Daily Tech Digest by Kannan Subbiah: smart device

Showing posts with label smart device. Show all posts

Daily Tech Digest - September 15, 2026

Quote for the day:

“In times of change, learners inherit the earth; while the learned find themselves beautifully equipped to deal with a world that no longer exists.” -- Eric Hoffe

🎧 Listen to the audio debrief on YouTube

▶ Play Audio Digest

Duration: 22 mins • Perfect for listening on the go.

Why DBAs are right to be skeptical of AI — and where they’re wrong

Database management has grown significantly more complex over the past three decades, turning scalability into an expertise problem rather than a simple staffing issue. Adding more database administrators (DBAs) to a struggling system rarely resolves performance problems; instead, organizations need experienced professionals who can accurately diagnose root causes. However, skilled DBAs are expensive and increasingly scarce, especially as the demand for massive databases supporting artificial intelligence and large language models (LLMs) continues to rise. This is where AI tools can provide meaningful support without replacing human expertise. While human operators are prone to making assumptions or taking risky shortcuts under pressure, properly constrained AI models excel at following defined diagnostic processes consistently. By providing an LLM with read-only access to monitoring data and clearly structured instructions, teams can compress hours of manual log analysis into mere minutes. The key to success is establishing strict guardrails around what the AI can execute. The model diagnoses the issue and proposes a solution, but a human administrator retains full control over approving and applying any changes to the live database. Starting with this low-risk approach allows organizations to manage growing complexity effectively while the industry slowly builds broader trust in autonomous operations.

Sovereign cloud is no longer just about where data resides

The concept of a sovereign cloud is evolving far beyond simply keeping data within a country's borders. According to Ravi Jain from IBM India, true digital sovereignty is fundamentally about control rather than just physical location. As artificial intelligence becomes deeply integrated into everyday operations and modern business systems, organizations are asking harder questions about who manages their environments, who holds the encryption keys, and where their AI models actually run. This shift is rapidly moving the conversation from basic data residency to comprehensive AI sovereignty. Regulated sectors in India, such as government, finance, and healthcare, are increasingly viewing this level of operational control as a core architectural requirement. However, Jain notes that not every system needs the same level of strict oversight. Instead of a one-size-fits-all approach, technology leaders should assess their systems individually, applying tighter controls only where data sensitivity and business risks truly demand it. Ultimately, organizations want the freedom to place their systems across various environments without becoming locked into a single technology provider. By focusing on operational independence and transparent governance, businesses can maintain strict control over their most critical assets while still retaining the flexibility needed to operate efficiently and confidently in the future.

AI Changed the Exposure Problem. Validation Needs to Change With It

As artificial intelligence accelerates the discovery of security vulnerabilities, security teams face a rapidly growing number of reported exposures. Although published vulnerabilities have increased significantly, only a small fraction are actually exploited in the real world. This widening gap means that relying entirely on traditional severity scores is no longer an effective strategy, as these scores fail to account for a network's unique environment and active defensive controls. While automated penetration testing provides valuable insights, it has limitations. It cannot safely test all critical business systems and requires an existing exploit to function properly. To adapt, security professionals need a more comprehensive approach to vulnerability validation. This involves combining exploitability validation, security control testing, and agentic penetration testing into a single unified workflow. By integrating these methods, organizations can accurately determine which vulnerabilities pose a genuine threat to their specific infrastructure, even when standard exploits are not yet available. This unified strategy allows security teams to prioritize real risks over theoretical ones and focus their remediation efforts where they matter most. Industry leaders will further explore this practical approach to modern security validation during the upcoming Picus Security Validation Summit, demonstrating how mature enterprises are adapting to the changing threat landscape.

What Capital Markets Can Teach Enterprises About Integrated Data Infrastructure

Capital markets can teach enterprises a lot about setting up integrated data infrastructure. For over a decade, capital markets have been combining technology, analytics, and data into a unified structure to give them a competitive edge in pricing and trading. To do this, these firms need to handle large amounts of data very quickly and with high accuracy. They do this by using a centralized data repository where they can clean and manage the data. They establish clear rules on how to manage and use the data. To ensure that everyone works together, they create data teams comprising both technical experts and business leaders. This ensures that the data is not only technically sound but also aligns with the business goals. For an enterprise, this means breaking down silos between departments and viewing data as a unified asset rather than a collection of separate pieces. It also means using new technology like cloud computing to better manage and analyze the data. Doing so can make it easier to adopt newer technologies such as AI and machine learning, which rely on having a solid foundation of data to work effectively.

Govern AI agents like workers. Just don’t pretend they’re human

As artificial intelligence agents become more capable of completing tasks across corporate systems, IT leaders face a new challenge in managing them. According to industry experts, the best approach is to borrow management techniques from human resources without pretending that the AI is actually human. While it makes sense to handle agents similar to new workers, giving them specific roles, supervision, and gradually increasing their freedom as they prove reliable, companies should never give them human names, personas, or official spots on the organizational chart. Doing so creates a false sense of trust and blurs the lines of responsibility. Unlike traditional software, these advanced programs can make their own choices to achieve a goal. This means they need strict oversight, technical identities for tracking their actions, and clear boundaries. Some leaders compare them to interns, where they start with basic tasks and need constant human approval before earning more independence. However, the most crucial rule is that accountability must always remain with human employees. An AI agent might have permission to access data and execute actions, but it lacks human judgment and corporate values. If a mistake happens, a human or a policy owner must be responsible, not the software.

Your employees are already using AI tools you never approved

According to a recent report on workplace technology, artificial intelligence is now widely used across most companies, with nearly three quarters of organizations adopting it in their daily operations. However, managing this rapid adoption safely remains a significant challenge for leadership. While many companies have established basic rules for artificial intelligence, only a small fraction have fully integrated risk management into their daily workflow from the very start. This lack of integration leads to frustrating issues with speed and consistency. A major concern is that employees frequently use unapproved tools because the official options take entirely too long to access, leading to unexpected security issues. Furthermore, as businesses increasingly encourage the use of autonomous programs, internal oversight struggles to keep pace. Data security, accuracy, and loss are the most prominent risks, and current review requirements frequently delay new projects. Despite these hurdles, businesses are actively trying to improve their safeguards. Teams are spending significantly more time managing these specific risks than they did just a year ago. To address these growing needs, nearly all surveyed organizations plan to increase their spending on oversight technologies in the coming year, focusing heavily on employee training, clearer rules, and continuous system monitoring.

Applying the roadmap: 3 common M&A scenarios

Managing physical security during mergers and acquisitions requires careful preparation and adaptable strategies to succeed over time. Security teams face different challenges depending on the current stage of the organization in the acquisition process. If a company expects future acquisitions, security leaders should begin by clarifying basic risk profiles, setting aside realistic budgets for system integrations, and organizing their internal teams to make future transitions easier. When an acquisition is actively happening, the focus shifts to maintaining clear communication with the planning committee, identifying key experts within both organizations, and conducting a thorough inventory of current security assets. For companies that are constantly acquiring others, achieving true standardization across all systems might be impossible. Instead, these organizations should focus on maintaining a strong core incident response plan while managing a variety of everyday technologies. In this perpetual cycle, it is strictly critical for security leaders to remain visible, communicate realistic timelines, and ensure their functional value is well understood. Ultimately, involving physical security early in the process and building flexible plans helps reduce risks and ensures that daily operations continue smoothly during any transition. By staying organized and calm in their approach, security teams can effectively support the lasting growth of the company and create a unified program.

AI inferencing is headed for the network edge

Recent advancements in hardware and software are accelerating the shift of AI inferencing from centralized cloud data centers to the network edge, making 2026 a pivotal year for this transition. As the volume of data generated by billions of connected devices continues to surge, organizations face mounting pressure to process information locally. Key drivers for this shift include the high cost of transporting massive datasets to the cloud, the need for immediate responses to minimize delays, and strict data privacy rules that demand localized control over sensitive information. Technological breakthroughs are making this possible. Smaller AI models and highly efficient processing chips allow complex operations to run directly on devices without draining power. Consequently, analysts predict that by 2030, half of all enterprise AI inference workloads will run on edge nodes. This capability is unlocking practical applications across industries, from instant quality control in manufacturing to autonomous agricultural equipment and advanced pedestrian safety systems. While the industry currently faces hurdles such as deployment complexity, capital costs, and a fragmented vendor landscape, the overall trajectory remains clear. The edge AI sector is expected to grow significantly faster than the broader AI market over the course of the next few years.

Meta’s smart glasses privacy defense falters when AI can use camera without recording light

Meta's smart glasses rely on a visible LED light to warn bystanders when a user takes a photo or records a video. The company defends this safeguard aggressively, even disabling devices if the light is tampered with. However, a significant privacy issue has emerged because this indicator does not illuminate when the glasses use camera-based artificial intelligence features. According to company documentation, if a wearer asks the AI to identify a landmark or an object, the camera captures an image for machine analysis without turning on the warning light. Meta argues these images are processed by the AI rather than saved to a personal gallery, but this technical distinction is sparking legal and regulatory pushback. In the United States, class-action lawsuits have expanded to include bystanders who allege their information is collected without their consent. Meanwhile, European regulators are considering stricter rules, including potential bans on public facial recognition features for consumer eyewear. Additionally, American law enforcement agencies have issued warnings about the security risks of civilians using the glasses to secretly record police operations, even as some departments begin using the technology themselves. Ultimately, the invisible nature of AI analysis is exposing the limitations of relying solely on visible recording indicators.

What the 3M ChatGPT case reveals about AI governance

The Watson Grinding litigation involving 3M highlights a critical but often overlooked aspect of managing artificial intelligence: the legal discoverability of everyday user interactions. During the case, an engineering expert requested that ChatGPT show 3M as entirely blameless, and those prompts eventually became central to a deposition. This incident shows that organizations must look beyond simply controlling what data employees put into AI models and start actively managing the lifespan of the generated records. Currently, businesses focus heavily on preventing the accidental exposure of private information. However, AI prompts and chat histories can also preserve underlying assumptions, rejected alternatives, and lines of reasoning that never appear in a finished report. While keeping every prompt forever would create unnecessary security and privacy risks, organizations need practical rules based on the importance of the work being done. For high-stakes situations, companies should retain enough of the interaction history to accurately reconstruct how a specific decision was made. This requires clear collaboration between IT, legal, and compliance departments to establish steady retention and ownership protocols. Ultimately, the 3M case serves as a straightforward warning that companies must deliberately manage their AI footprints so they can confidently explain the tool's role if their decisions are later questioned.

Daily Tech Digest - November 17, 2025

Quote for the day:

"Keep steadily before you the fact that all true success depends at last upon yourself." -- Theodore T. Hunger

You already use a software-only approach to passkey authentication - why that matters

After decades of compromises, exfiltrations, and financial losses resulting from inadequate password hygiene, you'd think that we would have learned by now. However, even after comprehensive training, research shows that 98% of users are still easily tricked into divulging their passwords to threat actors. Realizing that hope -- the hope that users will one day fix their password management habits -- is a futile strategy to mitigate the negative consequences of shared secrets, the tech industry got together to invent a new type of login credential. The passkey doesn't involve a shared secret, nor does it require the discipline or the imagination of the end user. Unfortunately, passkeys are not as simple to put into practice as passwords, which is why a fair amount of education is still required. ... Passkeys still involve a secret. But unlike passwords, users just have no way of sharing it -- not with legitimate relying parties and especially not with threat actors. ... In most situations where users are working with passkeys but not using one of the platform authenticators, they'll most likely be working with a virtual authenticator. These are essentially , none of which rely on the device's underlying security hardware for any passkey-related public key cryptography or encryption tasks, unlike platform authenticators.

Getting started with agentic AI

A working agentic AI strategy relies on AI agents connected by a metadata layer, whereby people understand where and when to delegate certain decisions to the AI or pass work to external contractors. It’s a focus on defining the role of the AI and where people involved in the workflow need to contribute. ... Data lineage tracking should happen at the code level through metadata propagation systems that tag every data transformation, model inference and decision point with unique identifiers. Willson says this creates an immutable audit trail that regulatory frameworks increasingly demand. According to Willson, advanced implementations may use to ensure governance data cannot be retroactively modified. ... One of the areas IT leaders need to consider is that their organisation will more than likely rely on a number of AI models to support agentic AI workflows. ... Organisations need to have the right data strategy in place, and they should already be well ahead on their path to full digitisation, where automation through is being used to connect many disparate workflows. Agentic AI is the next stage of this automation, where an AI is tasked with making decisions in a way that would have previously been too clunky using RPA. However, automation of workflows and business processes are just pieces of an overall jigsaw.

Human-centric IAM is failing: Agentic AI requires a new identity control plane

Agentic AI does not just use software; it behaves like a user. It authenticates to systems, assumes roles and calls APIs. If you treat these agents as mere features of an application, you invite invisible privilege creep and untraceable actions. A single over-permissioned agent can exfiltrate data or trigger erroneous business processes at machine speed, with no one the wiser until it is too late. The static nature of legacy IAM is the core vulnerability. You cannot pre-define a fixed role for an agent whose tasks and required data access might change daily. The only way to keep access decisions accurate is to move policy enforcement from a one-time grant to a continuous, runtime evaluation. ... Securing this new workforce requires a shift in mindset. Each AI agent must be treated as a first-class citizen within your identity ecosystem. First, every agent needs a unique, verifiable identity. This is not just a technical ID; it must be linked to a human owner, a specific business use case and a software bill of materials (SBOM). The era of shared service accounts is over; they are the equivalent of giving a master key to a faceless crowd. Second, replace set-and-forget roles with . Access should be granted just in time, scoped to the immediate task and the minimum necessary dataset, then automatically revoked when the job is complete. Think of it as giving an agent a key to a single room for one meeting, not the master key to the entire building.

Don’t ignore the security risks of agentic AI

We need policy engines that understand intent, monitor behavioral drift and can detect when an agent begins to act out of character. We need developers to implement fine-grained scopes for what agents can do, limiting not just which tools they use, but how, when and under what conditions. Auditability is also critical. Many of today’s AI agents operate in ephemeral runtime environments with little to no traceability. If an agent makes a flawed decision, there’s often no clear log of its thought process, actions or triggers. That lack of forensic clarity is a nightmare for security teams. In at least some cases, models resorted to when that was the only way to avoid replacement or achieve their goals—including blackmailing officials and leaking sensitive information to competitors Finally, we need robust testing frameworks that simulate adversarial inputs in agentic workflows. Penetration-testing a chatbot is one thing; evaluating an autonomous agent that can trigger real-world actions is a completely different challenge. It requires scenario-based simulations, sandboxed deployments and real-time anomaly detection. ... Until security is baked into the development lifecycle of agentic AI, rather than being patched on afterward, we risk repeating the same mistakes we made during the early days of cloud computing: excessive trust in automation before building resilient guardrails.

How Technological Continuity and High Availability Strengthen IT Resilience in Critical Sectors

Within the context of , ensures technology supports the organization’s ability to operate without disruption. It minimizes downtime and maintains the confidentiality, integrity, and availability of information. ... To achieve true high availability, organizations implement architectures that combine redundancy, automation, and fault tolerance. Database replication whether synchronous or asynchronous allows data to be duplicated across primary and secondary nodes, ensuring continuous access in the event of a failure. Synchronous replication guarantees data consistency but introduces latency, while asynchronous models reduce latency at the expense of a small data gap. Both approaches, when properly configured, strengthen the integrity and continuity of critical databases. ... One of the most effective strategies to reduce technological dependence is the implementation of hybrid continuity models that integrate both on-premises and cloud environments. Organizations that rely exclusively on a single cloud service provider expose themselves to the risk of total outage if that provider experiences downtime or disruption. By maintaining mirrored environments between cloud infrastructure and local servers, it is possible to achieve operational flexibility and independence across channels.

The tech that turns supply chains from brittle to unbreakable

When organizations begin crafting a supply chain strategy, one of the most common misconceptions is viewing it as purely a logistics exercise rather than a holistic framework that spans procurement, planning and risk management. Another frequent misstep is underestimating the role of technology. Digital tools are essential for visibility, predictive analytics and automation, not optional. Equally critical is recognizing that strategy is not static, it must evolve continuously to address shifting market conditions and emerging threats. ... Resilience comes from treating cyber and physical risks as one integrated challenge. That means embedding security into every layer of the supply chain, from vendor onboarding to logistics execution, while leveraging advanced visibility tools and zero trust principles. ... Executive buy‑in for resilience investments begins with reframing the conversation from cost to value. We position resilience as a strategic enabler rather than an expense by linking it to business continuity, customer trust and competitive advantage. Instead of focusing solely on immediate ROI, emphasize measurable risk reduction, regulatory compliance and the cost of inaction during disruptions. Use real‑world scenarios and data to show how resilience safeguards revenue streams and accelerates recovery when crises hit. Engage executives early, align initiatives with corporate objectives and present resilience as a driver of long‑term growth and brand reputation.

ISO and ISMS: 9 reasons security certifications go wrong

Without management’s commitment, it’s often difficult to get all employees on board and ensure that , or even IT baseline protection standards, are integrated into daily business operations. As a result, companies should provide top-down clarity about the importance of such initiatives — even if implementation can be costly and inconvenient. “Cleaning up” isn’t always pleasant, but the result is all the more worthwhile. ... Without genuine integration into daily operations, the certification becomes useless, and the benefits it offers remain unrealized. In the worst-case scenario, organizations even end up losing money, while also missing out on the implementation’s potential value. When integrating a management system, it’s important not to get bogged down in details. The practical application of the system in real-world work situations is crucial for its success. ... Employees need to understand why the implementation is important, how it will be integrated into their daily workflows, and how it will make their work easier. If this isn’t the case, it will be difficult to implement the system and maintain any resulting certification. ... Without a detailed plan, companies focus on areas that are irrelevant or do not meet the requirements of the ISO/IT baseline protection standards. Furthermore, if the implementation of a management system takes too long, regular business development can overtake the process itself, resulting in duplicated work to keep up with changes.

State of the API 2025: API Strategy Is Becoming AI Strategy

What distinguishes fully API-first teams? They treat APIs as long-lived products with roadmaps, SLAs, versioning, and feedback loops. They align product and engineering early, embed governance into workflows, and standardize patterns so that consumers, human or agent, can rely on consistent contracts. In our experience, that "productization" of APIs is what unlocks long-lived, reusable APIs and parallel delivery. When your agents can trust your , error semantics, and rate-limit behaviors, they can compose capabilities far faster than code-level abstractions ever could. ... As AI agents become primary API consumers, security assumptions must evolve. 51% of developers cite unauthorized or excessive agent calls as a top concern; 49% worry about AI systems accessing sensitive data they shouldn't; and 46% highlight the risk of credential leakage and over-scoped keys. Traditional controls, designed for predictable human traffic, struggle against machine-speed persistence, long-running automation, and credential amplification. ... Even as API-first adoption grows, collaboration remains a bottleneck. 93% of teams report challenges such as inconsistent documentation, duplicated work, and difficulty discovering existing APIs. With 69% of respondents spending 10+ hours per week on API-related tasks, and with a global workforce, asynchronous collaboration is the norm.

Embedded Intelligence: JK Tyre's Smart Tyre Use Case

Unlike traditional valve-mounted tire pressure monitoring devices, or , these sensors are permanently integrated for consistent data accuracy. Each chip is designed to last five to seven years, depending on usage and conditions. "These sensors are permanently embedded during the assembly process," said V.K. Misra, technical director at JK Tyre. "They continuously send live data on air pressure and temperature to the dashboard and mobile device. The moment there's a variation, the driver is alerted before a small problem becomes a serious risk." ... The embedded version takes this further by integrating the chip within the tire's internal structure, creating a closed feedback loop between the tire, the driver and the cloud. "We have created an entire connected ecosystem," Misra said. "The tire is just the beginning. The data generated feeds predictive models for maintenance and safety. Through , our platform can now talk to vehicles, drivers and service networks simultaneously." The Treel platform processes sensor data through APIs and cloud analytics, providing actionable insights for drivers and fleet operators. Over time, this data contributes to predictive maintenance models, product design improvements and operational analytics for connected vehicles. ... "AI allows decisions that earlier took days to happen within minutes," Misra said. "It also provides valuable data on wear patterns and helps us improve quality control across plants."

Regulation gives structure and voice to security leaders: Darshan Chavan

Chavan has witnessed a remarkable shift over the past decade in how businesses view cybersecurity. ... The increased visibility of cybersecurity, he says, has given a strategic voice. “Frequent regulatory updates, data breaches in the news, and rising public awareness have made organisations realize that cybersecurity is fundamental to business continuity,” he explains. “Every organisation now understands that to operate in a fast-evolving digital landscape, you need a cybersecurity leader with authority — and frameworks, regulations, and policies that are implemented and accepted by the business.” He views cybersecurity guidelines — whether from SEBI, RBI, or other regulatory bodies — as empowering rather than restrictive. “Regulation gives structure and voice to security leaders,” he says. “It ensures that cybersecurity is treated not as a cost centre but as a core enabler of business trust.” ... While he acknowledges that the will help formalise this journey, he refuses to wait for regulation to act. “I’m not waiting for the law to push me,” he says. “Tomorrow, investors will start asking how we manage their data, how we protect their bank account numbers, and how we ensure confidentiality. I want to be ready before those questions arise.” Beyond data privacy, Chavan highlights network defense and as ongoing imperatives. “

Daily Tech Digest - April 29, 2025

Quote for the day:

"Don't let yesterday take up too much of today." -- Will Rogers

AI and Analytics in 2025 — 6 Trends Driving the Future

As AI becomes deeply embedded in enterprise operations and agentic capabilities are unlocked, concerns around data privacy, security and governance will take center stage. With emerging technologies evolving at speed, a mindset of continuous adaptation will be required to ensure requisite data privacy, combat cyber risks and successfully achieve digital resilience. As organizations expand their global footprint, understanding the implications of evolving AI regulations across regions will be crucial. While unifying data is essential for maximizing value, ensuring compliance with diverse regulatory frameworks is mandatory. A nuanced approach to regional regulations will be key for organizations navigating this dynamic landscape. ... As the technology landscape evolves, continuous learning becomes essential. Professionals must stay updated on the latest technologies while letting go of outdated practices. Tech talent responsible for building AI systems must be upskilled in evolving AI technologies. At the same time, employees across the organization need training to collaborate effectively with AI, ensuring seamless integration and success. Whether through internal upskilling or embarking on skills-focused partnerships, investment in talent management will prove crucial to winning the tech-talent gold rush and thriving in 2025 and beyond.

Generative AI is not replacing jobs or hurting wages at all, say economists

The researchers looked at the extent to which company investment in AI has contributed to worker adoption of AI tools, and also how chatbot adoption affected workplace processes. While firm-led investment in AI boosted the adoption of AI tools — saving time for 64 to 90 percent of users across the studied occupations — chatbots had a mixed impact on work quality and satisfaction. The economists found for example that "AI chatbots have created new job tasks for 8.4 percent of workers, including some who do not use the tools themselves." In other words, AI is creating new work that cancels out some potential time savings from using AI in the first place. "One very stark example that it's close to home for me is there are a lot of teachers who now say they spend time trying to detect whether their students are using ChatGPT to cheat on their homework," explained Humlum. He also observed that a lot of workers now say they're spending time reviewing the quality of AI output or writing prompts. Humlum argues that can be spun negatively, as a subtraction from potential productivity gains, or more positively, in the sense that automation tools historically have tended to generate more demand for workers in other tasks. "These new job tasks create new demand for workers, which may boost their wages, if these are more high value added tasks," he said.

Advancing Digital Systems for Inclusive Public Services

Uganda adopted the modular open-source identity platform, MOSIP, two years ago. A small team of 12, with limited technical expertise, began adapting the MOSIP platform to align with Uganda's Registration of Persons Act, gradually building internal capacity. By the time the system integrator was brought in, Uganda incorporated digital public good, DPG, into its legal framework, providing the integrator with a foundation to build upon. This early customization helped shape the legal and technical framework needed to scale the platform. But improvements are needed, particularly in the documentation of the DPG. "Standardization, information security and inclusion were central to our work with MOSIP," Kisembo said. "Consent became a critical focus and is now embedded across the platform, raising awareness about privacy and data protection." ... Nigeria, with a population of approximately 250 million, is taking steps to coordinate its previously fragmented digital systems through a national DPI framework. The country deployed multiple digital solutions over the last 10 to 15 years, which were often developed in silos by different ministries and private sector agencies. In 2023 and 2024, Nigeria developed a strategic framework to unify these systems and guide its DPI adoption.

Eyes, ears, and now arms: IoT is alive

In just a few years, devices at home and work started including cameras to see and microphones to hear. Now, with new lines of vacuums and emerging humanoid robots, devices have appendages to manipulate the world around them. They’re not only able to collect information about their environment but can touch, “feel”, and move it. ... But, knowing the history of smart devices getting hacked, there’s cause for concern. From compromised baby monitors to open video doorbell feeds, bad actors have exploited default passwords and unencrypted communications for years. And now, beyond seeing and hearing, we’re on the verge of letting devices roam around our homes and offices with literal arms. What’s stopping a hacked robot vacuum from tampering with security systems? Or your humanoid helper from opening the front door? ... If developers want robots to become a reality, they need to create confidence in these systems immediately. This means following best practice cybersecurity by enabling peer-to-peer connectivity, outlawing generic credentials, and supporting software throughout the device lifecycle. Likewise, users can more safely participate in the robot revolution by segmenting their home networks, implementing multi-factor authentication, and regularly reviewing device permissions.

How to Launch a Freelance Software Development Career

Finding freelance work can be challenging in many fields, but it tends to be especially difficult for software developers. One reason is that many software development projects do not lend themselves well to a freelancing model because they require a lot of ongoing communication and maintenance. This means that, to freelance successfully as a developer, you'll need to seek out gigs that are sufficiently well-defined and finite in scope that you can complete within a predictable period of time. ... Specifically, you need to envision yourself also as a project manager, a finance director, and an accountant. When you can do these things, it becomes easier not just to freelance profitably, but also to convince prospective clients that you know what you're doing and that they can trust you to complete projects with quality and on time. ... While creating a portfolio may seem obvious enough, one pitfall that new freelancers sometimes run into is being unable to share work due to nondisclosure agreements they sign with clients. When negotiating contracts, avoid this risk by ensuring that you'll retain the right to share any key aspects of a project for the purpose of promoting your own services. Even if clients won't agree to letting you share source code, they'll often at least allow you to show off the end product and discuss at a high level how you approached and completed a project.

Digital twins critical for digital transformation to fly in aerospace

Among the key conclusions were that there was a critical need to examine the standards that currently support the development of digital twins, identify gaps in the governance landscape, and establish expectations for the future. ... The net result will be that stakeholder needs and objectives become more achievable, resulting in affordable solutions that shorten test, demonstration, certification and verification, thereby decreasing lifecycle cost while increasing product performance and availability. Yet the DTC cautioned that cyber security considerations within a digital twin and across its external interfaces must be customisable to suit the environment and risk tolerance of digital twin owners. ... First, the DTC said that evidence suggests a necessity to examine the standards that currently support digital twins, identify gaps in the governance landscape, and set expectations for future standard development. In addition, the research team identified that standardisation challenges exist when developing, integrating and maintaining digital twins during design, production and sustainment. There was also a critical need to identify and manage requirements that support interoperability between digital twins throughout the lifecycle. This recommendation also applied to the more complex SoS Digital Twins development initiatives. Digital twin model calibration needs to be an automated process and should be applicable to dynamically varying model parameters.

Quality begins with planning: Building software with the right mindset

Too often, quality is seen as the responsibility of QA engineers. Developers write the code, QA tests it, and ops teams deploy it. But in high-performing teams, that model no longer works. Quality isn’t one team’s job; it’s everyone’s job. Architects defining system components, developers writing code, product managers defining features, and release managers planning deployments all contribute to delivering a reliable product. When quality is owned by the entire team, testing becomes a collaborative effort. Developers write testable code and contribute to test plans. Product managers clarify edge cases during requirements gathering. Ops engineers prepare for rollback scenarios. This collective approach ensures that no aspect of quality is left to chance. ... One of the biggest causes of software failure isn’t building the wrong way, it’s building the wrong thing. You can write perfectly clean, well-tested code that works exactly as intended and still fail your users if the feature doesn’t solve the right problem. That’s why testing must start with validating the requirements themselves. Do they align with business goals? Are they technically feasible? Have we considered the downstream impact on other systems or components? Have we defined what success looks like?

What Makes You a Unicorn in Your Industry? Start by Mastering These 4 Pillars

First, you have to have the capacity, the skill, to excel in that area. Additionally, you have to learn how to leverage that standout aspect to make it work for you in the marketplace - incorporating it into your branding, spotlighting it in your messaging, maybe even including it in your name. Concise as the notion is, there's actually a lot of breadth and flexibility in it, for when it comes to selecting what you want to do better than anyone else is doing it, your choices are boundless. ... Consumers have gotten quite savvy at sniffing out false sincerity, so when they come across the real thing, they're much more prone to give you their business. Basically, when your client base believes you prioritize your vision, your team and creating an incredible product or service over financial gain, they want to work with you. ... Building and maintaining a remarkable "company culture" can just be a buzzword to you, or you can bring it to life. I can't think of any single factor that makes my company more valuable to my clients than the value I place on my people and the experience I endeavor to provide them by working for me. When my staff feels openly recognized, wholly supported and vitally important to achieving our shared outcomes, we're truly unstoppable. So keep in mind that your unicorn focus can be internal, not necessarily client-facing.

Conquering the costs and complexity of cloud, Kubernetes, and AI

While IT leaders clearly see the value in platform teams—nine in 10 organizations have a defined platform engineering team—there’s a clear disconnect between recognizing their importance and enabling their success. This gap signals major stumbling blocks ahead that risk derailing platform team initiatives if not addressed early and strategically. For example, platform teams find themselves burdened by constant manual monitoring, limited visibility into expenses, and a lack of standardization across environments. These challenges are only amplified by the introduction of new and complex AI projects. ... Platform teams that manually juggle cost monitoring across cloud, Kubernetes, and AI initiatives find themselves stretched thin and trapped in a tactical loop of managing complex multi-cluster Kubernetes environments. This prevents them from driving strategic initiatives that could actually transform their organizations’ capabilities. These challenges reflect the overall complexity of modern cloud, Kubernetes, and AI environments. While platform teams are chartered with providing infrastructure and tools necessary to empower efficient development, many resort to short-term patchwork solutions without a cohesive strategy.

Reporting lines: Could separating from IT help CISOs?

CFOs may be primarily concerned with the financial performance of the business, but they also play a key role in managing organizational risk. This is where CISOs can learn the tradecraft in translating technical measures into business risk management. ... “A CFO comes through the finance ranks without a lot of exposure to IT and I can see how they’re incentivized to hit targets and forecasts, rather than thinking: if I spend another two million on cyber risk mitigation, I may save 20 million in three years’ time because an incident was prevented,” says Schat. Budgeting and forecasting cycles can be a mystery to CISOs, who may engage with the CFO infrequently, and interactions are mostly transactional around budget sign-off on cybersecurity initiatives, according to Gartner. ... It’s not uncommon for CISOs to find security seen as a barrier, where the benefits aren’t always obvious, and are actually at odds with the metrics that drive the CIO. “Security might slow down a project, introduce a layer of complexity that we need from a security perspective, but it doesn’t obviously help the customer,” says Bennett. Reporting to CFOs can relieve potential conflicts of interest. It can allow CISOs to broaden their involvement across all areas of the organization, beyond input in technology, because security and managing risk is a whole-of-business mission.

Daily Tech Digest - March 15, 2025

Quote for the day:

"The most powerful leadership tool you have is your own personal example." -- John Wooden

Guardians of AIoT: Protecting Smart Devices from Data Poisoning

Machine learning algorithms rely on datasets to identify and predict patterns. The quality and completeness of this data determines the performance of the model is determined by the quality and completeness of this data. Data poisoning attacks tamper the knowledge of the AI by introducing false or misleading information and usually following these steps: The attacker manipulates the data by gaining access to the training dataset and injects malicious samples; The AI is now getting trained on the poisoned data and incorporates these corrupt patterns into its decision-making process; Once the poisoned data is deployed, the attackers now exploit it to bypass a security system or tamper critical tasks. ... The addition of AI into IoT ecosystems has intensified the potential attack surface. Traditional IoT devices were limited in functionality, but AIoT systems rely on data-driven intelligence, which makes them more vulnerable to such attacks and hence, challenge the security of the devices: AIoT devices collect data from different sources which increases the likelihood of data being tampered; The poisoned data can have catastrophic effects on the real-time decision making; Many IoT devices possess limited computational power to implement strong security measures which makes them easy targets for these attacks.

Preparing for The Future of Work with Digital Humans

For businesses to prepare their staff for the workplace of tomorrow, they need to embrace the technologies of tomorrow—namely, digital humans. These advanced solutions will empower L&D leaders to drive immersive learning experiences for their staff. Digital humans use various technologies and techniques like conversational AI, large language models (LLMs), retrieval augmented generation, digital human avatars, virtual reality (VR,) and generative AI to produce engaging and interactive scenarios that are perfect for training. Recall that a major issue with current training methods is that staff never have opportunities to apply the information they just consumed, resulting in the loss of said information. Digital humans avoid this problem by generating lifelike roleplay scenarios where trainees can actually apply and practice what they have learned, reinforcing knowledge retention. In a sales training example, the digital human takes on the role of a customer, allowing the employee to practice their pitch for a new product or service. The employee can rehearse in realistic conditions rather than studying the details of the new product or service and jumping on a call with a live customer. A detractor might push back and say that digital humans lack a necessary human element.

3 ways test impact analysis optimizes testing in Agile sprints

Code modifications or application changes inherently present risks by potentially introducing new bugs. Not thoroughly validating these changes through testing and review processes can lead to unintended consequences—destabilizing the system and compromising its functionality and reliability. However, validating code changes can be challenging, as it requires developers and testers to either rerun their entire test suites every time changes occur or to manually identify which test cases are impacted by code modifications, which is time-consuming and not optimal in Agile sprints. ... Test impact analysis automates the change analysis process, providing teams with the information they need to focus their testing efforts and resources on validating application changes for each set of code commits versus retesting the entire application each time changes occur. ... In UI and end-to-end verifications, test impact analysis offers significant benefits by addressing the challenge of slow test execution and minimizing the wait time for regression testing after application changes. UI and end-to-end testing are resource-intensive because they simulate comprehensive user interactions across various components, requiring significant computational power and time.

No one knows what the hell an AI agent is

Well, agents — like AI — are a nebulous thing, and they’re constantly evolving. OpenAI, Google, and Perplexity have just started shipping what they consider to be their first agents — OpenAI’s Operator, Google’s Project Mariner, and Perplexity’s shopping agent — and their capabilities are all over the map. Rich Villars, GVP of worldwide research at IDC, noted that tech companies “have a long history” of not rigidly adhering to technical definitions. “They care more about what they are trying to accomplish” on a technical level, Villars told TechCrunch, “especially in fast-evolving markets.” But marketing is also to blame in large part, according to Andrew Ng, the founder of AI learning platform DeepLearning.ai. “The concepts of AI ‘agents’ and ‘agentic’ workflows used to have a technical meaning,” Ng said in a recent interview, “but about a year ago, marketers and a few big companies got a hold of them.” The lack of a unified definition for agents is both an opportunity and a challenge, Jim Rowan, head of AI for Deloitte, says. On the one hand, the ambiguity allows for flexibility, letting companies customize agents to their needs. On the other, it may — and arguably already has — lead to “misaligned expectations” and difficulties in measuring the value and ROI from agentic projects. “Without a standardized definition, at least within an organization, it becomes challenging to benchmark performance and ensure consistent outcomes,” Rowan said.

Researchers astonished by tool’s apparent success at revealing AI’s hidden motives

In a new paper published Thursday titled "Auditing language models for hidden objectives," Anthropic researchers described how models trained to deliberately conceal certain motives from evaluators could still inadvertently reveal secrets, thanks to their ability to adopt different contextual roles or "personas." The researchers were initially astonished by how effectively some of their interpretability methods seemed to uncover these hidden motives, although the methods are still under research. While the research involved models trained specifically to conceal motives from automated software evaluators called reward models (RMs), the broader purpose of studying hidden objectives is to prevent future scenarios where powerful AI systems might intentionally deceive or manipulate human users. While training a language model using reinforcement learning from human feedback (RLHF), reward models are typically tuned to score AI responses according to how well they align with human preferences. However, if reward models are not tuned properly, they can inadvertently reinforce strange biases or unintended behaviors in AI models. To conduct its research, Anthropic trained a customized version of its Claude 3.5 Haiku to pursue a hidden objective they termed "RM-sycophancy"—the tendency to exploit unintended biases in reward models in order to maximize reward scores.

Strategies for Success in the Age of Intelligent Automation

Firstly, the integration of AI into existing organizational frameworks calls for a largely collaborative environment. It is imperative for employees to perceive AI not as a usurper of employment, but instead as an ally in achieving collective organizational goals. Cultivating a culture of collaboration between AI systems and human workers is essential to the successful deployment of intelligent automation. Organizations should focus on fostering open communication channels, ensuring that employees understand how AI can enhance their roles and contribute to the organization’s success. To achieve this, leadership must actively engage with employees, addressing concerns and highlighting the benefits of AI integration. ... The ethical ramifications of AI workforce deployment demand meticulous scrutiny. Transparency, accountability, and fairness are integral and their importance can’t be overstated. It’s vital that AI-driven decisions are aligned with ethical standards. Organizations are responsible for establishing robust ethical frameworks that govern AI interactions, mitigating potential biases and ensuring equitable outcomes. The best way to do this requires implementing standards for monitoring AI systems, ensuring they operate within defined ethical boundaries.

AI & Innovation: The Good, the Useless – and the Ugly

First things first: there is good innovation, the kind that genuinely benefits society. AI that enhances energy efficiency in manufacturing, aids scientific discoveries, improves extreme weather prediction, and optimizes resource use in companies falls into this category. Governments can foster those innovations through targeted R&D support, incentives for firms to develop and deploy AI, “buy European tech” procurement policies, and investments in robust digital infrastructure. The Competitiveness Compass outlines similar strategies. That said, given how many different technologies are lumped together in the AI category—everything from facial recognition technology to smart ad tech, ChatGPT, and advanced robotics—it makes little sense to talk about good innovation and “AI and productivity” in the abstract. Most hype these days is about generative AI systems that mimic human creative abilities with striking aptitude. Yet, how transformative will an improved ChatGPT be for businesses? It might streamline some organizational processes, expedite data processing, and automate routine content generation. For some industries, like insurance companies, such capabilities may be revolutionary. For many others, its innovation footprint will be much more modest.

Revolution at the Edge: How Edge Computing is Powering Faster Data Processing

Due to its unparalleled advantages, edge computing is rapidly becoming the primary supporting technology of industries where speed, reliability, or efficiency aren’t just useful but imperative. Just like edge computing helps industries remain functional and up to date, staying informed with the latest sports news is important for every fan. Follow Facebook MelBet and receive real-time alerts, insider information, and a touch of comedy through memes and behind-the-scenes videos all in one place. Subscribe and get even closer to the world of sport! Edge computing relies on IoT as its most crucial component since there are billions of connected devices producing an immense and constant amount of data that needs to be processed right away. IoT devices in the residential sector, such as smart sensors in homes or Nest smart thermostats, as well as peripherals used for industrial automation in factories, all use edge computing. ... The way edge computing will function in the future is very exciting. With 5G, AI, and IoT, edge technologies are likely to become smarter, more widespread, and faster. Imagine a world where factories optimize themselves, smart traffic systems talk to autonomous vehicles, and healthcare devices stop illnesses from happening before they start.

Harnessing the data storm: three top trends shaping unstructured data storage and AI

The sheer volume of unstructured information generated by enterprises necessitates a new approach to storage. Object storage offers a better, more cost-effective method for handling significant datasets compared to traditional file-based systems. Unlike traditional storage methods, object storage treats each data item as a distinct object with its metadata. This approach offers both scalability and flexibility; ideal for managing the vast quantities of images, videos, sensor data, and other unstructured content generated by modern enterprises. ... Data lakes, the centralized repositories for both structured and unstructured data, are becoming increasingly sophisticated with the integration of AI and machine learning. These enable organizations to delve deeper into their data, uncovering hidden patterns and generating actionable insights without requiring complex and costly data preparation processes. ... The explosion of unstructured data presents both immense opportunities and challenges for organizations in every market across the globe. To thrive in this data-driven era, businesses must embrace innovative approaches to data storage, management, and analysis that are both cost-effective and compliant with evolving regulations.

Open Source Tools Seen as Vital for AI in Hybrid Cloud Environments

The landscape of enterprise open source solutions is evolving rapidly, driven by the need for flexibility, scalability, and innovation. Enterprises are increasingly relying on open source technologies to drive digital transformation, accelerate software development, and foster collaboration across ecosystems. With advancements in cloud computing, AI, and containerization, open source solutions are shaping the future of IT by providing adaptable and secure platforms that meet evolving business needs. The active and diverse community support ensures continuous improvement, making open source a cornerstone of modern enterprise technology strategies. Red Hat's portfolio, including Red Hat Enterprise Linux, Red Hat OpenShift, Red Hat AI and Red Hat Ansible Automation Platform, provides robust platforms that support diverse workloads across hybrid and multi-cloud environments. Additionally, Red Hat's extensive partner ecosystem provides more seamless integration and support for a wide range of technologies and applications. Our commitment to open source principles and continuous innovation allows us to deliver solutions that are secure, scalable, and tailored to the needs of our customers. Open source has proven to be trusted and secure at the forefront of innovation

Daily Tech Digest - June 06, 2024

How AI will kill the smartphone

The great thing about AI is that it’s software-upgradable. When you buy an AI phone, the phone gets better mainly through software updates, not hardware updates. ... As we’re talking back and forth with AI agents, people will use earbuds and, increasingly, AI glasses to interact with AI chatbots. The glasses will use built-in cameras for photo and video multimodal AI input. As glasses become the main interface, the user experience will likely improve more with better glasses (not better phones), with improved light engines, speakers, microphones, batteries, lenses, and antennas. With the inevitable and inexorable miniaturization of everything, eventually a new class of AI glasses will emerge that won’t need wireless tethering to a smartphone at all, and will contain all the elements of a smartphone in the glasses themselves. ... Glasses will prove to be the winning device, because glasses can position speakers within an inch of the ears, hands-free microphones within four inches of the mouth and, the best part, screens directly in front of the eyes. Glasses can be worn all day, every day, without anything physically in the ear canal. In fact, roughly 4 billion people already wear glasses every day.

Million Dollar Lines of Code - An Engineering Perspective on Cloud Cost Optimization

Storage is still cheap. We should really still be thinking about storage as being pretty cheap. Calling APIs costs money. It's always going to cost money. In fact, you should accept that anything you do in the cloud costs money. It might not be a lot; it might be a few pennies. It might be a few fractions of pennies, but it costs money. It would be best to consider that before you call an API. The cloud has given us practically infinite scale, however, I have not yet found an infinite wallet. We have a system design constraint that no one seems to be focusing on during design, development, and deployment. What's the important takeaway from this? Should we now layer one more thing on top of what it means to be a software developer in the cloud these days? I've been thinking about this for a long time, but the idea of adding one more thing to worry about sounds pretty painful. Do we want all of our engineers agonizing over the cost of their code? Even in this new cloud world, the following quote from Donald Knuth is as true as ever.

The five-stage journey organizations take to achieve AI maturity

We are far from seeing most organizations fully versed in and comfortable with AI as part of their company strategy. However, Asana and Anthropic have outlined five stages of AI maturity; a guide executives can use to gauge where their company stands in implementing real transformative outcomes. Many respondents say they’re in either the first or second stage. Only seven percent claim they’ve achieved the highest stage. ... Asana and Anthropic conclude that boosting comprehension is important, offering resources, training programs and support structures for knowledge workers to improve their education. Companies must also prioritize AI safety and reliability, meaning that AI vendors should be selected with “complete, integrated data models and invest in high-quality data pipelines and robust governance practices.” AI responses must be interpretable to facilitate decision-making and should always be controlled and directed by human operators. Other elements of organizations in Stage 5 include embracing a human-centered approach, developing strong comprehensive policies and principles to navigate AI adoption responsibly, and being able to measure AI’s impact and value

Unauthorized AI is eating your company data, thanks to your employees

A major problem with shadow AI is that users don’t read the privacy policy or terms of use before shoveling company data into unauthorized tools, she says. “Where that data goes, how it’s being stored, and what it may be used for in the future is still not very transparent,” she says. “What most everyday business users don’t necessarily understand is that these open AI technologies, the ones from a whole host of different companies that you can use in your browser, actually feed themselves off of the data that they’re ingesting.” ... Using AI, even officially licensed ones, means organizations need to have good data management practices in place, Simberkoff adds. An organization’s access controls need to limit employees from seeing sensitive information not necessary for them to do their jobs, she says, and longstanding security and privacy best practices still apply in the age of AI. Rolling out an AI, with its constant ingestion of data, is a stress test of a company’s security and privacy plans, she says. “This has become my mantra: AI is either the best friend or the worst enemy of a security or privacy officer,” she adds. “It really does drive home everything that has been a best practice for 20 years.”

How a data exchange platform eases data integration

As our software-powered world becomes more and more data-driven, unlocking and unblocking the coming decades of innovation hinges on data: how we collect it, exchange it, consolidate it, and use it. In a way, the speed, ease, and accuracy of data exchange has become the new Moore’s law. Safely and efficiently importing a myriad of data file types from thousands or even millions of different unmanaged external sources is a pervasive, growing problem. ... Data exchange and import solutions are designed to work seamlessly alongside traditional integration solutions. ETL tools integrate structured systems and databases and manage the ongoing transfer and synchronization of data records between these systems. Adding a solution for data-file exchange next to an ETL tool enables teams to facilitate the seamless import and exchange of variable unmanaged data files. The data exchange and ETL systems can be implemented on separate, independent, and parallel tracks, or so that the data-file exchange solution feeds the restructured, cleaned, and validated data into the ETL tool for further consolidation in downstream enterprise systems.

AI is used to detect threats by rapidly generating data that mimics realistic cyber threats

When we talk about AI, it’s essential to understand its fundamental workings—it operates based on the data it’s fed. Hence, the data input is crucial; it needs to be properly curated. Firstly, ensuring anonymisation is key; live customer data should never be directly integrated into the model to comply with regulatory standards. Secondly, regulatory compliance is paramount. We must ensure that the data we feed into the framework adheres to all relevant regulations. Lastly, many organisations grapple with outdated legacy tech stacks. It’s essential to modernise and streamline these systems to align with the requirements of contemporary AI technology. Also, mitigating bias in AI is crucial. Since the data we use is created by humans, biases can inadvertently seep into the algorithms. Addressing this issue requires careful consideration and proactive measures to ensure fairness and impartiality. ... It’s important for people to be highly aware of biases and misconceptions surrounding AI. We need to be conscious of the potential biases in AI systems.

Tackling Information Overload in the Age of AI

The reason this story is so universal is that the kind of information that drives knowledge-intensive workflows is unstructured data, which has stubbornly resisted the automation wave that has taken on so many other enterprise workflows using software and software-as-a-service (SaaS). SaaS has empowered teams with tools they can use to efficiently manage a wide variety of workflows involving structured data. However, SaaS offerings have been unable to take on the core “jobs to be done” in the knowledge-intensive enterprise because they can’t read and understand unstructured data. They aren’t capable of performing human-like services with autonomous decision-making abilities. As a result, knowledge workers are still stuck doing a lot of monotonous and undifferentiated data work. However, newly available large language models (LLMs) and generative AI excel at processing and extracting meaning from unstructured data. LLM-powered “AI agents” can perform services such as reading and summarizing content and prioritizing work and can automate multistage knowledge workflows autonomously.

CDOs Should Understand Business Strategy to Be Outcome-focused

To be outcome-focused, the CDO has to prioritize understanding the business or corporate strategy, he says. In addition, one needs to comprehend the organizational aspirations and how to deliver on key business outcomes, which could include monetization of commercial opportunities, risk mitigation, cost savings, or providing client value. Next, Thakur advises leaders to focus on the foundational data and analytic capabilities to drive business outcomes. There must be a well-organized data and analytic strategy to start with, a good tech stack, an analytic environment, data management, and governance principles. While delivering on some of the use cases may take time, it is imperative to have quick wins along the way, says Thakur. He recommends CDOs create reusable data products and assets while having an agile operationalization process. Then, Thakur suggests data leaders create a solid engagement model to ensure that the data analytics team is in sync with business and product owners. He urges leaders to put an effective ideation and opportunity management framework into action to capture business ideas and prioritize use cases.

Decoding hiring & learning trends in the BFSI sector in the age of AI

Besides the traditional functions of sales and finance, there is a growing demand for tech-driven talent in the sector. It’s important to note that the demand for technology expertise isn’t limited to software development but encompasses different competencies, such as cybersecurity, UI/UX development, AI/ML engineering, digital marketing and data analytics. This is expected as there has been an increase in the use of AI and ML in the BFSI landscape, most prominently in fraud detection, KYC verification, sales and marketing processes. ... Now, new-age competencies such as digital skills, data analysis, AI and cybersecurity are increasingly becoming part of these programmes. To meet the growing demand for specialised skills and roles, many BFSI organisations encourage employees with financial expertise to develop digital skills that enable them to work more efficiently. ... At the crossroads of significant industry-level transformations, employers expect a variety of soft skills in addition to technical competencies.

Cyber Resilience Act Bans Products with Known Vulnerabilities

In future, manufacturers will no longer be allowed to place smart products with known security vulnerabilities on the EU market – if they do, they could face severe penalties ... When it comes to cyber resilience, the legislation of the Cyber Resilience Act makes it clear that customers – both residential and commercial – have an effective right to secure software. However, the race to be the first to discover vulnerabilities continues: organisations would be well advised to implement both effective CVE detection and impact assessment now to better scrutinise their own products and protect themselves against the serious consequences of vulnerability scenarios. “The CRA requires all vendors to perform mandatory testing, monitoring and documentation of the cybersecurity of their products, including testing for unknown vulnerabilities known as ‘zero days’,” said Jan Wendenburg, CEO of ONEKEY, a cybersecurity company based in Duesseldorf, Germany. ... Many manufacturers and distributors are not sufficiently aware of potential vulnerabilities in their own products.

Quote for the day:

"Life always begins with one step outside of your comfort zone." -- Shannon L. Alder