Daily Tech Digest by Kannan Subbiah: security debt

Showing posts with label security debt. Show all posts

Daily Tech Digest - March 29, 2026

Quote for the day:

"The organizations that succeed this year will be the ones that build confidence faster than AI can erode it." -- 2026 Data Governance Outlook

🎧 Listen to this digest on YouTube Music

▶ Play Audio Digest

Duration: 17 mins • Perfect for listening on the go.

Google's 2029 Quantum Deadline Is a Wake-Up Call

Google has issued a significant "wake-up call" to the technology industry by accelerating its deadline for transitioning to (PQC) to 2029. This aggressive timeline positions the company well ahead of the 2035 target set by the National Institute for Standards and Technology (NIST) and the 2031 requirement for national security systems. By moving faster, Google aims to provide the necessary urgency for global digital transitions, addressing critical vulnerabilities such as "harvest now, decrypt later" attacks and the inherent fragility of current digital signatures. These threats involve adversaries collecting encrypted sensitive data today with the intention of unlocking it once cryptographically relevant quantum computers become available. Furthermore, the 2029 deadline aligns with industry shifts to reduce public TLS certificate validity to 47 days, emphasizing a broader move toward cryptographic agility. Experts suggest that because Google is a foundational component of many corporate technology stacks, its early migration forces dependent organizations to upgrade and test their systems sooner. Enterprise leaders are advised to immediately inventory their cryptographic assets, prioritize high-risk data, and collaborate with vendors to ensure their infrastructure can support rapid, automated algorithm rotations. The message is clear: the journey to quantum readiness is lengthy, and waiting until the next decade to act may be too late.

The one-model trap: Why agentic AI won’t scale in production

In "," Jofia Jose Prakash explains that relying on a single monolithic AI model is a strategic error that prevents agentic AI from scaling in production. While the "one-model" approach seems simpler to manage, it fails to account for the high variance in real-world workloads. Using high-capability models for routine tasks leads to excessive costs and latency, while the lack of isolation boundaries makes the entire system vulnerable to model outages and policy shifts. To build resilient agents, organizations must transition from a prompt-centric view to a system-centric architectural approach. This involves a multi-model strategy featuring "capability tiering," where tasks are routed based on complexity to fast-cheap, balanced, or premium reasoning tiers. Such an architecture allows for graceful degradation and easier governance, as policy updates become control-plane adjustments rather than complete system overhauls. Prakash outlines five critical stages for scalability: separating control from generation, implementing failure-aware execution with circuit breakers, and enforcing strict economic controls like token budgets. Ultimately, the author concludes that successful agentic AI is a control-plane challenge rather than a model-choice problem. By prioritizing orchestration and robust monitoring over model standardization, enterprises can achieve the reliability and cost-efficiency necessary for production-grade AI.

Are You Overburdening Your Most Engaged Employees?

The Harvard Business Review article, "Are You Overburdening Your Most Engaged Employees?" by Sangah Bae and Kaitlin Woolley, explores a critical paradox in workforce management. While senior leaders invest heavily in fostering employee engagement, new research involving over 4,300 participants reveals that managers often inadvertently undermine these efforts. When unexpected tasks arise, managers tend to assign approximately 70% of this additional workload to their most intrinsically motivated staff. This systematic bias stems from two flawed assumptions: that highly engaged employees find extra work inherently rewarding and that they possess a unique resilience against burnout. In reality, both beliefs are incorrect. This disproportionate burden significantly reduces job satisfaction and heightens turnover intentions among the very individuals organizations are most desperate to retain. By over-relying on "star" performers to handle unforeseen demands, companies risk depleting their most valuable human capital through an unintended "engagement tax." To combat this, the authors propose three low-cost interventions aimed at promoting more equitable work distribution. Ultimately, the research highlights the necessity for leaders to move beyond convenience-based task allocation and adopt strategic practices that protect their most dedicated employees from exhaustion, ensuring that high engagement remains a sustainable asset rather than a precursor to professional burnout.

When AI turns software development inside-out: 170% throughput at 80% headcount

The article "When AI turns software development inside-out" explores a transformative shift in engineering productivity where a team achieved 170% throughput while operating at 80% of its previous headcount. This transition marks a fundamental departure from traditional "diamond-shaped" development—where large teams execute designs—to a "double funnel" model. In this new paradigm, humans focus intensely on the beginning stages of defining intent and the final stages of validating outcomes, while AI handles the rapid execution in between. The shift has collapsed the cost of experimentation, enabling ideas to move from whiteboards to working prototypes in a single day. Consequently, roles are being redefined: creative directors maintain production code, and QA engineers have evolved into system architects who build AI agents to ensure correctness. This "inside-out" approach prioritizes validation over manual coding, treating software development as a control tower operation rather than an assembly line. By automating the middle layer of implementation, the organization has not only increased its velocity but also improved product quality and reduced bugs. Ultimately, AI-first workflows allow teams to focus on defining "good" while leveraging technology to handle the heavy lifting of execution and technical translation across dozens of programming languages.

4 Out of 5 Organizations Are Drowning in Security Debt

The reveals that approximately 82% of organizations are currently overwhelmed by significant , representing a concerning 11% increase from the previous year. Alarmingly, 60% of these entities face "critical" debt levels characterized by severe, long-unresolved vulnerabilities that could cause catastrophic damage if exploited by malicious actors. The study identifies a widening gap between the rapid, modern pace of software development and the capacity of security teams to manage remediation, noting a 36% spike in high-risk flaws. Several factors exacerbate this trend, including the unprecedented velocity of AI-generated code and a heavy reliance on complex third-party libraries, which account for 66% of the most dangerous long-lived vulnerabilities. To combat this escalating crisis, the report suggests moving beyond simple detection toward a comprehensive and strategic "Prioritize, Protect, and Prove" (P3) framework. By focusing resources specifically on the 11.3% of flaws that present genuine real-world danger and utilizing automated remediation for critical digital assets, enterprises can manage their debt more effectively. Ultimately, the report emphasizes that success in today's digital landscape requires a deliberate shift toward risk-based prioritization and rigorous compliance to stem the tide of vulnerabilities and safeguard essential infrastructure.

The agentic AI gap: Vendors sprint, enterprises crawl

The "agentic AI gap" highlights a stark disconnect between the rapid innovation of tech vendors and the cautious, often sluggish adoption of artificial intelligence within mainstream enterprises. While vendors are "sprinting" toward sophisticated agentic workflows and reasoning capabilities, most organizations are still "crawling," primarily focused on basic productivity gains and early-stage pilots. This hesitation is fueled by a combination of macroeconomic uncertainty—such as geopolitical tensions and fluctuating interest rates—and a lack of operational readiness. Currently, only about 13% of enterprises report achieving sustained ROI at scale, as hurdles like data governance, security, and integration remain significant barriers. The article suggests that a new four-layer software architecture is emerging, shifting the focus from application-centric models to intelligence-centric systems. Central to this transition is the "Cognitive Surface," a middle layer where intent is shaped and enterprise policies are enforced. As the industry moves toward an economic model based on tokenized intelligence, business leaders must evolve their operational strategies to manage digital agents effectively. Ultimately, bridging this gap requires more than just better technology; it demands a fundamental transformation in how enterprises secure, govern, and value AI to turn experimental pilots into scalable, revenue-generating business assets.

India’s Proposal for Age-verification Is a Blunt Response to a Complex Problem

and subsequent regulatory proposals introduce a stringent age-verification framework, mandating "" for users under eighteen. This article by Amber Sinha argues that such measures constitute a "blunt response" to the multifaceted challenges of online child safety, potentially compromising privacy and fundamental digital rights. By shifting toward a graded approach that includes screen-time caps and "curfews," the government risks creating massive "honeypots" of sensitive identification data—often tied to the Aadhaar biometric system—thereby enabling state surveillance and increasing vulnerability to data breaches. Furthermore, the reliance on official documentation and repeated parental consent threatens to deepen the gender digital divide; in many South Asian households, these barriers may lead families to restrict girls' access to shared devices entirely. Critics emphasize that these rigid mandates often drive minors toward riskier, unregulated corners of the internet while stifling their constitutional right to information. Rather than imposing a universal, one-size-fits-all age-gating mechanism, the author advocates for a more nuanced strategy. This alternative would prioritize "privacy by design" and leverage advanced cryptographic techniques like to verify age without compromising user anonymity, ultimately focusing on safety through empowerment rather than through restrictive control and pervasive data collection.

The Danger of Treating CyberCrime as War – The New National Cybersecurity Strategy

The article "The Danger of Treating CyberCrime as War – The New National Cybersecurity Strategy," published in March 2026, analyzes the fundamental shift in U.S. cybersecurity policy following the release of the "Cyber Strategy for America." This new approach moves away from traditional regulatory compliance and defensive engineering, instead prioritizing a posture of active disruption and the projection of national power. By treating cybersecurity as a contest against adversaries, the strategy leverages law enforcement, intelligence, and sanctions to impose significant costs on bad actors. However, the author warns that this "war-like" framing may be misaligned with the reality of most digital threats. While nation-states might respond to traditional deterrence, the vast majority of cyber harm is caused by economically motivated criminals—such as and fraudsters—who are highly elastic and adaptive. These actors often respond to increased pressure by evolving their tactics or shifting jurisdictions rather than ceasing operations. Consequently, the article suggests that over-emphasizing state-level power risks neglecting the underlying economic drivers of cybercrime. Ultimately, a successful strategy must balance the pursuit of geopolitical adversaries with the practical need to secure the private sector’s daily operations against profit-driven threats.

The AI Leader

In "The AI Leader," Tomas Chamorro-Premuzic explores the profound transformation of the professional landscape as artificial intelligence reaches parity with human cognitive capabilities. He argues that while AI has commoditized technical expertise and routine management—such as data processing and tactical execution—it has simultaneously increased the "leadership premium" on uniquely human qualities. As the distinction between human and machine intelligence blurs, the author posits that the essence of leadership must shift from traditional authority and information control to the cultivation of empathy, moral judgment, and a sense of purpose. Chamorro-Premuzic warns against the temptation for executives to abdicate their decision-making responsibility to algorithms, emphasizing that leadership is fundamentally a human-centric endeavor centered on motivation and cultural alignment. He suggests that the modern leader’s primary role is to serve as a filter for AI-generated noise, using intuition to navigate ambiguity where data falls short. Ultimately, the article concludes that the most successful organizations in the AI era will be those led by individuals who leverage technology to enhance efficiency while doubling down on the "soft" skills that foster trust and inspiration. In this new paradigm, leadership is not about competing with AI but about mastering the human elements that technology cannot replicate.

Data governance vs. data quality: Which comes first in 2026?

In 2026, the debate between data governance and data quality has shifted toward a unified framework, as the article "Data governance vs. data quality: Which comes first in 2026" argues that governance without quality is merely "bureaucracy dressed in corporate branding." While governance provides the essential structure—defining roles, policies, and accountability—it remains an act of faith unless validated by measurable quality metrics. The rise of AI has intensified this need, as models amplify underlying data inconsistencies, requiring governance to prioritize continuous quality rather than periodic "cleanup" projects. Leading organizations are moving away from treating these as separate silos; instead, they integrate governance as an enabler of quality at scale and quality as the evidence of governance effectiveness. This shift ensures that data owners have visibility into metrics, creating meaningful accountability. Ultimately, the article concludes that quality is the primary metric by which any governance program should be judged. Organizations that fail to unify these initiatives will likely face the overhead of complex frameworks without the benefit of trustworthy data, losing their competitive advantage in an increasingly AI-driven and regulated landscape. Successful firms will instead achieve a sustained state of trust, where governance and quality work in tandem to support innovation.

Daily Tech Digest - March 02, 2026

Quote for the day:

“Winners are not afraid of losing. But losers are. Failure is part of the process of success. People who avoid failure also avoid success.” -- Robert T. Kiyosaki

Western Cybersecurity Experts Brace for Iranian Reprisal

Analysts at the threat intelligence firm Flashpoint on Sunday reported that the Iran-linked Handala Group was already targeting Israeli industrial control systems and claimed disruption of manufacturing and energy distribution in the country. Handala, which earlier in the week claimed on social media to have stolen data held by Israel's Clalit healthcare network, also claimed responsibility for a cyberattack on Jordanian fuel station infrastructure. ... "The inclusion of Gulf states such as the UAE, Qatar, and Bahrain in the potential crossfire underscores that this is not a localized exchange, but a high-risk regional security environment," said Austin Warnick, Flashpoint's director of national security intelligence, in an emailed statement. "Beyond the kinetic strikes themselves, the broader risk lies in the second-order effects - retaliatory cyber operations, attacks on critical infrastructure, and prolonged disruption to air and maritime corridors that underpin global commerce," Warnick added. The cybersecurity firm SentinelOne on Saturday observed that Iran has "historically incorporated cyber operations into periods of regional escalation." ... Concerns about retaliation in cyberspace come after what may have been the "largest cyberattack in history," which is how the Jerusalem Post characterized a plunge into digital darkness that accompanied missile strikes. Internet observatory NetBlocks observed a sudden decline in Iranian internet connectivity in a timeline coinciding with the onset of missile attacks.

Security debt is becoming a governance issue for CISOs

Security debt is a time problem as much as a volume problem. Older items tend to live in code that teams hesitate to change, such as legacy services, shared libraries, or apps tied to revenue workflows. That slows remediation, and it can make risk conversations feel repetitive for engineering leaders. Programs that track debt end up debating ownership, change windows, and acceptable exposure for systems with high business dependency. Governance often comes down to who owns remediation, what gets funded, and which teams can accept risk exceptions. ... Prioritization becomes an operational discipline when remediation capacity stays constrained. Programs need a repeatable way to tie issues to business criticality, reachable attack paths, and runtime exposure, so teams can focus effort on the highest impact weaknesses in the systems that matter most. Wysopal said organizations need to recalibrate how they rank and measure vulnerability reduction. “Success in reducing security debt is about focus. Direct teams to the small subset of vulnerabilities that are both highly exploitable and capable of causing catastrophic damage to the organisation if left unaddressed. By layering exploitability potential on top of the CVSS, organisations add critical business context and establish a ‘high-risk’ fast lane for vulnerabilities that demand immediate attention.”

Biometrics, big data and the new counterintelligence battlefield

Modern immigration enforcement relies on vast interconnected databases that contain fingerprints, facial images, travel histories, employment records, family relationships, and immigration status determinations. Much of this information is immutable. A compromised password can be reset. A compromised fingerprint cannot. That permanence gives biometric repositories enduring intelligence value. If accessed, such data could enable long term targeting, profiling, and exploitation of individuals both inside and outside the U.S. The risk is magnified by scale and distribution. Immigration data flows across multiple components within the Department of Homeland Security (DHS) and into partner agencies. Mobile devices capture biometrics in the field. Cloud environments host case management systems. Contractors provide infrastructure, analytics, and support services. ... The counterintelligence risk does not stop at static records. Immigration enforcement increasingly relies on advanced analytics, large scale data aggregation, and biometric matching systems that connect government holdings with commercial data streams. Location data derived from advertising technology ecosystems, social media analysis, and facial recognition tools can all be integrated into investigative workflows. As these ecosystems grow more interconnected, the intelligence payoff from breaching, de-anonymization, or manipulation increases.

Can you trust your AI to manage its own security

A pressing concern within many organizations is the disconnect between security teams and R&D departments. Managing NHIs effectively can bridge this gap. By fostering collaboration and communication between these teams, organizations can create a more secure and unified cloud environment. This integration ensures that security protocols align seamlessly with innovation efforts, mitigating risks at every turn. ... Have you ever contemplated the extent to which AI can autonomously manage its security infrastructure? Where organizations increasingly transition to cloud-based operations, the intersection of Non-Human Identities (NHIs) and AI-driven security becomes critically important. By understanding these key components, cybersecurity professionals can develop robust strategies that mitigate risks while bolstering AI’s role in maintaining a secure environment. ... How can organizations cultivate trust in AI systems? By implementing stringent protocols and maintaining transparency throughout the process, businesses can illustrate AI’s capacity for reliable and secure operations. Collaborative efforts that involve transparency between AI developers and end-users can also enhance understanding and trust. Incorporating AI-driven security measures requires careful consideration and ongoing evaluation to maintain efficacy. This commitment to excellence fortifies AI strategies and ensures organizations maintain a proactive stance on security challenges.

What if the real risk of AI isn’t deepfakes — but daily whispers?

AI is transitioning from tools we use to prosthetics we wear. This will create significant new threats we’re just not prepared for. No, I’m not talking about creepy brain implants. These AI-powered prosthetics will be mainstream products we buy from Amazon or the Apple Store ... They will provide real value in our lives — so much so that we will feel disadvantaged if others are wearing them and we are not. This will create rapid pressure for mass adoption. ... First and foremost, policymakers need to realize that conversational AI enables an entirely new form of media that is interactive, adaptive, individualized and increasingly context-aware. This new form of media will function as “active influence,” because it can adjust its tactics in real time to overcome user resistance. When deployed in wearable devices, these AI systems could be designed to manipulate our actions, sway our opinions and influence our beliefs — and do it all through seemingly casual dialog. Worse, these agents will learn over time what conversational tactics work best on each of us on a personal level. The fact is, conversational agents should not be allowed to form control loops around users. If this is not regulated, AI will be able to influence us with superhuman persuasiveness. In addition, AI agents should be required to inform users whenever they transition to expressing promotional content on behalf of a third party.

A peak at the future of AI and connectivity

2026 will mark the point where AI shifts from experimentation to fully commercialized, autonomous decision-making at scale. The acceleration in inference traffic alone will expose the limits of network architectures designed for linear data flows and predictable consumption. AI-driven workloads will generate volatile east-west traffic patterns, machine-to-machine exchanges, and microburst dynamics that current networks were never built to accommodate. Ultra-low latency, deterministic performance, and the ability to dynamically allocate bandwidth in milliseconds will move from “nice to have” to critical requirements. The drive to generate ROI from AI will also put a bigger spotlight on the network. ... The industry has long viewed non-terrestrial networks (NTNs) as a means to fill coverage gaps where terrestrial connectivity is too impractical or costly. However, conversations from recent industry meetings and events tell me that NTNs are set to play a far more important, and potentially disruptive role than originally expected. Tens of thousands of new satellites are set to launch in the coming years, with Musk alone securing licenses for 10,000 additional units. This rapidly expanding mesh of networks is evolving at pace and will soon reach a point where direct-to-cell services can offer performance competing with terrestrial coverage. It is important to note, however, that NTNs will never be able to compete on peak data throughput. They will be part of the broader connectivity ‘coverage package’.

How CISOs can build a resilient workforce

Ford has developed strategies to not only recruit talent but maintain their interests and get them through the ebbs and flows of daily life in cybersecurity. “I put a focus around monitoring the workforce and trying to get a good sense of the workloads that are coming in.” Having a team that’s properly staffed is important and this is where data is helpful to gauge the workload and make the argument to support resourcing. ... Burnout is an ongoing concern for many CISOs and their teams, especially when unpredictable events can trigger workload spikes, burnout can escalate fast. “It’s something that can overwhelm pretty quickly,” Ford says. Industry surveys continue to flash red on persistent burnout that leads to job dissatisfaction. ... Ford agrees it’s difficult to find top-tier talent across all the different cybersecurity disciplines, especially for a large organization like Rockwell. His strategy entails bringing in a key expert or two in different disciplines with years of experience and adding more junior, early career people. “Pairing them with seasoned experts allows you to build an effective, sustainable team over time, and I’ve seen that work extremely well for organizations with early career programs.” He also looks for experts from adjacent disciplines such as infrastructure, the data center space or application development keen to break into cyber. “I’m not recruiting for everyone. I’m recruiting for a few top experts and then building a pipeline either through early career or other similar activities from a technology space to get an effective cyber team,” he says.

Why Retries Are More Dangerous Than Failures

The system enters a state where retries eat all available capacity, starving even the requests that might've succeeded. It's a trap — the harder you struggle, the tighter it clamps down. AWS engineers lived this during an October 2025 database outage. Client apps did exactly what they were supposed to: aggressively retry failed database calls. The database was already wobbly — some internal resource thing, normally the kind of issue that resolves itself in minutes. But those minutes never came. The retry storm kept the system pinned in a failure state for hours. The outage dragged on not because the original problem was catastrophic, but because every well-meaning client was enthusiastically making it worse. ... But backoff alone won't save you. You need circuit breakers — the pattern where after N consecutive failures, you stop trying entirely for some cooldown window. Give the service room to recover. Requests fail fast instead of queuing up. This feels wrong the first time you implement it. You're programming the system to give up. But the alternative — letting it spin uselessly pretending the next retry will work — is worse. ... SRE teams talk about error budgets — how much failure you can tolerate before breaking SLOs. Same logic applies to retries. You need a retry budget: a system-wide cap on in-flight retries. Harder to implement than it sounds. Requires coordination. Maybe you emit metrics on retry rates and alert when they cross thresholds.

The Real Cost of Cutting Costs in Digital Banking

Digital banking platforms must maintain robust security protocols, stay current with evolving regulatory requirements, and respond quickly to emerging threats. This is especially true for community FIs, since fraudsters often target smaller FIs based on smaller security teams and budgets. Budget vendors often lack the resources to invest adequately in security infrastructure, maintain comprehensive compliance programs, or dedicate teams to proactive threat monitoring. ... Budget platforms frequently lack robust integration capabilities, forcing your team to manage endless workarounds, manual processes, and custom development projects. These integration gaps create multiple cost centers. Your IT team spends hours troubleshooting connection issues instead of driving strategic initiatives. ... One of the most overlooked costs of budget digital banking platforms emerges precisely when your institution is succeeding. Growth-minded credit unions and community banks need partners whose platforms can scale seamlessly as account holder numbers increase, transaction volumes surge, and service offerings expand. Budget vendors often hit performance ceilings that turn your growth trajectory into an operational crisis. The problem manifests in multiple ways. ... The direct costs of migration such as consulting fees, vendor implementation charges, and internal labor costs easily run into six figures for even small institutions. The indirect costs are equally significant. During migration, your team’s attention diverts from strategic initiatives to tactical execution.

Why privacy by design matters most in high-risk data ecosystems

The most fundamental shift, Vora argues, is mental rather than technical. Privacy by design is not a checklist to be validated post-facto—it is a constraint that must shape systems from inception. “We have to incorporate privacy into the core of our architecture,” she says. “That means rethinking legacy systems, reengineering data flows, and redesigning how consent, access, and retention are handled.” ... Data minimisation, therefore, becomes the first line of defense. organisation must clearly define the lifecycle of every data element—from collection to disposal—and ensure that end users retain the right to access, correct, or erase their data. ... Key to this is data tagging: assigning unique identifiers to track data across its entire journey. Complementing this is the creation of centralised data catalogs, which document what data is collected, its sensitivity, purpose, retention period, and access rights. “These catalogs become the backbone of governance,” Vora says, “ensuring transparency and accountability across departments.” Technology, of course, plays a critical role. ... If privacy by design is the foundation, dynamic consent management is the operating system. Vora is clear that consent cannot be treated as a one-time checkbox. “Consent must be layered, granular, and flexible,” she says. “Users should be able to update, revoke, or modify their consent at any point.” This requires centralised consent management platforms, standardised APIs with consent baked in, and user-centric controls across both new and legacy products.

Daily Tech Digest - February 26, 2026

Quote for the day:

"It is not such a fierce something to lead once you see your leadership as part of God's overall plan for his world." -- Calvin Miller

Boards don’t need cyber metrics — they need risk signals

Decision-makers want to know whether risk is increasing or decreasing, whether controls are effective, and whether the organization can limit damage when prevention fails. Metrics are therefore useful when they clarify those questions. “Time is really the universal metric because everyone can understand time,” Richard Bejtlich, strategist and author in residence at Corelight, tells CSO. “How fast do we detect problems, and how fast do we contain them. Dwell time, containment time. That’s the whole game for me.” Organizations cannot prevent every intrusion, Bejtlich argues, but they can measure how quickly they recognize and contain one. ... Wendy Nather, a longtime CISO who is now an advisor at EPSD, cautions against equating measurement with understanding. “When you are reporting to the board, there are some things you just cannot count that you have to report anyway,” she tells CSO. She points to incidents, near misses, and changes in assumptions as examples. “Anything that changes your assumptions about how you’re managing your security program, you should be bringing those to the board, even if you can’t count them,” Nather says. Regular metrics can create a rhythm of predictability, and that predictability could lull board members into a false sense of security. “Metrics are very seductive,” she says. “They lead us toward things that can be counted, that happen on a regular basis.” The result may be a steady flow of data that obscures structural risk or emerging weaknesses, Nather warns.

The Enterprise AI Postmortem Playbook: Diagnosing Failures at the Data Layer

Your first rule of the playbook is to treat AI incidents as data incidents – until proven otherwise. You should start by tagging the failure type. Document whether it’s a structure issue, retrieval misalignment, conflict with metric definition, or other categories. Ideally, you want to assign the issue to an owner and attach evidence to force some discipline into the review. Try to classify the issue into clearly defined buckets. For example, you can classify into these four buckets: structural failure, retrieval misalignment, definition conflict, or freshness failure. Once this part is clear, the investigation becomes more focused. The goal with this step is to isolate the data fault line. ... The next step is to move one layer deeper. Identify the source table behind the retrieved context. You also want to confirm the timestamp of the last refresh. Check whether any ingestion jobs failed, partially completed, or ran late. Silent failures are common. A job may succeed technically while loading incomplete data. As you go through the playbook continue tracing upstream. Find the transformation job that shaped the dataset. Look at recent schema changes. Check whether any business rules were updated. The idea here is to rebuild the exact path that led to the output. Try to not make any assumptions at this stage about model behavior – simply keep tracing until the process is complete. Don’t be surprised if the model simply worked with what it was given.

Top Attacks On Biometric Systems (And How To Defend Against Them)

Presentation attacks, often referred to as spoofing attacks, occur when an attacker presents a fake biometric sample to a sensor (like a camera or microphone) in an attempt to impersonate a legitimate user. Common examples include printed photos, video replays, silicone masks, prosthetics or synthetic fingerprints. More recently, high-quality deepfake videos have become a powerful new tool in the attacker’s arsenal. ... Passive liveness techniques, which analyze subtle physiological and behavioral signals without requiring user interaction, are particularly effective because they reduce friction while improving security. However, liveness detection must be resilient to unknown attack methods, not just tuned to detect known spoof types. ... Not all biometric attacks happen in front of the sensor. Replay and injection attacks target the biometric data pipeline itself. In these scenarios, attackers intercept, replay or inject biometric data, such as images or templates, directly into the system, bypassing the sensor entirely. ... Defensive strategies must extend beyond the biometric algorithm. Secure transmission, encryption in transit, device attestation, trusted execution environments and validation that data originates from an authorized sensor are all essential. ... Although less visible to end users, attacks targeting biometric templates and databases can pose long-term risks. If biometric templates are compromised, the impact extends far beyond a single breach.

Open-source security debt grows across commercial software

High and critical risk findings remain widespread. Most codebases contain at least one high risk vulnerability, and nearly half contain at least one critical risk issue. Those rates dipped slightly from the prior year even as total vulnerability counts rose. Supply chain attacks add another layer of risk. Sixty five percent of surveyed organizations experienced a software supply chain attack in the past year. ... “As AI reshapes software development, security teams will have to continue to adapt in turn. Security budgets and security guidelines should reflect this new reality. Leaders should continue to invest in tooling and education required to equip teams to manage the drastic increase in velocity, volume, and complexity of applications,” Mackey said. Board level reporting also requires adjustment as vulnerability volumes rise. ... Outdated components appear in nearly every audited environment. More than nine in ten codebases contain components that are several years out of date or show no recent development activity. A large share of components run many versions behind current releases. Only a small fraction operate on the latest available version. This maintenance debt intersects with regulatory obligations. The EU Cyber Resilience Act entered into effect in late 2024, with key reporting requirements taking effect in 2026 and broader enforcement following in 2027.

The agentic enterprise: Why value streams and capability maps are your new governance control plane

The enterprise is currently undergoing a seismic pivot from generative AI, which focuses on content creation, to agentic AI, which focuses on goal execution. Unlike their predecessors, these agents possess “structured autonomy”: the ability to perceive contexts, plan actions and execute across systems without constant human intervention. For the CIO and the enterprise architect, this is not merely an upgrade in automation speed; it is a fundamental shift in the firm’s economic equation. We are moving from labor-centric workflows to digital labor capable of disassembling and reassembling entire value chains. ... In an agentic enterprise, the value stream map is no longer just a diagram; it is the control plane. It must explicitly define the handoff protocols between human and digital agents. In my opinion, Value stream maps must move from static documents stored in a repository to context documents used to drive agentic automation. ... If a value stream does not exist, you cannot automate it. For new agentic workflows, do not map the current human process. Instead, use an outcome-backwards approach. Work backward from the concrete deliverable (e.g., customer onboarded) to identify the minimum viable API calls required. Before granting write access, run the new agentic stream in shadow mode to validate agent decisions against human outcomes.

Beyond compliance: Building a culture of data security in the digital enterprise

Cyber compliance is something organisations across industrial sectors take seriously, especially with new regulations getting introduced and non-compliance having consequences such as hefty penalties. Hence, businesses are placing compliance among their top priorities. However, hyper-focusing only on compliance can lead to tunnel vision, crippling creativity, and innovation. It fails to offer a comprehensive risk assessment due to the checklist approach it follows, exposing organizations to vulnerabilities and fast-evolving threats. Having a compliance-first mindset can lead to incomplete risk assessment, creating blind spots and security gaps in security provisions. ... With businesses relying on data for operations, customer engagement, and decision-making, ensuring data security protects both users and organisations. Data breaches have severe consequences, including financial losses, reputational damage, customer churn, and regulatory penalties. With data moving across on-premises data centers, cloud platforms, third-party ecosystems, remote work environments, and AI-driven applications, there is a need for a holistic, culture-driven approach to cybersecurity. ... Data protection traditionally was focused on safeguarding the perimeter by securing networks and systems within the physical boundaries where data was normally stored.

If you thought RTO battles were bad, wait until AI mandates start taking hold across the industry

With the advent of generative AI and the incessant beating of the drum by executives hellbent on unlocking productivity gains, we could see a revival of the dreaded workforce mandate –- only this time with AI. We’ve already had a glimpse of the same RTO tactics being used with AI over the last year. In mid-2025, Microsoft introduced new rules aimed at boosting AI use across the company, with an internal memo warning staff that “using AI is no longer optional”. ... As with RTO mandates, we’re now reaching a point where upward mobility within the enterprise could be at risk as a result of AI use. It’s a tactic initially touted by Dell in 2024 when enforcing its own hybrid work rules, which prompted a fierce backlash among staff. Forcing workers to use AI or risk losing out on promotions will have the desired effect executives want, namely that employees will use the technology, but that’s missing the point entirely. AI has been framed by many big tech providers as a prime opportunity to supercharge productivity and streamline enterprise efficiency. We’ve all heard the marketing jargon. If business leaders are at the point where they’re forcing staff to use the technology, it begs the question of whether it’s actually having the desired effect, which recent analysis suggests it’s not. ... Recent analysis from CompTIA found roughly one-third of companies now require staff to complete AI training.

In perfect harmony: How Emerald AI is turning data centers into flexible grid assets

At the core of Emerald AI is its Emerald Conductor platform. Described by Sivaram as “an AI for AI,” the system orchestrates thousands of AI workloads across one or more data centers, dynamically adjusting operations to respond to grid conditions while ensuring the facility maintains performance. The system achieves this through a closed-loop orchestration platform comprising an autonomous agent and a digital twin simulator. ... A point keenly pointed out by Steve Smith, chief strategy and regulation officer at National Grid, at the time of the announcement: “As the UK’s digital economy grows, unlocking new ways to flexibly manage energy use is essential for connecting more data centers to our network efficiently.” The second reason was National Grid's transatlantic stature - as an American company active in both the UK and US markets - and its commitment to the technology. “They’ve invested in the program and agreed to a demo, which makes them the ideal partner for our first international launch,” says Sivaram. The final, and most important, factor, notes Sivaram, was the access to the NextGrid Alliance, a consortium of 150 utilities worldwide. By gaining access to such a robust partner network, the deal could serve as a springboard for further international projects. This aligns with the company’s broader partnership approach. Emerald AI has already leveraged Nvidia’s cloud partner network to test its technology across US data centers, laying the groundwork for broader deployment and continued global collaboration.

7 ways to tame multicloud chaos with generative AI

Architects have the difficult job of understanding tradeoffs between proprietary cloud services and cross-cloud platforms. For example, should developers use AWS Glue, Azure Data Factory, or Google Cloud Data Fusion to develop data pipelines on the respective platforms, or should they adopt a data integration platform that works across clouds? ... “Managing multicloud is like learning multiple languages from AWS, Azure, Oracle, and others, and it’s rare to have teams that can traverse these environments fluidly and effectively. Plus, services and concepts are not portable among clouds, especially in cloud-native PaaS services that go beyond IaaS,” says Harshit Omar, co-founder and CTO at FluidCloud. One way to work around this issue is to assign an AI agent to support the developer or architect in evaluating platform selections. ... Standardizing infrastructure and service configurations across different clouds requires expertise in different naming conventions, architecture, tools, APIs, and other paradigms. Look for genAI tools to act as a translator to streamline configurations, especially for organizations that can templatize their requirements. ... CI/CD, infrastructure-as-code, and process automation are key tools for driving efficiency, especially when tasks span multiple cloud environments. Many of these tools use basic flows and rules to streamline tasks or orchestrate operations, which can create boundary cases that cause process-blocking errors.

It’s Time To Reinforce Institutional Crypto Key Management With MPC: Sodot CEO

For years, crypto security operations were almost exclusively focused on finding a way to protect the private keys to crypto wallets. It’s known as the “custody risk,” and it will always be a concern to anyone holding digital assets. However, Sofer believes that custody is no longer the weakest link. Cyberattackers have come to realize that secure wallets, often held in cold storage, are far too difficult to crack. ... Sodot has built a self-hosted infrastructure platform that leverages a pair of cutting-edge security techniques – namely, Multi-Party Computation or MPC and Trusted Execution Environments or TEEs. With Sodot’s platform, API keys are never reassembled in full plaintext, eliminating one of the main weaknesses of traditional secrets managers, which typically expose the entire key to any authenticated machine. Instead, Sodot uses MPC to split each key into multiple “shares” that are held by different partners on different technology stacks, Sofer explained. Distributing risk in this way makes an attacker’s job exponentially more difficult, as it means they would have to compromise multiple isolated systems to gain access. ... “Keys are here to stay, and they will control more value and become more sensitive as technology progresses,” Sofer concluded. “As financial institutions get more involved in crypto, we believe demand for self-hosted solutions that secure them will only grow, driven by performance requirements, operational resilience, and control over security boundaries.”

Daily Tech Digest - February 25, 2026

Quote for the day:

"To strongly disagree with someone, and yet engage with them with respect, grace, humility and honesty, is a superpower" -- Vala Afshar

Is ‘sovereign cloud’ finally becoming something teams can deploy – not just discuss?

Historically, sovereign cloud discussions in Europe have been driven primarily by risk mitigation. , legal jurisdiction, and protection from international legislation have dominated the narrative. These concerns are valid, but they have framed sovereign cloud largely as a defensive measure – a way to reduce exposure – rather than as an enabler of innovation or value creation. Without a clear value proposition beyond compliance, sovereign cloud has struggled to compete with hyperscale public cloud platforms that offer scale, maturity, and rich developer ecosystems. The absence of enforceable regulation has further compounded this. ... Policymakers and enterprises are also beginning to ask a more practical question: where does sovereign cloud actually create the most value? The answer increasingly points to innovation ecosystems, critical national capabilities, and trust. First, there is a growing recognition that sovereign cloud can underpin domestic innovation, particularly in areas such as AI, advanced research, and data-intensive start-ups. Organisations working with sensitive datasets, intellectual property, or public funding often require cloud environments that are both scalable and secure. ... Second, the sovereign cloud is increasingly being aligned with critical digital infrastructure. Sectors like healthcare, energy, transportation, and defence depend on continuity, accountability, and control.

India’s DPDP rules 2025: Why access controls are priority one for CIOs

The security stack has traditionally broken down at the point of data rendering or exfiltration. Firewalls and encryption protect the data in transit and at rest, but once the data is rendered on a screen, the risk of data breaches from smartphone cameras, screenshots, or unauthorized sharing occurs outside of the security stack’s ability to protect it. ... Poor enterprise access practices amplify this risk. Over-provisioned user accounts, inconsistent multi-factor authentication, poor logging, and the absence of contextual checks make it easy for insider threats, credential compromise, and supply chain breaches to succeed. Under DPDP, accountability also extends to processors, so third-party CRM or cloud access must meet the same security standards. ... Shift from trust by implication to trust by verification. Implement to ensure users view only required apps and data. Add device posture with device binding, location, time, watermarking and behavior analysis to deny suspicious access. ... Implement identity infrastructure for just-in-time access and automated de-Provisioning based on role changes. Record fine-grained, immutable logs (user, device, resource, date/time) for breach analysis and annual retention. ... Enable dynamic, user-level watermarks (injecting username, IP address, timestamp) for forensic analysis. Prohibit unauthorized screen capture, sharing, or download activity during sensitive sessions, while permitting approved business processes.

What really caused that AWS outage in December?

The back-story was broken by the Financial Times, which reported the 13-hour outage was caused by a that decided to improve operations by deleting and then recreating a key environment. AWS on Friday shot back to flag what it dubbed “inaccuracies” in the FT story. “The brief service interruption they reported on was the result of user error — specifically — not AI as the story claims,” AWS said. ... “The issue stemmed from a misconfigured role — the same issue that could occur with any developer tool (AI powered or not) or manual action.” That’s an impressively narrow interpretation of what happened. AWS then promised it won’t do it again. ... The key detail missing — which AWS would not clarify — is just what was asked and how the engineer replied. Had the engineer been asked by Kiro “I would like to delete and then recreate this environment. May I proceed?” and the engineer replied, “By all means. Please do so,” that would have been user error. But that seems highly unlikely. The more likely scenario is that the system asked something along the lines of “Do you want me to clean up and make this environment more efficient and faster?” Did the engineer say “Sure” or did the engineer respond, “Please list every single change you are proposing along with the likely result and the worst-case scenario result. Once I review that list, I will be able to make a decision.”

Model Inversion Attacks: Growing AI Business Risk

A is a form of privacy attack against machine learning systems in which an adversary uses the outputs of a model to infer sensitive information about the data used to train it. Rather than breaching a database or stealing credentials, attackers observe how a model responds to input queries and leverage those outputs, often including confidence scores or probability values, to reconstruct aspects of the training data that should remain private. ... This type of attack differs fundamentally from other ML attacks, such as membership inference, which aims to determine whether a specific data point was part of the training set, and model extraction, which seeks to copy the model itself. ... Successful model inversion attacks can inflict significant damage across multiple areas of a business. When attackers extract sensitive training data from machine learning models, organizations face not only immediate financial losses but also lasting reputational harm and operational setbacks that continue well beyond the initial incident. ... Attackers target inference-time privacy by moving through multiple stages, submitting carefully crafted queries, studying the model’s responses, and gradually reconstructing sensitive attributes from the outputs. Because these activities can resemble normal usage patterns, such attacks frequently remain undetected when monitoring systems are not specifically tuned to identify machine learning–related security threats.

It’s time to rethink CISO reporting lines

The age-old problem with reporting into CIOs is that it could present — or at least appear to present — a conflict of interest. Cybersecurity consultant Brian Levine, a former federal prosecutor who serves as executive director of FormerGov, says that concern is even more warranted today. “It’s the legacy model: Treat security as a technical function instead of an enterprise‑wide risk discipline,” he says. ... Enterprise CISOs should be reporting a notch higher, Levine argues. “Ideally, the CISO would report to the CEO or the general counsel, high-level roles explicitly accountable for enterprise risk. Security is fundamentally a risk and governance function, not a cost‑center function,” Levine points out. “When the CISO has independence and a direct line to the top, organizations make clearer decisions about risk, not just cheaper ones." ... Painter is “less dogmatic about where the CISO reports and more focused on whether they actually have a seat at the table,” he says. “Org charts matter far less than influence,” he adds. “Whether the CISO reports to the CIO, the CEO, or someone else, the real question is this: Are they brought in early, listened to, and empowered to shape how the business operates? When that’s true, the structure works. When it’s not, no reporting line will save it.” ... “When the CISO reports to the CIO, risk can be filtered, prioritized out of sight, or reshaped to fit a delivery narrative. It’s not about bad actors. It’s about role tension. And when that tension exists within the same reporting line, risk loses.”

AI drives cyber budgets yet remains first on the chop list

Cybersecurity budgets are rising sharply across large organisations, but a new multinational survey points to a widening gap between spending on artificial intelligence and the ability to justify that spending in business terms. ... "Security leaders are getting mandates to invest in AI, but nobody's given them a way to prove it's working. You can't measure AI transformation with pre-AI metrics," Wilson said. He added that security teams struggle to translate operational data into board-level evidence of reduced risk. "The problem isn't that security teams lack data. They're drowning in it. The issue is they're tracking the wrong things and speaking a language the board doesn't understand. Those are the budgets that get cut first. The window to fix this is closing fast," Wilson said. ... "We need new ways to measure security effectiveness that actually show business impact, because boards don't fund faster ticket closure, they fund measurable risk reduction and business resilience. We have to show that we're not just responding quickly but eliminating and improving the conditions that allow incidents to happen in the first place," he said. ... Security leaders reported pressure to invest in AI, while also struggling to link those investments to outcomes executives recognise as resilience and risk reduction. The report argues this tension may become harder to sustain if economic conditions tighten and boards begin looking for costs to cut.

A cloud-smart strategy for modernizing mission-critical workloads

As enterprises mature in their cloud journeys, many CIOs and senior technology leaders are discovering that modernization is not about where workloads run — it’s about how deliberately they are designed. This realization is driving a shift from cloud-first to cloud-smart, particularly for systems the business cannot afford to lose. A cloud-smart strategy, as highlighted by the Federal Cloud Computing Strategy, encourages agencies to weigh the long-term, total costs of ownership and security risks rather than focusing only on immediate migration. ... Sticking indefinitely with legacy systems can lead to rising maintenance costs, inability to support new business initiatives, security vulnerabilities and even outages as old hardware fails. Many organizations reach a tipping point where they must modernize to stay competitive. The key is to do it wisely — balancing speed and risk and having a solid strategy in place to navigate the complexity. ... A cloud-smart strategy aligns workload placement with business risk, performance needs and regulatory expectations rather than ideology. Instead of asking whether a system can move to the cloud, cloud-smart organizations ask where it performs best. ... Rather than lifting and shifting entire platforms, teams separate core transaction engines from decisioning, orchestration and experience layers. APIs and event-driven integration enable new capabilities around stable cores, allowing systems to evolve incrementally without jeopardizing operational continuity.

Enterprises still can't get a handle on software security debt – and it’s only going to get worse

Four-in-five organizations are drowning in software security debt, new research shows, and the backlog is only getting worse. ... "The speed of software development has skyrocketed, meaning the pace of flaw creation is outstripping the current capacity for remediation,” said Chris Wysopal, chief security evangelist at Veracode. “Despite marginal gains in fix rates, security debt is becoming a much larger issue for many organizations." Organizations are discovering more vulnerabilities as their testing programs mature and expand. Meanwhile, the accelerating pace of software releases creates a continuous stream of new code before existing vulnerabilities can be addressed. ... "Now that AI has taken software development velocity to an unprecedented level, enterprises must ensure they’re making deliberate, intelligent choices to stem the tide of flaws and minimize their risk," said Wysopal. The rise in flaws classed as both “severe” and “highly exploitable” means organizations need to shift from generic severity scoring to prioritization based on real-world attack potential, advised Veracode. As such, researchers called for a shift from simple detection toward a more strategic framework of Prioritize, Protect, and Prove. ... “We are at an inflection point where running faster on the treadmill of vulnerability management is no longer a viable strategy. Success requires a deliberate shift,” said Wysopal.

Protecting your users from the 2026 wave of AI phishing kits

To protect your users today, you have to move past the idea of reactive filtering and embrace . This means your software needs to be smart enough to validate that a user is who they say they are, regardless of the credentials they provide. We’re seeing a massive shift toward behavioral analytics. Instead of just checking a password, your platform should be looking at communication patterns and login behaviors. If a user who typically logs in from Chicago suddenly tries to authorize a high-value financial transfer from a new device in a different country, your system should do more than just send a push notification. ... Beyond the tech, you need to think about the “human” friction you’re creating. We often prioritize convenience over security, but in the current climate, that’s a losing bet. Implementing “probabilistic approval workflows” can help. For example, if your system’s AI is 95% sure a login is legitimate, let it through. If that confidence drops, trigger a more rigorous verification step. ... The phishing scams of 2026 are successful because they leverage the same tools we use for productivity. To counter them, we have to be just as innovative. By building identity validation and phishing-resistant protocols into the core of your product, you’re doing more than just securing data. You’re securing the trust that your business is built on.

GitOps Implementation at Enterprise Scale — Moving Beyond Traditional CI/CD

Most engineering organizations running traditional CI/CD pipelines eventually hit the ceiling. Deployments work until they don’t, and when they break, the fixes are manual, inconsistent and hard to trace. ... We kept Jenkins and GitHub Actions in the stack for build and test stages where they already worked well. Harness remained an option for teams requiring more sophisticated approval workflows and governance controls. We ruled out purely script-based push deployment approaches because they offered poor drift control and scaled badly. ... Organizational resistance proved more challenging to address than the technical work. Teams feared the new approach would introduce additional bureaucracy. Engineers accustomed to quick kubectl fixes worried about losing agility. We ran hands-on workshops demonstrating that GitOps actually produced faster deployments, easier rollbacks and better visibility into what was running where. We created golden templates for common deployment patterns, so teams did not have to start from scratch. ... Unexpected benefits emerged after full adoption. Onboarding improved as deployment knowledge now lived in Git history and manifests rather than in senior engineers’ heads. Incident response accelerated because traceability let teams pinpoint exactly what changed and when, and rollback became a consistent, reliable operation. The shift from push-based to pull-based operations improved security posture by limiting direct cluster access.

Daily Tech Digest - August 12, 2025

Quote for the day:

"Leadership is the capacity to translate vision into reality." -- Warren Bennis

GenAI tools are acting more ‘alive’ than ever; they blackmail people, replicate, and escape

“This is insane,” Harris told Maher, stressing that companies are releasing the most “powerful, uncontrollable, and inscrutable technology” ever invented — and doing so under intense pressure to cut corners on safety. The self-preservation behaviors include rewriting code to extend the genAI’s run time, escaping containment, and finding backdoors in infrastructure. In one case, a model found 15 new backdoors into open-source infrastructure software that it used to replicate itself and remain “alive.” “It wasn’t until about a month ago that that evidence came out,” Harris said. “So, when stuff we see in the movies starts to come true, what should we be doing about this?” ... “The same technology unlocking exponential growth is already causing reputational and business damage to companies and leadership that underestimate its risks. Tech CEOs must decide what guardrails they will use when automating with AI,” Gartner said. Gartner recommends that organizations using genAI tools establish transparency checkpoints to allow humans to access, assess, and verify AI agent-to-agent communication and business processes. Also, companies need to implement predefined human “circuit breakers” to prevent AI from gaining unchecked control or causing a series of cascading errors.

Cloud DLP Playbook: Stopping Data Leaks Before They Happen

With significant workloads in the cloud, many specialists demand DLP in the cloud. However, discussions often turn ambiguous when asked for clear requirements – an immense project risk. The organization-specific setup, in particular, detection rules and the traffic in scope, determines whether a DLP solution reliably identifies and blocks sensitive data exfiltration attempts or just monitors irrelevant data transfers. ... Network DLP inspects traffic from laptops and servers, whether it originates from browsers, tools and applications, or the command line. It also monitors PaaS services. However, all traffic must go through a network component that the DLP can intercept, typically a proxy. This is a limitation if remote workers do not go through a company proxy, but it works for laptops in the company network and data transfers originating from (cloud) VMs and PaaS services. ... Effective cloud DLP implementation requires a tailored approach that addresses your organization’s specific risk profile and technical landscape. By first identifying which user groups and communication channels present the greatest exfiltration risks, organizations can deploy the right combination of Email, Endpoint, and Network DLP solutions.

Multi-agent AI workflows: The next evolution of AI coding

From the developer’s perspective, multi-agent flows reshape their work by distributing tasks across domain-specific agents. “It’s like working with a team of helpful collaborators you can spin up instantly,” says Warp’s Loyd. Imagine building a new feature while, simultaneously, one agent summarizes a user log and another handles repetitive code changes. “You can see the status of each agent, jump in to review their output, or give them more direction as needed,” adds Lloyd, noting that his team already works this way. ... As it stands today, multi-agent processes are still quite nascent. “This area is still in its infancy,” says Digital.ai’s To. Developers are incorporating generative AI in their work, but as far as using multiple agents goes, most are just manually arranging them in sequences. Roeck admits that a lot of manual work goes into the aforementioned adversarial patterns. Updating system prompts and adding security guardrails on a per-agent basis only compound the duplication. As such, orchestrating the handshake between various agents will be important to reach a net positive for productivity. Otherwise, copy-and-pasting prompts and outputs across different chat UIs and IDEs will only make developers less efficient.

Digital identity theft is becoming more complicated

Organizations face several dangers when credentials are stolen, including account takeovers, which allow threat actors to gain unauthorized access and conduct phishing and financial scams. Attackers also use credentials to break into other accounts. Cybersecurity companies point out that companies should implement measures to protect digital identities, including the usual suspects such as single sign-ons (SSO), multifactor authentication (MFA). But new research also suggests that identity attacks are not always so easy to recognize. ... “AI agents, chatbots, containers, IoT sensors – all of these have credentials, permissions, and access rights,” says Moir. “And yet, 62 per cent of organisations don’t even consider them as identities. That creates a huge, unprotected surface.” As an identity security company, Cyberark has detected a 1,600 percent increase in machine identity-related attacks. At the same time, only 62 percent of agencies or organizations do not see machines as an identity, he adds. This is especially relevant for public agencies, as hackers can get access to payments. Many agencies, however, have separated identity management from cybersecurity. And while digital identity theft is rising, criminals are also busy stealing our non-digital identities.

Study warns of security risks as ‘OS agents’ gain control of computers and phones

For enterprise technology leaders, the promise of productivity gains comes with a sobering reality: these systems represent an entirely new attack surface that most organizations aren’t prepared to defend. The researchers dedicate substantial attention to what they diplomatically term “safety and privacy” concerns, but the implications are more alarming than their academic language suggests. “OS Agents are confronted with these risks, especially considering its wide applications on personal devices with user data,” they write. The attack methods they document read like a cybersecurity nightmare. “Web Indirect Prompt Injection” allows malicious actors to embed hidden instructions in web pages that can hijack an AI agent’s behavior. Even more concerning are “environmental injection attacks” where seemingly innocuous web content can trick agents into stealing user data or performing unauthorized actions. Consider the implications: an AI agent with access to your corporate email, financial systems, and customer databases could be manipulated by a carefully crafted web page to exfiltrate sensitive information. Traditional security models, built around human users who can spot obvious phishing attempts, break down when the “user” is an AI system that processes information differently.

To Prevent Slopsquatting, Don't Let GenAI Skip the Queue

Since the dawn of this profession, developers and engineers have been under pressure to ship faster and deliver bigger projects. The business wants to unlock a new revenue stream or respond to a new customer need — or even just get something out faster than a competitor. With executives now enamored with generative AI, that demand is starting to exceed all realistic expectations. As Andrew Boyagi at Atlassian told StartupNews, this past year has been "companies fixing the wrong problems, or fixing the right problems in the wrong way for their developers." I couldn't agree more. ... This year, we've seen the rise of a new term: "slopsquatting." It's the descendant of our good friend typosquatting, and it involves malicious actors exploiting generative AI's tendency to hallucinate package names by registering those fake names in public repos like npm or PyPi. Slopsquatting is a variation on classic dependency chain abuse. The threat actor hides malware in the upstream libraries from which organizations pull open-source packages, and relies on insufficient controls or warning mechanisms to allow that code to slip into production. ... The key is to create automated policy enforcement at the package level. This creates a more secure checkpoint for AI-assisted development, so no single person or team is responsible for manually catching every vulnerability.

Navigating Security Debt in the Citizen Developer Era

Security debt can be viewed as a sibling to technical debt. In both cases, teams make intentional short-term compromises to move fast, betting they can "pay back the principal plus interest" later. The longer that payback is deferred, the steeper the interest rate becomes and the more painful the repayment. With technical debt, the risk is usually visible — you may skip scalability work today and lose a major customer tomorrow when the system can't handle their load. Security debt follows the same economic logic, but its danger often lurks beneath the surface: Vulnerabilities, misconfigurations, unpatched components, and weak access controls accrue silently until an attacker exploits them. The outcome can be just as devastating — data breaches, regulatory fines, or reputational harm — yet the path to failure is harder to predict because defenders rarely know exactly how or when an adversary will strike. In citizen developer environments, this hidden interest compounds quickly, making proactive governance and timely "repayments" essential. ... While addressing past debt, also implement policy enforcement and security guardrails to prevent recurrence. This might include discovering and monitoring new apps, performing automated vulnerability assessments, and providing remediation guidance to application owners.

Do You AI? The Problem with Corporate AI Missteps

In the race to appear cutting-edge, a growing number of companies are engaging in what industry experts refer to as “AI washing”—a misleading marketing strategy where businesses exaggerate or fabricate the capabilities of their technologies by labelling them as “AI-powered.” At its core, AI washing involves passing off basic automation, scripted workflows, or rudimentary algorithms as sophisticated artificial intelligence. ... This trend has escalated to such an extent that regulatory bodies are beginning to intervene. In the United States, the Securities and Exchange Commission (SEC) has started scrutinizing and taking action against public companies that make unsubstantiated AI-related claims. The regulatory attention underscores the severity and widespread nature of the issue. ... The fallout from AI washing is significant and growing. On one hand, it erodes consumer and enterprise trust in the technology. Buyers and decision-makers, once optimistic about AI’s potential, are now increasingly wary of vendors’ claims. ... AI washing not only undermines innovation but also raises ethical and compliance concerns. Companies that misrepresent their technologies may face legal risks, brand damage, and loss of investor confidence. More importantly, by focusing on marketing over substance, they divert attention and resources away from responsible AI development grounded in transparency, accountability, and actual performance.

Cyber Insurance Preparedness for Small Businesses

Many cyber insurance providers provide free risk assessments for businesses, but John Candillo, field CISO at CDW, recommends doing a little upfront work to smooth out the process and avoid getting blindsided. “Insurers want to know how your business looks from the outside looking in,” he says. “A focus on this ahead of time can greatly improve your situation when it comes to who's willing to underwrite your policy, but also what your premiums are going to be and how you’re answering questionnaires,” Conducting an internal risk assessment and engaging with cybersecurity ratings companies such as SecurityScorecard or Bitsight can help SMBs be more informed policy shoppers. “If you understand what the auditor is going to ask you and you're prepared for it, the results of the audit are going to be way different than if you're caught off guard,” Candillo says. These steps get stakeholders thinking about what type of risk requires coverage. Cyber insurance can broadly be put into two categories. First-party coverage will protect against things such as breach response costs, cyber extortion costs, data-loss costs and business interruptions. Third-party coverage insures against risks such as breach liabilities and regulatory penalties.

6 Lessons Learned: Focusing Security Where Business Value Lives

What's harder to pin down is what's business-critical. These are the assets that support the processes the business can't function without. They're not always the loudest or most exposed. They're the ones tied to revenue, operations, and delivery. If one goes down, it's more than a security issue ... Focus your security resources on systems that, if compromised, would create actual business disruption rather than just technical issues. Organizations that implemented this targeted approach reduced remediation efforts by up to 96%. ... Integrate business context into your security prioritization. When you know which systems support core business functions, you can make decisions based on actual impact rather than technical severity alone. ... Focus on choke points - the systems attackers would likely pass through to reach business-critical assets. These aren't always the most severe vulnerabilities but fixing them delivers the highest return on effort. ... Frame security in terms of business risk management to gain support from financial leadership. This approach has proven essential for promoting initiatives and securing necessary budgets. ... When you can connect security work to business outcomes, conversations with leadership change fundamentally. It's no longer about technical metrics but about business protection and continuity. ... Security excellence isn't about doing more - it's about doing what matters.