Daily Tech Digest - July 14, 2026

---

Quote for the day:

"Goals are for people who care about winning once. Systems are for people who care about winning repeatedly." -- James Clear

---

🎧 Listen to this digest on YouTube Music

▶ Play Audio Digest

Duration: 21 mins • Perfect for listening on the go.

Digital devolution and taking back control

The article discusses the shift from highly centralized technology management to a model of digital devolution, where local organizations regain control over their systems and data. For many years, massive top down technology contracts locked public sector and enterprise groups into rigid, monolithic platforms that often failed to address specific local needs. Now, there is a growing movement to push decision making, budget, and technical authority away from the center and back into the hands of the people actually delivering frontline services. By taking back this control, local departments can choose modern, flexible tools that solve their unique operational problems. However, this decentralized approach does not mean a return to isolated silos. Instead, it relies heavily on open standards, shared data registries, and common technical platforms to ensure that different local systems can still talk to one another smoothly. This transition requires a careful balance between giving local leaders the freedom to innovate and maintaining enough central coordination to prevent any overlapping financial costs and security risks. Ultimately, giving power back to local teams enables much faster responses to user needs, reduces reliance on expensive older legacy vendors, and builds a more resilient technology landscape across the entire broader organization.

Mastering NHS Risk Management: A Guide to Best Practice

The article outlines how NHS boards can transition from treating risk management as a passive compliance exercise to using it as an active tool for institutional assurance. Often, executive teams rely on massive risk registers that blur the line between critical threats and minor operational friction. Instead, boards need a unified framework that actively drives real-world decision-making. A central theme is the need to break down silos between clinical care, financial stability, and digital security, treating them as an interconnected triad. A failure in finances or data security inevitably compromises patient safety. For example, with over 260,000 cyber attacks recorded in early 2026 and the increasing use of artificial intelligence, digital risk is now a direct threat to clinical outcomes. To build true resilience, the article advises leaders to use their Board Assurance Framework not just to record problems, but to demonstrate clear, evidenced progress toward long-term strategic goals, such as those in the 10-Year Health Plan. Ultimately, effective governance requires boards to replace bureaucratic rituals with practical judgment and institutional memory, ensuring that every identified risk leads to a deliberate action to either mitigate a threat or enable an opportunity for better healthcare delivery.

Routine maintenance as a failure vector in modern networks

In today's highly interconnected technology environments, "routine" network maintenance is no longer a low-risk activity. While planned updates, such as firewall adjustments, DNS modifications, or certificate renewals, are meant to improve system reliability, they often trigger unexpected outages. This happens because modern networks are incredibly complex, and a single user transaction now crosses multiple layers, including load balancers, security policies, and routing protocols. Consequently, a change to just one device can easily break a hidden dependency elsewhere in the traffic path. The core issue is that teams typically test only the specific component they changed, rather than verifying the complete traffic flow. Preliminary checks and isolated test environments are helpful, but they rarely mirror the true conditions of a live network. To prevent these maintenance induced failures, professionals need to map out traffic paths completely before making any changes. They should also establish clear expectations for how systems will react and prepare precise rollback plans that go beyond simply reverting a configuration. Ultimately, organizations must stop viewing maintenance as a simple checklist of isolated device updates. Instead, every maintenance window should be treated as a practical exercise in network resilience, requiring collaboration across security, application, and operations teams to ensure continuous service.

Hacker Conversations: Jesse McGraw (GhostExodus), From Blackhat Hacker to Redemption

Jesse McGraw, formerly known as the malicious computer hacker GhostExodus, underwent a profound transformation from a cybercriminal to a dedicated cybersecurity advocate. His journey began in high school, where a profound sense of isolation and neurodivergence fueled his obsession with technology. He discovered a talent for breaking rules and bypassing systems, driven primarily by the thrill of unauthorized access rather than financial gain. Lacking a clear moral compass regarding digital boundaries, his exploits steadily escalated. This culminated in his leadership of a hacker group and a dangerous breach of a Dallas medical facility network. After he recklessly posted a video of the hack online, a security researcher used open source intelligence to identify him, leading to McGraw's arrest and an eleven year prison sentence. This lengthy incarceration forced a pivotal realization about the real world consequences of his actions and the severe impact on victims. Today, McGraw channels his skills toward positive outcomes. Instead of breaking into networks, he utilizes open source intelligence to identify online predators and protect children. Acting as a bridge between the underground hacker community and the legitimate security industry, he educates the public on safe computing practices and works to prevent attacks on critical infrastructure.

Turning the Tables on Email Scammers With 'ScamBuster'

Instead of deleting scam emails, organizations can now use ScamBuster to fight back. Designed by software engineer Laurent Giovannoni, ScamBuster is an open-source, AI-driven system that engages with phishing attackers to gather intelligence. It uses large language models to adopt various personas—such as an elderly widow or a busy executive—to trick scammers into thinking they have successfully found a target. The AI learns which personas are most effective and adjusts its approach to extract valuable data like bank account numbers, payment domains, and phone numbers. ScamBuster operates strictly on an inbound basis, meaning it only replies to incoming emails. Once it extracts the attacker's information, the system structures the data into standard threat intelligence formats, such as STIX 2.1 and MISP. Security teams and law enforcement can then use this intelligence to link different scams together and build profiles of cybercriminal operations. Scheduled for release at Black Hat USA 2026, ScamBuster is designed to be affordable and is compatible with any preferred AI model. Giovannoni is also developing updates to address vishing and smishing attacks, extending the tool's capability to combat multiple forms of social engineering.

Is that QR code a trap? How to spot quishing scams before it's too late

Quishing, or QR code phishing, is a growing modern scam where attackers trick people into scanning malicious QR codes. These specific codes usually lead to fraudulent websites designed to steal sensitive information like passwords, credit card numbers, or personal data. Scammers often place fake QR codes over legitimate ones on parking meters, restaurant menus, or public transit stations. They also send them through emails or physical mail, pretending to be from trusted sources like banks or delivery services. To protect yourself, treat QR codes with the same caution as email links. Before scanning, physically inspect the code; if it is printed on a sticker placed over another code, avoid it. Use your phone's built-in camera app rather than a third-party QR scanner, as native cameras usually display the destination URL before opening it. Review the URL carefully for subtle misspellings or odd domain names that mimic real brands. If a scanned code asks for login credentials or payment information, stop and navigate to the official website manually instead. Finally, keep your smartphone's operating system updated, as this ensures you have the latest built-in security features. By staying observant and verifying links, you can easily avoid these deceptive QR code scams.

Your AI risk register is not an incident response plan

Many organizations mistakenly treat a list of potential AI risks as an actual plan for managing failures. While documenting risks creates helpful visibility, a spreadsheet cannot investigate, contain, or resolve a problem when an artificial intelligence system breaks down in a live environment. To properly manage these systems, security teams need a practical response plan that dictates exactly what to do when an issue occurs. Unlike traditional security breaches involving unauthorized access or stolen data, AI failures are often messier. They might look like a misleading summary, a flawed recommendation, or a bad automated decision. Because of this, organizations must define what counts as an AI incident and establish clear ways for employees to report these events. Additionally, investigating these issues requires evidence. Organizations must ensure that logs, prompt histories, and system outputs are captured before moving AI tools into active use. Most importantly, clear ownership is essential. Someone must have the explicit authority to pause or restrict an AI system if it starts producing harmful or unreliable results. Ultimately, security leaders must bridge the gap between acknowledging potential problems and being operationally prepared to fix them by creating a clear, realistic response playbook for their organizations to follow.

Building AI Agents? Here Are Some Anti-Patterns to Avoid.

When building artificial intelligence agents, projects often fail not because of the underlying models, but due to preventable structural and operational mistakes. To build reliable systems, it is essential to start simple and scale complexity only when necessary. A common error is adopting a complex, multi-agent setup early when a single, well-scoped agent with clear responsibilities would suffice. Similarly, overloading an agent with too many tools or expecting it to handle every possible task makes it inefficient and prone to errors. Instead, provide a minimal set of distinct tools and focus on specialized tasks. Another key issue is hardcoding rigid logic rather than building modular components that are easy to update. Furthermore, a solid memory design is vital; agents need to recall past steps to navigate complex tasks effectively. On the operational side, releasing agents without clear visibility into their decision-making processes makes fixing problems incredibly frustrating. It is also crucial to limit their ability to make permanent changes without human oversight, carefully manage the information they process over long tasks to avoid confusion, and rigorously test them against unexpected scenarios before launch. By addressing these pitfalls, you can create practical tools that consistently deliver the desired results in everyday applications.

CIOs must rethink operating models to unlock AI at scale

Many organizations face immense pressure to implement AI at scale, but their current operational foundations often aren't ready. While AI technology is advancing rapidly, businesses are struggling with a "readiness gap" caused by issues like data quality, disjointed operating models, and a lack of proper skills and governance. CIOs must rethink their operating models to close this gap. This requires moving away from traditional, siloed technology playbooks toward a tighter partnership between IT and business teams. AI thrives on clarity, and organizations need to redesign their end-to-end workflows rather than just bolting AI onto existing processes. Data readiness is a critical first step; companies must focus on improving data quality, standardizing procedures, and managing the new information generated by AI tools. Furthermore, successful AI scaling requires executive sponsorship, clear communication to address employee fears, and governance that is embedded directly into the operating model rather than treated as an afterthought. Transitioning from small proofs of concept to full production demands a strategic shift in how teams work together. Ultimately, unlocking AI's potential is a team effort that relies on intentional design, continuous upskilling, and a strong, integrated foundation.

Why SBOMs, signing, and provenance still don’t tell you if software is safe

While current software security practices like tracking components and verifying origins are helpful, they are no longer enough to keep systems safe. Tools that show what is inside a program or prove who made it do not answer the most important question: what the code will actually do once it is running. A program might have a verified source and a clean list of ingredients, yet still attempt to steal passwords or expose private data. This gap in security is becoming more urgent as artificial intelligence allows both safe and harmful code to be written and changed faster than humans can review. We cannot assume software is safe just because it comes from a known publisher or looks familiar. Instead, we need to stop trusting software based only on its identity or background. The next step is to evaluate how the code behaves before allowing it to run. We must check if its actions, such as accessing sensitive files or connecting to outside networks, are necessary and appropriate for its purpose. By adopting a mindset where no code is trusted by default, we can focus on verifying behavior rather than just origin, creating a more reliable defense against modern threats.

Daily Tech Digest - October 27, 2023

Quishing is the new phishing: What you need to know

Consider the QR code aired during the Super Bowl. Now, imagine the company behind that commercial had malicious intent (just to be clear, the company behind that commercial did not have malicious intent). Say, for example, the QR code displayed during the ad opened your phone's browser and automatically downloaded and installed a piece of ransomware. Given the number of people who watch the Super Bowl, the outcome of that attack could have been disastrous. That's quishing. ... We've all just accepted the QR code. And, to that end, we trust them. After all, how harmful can a simple QR code be? The answer to that question is…very. And cybercriminals are counting on the idea that most consumers always assume QR codes are harmless. Those same criminals also understand that their easiest targets are those on mobile phones. Why? Because most desktop operating systems include phishing protection. Phones, on the other hand, are far more vulnerable to those attacks. At the moment, most quishing attacks involve criminals sending a QR code via email. 

Boardrooms losing control in generative AI takeover

The theme of people adopting GenAI within their workplaces without oversight from IT and security teams or leadership, a trend we might reasonably term shadow AI, is not a new one as such. Earlier this year, an Imperva report drew similar concerns, stating that an insider breach at a large organisation arising from someone using generative AI in an off-the-books capacity was only a matter of time. However, given the steadily widening scope and ever-growing capability of generative AI tools, organisations can no longer afford not to exert, at the very least, minimal oversight. “Much like bring-your-own-device [BYOD], gen AI offers massive productivity benefits to businesses, but while our findings reveal that boardroom executives are clearly acknowledging its presence in their organisations, the extent of its use and purpose are shrouded in mystery,” said Kaspersky principal security researcher, David Emm. “Given that GenAI’s rapid evolution is currently showing no signs of abating, the longer these applications operate unchecked, the harder they will become to control and secure across major business functions such as HR, finance, marketing or even IT,” said Emm.

Privacy vs convenience – which comes out ahead?

There is a mutual responsibility between employees and employers, so trust and openness are essential. On the one hand, employees must be discerning about the digital tools they employ, understanding the permissions they grant and the third parties that might gain access to their data. They also need to accept that their personal choices can impact the security of the organization too. This requires awareness and a commitment to regular audits of personal digital spaces, ensuring that no unwanted entities are lurking in the shadows. Conversely, organizations bear the responsibility of being forthright about their data practices. Companies that are transparent about the data they access - and, more importantly, why they access it—stand out as beacons of integrity. This transparency extends beyond mere access; it encompasses the entire data lifecycle, from collection to storage, usage, and eventual disposal. By openly communicating these practices, enterprises can foster a culture of trust with their employees – and comply with regulatory standards too.

How to Speed Cyberattack Discovery

A fast and reliable way to identify cyber threats is with proactive threat hunting, which utilizes human defenders armed with advanced detection and proactive response technologies and approaches, says Mike Morris, a Deloitte risk and financial advisory managing director via an email interview. “In particular, threat hunting, during which human defenders actively maneuver through their networks and systems to identify indicators of a network attack and preemptively counter these threats, can speed the discovery of cyberattacks.” Yet he warns that for threat hunting to function optimally, it’s necessary that specific, relevant, and accurate intelligence is coupled with automation to identify and mitigate the adversary’s activities. When deploying human-based threat-hunting capabilities, it’s helpful to think about the parallels to physical security leading practices, Morris says. “For example, human security guards, tasked with protecting critical assets, constantly inspect physical infrastructures and maintain the integrity of their responsible spaces by actively patrolling and investigating,” he explains.

The Financial Consequences of Inadequate Data Governance

Low-quality data can severely impact decision-making and operational efficiency. Inaccurate or incomplete data can lead to flawed strategies, missed opportunities, and ultimately, financial losses. A sales team relying on outdated customer information could waste time on leads that have already been converted or are no longer relevant, leading to lost sales opportunities and financial losses. Similarly, a marketing team using incorrect customer segmentation data could end up targeting the wrong audience, wasting advertising budget, and missing revenue targets. These real-world scenarios further illustrate the cost of poor data quality. The examples highlight the tangible impact of data quality issues on an organization's bottom line. ... Data breaches can have devastating financial consequences for organizations. The direct costs include legal fees, fines, and customer compensation, which can run into millions of dollars. Indirect costs, such as reputational damage and loss of business, can be even more damaging in the long run. 

Change Management for Zero Trust

Change management isn’t any different for Zero Trust than it is for any other big initiative. But most of us aren’t very good at change management. And security and cybersecurity are not sexy. And most people want their security to be minimally invasive and as unnoticeable as possible. And most leaders get no top-line/bottom-line joy from spending money on Zero Trust initiatives. And Zero Trust doesn’t drop new features and functionality for a product at the end of a sprint. ... Three key areas you can focus on as you get started:Get leadership engaged – If the culture of your organization is driven by urgency, craft a message and plan that leverages urgency. If the culture is driven through aspiration, use aspirational vision and goals. Either way, get leadership on board to deliver the message. Create a communications strategy – The strategy must include the rhythm and mode of communications, as well as the context and content of the communications for leadership and sponsors, leads and key centralized players, local mavens, and users. Persuasive communication is what the marketing team does well. Get them involved.

UK Prime Minister announces world’s first AI Safety Institute

"The British people should have peace of mind that we're developing the most advanced protections for AI of any country in the world," Sunak said. "I will always be honest with you about the risks, and you can trust me to make the right long-term decisions." The AI Safety Institute will assess and study these risks — from social harms like bias and misinformation, through to the most extreme risks of all - so that the UK understands what each new AI model is capable of, Sunak added. "Right now, we don't have a shared understanding of the risks that we face. Without that, we cannot hope to work together to address them." The UK will therefore push hard to agree to the first ever international statement about the nature of AI risks to ensure that, as they evolve, so does shared understanding about them, Sunak said. "I will propose that we establish a truly global expert panel to publish a State of AI Science report. Of course, our efforts also depend on collaboration with the AI companies themselves. Uniquely in the world, those companies have already trusted the UK with privileged access to their models. That's why the UK is so well-placed to create the world's first Safety Institute."

DNS Under Siege: Real-World DNS Flood Attacks

During H1 2023 there was a surge in DNS flood attacks affecting multiple organizations around the world. Looking at the DNS attacks and their characteristics we suspect that they belong to one or more global DNS attack campaigns. We were able to identify significant DNS attack activity world-wide and were able to identify correlations between attack events to different DNS servers. ... The organizations that were targeted by these DNS flood attacks all belong to the financial and commercial segment. We detected and mitigated DNS flood attacks targeting banks, retailers, insurance etc. This can hint on the DNS campaign’s agenda, and help similar organizations protect their DNS services. ... There was a single attack vector repeating in all DNS attacks and that is the random subdomain, also known as DNS water torture. Interestingly, we identified different types of invalid subdomains used in the attacks. In some cases, it was purely random with high entropy1 including case randomization and in other cases the attack subdomains were human-readable, but non-existent.

FTC eyes competitive practices for genAI

Generative AI is set to become one of the world’s most dominant industries. One projection puts the market at $76.8 billion by 2030, up from a current valuation at $11.3 billion. Goldman Sachs, for its part, boldly says the technology could drive a 7% (or nearly $7 trillion) increase in global GDP. Amidst all this, the FTC says issues could arise around control over one or more of the “key building blocks” of generative AI: data, talent and computational resources. If a single company or handful of firms controlled one of these essential inputs, “they may be able to leverage their control to dampen or distort competition,” the agency asserts. “And if generative AI itself becomes an increasingly critical tool, then those who control its essential inputs could wield outsized influence over a significant swath of economic activity.” In particular, the agency said firms could bundle and tie products — offering multiple products in a single package or conditioning the sale of one product on the purchase of another, respectively. 

Keys to effective cybersecurity threat monitoring

Over the past few years, attackers have adjusted their tactics, finding success in targeting employees with the intent of stealing their credentials. Social engineering tactics such as phishing often catch individual users out, leading to passwords, financial information and other sensitive data being breached. “In the past, they might have relied on attacking infrastructure directly through vulnerabilities or brute force attacks. While they can still happen, these attacks run a high risk of discovery before the bad actor can get in,” explained Hank Schless, director of global security campaigns at Lookout and host of the Security Soapbox Podcast. “Now, attackers are targeting individuals who likely have access to large sets of valuable cloud data. They do this with the intention of stealing those individuals’ credentials via mobile phishing attacks in order to be able to enter the organisation’s infrastructure discreetly under the guise of being a legitimate user. “This creates massive issues with monitoring for threats, because the threat looks like it’s coming from the inside if an attacker is using stolen credentials.”

---

Quote for the day:

"It is the capacity to develop and improve their skills that distinguishes leaders from followers." -- Warren G. Bennis

---