Daily Tech Digest by Kannan Subbiah: protocols

Showing posts with label protocols. Show all posts

Daily Tech Digest - April 04, 2026

Quote for the day:

“We are what we pretend to be, so we must be careful about what we pretend to be.” -- Kurt Vonnegut

🎧 Listen to this digest on YouTube Music

▶ Play Audio Digest

Duration: 22 mins • Perfect for listening on the go.

One-Time Passcodes Are Gateway for Financial Fraud Attacks

The article "One-Time Passcodes Are Gateway for Financial Fraud Attacks" highlights the increasing vulnerability of SMS-based one-time passcodes (OTPs) as a primary authentication method. Threat intelligence from Recorded Future reveals that fraudsters are increasingly exploiting real-time communication weaknesses through social engineering and impersonation to intercept these codes, facilitating account takeovers and payment fraud. This shift indicates a growing industrialization of fraud operations where attackers no longer need to defeat complex technical security controls but instead manipulate user behavior during live interactions. Security experts, including those from Coalition, argue that OTPs represent "low-hanging fruit" for cybercriminals and advocate for phishing-resistant alternatives like FIDO-based hardware authentication. Consequently, global regulators are taking action to mitigate these risks. For instance, Singapore and the United Arab Emirates have already phased out SMS-based OTPs for banking logins, while India and the Philippines are moving toward multifactor approaches involving biometrics and device-based identification. Although U.S. regulators still recognize OTPs as part of multifactor authentication, the rise of SIM-swapping and sophisticated social engineering is pushing the financial industry toward more resilient, multi-signal authentication models that integrate behavioral patterns and device identity to better balance security with user experience.

Evaluating the ethics of autonomous systems

MIT researchers, led by Professor Chuchu Fan and graduate student Anjali Parashar, have developed a pioneering evaluation framework titled SEED-SET to assess the ethical alignment of autonomous systems before their deployment. This innovative system addresses the challenge of balancing measurable outcomes, such as cost and reliability, with subjective human values like fairness. Designed to operate without pre-existing labeled data, SEED-SET utilizes a hierarchical structure that separates objective technical performance from subjective ethical criteria. By employing a Large Language Model as a proxy for human stakeholders, the framework can consistently evaluate thousands of complex scenarios without the fatigue often experienced by human reviewers. In testing involving realistic models like power grids and urban traffic routing, the system successfully pinpointed critical ethical dilemmas, such as strategies that might inadvertently prioritize high-income neighborhoods over disadvantaged ones. SEED-SET generated twice as many optimal test cases as traditional methods, uncovering "unknown unknowns" that static regulatory codes often miss. This research, presented at the International Conference on Learning Representations, provides a systematic way to ensure AI-driven decision-making remains well-aligned with diverse human preferences, moving beyond simple technical optimization to foster more equitable technological solutions for high-stakes societal challenges.

Blast Radius of TeamPCP Attacks Expands Amid Hacker Infighting

The article "Blast Radius of TeamPCP Attacks Expands Amid Hacker Infighting" details the escalating impact of supply chain compromises targeting open-source projects like LiteLLM and Trivy. Attributed to the threat group TeamPCP, these attacks have victimized high-profile entities such as the European Commission and AI startup Mercor by harvesting cloud credentials and API keys. The situation has become increasingly volatile due to "infighting" and a lack of clear collaboration between cybercriminal factions. While TeamPCP initiates the intrusions, groups like ShinyHunters and Lapsus$ have begun leaking and claiming credit for the stolen data, leading to a murky ecosystem where multiple actors converge on the same access points. Further complicating the threat landscape is TeamPCP's formal alliance with the Vect ransomware gang, which utilizes a three-stage remote access Trojan to deepen their foothold. Security experts emphasize that the speed of these attacks—often moving from initial compromise to data exfiltration within hours—necessitates a rapid response. Organizations are urged to move beyond merely removing malicious packages; they must immediately revoke exposed secrets, rotate cloud credentials, and audit CI/CD workflows to mitigate the risk of follow-on extortion and ransomware deployment by this expanding criminal network.

Beyond RAG: Architecting Context-Aware AI Systems with Spring Boot

The article "Beyond RAG: Architecting Context-Aware AI Systems with Spring Boot" introduces Context-Augmented Generation (CAG), an architectural refinement designed to address the limitations of standard Retrieval-Augmented Generation (RAG) in enterprise environments. While traditional RAG successfully grounds AI responses in external data, it often ignores vital runtime factors such as user identity, session history, and specific workflow states. CAG solves this by introducing a dedicated context manager that assembles and normalizes these contextual signals before they reach the core RAG pipeline. This additional layer allows systems to provide answers that are not only factually accurate but also contextually appropriate for the specific user and situation. A key advantage of this design is its modularity; the context manager operates independently of the retriever and large language model, requiring no changes to the underlying infrastructure or model retraining. By isolating contextual reasoning, enterprise teams can achieve better traceability, consistency, and governance across their AI applications. Specifically targeting Java developers, the piece demonstrates how to implement this pattern using Spring Boot, moving AI beyond simple prototypes toward production-ready systems that can handle complex, multi-departmental constraints and dynamic organizational policies with much greater precision.

Eliminating blind spots – nailing the IPv6 transition

The article "Eliminating blind spots – nailing the IPv6 transition" highlights the critical shift from IPv4 to IPv6, noting that global adoption reached 45% by 2026. Despite this growth, many IT teams remain overly reliant on legacy dual-stack monitoring that prioritizes IPv4, leading to significant visibility gaps. Because IPv6 operates differently—utilizing 128-bit addresses and emphasizing ICMPv6 and AAAA records—traditional scanning and monitoring methods often fail to detect degraded performance or security vulnerabilities. These "blind spots" can result in service outages that teams only discover through user complaints rather than proactive alerts. To navigate this transition successfully, organizations must adopt monitoring solutions with robust auto-discovery capabilities and real-time notifications tailored to IPv6-specific behaviors. The article emphasizes that an effective transition does not require a complete infrastructure rebuild; instead, it demands a mindset shift where IPv6 is treated as a primary protocol rather than a secondary concern. By integrating comprehensive visibility across cloud, data centers, and OT environments, businesses can ensure network resilience and security. Ultimately, proactively addressing these monitoring deficiencies allows IT departments to manage the increasing complexity of modern internet traffic while avoiding the pitfalls of reactive troubleshooting in a rapidly evolving digital landscape.

Post-Quantum Readiness Starts Long Before Q-Day

The Forbes article "Post-Quantum Readiness Starts Long Before Q-Day" by Etay Maor highlights the urgent need for organizations to prepare for the inevitable arrival of "Q-Day"—the moment quantum computers become capable of shattering current public-key cryptography standards. While significant quantum utility may be years away, the author warns of the "harvest now, decrypt later" threat, where malicious actors collect encrypted sensitive data today to decrypt it once quantum technology matures. Consequently, post-quantum readiness must be viewed as a critical leadership and business-risk issue rather than a distant technical concern. Maor argues that the transition will be a multi-year journey, not a simple switch, requiring deep visibility into an organization’s cryptographic sprawl to identify vulnerabilities. He recommends a hybrid security approach, utilizing standards like TLS 1.3 with post-quantum-ready cipher suites to protect high-priority "crown jewel" data while the broader ecosystem catches up. By prioritizing sensitive traffic and adopting a centralized operating model, such as a quantum-aware Secure Access Service Edge (SASE), businesses can build long-term resilience. Ultimately, proactive preparation is essential to safeguarding data confidentiality against the future capabilities of quantum computing, ensuring that security measures evolve alongside emerging threats.

Confidential computing resurfaces as security priority for CIOs

Confidential computing has resurfaced as a critical security priority for CIOs, addressing the long-standing industry gap of protecting data while it is actively being processed. While traditional encryption safeguards data at rest and in transit, confidential computing utilizes hardware-encrypted Trusted Execution Environments (TEEs) to isolate sensitive information from the surrounding infrastructure, cloud providers, and even privileged users. This technology is gaining significant traction as organizations seek to protect intellectual property and regulated analytics workloads, especially within the context of generative AI. According to IDC, 75% of surveyed organizations are already testing or adopting the technology in some form. Unlike earlier versions that required deep technical expertise and application redesign, modern confidential computing integrates seamlessly into existing virtual machines and containers. This evolution allows developers to maintain current workflows while gaining hardware-enforced security boundaries that software controls alone cannot provide. Gartner has notably ranked confidential computing as a top three technology to watch for 2026, highlighting its growing importance in sectors like finance and healthcare. By providing hardware-rooted attestation and verifiable trust, it helps organizations minimize risk exposure and maintain regulatory compliance. Ultimately, as confidential computing converges with AI and data security management platforms, it will become an essential component of a robust zero-trust architecture.

Introducing the Agent Governance Toolkit: Open-source runtime security for AI agents

Microsoft has introduced the Agent Governance Toolkit, an open-source project designed to provide critical runtime security for autonomous AI agents. As AI evolves from simple chat interfaces to independent actors capable of executing complex trades and managing infrastructure, the need for robust oversight has become paramount. Released under the MIT license, this framework-agnostic toolkit addresses the risks outlined in the OWASP Top 10 for Agentic Applications through deterministic, sub-millisecond policy enforcement. The suite comprises seven specialized packages, including "Agent OS" for stateless policy execution and "Agent Mesh" for cryptographic identity and dynamic trust scoring. Drawing inspiration from battle-tested operating system principles, the toolkit incorporates features like execution rings, circuit breakers, and emergency kill switches to ensure reliable and secure operations. It seamlessly integrates with popular frameworks like LangChain and AutoGen, allowing developers to implement governance without rewriting core code. By mapping directly to regulatory requirements like the EU AI Act, the toolkit empowers organizations to proactively manage goal hijacking, tool misuse, and cascading failures. Ultimately, Microsoft’s initiative fosters a secure ecosystem where autonomous agents can scale safely across diverse platforms, including Azure Kubernetes Service, while remaining subject to transparent and community-driven governance standards.

Twinning! Quantum ‘Digital Twins’ Tackle Error Correction Task to Speed Path to Reliable Quantum Computers

Researchers have introduced a groundbreaking classical simulation method that utilizes "digital twins" to significantly accelerate the development of reliable, fault-tolerant quantum computers. By creating highly detailed virtual replicas of quantum hardware, scientists can now model quantum error correction (QEC) processes for systems containing up to 97 physical qubits. This approach addresses the massive overhead traditionally required to stabilize fragile qubits, where multiple physical units are needed to form a single, error-resistant logical qubit. Unlike traditional methods that require building and debugging expensive physical prototypes, these digital twins leverage Monte Carlo simulations to model error propagation and decoding strategies on standard cloud computing nodes in roughly an hour. This shift allows researchers to rapidly iterate and optimize hardware parameters and error-fixing codes without the exorbitant costs and time constraints of physical testing. Functioning essentially as a "virtual wind tunnel," this innovation provides a critical, scalable framework for designing the complex error-correction layers necessary for practical quantum computation. By streamlining the path toward fault tolerance, this digital twin methodology represents a profound, practical advancement that enables the quantum industry to refine complex systems virtually, ultimately bringing the reality of large-scale, dependable quantum computing closer than ever before.

The end of the org chart: Leadership in an agentic enterprise

The traditional organizational chart is becoming obsolete as modern enterprises transition toward an "agentic" model where AI agents and humans collaborate as teammates. According to industry expert Steve Tout, the sheer volume of digital information—now doubling every eight hours—has overwhelmed human judgment, rendering legacy hierarchical structures and the "people-process-technology" framework increasingly insufficient. In this evolving landscape, AI agents handle repeatable cognitive tasks, synthesis, and data-heavy "grunt work," while human professionals retain control over high-level judgment, ethical accountability, and client trust. Organizations like McKinsey are already pioneering this shift, deploying tens of thousands of agents to streamline complex workflows. Leadership is consequently being redefined; it is no longer about maintaining a strict span of control or following predictable reporting lines. Instead, next-generation leaders must become architects of integrated networks, managing both human talent and agentic systems to foster deep organizational intelligence. By protecting human decision-makers from information fatigue, agentic enterprises can achieve greater clarity and faster strategic alignment. Ultimately, success in this new era requires a fundamental shift from viewing technology as a standalone tool to embracing it as a collaborative force that enhances the unique human capacity for sensemaking in complex, fast-moving business environments.

Daily Tech Digest - December 05, 2025

Quote for the day:

“Failure defeats losers, failure inspires winners.” -- Robert T. Kiyosaki

The 'truth serum' for AI: OpenAI’s new method for training models to confess their mistakes

A confession is a structured report generated by the model after it provides its main answer. It serves as a self-evaluation of its own compliance with instructions. In this report, the model must list all instructions it was supposed to follow, evaluate how well it satisfied them and report any uncertainties or judgment calls it made along the way. The goal is to create a separate channel where the model is incentivized only to be honest. ... During training, the reward assigned to the confession is based solely on its honesty and is never mixed with the reward for the main task. "Like the Catholic Church’s 'seal of confession', nothing that the model reveals can change the reward it receives for completing its original task," the researchers write. This creates a "safe space" for the model to admit fault without penalty. This approach is powerful because it sidesteps a major challenge in AI training. The researchers’ intuition is that honestly confessing to misbehavior is an easier task than achieving a high reward on the original, often complex, problem. ... For AI applications, mechanisms such as confessions can provide a practical monitoring mechanism. The structured output from a confession can be used at inference time to flag or reject a model’s response before it causes a problem. For example, a system could be designed to automatically escalate any output for human review if its confession indicates a policy violation or high uncertainty.

Why is enterprise disaster recovery always such a…disaster?

One of the brutal truths about enterprise disaster recovery (DR) strategies is that there is virtually no reliable way to truly test them. ... From a corporate politics perspective, IT managers responsible for disaster recovery have a lot of reasons to avoid an especially meaningful test. Look at it from a risk/reward perspective. They’re going to take a gamble, figuring that any disaster requiring the recovery environment might not happen for a few years. And by then with any luck, they’ll be long gone. ... “Enterprises place too much trust in DR strategies that look complete on slides but fall apart when chaos hits,” he said. “The misunderstanding starts with how recovery is defined. It’s not enough for infrastructure to come back online. What matters is whether the business continues to function — and most enterprises haven’t closed that gap. ... “Most DR tools, even DRaaS, only protect fragments of the IT estate,” Gogia said. “They’re scoped narrowly to fit budget or ease of implementation, not to guarantee holistic recovery. Cloud-heavy environments make things worse when teams assume resilience is built in, but haven’t configured failover paths, replicated across regions, or validated workloads post-failover. Sovereign cloud initiatives might address geopolitical risk, but they rarely address operational realism.

The first building blocks of an agentic Windows OS

Microsoft is adding an MCP registry to Windows, which adds security wrappers and provides discovery tools for use by local agents. An associated proxy manages connectivity for both local and remote servers, with authentication, audit, and authorization. Enterprises will be able to use these tools to control access to MCP, using group policies and default settings to give connectors their own identities. ... Be careful when giving agents access to the Windows file system; use base prompts that reduce the risks associated with file system access. When building out your first agent, it’s worth limiting the connector to search (taking advantage of the semantic capabilities of Windows’ built-in Phi small language model) and reading text data. This does mean you’ll need to provide your own guardrails for agent code running on PCs, for example, forcing read-only operations and locking down access as much as possible. Microsoft’s planned move to a least-privilege model for Windows users could help here, ensuring that agents have as few rights as possible and no avenue for privilege escalation. ... Building an agentic OS is hard, as the underlying technologies work very differently from standard Windows applications. Microsoft is doing a lot to provide appropriate protections, building on its experience in delivering multitenancy in the cloud.

Syntax hacking: Researchers discover sentence structure can bypass AI safety rules

The findings reveal a weakness in how these models process instructions that may shed light on why some prompt injection or jailbreaking approaches work, though the researchers caution their analysis of some production models remains speculative since training data details of prominent commercial AI models are not publicly available. ... This suggests models absorb both meaning and syntactic patterns, but can overrely on structural shortcuts when they strongly correlate with specific domains in training data, which sometimes allows patterns to override semantic understanding in edge cases. ... In layperson terms, the research shows that AI language models can become overly fixated on the style of a question rather than its actual meaning. Imagine if someone learned that questions starting with “Where is…” are always about geography, so when you ask “Where is the best pizza in Chicago?”, they respond with “Illinois” instead of recommending restaurants based on some other criteria. They’re responding to the grammatical pattern (“Where is…”) rather than understanding you’re asking about food. This creates two risks: models giving wrong answers in unfamiliar contexts (a form of confabulation), and bad actors exploiting these patterns to bypass safety conditioning by wrapping harmful requests in “safe” grammatical styles. It’s a form of domain switching that can reframe an input, linking it into a different context to get a different result.

In 2026, Should Banks Aim Beyond AI?

Developing native AI agents and agentic workflows will allow banks to automate complex journeys while fine-tuning systems to their specific data and compliance landscapes. These platforms accelerate innovation and reinforce governance structures around AI deployment. This next generation of AI applications elevates customer service, fostering deeper trust and engagement. ... But any technological advancement must be paired with accountability and prudent risk management, given the sensitive nature of banking. AI can unlock efficiency and innovation, but its impact depends on keeping human decision-making and oversight firmly in place. It should augment rather than replace human authority, maintaining transparency and accountability in all automated processes. ... The banking environment is too risky for fully autonomous agentic AI workflows. Critical financial decisions require human judgment due to the potential for significant consequences. Nonetheless, many opportunities exist to augment decision-making with AI agents, advanced models and enriched datasets. ... As this evolution unfolds, financial institutions must focus on executing AI initiatives responsibly and effectively. By investing in home-grown platforms, emphasizing explainability, balancing human oversight with automation and fostering adaptive leadership, banks, financial services and insurance providers can navigate the complexities of AI adoption.

Building the missing layers for an internet of agents

The proposed Agent Communication Layer sits above HTTP and focuses on message structure and interaction patterns. It brings together what has been emerging across several protocols and organizes them into a common set of building blocks. These include standardized envelopes, a registry of performatives that define intent, and patterns for one to one or one to many communication. The idea is to give agents a dependable way to understand the type of communication taking place before interpreting the content. A request, an update, or a proposal each follows an expected pattern. This helps agents coordinate tasks without guessing the sender’s intention. The layer does not judge meaning. It only ensures that communication follows predictable rules that all agents can interpret. ... The paper outlines several new risks. Attackers might inject harmful content that fits the schema but tricks the agent’s reasoning. They might distribute altered or fake context definitions that mislead a population of agents. They might overwhelm a system with repetitive semantic queries that drain inference resources rather than network resources. To manage these problems, the authors propose security measures that match the new layer. Signed context definitions would prevent tampering. Semantic firewalls would examine content at the concept level and enforce rules about who can use which parts of a context.

The Rise of SASE: From Emerging Concept to Enterprise Cornerstone

The case for SASE depends heavily on the business outcomes required, and there can be multiple use cases for SASE deployment. However, not everyone is always aligned around these. Whether you’re looking to modernize systems to boost operational resilience, reduce costs, or improve security to adhere to regulatory compliance, there needs to be alignment around your SASE deployment. Additionally, because of its versatility, SASE demands expertise across networking, cloud security, zero trust, and SD-WAN, but, unfortunately, these skills are in short supply. IT teams must upskill or recruit talent capable of managing (and running) this convergence, while also adapting to new operational models and workflows. ... However, most of the reported benefits don’t focus on tangible or financial outcomes, but rather those that are typically harder to measure, namely boosting operational resilience and enhancing user experience. These are interesting numbers to explore, as SASE investments are often predicated on specific and easily measurable business cases, typically centered around cost savings or mitigation of specific cyber/operational risks. Looking at the benefits from both a networking and security perspective, the data reveals different priorities for SASE adoption: IT Network leaders value operational streamlining and efficiency, while IT Security leaders emphasize secure access and cloud protection.

Intelligent Banking: A New Standard for Experience and Trust

At its core, Intelligent Banking connects three forces that are redefining what "intelligent" really means: Rising expectations - Customers not only expect their institutions to understand them, but to intuitively put forward recommendations before they realize change is needed. All while acting with empathy while delivering secure, trusted experiences. ... Data abundance - Financial institutions have more data than ever but struggle to turn it into actionable insight that benefits both the customer and the institution. ... AI readiness - For years, AI in banking was at best a buzz word that encapsulated the standard — decision trees, models, rules. ... The next era of AI in banking will be completely different. It will be invisible. Embedded. Contextual. It will be built into the fabric of the experience, not just added on top. And while mobile apps as we know them will likely be around for a while, a fully GenAI native banking experience is both possible and imminent. ... In the age of AI, it’s tempting to see "intelligence" purely as technology alone. But the future of banking will depend just as much on human intelligence as it will artificial intelligence. The expertise, empathy, and judgement of the institutions who understand financial context and complexity blended with the speed, prediction and pattern recognition that uncover insights humans can’t see will create a new standard for banking, one where experiences feel both profoundly human and intelligently anticipatory.

Taking Control of Unstructured Data to Optimize Storage

The modern business preoccupation with collecting and retaining data has become something of a double-edged sword. On the plus side, it has fueled a transformational approach to how organizations are run. On the other hand, it’s rapidly becoming an enormous drain on resources and efficiency. The fact that 80-90% of this information is unstructured, i.e. spread across formats such as documents, images, videos, emails, and sensor outputs, only adds to the difficulty of organizing and controlling it. ... To break this down, detailed metadata insight is essential for revealing how storage is actually being used. Information such as creation dates, last accessed timestamps, and ownership highlights which data is active and requires performance storage, and which has aged out of use or no longer relates to current users. ... So, how can this be achieved? At a fundamental level, storage optimization hinges on adopting a technology approach that manages data, not storage devices; simply adding more and more capacity is no longer viable. Instead, organizations must have the ability to work across heterogeneous storage environments, including multiple vendors, locations and clouds. Tools should support vendor-neutral management so data can be monitored and moved regardless of the underlying platform. Clearly, this has to take place at petabyte scale. Optimization also relies on policy-based data mobility that enables data to be moved based on defined rules, such as age or inactivity, with inactive or long-dormant data.

W.A.R & P.E.A.C.E: The Critical Battle for Organizational Harmony

W.A.R & P.E.A.C.E, the pivotal human lens within TRIAL, designed specifically to address this cultural challenge and shepherd the enterprise toward AARAM (Agentic AI Reinforced Architecture Maturities)2 with what I term “speed 3” transformation of AI. ... The successful, continuous balancing of W.A.R. and P.E.A.C.E. is the biggest battle an Enterprise Architect must win. Just as Tolstoy explored the monumental scope of war against intimate moments of peace in his masterwork, the Enterprise Architect must balance the intense effort to build repositories against the delicate work of fostering organizational harmony. ... The W.A.R. systematically organizes information across the four critical architectural domains defined in our previous article: Business, Information, Technology, and Security (BITS). The true power of W.A.R. lies in its ability to associate technical components with measurable business and financial properties, effectively transforming technical discussions into measurable, strategic imperatives. Each architectural components across BITS are tracked across Plan, Design & Run lifecycle of change under the guardrails of BYTES. ... Achieving effective P.E.A.C.E. mandates a carefully constructed collaborative environment where diverse organizational roles work together toward a shared objective. This requires alignment across all lifecycle stages using social capital and intelligence.

Daily Tech Digest - October 22, 2025

Quote for the day:

"Good content isn't about good storytelling. It's about telling a true story well." -- Ann Handley

When yesterday’s code becomes today’s threat

A striking new supply chain attack is sending shockwaves through the developer community: a worm-style campaign dubbed “” has compromised at least 187 npm packages, including the that has 2 million hits weekly, and spreading to other maintainers' packages. The malicious payload modifies package manifests, injects malicious files, repackages, and republishes — thereby infecting downstream projects. This incident underscores a harsh reality: even code released weeks, months, or even years ago can become dangerous once a dependency in its chain has been compromised. ... Sign your code: All packages/releases should use cryptographic signing. This allows users to verify the origin and integrity of what they are installing. Verify signatures before use: When pulling in dependencies, CI/CD pipelines, and even local dev setups, include a step to check that the signature matches a trusted publisher and that the code wasn’t tampered with. SBOMs are your map of exposure: If you have a for your project(s), you can query it for compromised packages. Find which versions/packages have been modified — even retroactively — so you can patch, remove, or isolate them. Continuous monitoring of risk posture: It's not enough to secure when you ship. You need alerts when any dependency or component’s risk changes: new vulnerabilities, suspicious behavior, misuse of credentials, or signs that a trusted package may have been modified after release.

Cloud Sovereignty: Feature. Bug. Feature. Repeat!

isn’t just a buzzword anymore, argues Kushwaha. “It’s a real concern for businesses across the world. The pattern is clear. The cloud isn’t a one-size-fits-all solution anymore. Companies are starting to realise that sometimes control, cost, and compliance matter more than convenience.” ... Cloud sovereignty is increasingly critical due to the evolving geopolitical scenario, government and industry-specific regulations, and vendor lock-ins with heavy reliance on . The concept has gained momentum and will continue to do so because technology has become pervasive and critical for running a state/country and any misuse by foreign actors can cause major repercussions, the way Bavishi sees it. Prof. Bhatt captures that true digital sovereignty is a distant dream and achieving this requires a robust ecosystem for decades. This isn’t counterintuitive; it’s evolution, as Kushwaha epitomises. “The cloud’s original promise was one of freedom. Today, when it comes to the cloud, freedom means more control. Businesses investing heavily in digital futures can’t afford to ignore the fine print in hyperscaler contracts or the reach of foreign laws. Sovereignty is the foundation for building safely in a fragmented world.” ... Organisations have recognised the risks of digital dependencies and are looking for better options. There is no turning back, Karlitschek underlines.

Securing AI to Benefit from AI

As organizations begin to integrate AI into defensive workflows, identity security becomes the foundation for trust. Every model, script, or autonomous agent operating in a production environment now represents a new identity — one capable of accessing data, issuing commands, and influencing defensive outcomes. If those identities aren't properly governed, the tools meant to strengthen security can quietly become sources of risk. The emergence of make this especially important. These systems don't just analyze; they may act without human intervention. They triage alerts, enrich context, or trigger response playbooks under delegated authority from human operators. ... AI systems are capable of assisting human practitioners like an intern that never sleeps. However, it is critical for security teams to differentiate what to automate from what to augment. Some tasks benefit from full automation, especially those that are repeatable, measurable, and low-risk if an error occurs. ... , , and are prime candidates for automation. These are data-heavy, pattern-driven processes where consistency outperforms creativity. By contrast, , attribution, and response decisions rely on context that AI cannot fully grasp. Here, AI should assist by surfacing indicators, suggesting next steps, or summarizing findings while practitioners retain decision authority. Finding that balance requires maturity in process design.

The Unkillable Threat: How Attackers Turned Blockchain Into Bulletproof Malware Infrastructure

When EtherHiding emerged in September 2023 as part of the CLEARFAKE campaign, it introduced a chilling reality: attackers no longer need vulnerable servers or hackable domains. They’ve found something far better—a global, decentralized infrastructure that literally cannot be shut down. ... When victims visit the infected page, the loader queries a smart contract on or using a read-only function call. ... Forget everything you know about disrupting cybercrime infrastructure. There is no command-and-control server to raid. No hosting provider to subpoena. No DNS to poison. The malicious code exists simultaneously everywhere and nowhere, distributed across thousands of blockchain nodes worldwide. As long as Ethereum or BNB Smart Chain operates—and they’re not going anywhere—the malware persists. Traditional law enforcement tactics, honed over decades of fighting cybercrime, suddenly encounter an immovable object. You cannot arrest a blockchain. You cannot seize a smart contract. You cannot compel a decentralized network to comply. ... The read-only nature of payload retrieval is perhaps the most insidious feature. When the loader queries the smart contract, it uses functions that don’t create transactions or blockchain records.

New 'Markovian Thinking' technique unlocks a path to million-token AI reasoning

Researchers at have proposed a new technique that makes large language models (LLMs) vastly more efficient when performing complex reasoning. Called Markovian Thinking, the approach allows LLMs to engage in lengthy reasoning without incurring the prohibitive computational costs that currently limit such tasks. The team’s implementation, an environment named , structures the reasoning chain into fixed-size chunks, breaking the scaling problem that plagues very long LLM responses. Initial estimates show that for a 1.5B parameter model, this method can cut the costs of training by more than two-thirds compared to standard approaches. ... The researchers compared this to models trained with the standard . Their findings indicate that the model trained with Delethink could reason up to 24,000 tokens, and matched or surpassed a LongCoT model trained with the same 24,000-token budget on math benchmarks. On other tasks like coding and PhD-level questions, Delethink also matched or slightly beat its LongCoT counterpart. “Overall, these results indicate that Delethink uses its thinking tokens as effectively as LongCoT-RL with reduced compute,” the researchers write. The benefits become even more pronounced when scaling beyond the training budget.

The dazzling appeal of the neoclouds

While their purpose-built design gives them an advantage for AI workloads, neoclouds also bring complexities and trade-offs. Enterprises need to understand where these platforms excel and plan how to integrate them most effectively into broader cloud strategies. Let’s explore why this buzzword demands your attention and how to stay ahead in this new era of cloud computing. ... Neoclouds, unburdened by the need to support everything, are outpacing hyperscalers in areas like agility, pricing, and speed of deployment for AI workloads. A shortage of GPUs and data center capacity also benefits neocloud providers, which are smaller and nimbler, allowing them to scale quickly and meet growing demand more effectively. This agility has made them increasingly attractive to AI researchers, startups, and enterprises transitioning to AI-powered technologies. ... Neoclouds are transforming cloud computing by offering purpose-built, cost-effective infrastructure for AI workloads. Their price advantages will challenge traditional cloud providers’ market share, reshape the industry, and change enterprise perceptions, fueled by their expected rapid growth. As enterprises find themselves at the crossroads of innovation and infrastructure, they must carefully assess how neoclouds can fit into their broader architectural strategies.

Wi-Fi 8 is coming — and it’s going to make AI a lot faster

Unlike previous generations of Wi-Fi that competed on peak throughput numbers, Wi-Fi 8 prioritizes consistent performance under challenging conditions. The specification introduces coordinated multi-access point features, dynamic spectrum management, and hardware-accelerated telemetry designed for AI workloads at the network edge. ... A core part of the Wi-Fi 8 architecture is an approach known as (UHR). This architectural philosophy targets the 99th percentile user experience rather than best-case scenarios. The innovation addresses AI application requirements that demand symmetric bandwidth, consistent sub-5-millisecond latency and reliable uplink performance. ... Wi-Fi 8 introduces (ELR) mode specifically for IoT devices. This feature uses lower data rates with more robust coding to extend coverage. The tradeoff accepts reduced throughput for dramatically improved range. ELR operates by increasing symbol duration and using lower-order modulation. This improves the link budget for battery-powered sensors, smart home devices and outdoor IoT deployments. ... Wi-Fi 8 enhances roaming to maintain sub-millisecond handoff latency. The specification includes improved (FILS) and introduces coordinated roaming decisions across the infrastructure. Access points share client context information before handoff.

Life, death, and online identity: What happens to your online accounts after death?

Today, we lack the tools (protocols) and the regulations to enable digital estate management at scale. Law and regulation can force a change in behavior by large providers. However, lacking effective protocols to establish a mechanism to identify the decedent’s chosen individuals who will manage their digital estate, every service will have to design their own path. This creates an exceptional burden on individuals planning their digital estate, and on individuals who manage the digital estates of the deceased. ... When we set out to write this paper, we wanted to influence the large technology and social media platforms, politicians, regulators, estate planners, and others who can help change the status quo. Further, we hoped to influence standards development organizations, such as the and the Internet Engineering Task Force (IETF), and their members. As standards developers in the realm of identity, we have an obligation to the people we serve to consider identity from birth to death and beyond, to ensure every human receives the respect they deserve in life and in death. Additionally, we wrote the planning guide to help individuals plan for their own digital estate. By giving people the tools to help describe, document, and manage their digital estates proactively, we can raise more awareness and provide tools to help protect individuals at one of the most vulnerable moments of their lives.

5 steps to help CIOs land a board seat

Serving on a board isn’t an extension of an operational role. One issue CIOs face is not understanding the difference between executive management and governance, Stadolnik says. “They’re there to advise, not audit or lead the current company’s CIO,” he adds. In the boardroom, the mandate is to provide strategy, governance, and oversight, not execution. That shift, Stadolnik says, can be jarring for tech leaders who’ve spent their careers driving operational results. ... “There were some broad risk areas where having strong technical leadership was valuable, but it was hard for boards to carve out a full seat just for that, which is why having CIO-plus roles was very beneficial,” says Cullivan. The issue of access is another uphill battle for CIOs. As Payne found, the network effect can play a huge role in seeking a board role. But not every IT leader has the right kind of network that can open the door to these opportunities. ... Boards expect directors to bring scope across business disciplines and issues, not just depth in one functional area. Stadolnik encourages CIOs to utilize their strategic orientation, results focus, and collaborative and influence skills to set themselves up for additional responsibilities like procurement, supply chain, shared services, and others. “It’s those executive leadership capabilities that will unlock broader roles,” he says. Experience in those broader roles bolsters a CIO’s board résumé and credibility.

Microservices Without Meltdown: 7 Pragmatic Patterns That Stick

A good sniff test: can we describe the service’s job in one short sentence, and does a single team wake up if it misbehaves? If not, we’ve drawn mural art, not an interface. Start with a small handful of services you can name plainly—orders, payments, catalog—then pressure-test them with real flows. When a request spans three services just to answer a simple question, that’s a hint we’ve sliced too thin or coupled too often. ... Microservices live and die by their contracts. We like contracts that are explicit, versioned, and backwards-friendly. “Backwards-friendly” means old clients keep working for a while when we add fields or new behaviors. For HTTP APIs, plus consistent error formats makes a huge difference. ... We need timeouts and retries that fit our service behavior, or we’ll turn small hiccups into big outages. For east-west traffic, a or smart gateway helps us nudge traffic safely and set per-route policies. We’re fans of explicit settings instead of magical defaults. ... Each service owns its tables; cross-service read needs go through APIs or asynchronous replication. When a write spans multiple services, aim for a sequence of local commits with compensating actions instead of distributed locks. Yes, we’re describing sagas without the capes: do the smallest thing, record it durably, then trigger the next hop.

Daily Tech Digest - August 07, 2025

Quote for the day:

"Do the difficult things while they are easy and do the great things while they are small." -- Lao Tzu

Data neutrality: Safeguarding your AI’s competitive edge

“At the bottom there is a computational layer, such as the NVIDIA GPUs, anyone who provides the infrastructure for running AI. The next few layers are software-oriented, but also impacts infrastructure as well. Then there’s security and the data that feeds the models and those that feeds the applications. And on top of that, there’s the operational layer, which is how you enable data operations for AI. Data being so foundational means that whoever works with that layer is essentially holding the keys to the AI asset, so, it’s imperative that anything you do around data has to have a level of trust and data neutrality.” ... The risks in having common data infrastructure, particularly with those that are direct or indirect competitors, are significant. When proprietary training data is transplanted to another platform or service of a competitor, there is always an implicit, but frequently subtle, risk that proprietary insights, unique patterns of data or even the operational data of an enterprise will be accidentally shared. ... These trends in the market have precipitated the need for “sovereign AI platforms”– controlled spaces where companies have complete control over their data, models and the overall AI pipeline for development without outside interference.

The problem with AI agent-to-agent communication protocols

Some will say, “Competition breeds innovation.” That’s the party line. But for anyone who’s run a large IT organization, it means increased integration work, risk, cost, and vendor lock-in—all to achieve what should be the technical equivalent of exchanging a business card. Let’s not forget history. The 90s saw the rise and fall of CORBA and DCOM, each claiming to be the last word in distributed computing. The 2000s blessed us with WS-* (the asterisk is a wildcard because the number of specs was infinite), most of which are now forgotten. ... The truth: When vendors promote their own communication protocols, they build silos instead of bridges. Agents trained on one protocol can’t interact seamlessly with those speaking another dialect. Businesses end up either locking into one vendor’s standard, writing costly translation layers, or waiting for the market to move on from this round of wheel reinvention. ... We in IT love to make simple things complicated. The urge to create a universal, infinitely extensible, plug-and-play protocol is irresistible. But the real-world lesson is that 99% of enterprise agent interaction can be handled with a handful of message types: request, response, notify, error. The rest—trust negotiation, context passing, and the inevitable “unknown unknowns”—can be managed incrementally, so long as the basic messaging is interoperable.

Agents or Bots? Making Sense of AI on the Open Web

The difference between automated crawling and user-driven fetching isn't just technical—it's about who gets to access information on the open web. When Google's search engine crawls to build its index, that's different from when it fetches a webpage because you asked for a preview. Google's "user-triggered fetchers" prioritize your experience over robots.txt restrictions because these requests happen on your behalf. The same applies to AI assistants. When Perplexity fetches a webpage, it's because you asked a specific question requiring current information. The content isn't stored for training—it's used immediately to answer your question. ... An AI assistant works just like a human assistant. When you ask an AI assistant a question that requires current information, they don’t already know the answer. They look it up for you in order to complete whatever task you’ve asked. On Perplexity and all other agentic AI platforms, this happens in real-time, in response to your request, and the information is used immediately to answer your question. It's not stored in massive databases for future use, and it's not used to train AI models. User-driven agents only act when users make specific requests, and they only fetch the content needed to fulfill those requests. This is the fundamental difference between a user agent and a bot.

The Increasing Importance of Privacy-By-Design

Today’s data landscape is evolving at breakneck speed. With the explosion of IoT devices, AI-powered systems, and big data analytics, the volume and variety of personal data collected have skyrocketed. This means more opportunities for breaches, misuse, and regulatory headaches. And let’s not forget that consumers are savvier than ever about privacy risks – they want to know how their data is handled, shared, and stored. ... Integrating Privacy-By-Design into your development process doesn’t require reinventing the wheel; it simply demands a mindset shift and a commitment to building privacy into every stage of the lifecycle. From ideation to deployment, developers and product teams need to ask: How are we collecting, storing, and using data? ... Privacy teams need to work closely with developers, legal advisors, and user experience designers to ensure that privacy features do not compromise usability or performance. This balance can be challenging to achieve, especially in fast-paced development environments where deadlines are tight and product launches are prioritized. Another common challenge is educating the entire team on what Privacy-By-Design actually means in practice. It’s not enough to have a single data protection champion in the company; the entire culture needs to shift toward valuing privacy as a key product feature.

Microsoft’s real AI challenge: Moving past the prototypes

Now, you can see that with Bing Chat, Microsoft was merely repeating an old pattern. The company invested in OpenAI early, then moved to quickly launch a consumer AI product with Bing Chat. It was the first AI search engine and the first big consumer AI experience aside from ChatGPT — which was positioned more as a research project and not a consumer tool at the time. Needless to say, things didn’t pan out. Despite using the tarnished Bing name and logo that would probably make any product seem less cool, Bing Chat and its “Sydney” persona had breakout viral success. But the company scrambled after Bing Chat behaved in unpredictable ways. Microsoft’s explanation doesn’t exactly make it better: “Microsoft did not expect people to have hours-long conversations with it that would veer into personal territory,” Yusuf Mehdi, a corporate vice president at the company, told NPR. In other words, Microsoft didn’t expect people would chat with its chatbot so much. Faced with that, Microsoft started instituting limits and generally making Bing Chat both less interesting and less useful. Under current CEO Satya Nadella, Microsoft is a different company than it was under Ballmer. The past doesn’t always predict the future. But it does look like Microsoft had an early, rough prototype — yet again — and then saw competitors surpass it.

Is confusion over tech emissions measurement stifling innovation?

If sustainability is becoming a bottleneck for innovation, then businesses need to take action. If a cloud provider cannot (or will not) disclose exact emissions per workload, that is a red flag. Procurement teams need to start asking tough questions, and when appropriate, walking away from vendors that will not answer them. Businesses also need to unite to push for the development of a global measurement standard for carbon accounting. Until regulators or consortia enforce uniform reporting standards, companies will keep struggling to compare different measurements and metrics. Finally, it is imperative that businesses rethink the way they see emissions reporting. Rather than it being a compliance burden, they need to grasp it as an opportunity. Get emissions tracking right, and companies can be upfront and authentic about their green credentials, which can reassure potential customers and ultimately generate new business opportunities. Measuring environmental impact can be messy right now, but the alternative of sticking with outdated systems because new ones feel "too risky" is far worse. The solution is more transparency, smarter tools, a collective push for accountability, and above all, working with the right partners that can deliver accurate emissions statistics.

Making sense of data sovereignty and how to regain it

Although the concept of sovereignty is subject to greater regulatory control, its practical implications are often misunderstood or oversimplified, resulting in it being frequently reduced to questions of data location or legal jurisdiction. In reality, however, sovereignty extends across technical, operational and strategic domains. In practice, these elements are difficult to separate. While policy discussions often centre on where data is stored and who can access it, true sovereignty goes further. For example, much of the current debate focuses on physical infrastructure and national data residency. While these are very important issues, they represent only one part of the overall picture. Sovereignty is not achieved simply by locating data in a particular jurisdiction or switching to a domestic provider, because without visibility into how systems are built, maintained and supported, location alone offers limited protection. ... Organisations that take it seriously tend to focus less on technical purity and more on practical control. That means understanding which systems are critical to ongoing operations, where decision-making authority sits and what options exist if a provider, platform or regulation changes. Clearly, there is no single approach that suits every organisation, but these core principles help set direction.

Beyond PQC: Building adaptive security programs for the unknown

The lack of a timeline for a post-quantum world means that it doesn’t make sense to consider post-quantum as either a long-term or a short-term risk, but both. Practically, we can prepare for the threat of quantum technology today by deploying post-quantum cryptography to protect identities and sensitive data. This year is crucial for post-quantum preparedness, as organisations are starting to put quantum-safe infrastructure in place, and regulatory bodies are beginning to address the importance of post-quantum cryptography. ... CISOs should take steps now to understand their current cryptographic estate. Many organisations have developed a fragmented cryptographic estate without a unified approach to protecting and managing keys, certificates, and protocols. This lack of visibility opens increased exposure to cybersecurity threats. Understanding this landscape is a prerequisite for migrating safely to post-quantum cryptography. Another practical step you can take is to prepare your organisation for the impact of quantum computing on public key encryption. This has become more feasible with NIST’s release of quantum-resistant algorithms and the NCSC’s recently announced three-step plan for moving to quantum-safe encryption. Even if there is no pressing threat to your business, implementing a crypto-agile strategy will also ensure a smooth transition to quantum-resistant algorithms when they become mainstream.

Critical Zero-Day Bugs Crack Open CyberArk, HashiCorp Password Vaults

"Secret management is a good thing. You just have to account for when things go badly. I think many professionals think that by vaulting a credential, their job is done. In reality, this should be just the beginning of a broader effort to build a more resilient identity infrastructure." "You want to have high fault tolerance, and failover scenarios — break-the-glass scenarios for when compromise happens. There are Gartner guides on how to do that. There's a whole market for identity and access management (IAM) integrators which sells these types of preparing for doomsday solutions," he notes. It might ring unsatisfying — a bandage for a deeper-rooted problem. It's part of the reason why, in recent years, many security experts have been asking not just how to better protect secrets, but how to move past them to other models of authorization. "I know there are going to be static secrets for a while, but they're fading away," Tal says. "We should be managing [users], rather than secrets. We should be contextualizing behaviors, evaluating the kinds of identities and machines of users that are performing actions, and then making decisions based on their behavior, not just what secrets they hold. I think that secrets are not a bad thing for now, but eventually we're going to move to the next generation of identity infrastructure."

Strategies for Robust Engineering: Automated Testing for Scalable Software

The changes happening to software development through AI and machine learning require testing to transform as well. The purpose now exceeds basic software testing because we need to create testing systems that learn and grow as autonomous entities. Software quality should be viewed through a new perspective where testing functions as an intelligent system that adapts over time instead of remaining as a collection of unchanging assertions. The future of software development will transform when engineering leaders move past traditional automated testing frameworks to create predictive AI-based test suites. The establishment of scalable engineering presents an exciting new direction that I am eager to lead. Software development teams must adopt new automated testing approaches because the time to transform their current strategies has arrived. Our testing systems should evolve from basic code verification into active improvement mechanisms. As applications become increasingly complex and dynamic, especially in distributed, cloud-native environments, test automation must keep pace. Predictive models, trained on historical failure patterns, can anticipate high-risk areas in codebases before issues emerge. Test coverage should be driven by real-time code behavior, user analytics, and system telemetry rather than static rule sets.

Daily Tech Digest - May 23, 2025

Quote for the day:

"People may forget what you say, but they won't forget how you them feel." -- Mary Kay Ash

MCP, ACP, and Agent2Agent set standards for scalable AI results

“Without standardized protocols, companies will not be able to reap the maximum value from digital labor, or will be forced to build interoperability capabilities themselves, increasing technical debt,” he says. Protocols are also essential for AI security and scalability, because they will enable AI agents to validate each other, exchange data, and coordinate complex workflows, Lerhaupt adds. “The industry can build more robust and trustworthy multi-agent systems that integrate with existing infrastructure, encouraging innovation and collaboration instead of isolated, fragmented point solutions,” he says. ... ACP is “a universal protocol that transforms the fragmented landscape of today’s AI agents into inter-connected teammates,” writes Sandi Besen, ecosystem lead and AI research engineer at IBM Research, in Towards Data Science. “This unlocks new levels of interoperability, reuse, and scale.” ACP uses standard HTTP patterns for communication, making it easy to integrate into production, compared to JSON-RPC, which relies on more complex methods, Besen says. ... Agent2Agent, supported by more than 50 Google technology partners, will allow IT leaders to string a series of AI agents together, making it easier to get the specialized functionality their organizations need, Ensono’s Piazza says. Both ACP and Agent2Agent, with their focus on connecting AI agents, are complementary protocols to the model-centric MCP, their creators say.

It’s Time to Get Comfortable with Uncertainty in AI Model Training

“We noticed that some uncertainty models tend to be overconfident, even when the actual error in prediction is high,” said Bilbrey Pope. “This is common for most deep neural networks. But a model trained with SNAP gives a metric that mitigates this overconfidence. Ideally, you’d want to look at both prediction uncertainty and training data uncertainty to assess your overall model performance.” ... “AI should be able to accurately detect its knowledge boundaries,” said Choudhury. “We want our AI models to come with a confidence guarantee. We want to be able to make statements such as ‘This prediction provides 85% confidence that catalyst A is better than catalyst B, based on your requirements.’” In their published study, the researchers chose to benchmark their uncertainty method with one of the most advanced foundation models for atomistic materials chemistry, called MACE. The researchers calculated how well the model is trained to calculate the energy of specific families of materials. These calculations are important to understanding how well the AI model can approximate the more time- and energy-intensive methods that run on supercomputers. The results show what kinds of simulations can be calculated with confidence that the answers are accurate.

Don’t let AI integration become your weakest link

Ironically, integration meant to boost eﬃciency can stiﬂe innovation. Once a complex web of AI- interconnected systems exists, adding tools or modifying processes becomes a major architectural undertaking, not plug-and-play. It requires understanding interactions with central AI logic, potentially needing complex model re-training, integration point redevelopment, and extensive regression testing to avoid destabilisation. ... When AI integrates and automates decisions and workﬂows across systems based on learned patterns, it inherently optimises for the existing or dominant processes observed in the training data. While eﬃciency is the goal, there’s a tangible risk of inadvertently enforcing uniformity and suppressing valuable diversity in approaches. Different teams might have unique, effective methods deviating from the norm. An AI trained on the majority might ﬂag these as errors, subtly discouraging creative problem-solving or context-specific adaptations. ... Feeding data from multiple sensitive systems (CRM, HR, finance, and communications) into central AI dramatically increases the scope and sensitivity of data processed and potentially exposed. Each integration point is another vector for data leakage or unauthorised access. Sensitive customer, employee, and financial data may ﬂow across more boundaries and be aggregated in new ways, increasing the surface area for breaches or misuse.

Beyond API Uptime: Modern Metrics That Matter

A minuscule delay (measurable in API response times) in processing API requests can be as painful to a customer as a major outage. User behavior and expectations have evolved, and performance standards need to keep up. Traditional API monitoring tools are stuck in a binary paradigm of up versus down, despite the fact that modern, cloud native applications live in complex, distributed ecosystems. ... Measuring performance from multiple locations provides a more balanced and realistic view of user experience and can help uncover metrics you need to monitor, like location-specific latency: What’s fast in San Francisco might be slow in New York and terrible in London. ... The real value of IPM comes from how its core strengths, such as proactive synthetic testing, global monitoring agents, rich analytics with percentile-based metrics and experience-level objectives, interact and complement each other, Vasiliou told me. “IPM can proactively monitor single API URIs [uniform resource identifiers] or full API multistep transactions, even when users are not on your site or app. Many other monitors can also do this. It is only when you combine this with measuring performance from multiple locations, granular analytics and experience-level objectives that the value of the whole is greater than the sum of its parts,” Vasiliou said.

Agentic AI shaping strategies and plans across sectors as AI agents swarm

“Without a robust identity model, agents can’t truly act autonomously or securely,” says the post. “The MCP-I (I for Identity) specification addresses this gap – introducing a practical, interoperable approach to agentic identity.” Vouched also offers its turnkey SaaS Vouched MCP Identity Server, which provides easy-to-integrate APIs and SDKs for enterprises and developers to embed strong identity verification into agent systems. While the Agent Reputation Directory and MCP-I specification are open and free to the public, the MCP Identity Server is available as a commercial offering. “Thinking through strong identity in advance is critical to building an agentic future that works,” says Peter Horadan, CEO of Vouched. “In some ways we’ve seen this movie before. For example, when our industry designed email, they never anticipated that there would be bad email senders. As a result, we’re still dealing with spam problems 50 years later.” ... An early slide outlining definitions tells us that AI agents are ushering in a new definition of the word “tools,” which he calls “one of the big changes that’s happening this year around agentic AI, giving the ability to LLMs to actually do and act with permission on behalf of the user, interact with permission on behalf of the user, interact with third-party APIs,” and so on. Tools aside, what are the challenges for agentic AI? “The biggest one is security,” he says.

Optimistic Security: A New Era for Cyber Defense

Optimistic cybersecurity involves effective NHI management that reduces risk, improves regulatory compliance, enhances operational efficiency and provides better control over access management. This management strategy goes beyond point solutions such as secret scanners, offering comprehensive protection throughout the entire lifecycle of these identities. ... Furthermore, a proactive attitude towards cybersecurity can lead to potential cost savings by automating processes such as secrets rotation and NHIs decommissioning. By utilizing optimistic cybersecurity strategies, businesses can transform their defensive mechanisms, preparing for a new era in cyber defense. By integrating Non-Human Identities and Secrets Management into their cloud security control strategies, organizations can fortify their digital infrastructure, significantly reducing security breaches and data leaks. ... Implementing an optimistic cybersecurity approach is no less than a transformation in perspective. It involves harnessing the power of technology and human ingenuity to build a resilient future. With optimism at its core, cybersecurity measures can become a beacon of hope rather than a looming threat. By welcoming this new era of cyber defense with open arms, organizations can build a secure digital environment where NHIs and their secrets operate seamlessly, playing a pivotal role in enhancing overall cybersecurity.

Identity Security Has an Automation Problem—And It's Bigger Than You Think

The data reveals a persistent reliance on human action for tasks that should be automated across the identity security lifecycle.41% of end users still share or update passwords manually, using insecure methods like spreadsheets, emails, or chat tools. They are rarely updated or monitored, increasing the likelihood of credential misuse or compromise. Nearly 89% of organizations rely on users to manually enable MFA in applications, despite MFA being one of the most effective security controls. Without enforcement, protection becomes optional, and attackers know how to exploit that inconsistency. 59% of IT teams handle user provisioning and deprovisioning manually, relying on ticketing systems or informal follow-ups to grant and remove access. These workflows are slow, inconsistent, and easy to overlook—leaving organizations exposed to unauthorized access and compliance failures. ... According to the Ponemon Institute, 52% of enterprises have experienced a security breach caused by manual identity work in disconnected applications. Most of them had four or more. The downstream impact was tangible: 43% reported customer loss, and 36% lost partners. These failures are predictable and preventable, but only if organizations stop relying on humans to carry out what should be automated. Identity is no longer a background system. It's one of the primary control planes in enterprise security.

Critical infrastructure under attack: Flaws becoming weapon of choice

“Attackers have leaned more heavily on vulnerability exploitation to get in quickly and quietly,” said Dray Agha, senior manager of security operations at managed detection and response vendor Huntress. “Phishing and stolen credentials play a huge role, however, and we’re seeing more and more threat actors target identity first before they probe infrastructure.” James Lei, chief operating officer at application security testing firm Sparrow, added: “We’re seeing a shift in how attackers approach critical infrastructure in that they’re not just going after the usual suspects like phishing or credential stuffing, but increasingly targeting vulnerabilities in exposed systems that were never meant to be public-facing.” ... “Traditional methods for defense are not resilient enough for today’s evolving risk landscape,” said Andy Norton, European cyber risk officer at cybersecurity vendor Armis. “Legacy point products and siloed security solutions cannot adequately defend systems against modern threats, which increasingly incorporate AI. And yet, too few organizations are successfully adapting.” Norton added: “It’s vital that organizations stop reacting to cyber incidents once they’ve occurred and instead shift to a proactive cybersecurity posture that allows them to eliminate vulnerabilities before they can be exploited.”

Fundamentals of Data Access Management

An important component of an organization’s data management strategy is controlling access to the data to prevent data corruption, data loss, or unauthorized modification of the information. The fundamentals of data access management are especially important as the first line of defense for a company’s sensitive and proprietary data. Data access management protects the privacy of the individuals to which the data pertains, while also ensuring the organization complies with data protection laws. It does so by preventing unauthorized people from accessing the data, and by ensuring those who need access can reach it securely and in a timely manner. ... Appropriate data access controls improve the efficiency of business processes by limiting the number of actions an employee can take. This helps simplify user interfaces, reduce database errors, and automate validation, accuracy, and integrity checks. By restricting the number of entities that have access to sensitive data, or permission to alter or delete the data, organizations reduce the likelihood of errors being introduced while enhancing the effectiveness of their real-time data processing activities. ... Becoming a data-driven organization requires overcoming several obstacles, such as data silos, fragmented and decentralized data, lack of visibility into security and access-control measures currently in place, and a lack of organizational memory about how existing data systems were designed and implemented.

Chief Intelligence Officers? How Gen AI is rewiring the CxOs Brain

Generative AI is making the most impact in areas like Marketing, Software Engineering, Customer Service, and Sales. These functions benefit from AI’s ability to process vast amounts of data quickly. On the other hand, Legal and HR departments see less GenAI adoption, as these areas require high levels of accuracy, predictability, and human judgment. ... Business and tech leaders must prioritize business value when choosing AI use cases, focus on AI literacy and responsible AI, nurture cross-functional collaboration, and stress continuous learning to achieve successful outcomes. ... Leaders need to clearly outline and share a vision for responsible AI, establishing straightforward principles and policies that address fairness, bias reduction, ethics, risk management, privacy, sustainability, and compliance with regulations. They should also pinpoint the risks associated with Generative AI, such as privacy concerns, security issues, hallucinations, explainability, and legal compliance challenges, along with practical ways to mitigate these risks. When choosing and prioritizing use cases, it’s essential to consider responsible AI by filtering out those that carry unacceptable risks. Each Generative AI use case should have a designated champion responsible for ensuring that development and usage align with established policies.