comes out, there’s a good chance that agentic AI will be in the rear-view mirror and we’ll all be chasing after the next new big thing. Anyone for autonomous generative agentic AI agent bots? ... Some things on the surface seem more irresponsible than others, but for some, agentic AI apparently not so much. Debugging large language models, AI agents, and agentic AI, as well as implementing guardrails are topics for another time, but it’s important to recognize that companies are handing over those car keys. Willingly. Enthusiastically. Would you put that eighth grader in charge of your marketing department? Of autonomously creating collateral that goes out to your customers without checking it first? Of course not. ... We want AI agents and agentic AI to make decisions, but we must be intentional about the decisions they are allowed to make. What are the stakes personally, professionally, or for the organization? What is the potential liability when something goes wrong? And something will go wrong. Something that you never considered going wrong will go wrong. And maybe think about the importance of the training data. Isn’t that what we say when an actual person does something wrong? “They weren’t adequately trained.” Same thing here.

How software engineers and team leaders can excel with artificial intelligence

As long as software development and AI designers continue to fall prey to the substitution myth, we’ll continue to develop systems and tools that, instead of supposedly making humans lives easier/better, will require unexpected new skills and interventions from humans that weren’t factored into the system/tool design ... Software development covers a lot of ground, from understanding requirements, architecting, designing, coding, writing tests, code review, debugging, building new skills and knowledge, and more. AI has now reached a point where it can automate or speed up almost every part of the process. This is an exciting time to be a builder. A lot of the routine, repetitive, and frankly boring parts of the job, the "cognitive grunt work", can now be handled by AI. Developers especially appreciate the help in areas like generating test cases, reviewing code, and writing documentation. When those tasks are off our plate, we can spend more time on the things that really add value: solving complex problems, designing great systems, thinking strategically, and growing our skills. ... The elephant in the room is "whether AI will take over my job one day?". Until this year, I always thought no, but the recent technological advancements and new product offerings in this space are beginning to change my mind. The reality is that we should be prepared for AI to change the software development role as we know it.

6 browser-based attacks all security teams should be ready for in 2025

Phishing tooling and infrastructure has evolved a lot in the past decade, while the changes to business IT means there are both many more vectors for phishing attack delivery, and apps and identities to target. Attackers can deliver links over instant messenger apps, social media, SMS, malicious ads, and using in-app messenger functionality, as well as sending emails directly from SaaS services to bypass email-based checks. Likewise, there are now hundreds of apps per enterprise to target, with varying levels of account security configuration. ... Like modern credential and session phishing, links to malicious pages are distributed over various delivery channels and using a variety of lures, including impersonating CAPTCHA, Cloudflare Turnstile, simulating an error loading a webpage, and many more. The variance in lure, and differences between different versions of the same lure, can make it difficult to fingerprint and detect based on visual elements alone. ... Preventing malicious OAuth grants being authorized requires tight in-app management of user permissions and tenant security settings. This is no mean feat when considering the 100s of apps in use across the modern enterprise, many of which are not centrally managed by IT and security teams

JSON Config File Leaks Azure ActiveDirectory Credentials

"The critical risk lies in the fact that this file was publicly accessible over the Internet," according to the post. "This means anyone — from opportunistic bots to advanced threat actors — could harvest the credentials and immediately leverage them for cloud account compromise, data theft, or further intrusion." ... To exploit the flaw, an attacker can first use the leaked ClientId and ClientSecret to authenticate against Azure AD using the OAuth2 Client Credentials flow to acquire an access token. Once this is acquired, the attacker then can send a GET request to the Microsoft Graph API to enumerate users within the tenant. This allows them to collect usernames and emails; build a list for password spraying or phishing; and/or identify naming conventions and internal accounts, according to the post. The attacker also can query the Microsoft Graph API to enumerate OAuth2 permission grants within the tenant, revealing which applications have been authorized and what scopes, or permissions, they hold. Finally, the acquired token allows an attacker to use group information to identify privilege clusters and business-critical teams, thus exposing organizational structure and identifying key targets for compromise, according to the post. ... "What appears to be a harmless JSON configuration file can in reality act as a master key to an organization’s cloud kingdom," according to the post.

Data centers are key to decarbonizing tech’s AI-fuelled supply chain

Data center owners and operators are uniquely positioned to step up and play a larger, more proactive role in this by pushing back on tech manufacturers in terms of the patchy emissions data they provide, while also facilitating sustainable circular IT product lifecycle management/disposal solutions for their users and customers. ... The hard truth, however, is that any data center striving to meet its own decarbonization goals and obligations cannot do so singlehandedly. It’s largely beholden to the supply chain stakeholders upstream. At the same time, their customers/users tend to accept ever shortening usage periods as the norm. Often, they overlook the benefits of achieving greater product longevity and optimal cost of ownership through the implementation of product maintenance, refurbishment, and reuse programmes. ... As a focal point for the enablement of the digital economy, data centers are ideally placed to take a much more active role: by lobbying manufacturers, educating users and customers about the necessity and benefits of changing conventional linear practices in favour of circular IT lifecycle management and recycling solutions. Such an approach will not only help decarbonize data centers themselves but the entire tech industry supply chain – by reducing emissions.

Daily Tech Digest - August 06, 2025

---

Quote for the day:

"What you do has far greater impact than what you say." -- Stephen Covey

---

“Man in the Prompt”: New Class of Prompt Injection Attacks Pairs With Malicious Browser Extensions to Issue Secret Commands to LLMs

The so-called “Man in the Prompt” attack presents two priority risks. One is to internal LLMs that store sensitive company data and personal information, in the belief that it is appropriately fenced off from other software and apps. The other risk comes from particular LLMs that are broadly integrated into workspaces, such as Google Gemini’s interaction with Google Workspace tools such as Mail and Docs. This category of prompt injection attacks applies not just to any type of browser extension, but any model or deployment of LLM. And the malicious extension requires no special permissions to work, given that the DOM access already provides everything it needs. ... The other proof-of-concept targets Google Gemini, and by extension any elements of Google Workspace it has been integrated with. Gemini is meant to automate routine and tedious tasks in Workspace such as email responses, document editing and updating contacts. The trouble is that it has almost complete access to the contents of these accounts as well as anything the user has access permission for or has had shared with them by someone else. Prompt injection attacks conducted by these extensions can not only steal the contents of emails and documents with ease, but complex queries can be fed to the LLM to target particular types of data and file extensions; the autocomplete function can also be abused to enumerate available files.

EU seeks more age verification transparency amid contentious debate

The EU is considering setting minimum requirements for online platforms to disclose their use of age verification or age estimation tools in their terms and conditions. The obligation is contained in a new compromise draft text of the EU’s proposed law on detecting and removing online child sex abuse material (CSAM), dated July 24 and seen by MLex. A discussion of the proposal, which contains few other changes to a previous draft, is scheduled for September 12. The text also calls for online platforms to perform mandatory scans for CSAM, which critics say could result in false positives and break end-to-end cryptography. ... The way age verification is set to work under the OSA is described as a “privacy nightmare” by PC Gamer, but the article stands in stark contrast to the vague posturing of the political class. Author Jacob Ridley acknowledges the possibility for double-blind methods of age assurance among those that do not require any personal information at all to be shared with the website or app the individual is trying to access. At the same time, many age verification systems do not work this way. Also, age assurance pop-ups can be spoofed, and those spoofs could harvest a wealth of valuable personal information Privado ID Co-founder Evan McMullen calls it “like using a sledgehammer to crack a walnut.” McMullen, of course, prefers a decentralized approach that leans on zero-knowledge proofs (ZKPs).

AI Is Changing the Cybersecurity Game in Ways Both Big and Small

“People are rushing now to get [MCP] functionality while overlooking the security aspect,” he said. “But once the functionality is established and the whole concept of MCP becomes the norm, I would assume that security researchers will go in and essentially update and fix those security issues over time. But it will take a couple of years, and while that is taking time, I would advise you to run MCP somehow securely so that you know what’s going on.” Beyond the tactical security issues around MCP, there are bigger issues that are more strategic, more systemic in nature. They involve the big changes that large language models (LLMs) are having on the cybersecurity business and the things that organizations will have to do to protect themselves from AI-powered attacks in the future ... The sheer volume of threat data, some of which may be AI generated, demands more AI to be able to parse it and understand it, Sharma said. “It’s not humanly possible to do it by a SOC engineer or a vulnerability engineer or a threat engineer,” he said. Tuskira essentially functions as an AI-powered security analyst to detect traditional threats on IT systems as well as threats posed to AI-powered systems. Instead of using commercial AI models, Sharma adopted open-source foundation models running in private data centers. Developing AI tools to counter AI-powered security threats demands custom models, a lot of fine-tuning, and a data fabric that can maintain context of particular threats, he said.

AI burnout: A new challenge for CIOs

To take advantage of the benefits of smart tools and avoid overburdening the workforce, the board of directors must carefully manage their deployment. “As leaders, we must set clear limits, encourage training without overwhelming others, and open spaces for conversation about how people are experiencing this transition,” Blázquez says. “Technology must be an ally, not a threat, and the role of leadership will be key in that balance.” “It is recommended that companies take the first step. They must act from a preventative, humane, and structural perspective,” says De la Hoz. “In addition to all the human, ethical, and responsible components, it is in the company’s economic interest to maintain a happy, safe, and mission-focused workforce.” Regarding increasing personal productivity, he emphasizes the importance of “valuing their efforts, whether through higher salary returns or other forms of compensation.” ... From here, action must be taken, “implementing contingency plans to alleviate these areas.” One way: working groups, where the problems and barriers associated with technology can be analyzed. “From here, use these KPIs to change my strategy. Or to set it up, because often what happens is that I deploy the technology and forget how to get that technology adopted.” 

CIOs need a military mindset

While the battlefield feels very far away from the boardroom, this principle is something that CIOs can take on board when they’re tasked with steering a complex digital programme. Step back and clear the path so that you can trust your people to deliver; that’s when the real progress gets made. Contrary to popular belief, the military is not rigidly hierarchical. In fact, it teaches individuals to operate with autonomy within defined parameters. Officers set the boundaries of a mission and step back, allowing you to take full ownership of your actions. This approach is supported by the OODA Loop, a framework that cultivates awareness and decisive action under pressure. ... Resilience is perhaps the hardest leadership trait to teach and the most vital to embody. Military officers are taught to plan exhaustively, train rigorously, and prepare for all scenarios, but they’re also taught that ‘the first casualty of war is the plan.’ Adaptability under pressure is a non-negotiable mindset for you to adopt and instil in your team. When your team feels supported to grow, they stop fearing change and start responding to it; it is here that adaptability and resilience become second nature. There is also a practical opportunity to bring these principles in-house, as veterans transitioning out of the army may bring with them a refreshed leadership approach. Because they’re often confident under pressure and focused on outcomes, their transferrable skills allow them to thrive in the corporate world.

Backend FinOps: Engineering Cost-Efficient Microservices in the Cloud

Integrating cost management directly into Infrastructure-as-Code (IaC) frameworks such as Terraform enforces fiscal responsibility at the resource provisioning phase. By explicitly defining resource constraints and mandatory tagging, teams can preemptively mitigate orphaned cloud expenditures. ... Integrating cost awareness directly within Continuous Integration and Delivery (CI/CD) pipelines ensures proactive management of cloud expenditures throughout the development lifecycle. Tools such as Infracost automate the calculation of incremental cloud costs introduced by individual code changes. ... Cost-based pre-merge testing frameworks reinforce fiscal prudence by simulating peak-load scenarios prior to code integration. Automated tests measured critical metrics, including ninety-fifth percentile response times and estimated cost per ten thousand requests, to ensure compliance with established financial performance benchmarks. Pull requests failing predefined cost-efficiency criteria were systematically blocked. ... Comprehensive cost observability tools such as Datadog Cost Dashboards combine billing metrics with Application Performance Monitoring (APM) data, directly supporting operational and cost-related SLO compliance.

5 hard truths of a career in cybersecurity — and how to navigate them

Leadership and HR teams often gatekeep by focusing exclusively on candidates with certain educational degrees or specific credentials, typically from vendors such as Cisco, Juniper, or Palo Alto. Although Morrato finds this somewhat understandable given the high cost of hiring in cybersecurity, he believes this approach unfairly filters out capable individuals who, in a different era, would have had more opportunities. ... Because most team managers elevate from technical roles, they often lack the leadership and interpersonal skills needed to foster healthy team cultures or manage stakeholder relationships effectively. This cultural disconnect has a tangible impact on individuals. “People who work in security functions don’t always feel safe — psychologically safe — doing so,” Budge explains. ... Cybersecurity teams must also rethink how they approach risk, as relying solely on strict, one-size-fits-all controls is no longer tenable, Mistry says. Instead, he advocates for a more adaptive, business-aligned framework that considers overall exposure rather than just technical vulnerabilities. “Can I live with this risk? Can I not live with this risk? Can I do something to reduce the risk? Can I offload the risk? And it’s a risk conversation, not a ‘speeds and feeds’ conversation,” he says, emphasizing that cybersecurity leaders must actively build relationships across the organization to make these conversations possible.

How AI amplifies these other tech trends that matter most to business in 2025

Agentic AI is an artificial intelligence system capable of independently planning and executing complex, multistep tasks. Built on foundation models, these agents can autonomously perform actions, communicate with one another, and adapt to new information. Significant advancements have emerged, from general agent platforms to specialized agents designed for deep research. ... Application-specific semiconductors are purpose-built chips optimized to perform specialized tasks. Unlike general-purpose semiconductors, they are engineered to handle specific workloads (such as large-scale AI training and inference tasks) while optimizing performance characteristics, including offering superior speed, energy efficiency, and performance. ... Cloud and edge computing involve distributing workloads across locations, from hyperscale remote data centers to regional hubs and local nodes. This approach optimizes performance by addressing factors such as latency, data transfer costs, data sovereignty, and data security. ... Quantum-based technologies use the unique properties of quantum mechanics to execute certain complex calculations exponentially faster than classical computers; secure communication networks; and produce sensors with higher sensitivity levels than their classical counterparts.

Differentiable Economics: Strategic Behavior, Mechanisms, and Machine Learning

Differential economics is related to but different from the recent progress in building agents that achieve super-human performance in combinatorial games such as chess and Go. First, economic games such as auctions, oligopoly competition, or contests typically have a continuous action space expressed in money, and opponents are modeled as draws from a prior distribution that has continuous support. Second, differentiable economics is focused on modeling and achieving equilibrium behavior. The second opportunity in differentiable economics is to use data-driven methods and machine learning to discover rules, constraints, and affordances—mechanisms—for economic environments that promote good outcomes in the equilibrium behavior of a system. Mechanism design solves the inverse problem of game theory, finding rules of strategic interaction such that agents in equilibrium will effect an outcome with desired properties. Where possible, mechanisms promote strong equilibrium solution concepts such as dominant strategy equilibria, making it strategically easy for agents to participate. Think of a series of bilateral negotiations between buyers and a seller that is replaced by an efficient auction mechanism with simple dominant strategies for agents to report their preferences truthfully. 

Ownership Mindset Drives Innovation: Milwaukee Tool CEO

“Empowerment was not a free-for-all,” Richman explained. In fact, the company recently changed the wording around its core values from “empowerment” to “extreme ownership” to reflect the importance of accountability for results. Emphasizing ownership can also help employees do what is best for the company as a whole rather than just their own teams, particularly when it comes to reallocating resources. ... Surprises and setbacks are an unavoidable cost of trying new things while innovating. Since organizations cannot avoid these issues, leaders and employees need to discuss them frankly and quickly enough to minimize the downside while seizing the upside. “[Being] candid is the most challenging cultural element of any company,” Richman said. “And we believe that it really leads to success or failure.” … In successful cultures, teams, people, parts of the organization can bring problems up and bring them up in a way to be able to say, ‘How are we going to rally the troops as one team, come together, fix it, and figure out why we got into this mess, and what are we going to do to not do it again?’” Candor is a two-way street. To build trust, leaders need to provide an honest assessment of the state of the company and the path forward — a “candid communication of where you are,” Richman said. 

Daily Tech Digest - March 16, 2025

---

Quote for the day:

"Absolute identity with one's cause is the first and great condition of successful leadership." -- Woodrow Wilson

---

What Do You Get When You Hire a Ransomware Negotiator?

Despite calls from law enforcement agencies and some lawmakers urging victims not to make any ransom payment, the demand for experienced ransomware negotiators remains high. The negotiators say they provide a valuable service, even if the victim has no intention to pay. They bring skills into an incident that aren't usually found in the executive suite - strategies for dealing with criminals. ... Negotiation is more a thinking game, in which you try to outsmart the hackers to buy time and ascertain valuable insight, said Richard Bird, a ransomware negotiator who draws much of his skills from his past stint as a law enforcement crises aversion expert - talking people out of attempting suicide or negotiating with kidnappers for the release of hostages. "The biggest difference is that when you are doing a face-to-face negotiation, you can pick-up lots of information from a person on their non-verbal communications such as eye gestures, body movements, but when you are talking to someone over email or messaging apps that can cause some issues - because you have got to work out how the person might perceive," Bird said. One advantage of online negotiation is that it gives the negotiator time to reflect on what to tell the hackers. 

Managing Data Security and Privacy Risks in Enterprise AI

While enterprise AI presents opportunities to achieve business goals in a way not previously conceived, one should also understand and mitigate potential risks associated with its development and use. Even AI tools designed with the most robust security protocols may still present a multitude of risks. These risks include intellectual property theft, privacy concerns when training data and/or output data may contain personally identifiable information (PII) or protected health information (PHI), and security vulnerabilities stemming from data breaches and data tampering. ... Privacy and data security in the context of AI are interdependent disciplines that often require simultaneous consideration and action. To begin with, advanced enterprise AI tools are trained on prodigious amounts of data processed using algorithms that should be—but are not always—designed to comply with privacy and security laws and regulations. ... Emerging laws and regulations related to AI are thematically consistent in their emphasis on accountability, fairness, transparency, accuracy, privacy, and security. These principles can serve as guideposts when developing AI governance action plans that can make your organization more resilient as advances in AI technology continue to outpace the law.

Mastering Prompt Engineering with Functional Testing: A Systematic Guide to Reliable LLM

OutputsCreating efficient prompts for large language models often starts as a simple task… but it doesn’t always stay that way. Initially, following basic best practices seems sufficient: adopt the persona of a specialist, write clear instructions, require a specific response format, and include a few relevant examples. But as requirements multiply, contradictions emerge, and even minor modifications can introduce unexpected failures. What was working perfectly in one prompt version suddenly breaks in another. ... What might seem like a minor modification can unexpectedly impact other aspects of a prompt. This is not only true when adding a new rule but also when adding more detail to an existing rule, like changing the order of the set of instructions or even simply rewording it. These minor modifications can unintentionally change the way the model interprets and prioritizes the set of instructions. The more details you add to a prompt, the greater the risk of unintended side effects. By trying to give too many details to every aspect of your task, you increase as well the risk of getting unexpected or deformed results. It is, therefore, essential to find the right balance between clarity and a high level of specification to maximise the relevance and consistency of the response.

You need to prepare for post-quantum cryptography now. Here’s why

"In some respects, we're already too late," said Russ Housley, founder of Vigil Security LLC, in a panel discussion at the conference. Housley and other speakers at the conference brought up the lesson from the SHA-1 to SHA-2 hashing-algorithm transition, which began in 2005 and was supposed to take five years but took about 12 to complete — "and that was a fairly simple transition," Housley noted. In a different panel discussion, InfoSec Global Vice President of Cryptographic Research & Development Vladimir Soukharev called the upcoming move to post-quantum cryptography a "much more complicated transition than we've ever seen in cryptographic history." ... The asymmetric algorithms that NIST is phasing out are thought to be vulnerable to this. The new ones that NIST is introducing use even more complicated math that quantum computers probably can't crack (yet). Today, an attacker could watch you log into Amazon and capture the asymmetrically-encrypted exchange of the symmetric key that secures your shopping session. But that would be pointless because the attacker couldn't decrypt that key exchange. In five or 10 years, it'll be a different story. The attacker will be able to decrypt the key exchange and then use that stolen key to reveal your shopping session

Network Forensics: A Short Guide to Digital Evidence Recovery from Computer Networks

At a technical level, this discipline operates across multiple layers of the OSI model. At the lower layers, it examines MAC addresses, VLAN tags, and frame metadata, while at the network and transport layers, it analyses IP addresses, routing information, port usage, and TCP/UDP session characteristics. ... Network communications contain rich metadata in their headers—the “envelope” information surrounding actual content. This includes IP headers with source/destination addresses, fragmentation flags, and TTL values; TCP/UDP headers containing port numbers, sequence numbers, window sizes, and flags; and application protocol headers with HTTP methods, DNS query types, and SMTP commands. This metadata remains valuable even when content is encrypted, revealing communication patterns, timing relationships, and protocol behaviors. ... Encryption presents perhaps the most significant technical challenge for modern network forensics, with over 95% of web traffic now encrypted using TLS. Despite encryption, substantial metadata remains visible, including connection details, TLS handshake parameters, certificate information, and packet sizing and timing patterns. This observable data still provides significant forensic value when properly analyzed.

Modernising Enterprise Architecture: Bridging Legacy Systems with Jargon

The growing gap between enterprise-wide architecture and the actual work being done on the ground leads to manual processes, poor integration, and limits how effectively teams can work across modern DevOps environments — ultimately creating the next generation of rigid, hard-to-maintain systems — repeating the mistakes of the past. ... Instead of treating enterprise architecture as a walled-off function, Jargon enables continuous integration between high-level architecture and real-world software design — bridging the gap between enterprise-wide planning and hands-on development while automating validation and collaboration. ... Jargon is already working with organisations to bridge the gap between modern API-first design and legacy enterprise tooling, enabling teams to modernise workflows without abandoning existing systems. While our support for OpenAPI and JSON Schema is already in place, we’re planning to add XMI support to bring Jargon’s benefits to a wider audience of enterprises who use legacy architecture tools. By supporting XMI, Jargon will allow enterprises to unlock their existing architecture investments while seamlessly integrating API-driven workflows. This helps address the challenge of top-down governance conflicting with bottom-up development needs, enabling smoother collaboration across teams.

CAIOs are stepping out from the CIO’s shadow

The CAIO position as such is still finding its prime location in the org chart, Fernández says, often assuming a position of medium-high responsibility in reporting to the CDO and thus, in turn, to the CIO. “These positions that are being created are very ‘business partner’ style,” he says, “to make these types of products understood, what needs they have, and to carry them out.” Casado adds: “For me, the CIO does not have such a ‘business case’ component — of impact on the profit and loss account. The role of artificial intelligence is very closely tied to generating efficiencies on an ongoing basis,” as well as implying “continuous adoption.” “It is essential that there is this adoption and that implies being very close to the people,” he says. ... Garnacho agrees, stating that, in less mature AI development environments, the CIO can assume CAIO functions. “But as the complexity and scope of AI grows, the specialization of the CAIO makes the difference,” he says. This is because “although the CIO plays a fundamental role in technological infrastructure and data management, AI and its challenges require specific leadership. In our view, the CIO lays the technological foundations, but it is the CAIO who drives the vision.” In this emerging division of functions, other positions may be impacted by the emergence of the AI chief.

Forget About Cloud Computing. On-Premises Is All the Rage Again

Cloud costs have a tendency to balloon over time: Storage costs per GB of data might seem low, but when you’re dealing with terabytes of data—which even we as a three-person startup are already doing—costs add up very quickly. Add to this retrieval and egress fees, and you’re faced with a bill you cannot unsee. Steep retrieval and egress fees only serve one thing: Cloud providers want to incentivize you to keep as much data as possible on the platform, so they can make money off every operation. If you download data from the cloud, it will cost you inordinate amounts of money. Variable costs based on CPU and GPU usage often spike during high-performance workloads. A report by CNCF found that almost half of Kubernetes adopters found that they’d exceeded their budget as a result. Kubernetes is an open-source container orchestration software that is often used for cloud deployments. The pay-per-use model of the cloud has its advantages, but billing becomes unpredictable as a result. Costs can then explode during usage spikes. Cloud add-ons for security, monitoring, and data analytics also come at a premium, which often increases costs further. As a result, many IT leaders have started migrating back to on-premises servers. A 2023 survey by Uptime found that 33% of respondents had repatriated at least some production applications in the past year.

IT leaders are driving a new cloud computing era

CIOs have become increasingly frustrated with vendor pricing models that lock them into unpredictable and often unfavorable long-term commitments. Many find that mounting operational costs frequently outweigh the promised savings from cloud computing. It’s no wonder that leadership teams are beginning to shift gears, discussing alternative solutions that might better serve their best interests. ... Regional or sovereign clouds offer significant advantages, including compliance with local data regulations that ensure data sovereignty while meeting industry standards. They reduce latency by placing data centers nearer to users, enhancing service performance. Security is also bolstered, as these clouds can apply customized protection measures against specific threats. Additionally, regional clouds provide customized services that cater to local needs and industries and offer more responsive customer support than larger global providers. ... The pushback against traditional cloud providers is not driven only by unexpected costs; it also reflects enterprise demand for greater autonomy, flexibility, and a skillfully managed approach to technology infrastructure. Effectively navigating the complexities of cloud computing will require organizations to reassess their dependencies and stay vigilant in seeking solutions that align with their growth strategies.

How Intelligent Continuous Security Enables True End-to-End Security

Intelligent Continuous Security (TM) (ICS) is the next evolution — harnessing AI-driven automation, real-time threat detection and continuous compliance enforcement to eliminate these inefficiencies. ICS extends beyond DevSecOps to also close security gaps with SecOps, ensuring end-to-end continuous security across the entire software lifecycle. This article explores how ICS enables true DevOps transformation by addressing the shortcomings of traditional security, reducing friction across teams, and accelerating secure software delivery. ... As indicated in the article The Next Generation of Security “The Future of Security is Continuous. Security isn’t a destination — it’s a continuous process of learning, adapting and evolving. As threats become smarter, faster, and more unpredictable, security must follow suit.” Traditional security practices were designed for a slower, waterfall-style development process. ... Intelligent Continuous Security (ICS) builds on DevSecOps principles but goes further by embedding AI-driven security automation throughout the SDLC. ICS creates a seamless security layer that integrates with DevOps pipelines, reducing the friction that has long plagued DevSecOps initiatives. ... ICS shifts security testing left by embedding automated security checks at every stage of development.