Daily Tech Digest by Kannan Subbiah: social media

Showing posts with label social media. Show all posts

Daily Tech Digest - March 19, 2026

Quote for the day:

“The first step toward success is taken when you refuse to be a captive of the environment in which you first find yourself.” -- Mark Caine

🎧 Listen to this digest on YouTube Music

▶ Play Audio Digest

Duration: 22 mins • Perfect for listening on the go.

Vibe coding can’t dance, a new spec routine emerges

The article explores the shifting paradigm of AI-assisted software engineering, contrasting the improvisational "" approach with the emerging methodology of Spec-Driven Development (SDD). Vibe coding relies on high-level, conversational prompts to rapidly scaffold code based on a developer’s creative intent. However, as noted by industry expert , this method often leads to compounding ambiguity, "repository slop," and technical debt because AI models cannot truly interpret "vibes" without precise context. In response, SDD offers a rigorous alternative by encoding product intent into machine-readable constraints—such as API contracts, data shapes, and acceptance tests—before any implementation begins. This transition redefines the developer’s role as a "context engineer," responsible for orchestrating AI agents through structured architectural memory rather than ephemeral chat windows. Unlike the heavy waterfall processes of the past, SDD provides a lean, scalable framework that ensures AI outputs remain predictable, maintainable, and verifiable. While vibe coding remains highly useful for early-stage prototyping and rapid exploration, the article ultimately argues that SDD is essential for building robust production systems, effectively bridging the critical gap between human intent and machine execution to ensure software doesn't lose its "rhythm" as complexity grows.

Cybersecurity and privacy priorities for 2026: The legal risk map

As the cybersecurity landscape evolves in early 2026, corporate legal exposure is reaching unprecedented levels, driven by sophisticated state-sponsored threats and tightening regulatory oversight. Cyber actors are increasingly leveraging advanced artificial intelligence to exploit global geopolitical tensions, resulting in significant disruptions and large-scale data theft. On the federal level, the and aggressive FTC enforcement against data brokers—enforced under the Protecting Americans' Data from Foreign Adversaries Act—signal a period of intense scrutiny. Simultaneously, state-level initiatives, such as California’s rigorous CCPA annual audit requirements and new focuses on "surveillance pricing," add layers of complexity for businesses. Beyond external threats, organizations must grapple with supply chain vulnerabilities and the Department of Justice’s growing reliance on whistleblowers to identify noncompliance. To navigate this legal risk map, companies must implement robust third-party management and internal processes for escalating privacy concerns. Ultimately, success requires a fundamental reassessment of data handling practices, clear accountability, and continuous training to ensure resilience against a backdrop of creative litigation and expanding global enforcement networks. This strategic shift is essential for organizations to avoid the mounting whirlwind of legal challenges.

We mistook event handling for architecture

In "We mistook event handling for architecture," argues that modern front-end development has erroneously prioritized event-driven reactions over structural state management. While events are necessary inputs for user interaction and data updates, treating the orchestration of these flows as the core architecture leads to overwhelming complexity. In event-centric systems, understanding application behavior requires mentally replaying a timeline of transient actions, making it difficult to discern what is currently true. To combat this, Kapoor advocates for a "state-first" architectural shift where the application state serves as the primary source of truth. By defining explicit relationships and dependencies rather than manual chains of reactions, developers can create systems that are more deterministic and easier to reason about. This transition is already visible in technologies like , which emphasize fine-grained reactivity and treat the user interface as a projection of state. Ultimately, true architectural maturity involves moving beyond the clever coordination of events to focus on modeling clear, persistent structures. This approach ensures that as applications scale, they remain maintainable, testable, and transparent, allowing developers to prioritize the system's current reality over its historical sequence of reactions.

Stop building security goals around controls

In an insightful interview with Help Net Security, , CISO at Fitch Group, advocates for a paradigm shift in cybersecurity from focusing solely on technical controls to prioritizing business-aligned outcomes. Rudnicki argues that security strategy is most effective when it is directly anchored to three critical pillars: corporate objectives, real-world cyber threats, and established industry standards. A common pitfall for security leaders is failing to communicate the "why" behind their initiatives; instead, they should present risk in terms that executive leadership can act upon, such as protecting revenue, uptime, and customer trust. To address the tension between innovation speed and security, she suggests using secure sandboxes and providing mitigation options that enable growth safely. Rudnicki recommends tracking three core metrics—value, risk, and maturity—with the latter benefiting from independent third-party assessments. Furthermore, she stresses that automation should be strategically applied to routine tasks to create capacity for human expertise and high-level judgment. By transforming security into a business enabler rather than a barrier, CISOs can demonstrate measurable progress and accountability. This comprehensive approach ensures that security decisions support the broader organizational strategy while maintaining a robust and resilient defensive posture in an evolving threat landscape.

The post-cloud data center: Back in fashion, but not like before

The "post-cloud data center" era represents a shift from reflexive cloud migration toward a mature, situational architecture where on-premises and colocation facilities regain strategic importance. This transition is not a simple "cloud repatriation" but a response to the specific demands of artificial intelligence, GPU economics, and increasing regulatory pressure. AI workloads, in particular, challenge the universal cloud default; as they transition from experimentation to steady-state operations, the need for stable utilization and cost control often favors physical infrastructure. Furthermore, the concept of "the edge" has evolved to prioritize proximity to accountability rather than just geographical distance. Organizations now treat compute placement as a decision rooted in data sovereignty, security, and governance requirements. Consequently, IT leadership is refocusing on physical constraints long delegated to facilities teams, such as rack density, power topology, and liquid cooling. This new paradigm advocates for a hybrid operating model where workloads are placed based on density, locality, and auditability. Ultimately, the post-cloud era signifies that infrastructure is no longer an abstract service but a critical business constraint that requires a deliberate, evidence-based strategy to balance the elasticity of the cloud with the control of owned or colocated hardware.

Understanding Quantum Error Correction: Will Quantum Computers Overcome Their Biggest Challenge?

The article "Understanding Quantum Error Correction: Physical vs. Logical Qubits" from The Quantum Insider explores the critical role of error correction in overcoming the inherent instability of quantum systems. It establishes a clear distinction between physical qubits—the raw, noisy hardware units—and logical qubits, which are robust ensembles of physical qubits that work collectively to store reliable quantum information. The piece emphasizes that while physical qubits are highly susceptible to decoherence from environmental noise, logical qubits utilize Quantum Error Correction (QEC) protocols and redundancy to detect and fix errors without measuring the actual quantum state. Highlighting the "threshold theorem," the article notes that correction only succeeds if physical error rates remain below a specific limit. Featuring insights into the work of industry leaders like Google, IBM, Microsoft, Riverlane, and Iceberg Quantum, the report details the transition from the NISQ era to fault-tolerant quantum computing. Recent breakthroughs show that logical error rates can now be hundreds of times lower than physical ones, significantly reducing the overhead required. Ultimately, mastering this physical-to-logical translation is the definitive path toward building scalable quantum supercomputers capable of solving complex problems in cryptography and material science.

Shadow AI Risk: How SaaS Apps Are Quietly Enabling Massive Breaches

The "Shadow AI" problem represents a critical cybersecurity shift where autonomous agentic AI is embedded within SaaS applications without formal IT oversight. According to a Grip Security report, every analyzed company now operates within AI-enabled SaaS environments, contributing to a staggering 490% year-over-year increase in public SaaS attacks. These breaches often exploit stolen OAuth tokens—the modern "identity perimeter"—to bypass traditional firewalls. Once inside, attackers leverage agentic AI to scrape sensitive data from connected systems or trigger cascading breaches across hundreds of organizations, as seen in the notorious 2025 Salesloft Drift incident. The risk is amplified by "IdentityMesh" flaws, which allow attackers to pivot through unified authentication contexts into third-party apps and shared service accounts. As businesses prioritize speed over security, many remain unaware of the shadow AI lurking in their software stacks, expanding the potential blast radius of single compromises. To mitigate this chaos, organizations must move beyond static approvals toward continuous visibility and dynamic governance. Treating AI as a high-priority third-party risk is essential to preventing 2026 from becoming the most catastrophic year for SaaS-enabled data breaches, ensuring that innovation does not outpace the fundamental ability to protect customer information.

Federal cyber experts called Microsoft’s cloud a “pile of shit,” approved it anyway

The Ars Technica report reveals a disturbing disconnect between the internal assessments of federal cybersecurity experts and the official authorization of Microsoft's cloud services for government use. According to internal documents and whistleblower accounts, reviewers tasked with evaluating Microsoft’s Government Community Cloud High (GCC-H) under the FedRAMP program described the system in disparaging terms, with one official famously labeling it a "pile of shit." Experts expressed grave concerns over a lack of detailed security documentation, particularly regarding how sensitive data is encrypted as it moves between servers. Despite these critical findings and a self-reported "lack of confidence" in the platform's overall security posture, federal officials ultimately granted authorization. The decision to approve the service was driven less by technical resolution and more by the reality that many agencies had already integrated the product, making a rejection logistically and politically unfeasible. Critics argue this represents a form of "security theater," where the pressure to maintain operations outweighed the mandate to ensure robust protection of state secrets. This situation underscores the immense leverage major tech providers hold over the federal government, effectively rendering their platforms "too big to fail" regardless of significant, unresolved security flaws.

To ban or not to ban? UK debates age restrictions for social media platforms

The article "To ban or not to ban? UK debates age restrictions for social media platforms" details a recent UK parliamentary evidence session exploring Australian-style age restrictions for minors. The debate features a tripartite structure, beginning with urgent warnings from clinicians and parent advocacy groups like Parentkind. These stakeholders highlight alarming statistics, including a 93% parental concern rate regarding social media harms and a significant rise in mental health issues, sexual extortion, and misinformation-driven health crises among youth. emphasizes that while privacy-preserving age assurance technology is currently viable, the government must shift from endless consultation to active enforcement of the Online Safety Act. Conversely, researchers from the London School of Economics voice concerns that total bans might inadvertently dismantle vital online safe spaces for marginalized communities, such as LGBTQ+ youth. Australian eSafety Commissioner Julie Inman Grant advocates for a "social media delay" rather than a "ban," targeting the predatory nature of platforms. The discussion concludes with insights from the Age Verification Providers Association, which asserts that while verifying younger users is technically complex, hybrid estimation and data-driven methods can effectively uphold age-related policies. Ultimately, the UK remains at a crossroads, balancing technical feasibility against societal protection.

Researchers: Meta, TikTok Steal Personal & Financial Info When Users Click Ads

According to a report from cybersecurity firm Jscrambler, are allegedly weaponizing ad-tracking pixels to operate what researchers describe as the world’s most prolific "infostealing" operations. By embedding sophisticated JavaScript code into advertiser websites, these social media giants exfiltrate sensitive personally identifiable information (PII) and financial data whenever users click on platform-hosted ads. The investigation reveals that these tracking scripts capture granular details, including full names, precise geolocations, credit card numbers, and even specific shopping cart contents. Most critically, the data collection reportedly occurs regardless of whether users have explicitly opted out or selected "do not share" preferences on consent banners, rendering privacy controls largely decorative. While traditional hackers use stolen data for immediate criminal profit, these corporations leverage it for invasive microtargeting, potentially violating major privacy regulations like GDPR and CCPA. In response, Meta dismissed the findings as self-promotional clickbait that misrepresents standard digital advertising practices, while TikTok emphasized that legal compliance and pixel configuration remain the responsibility of individual advertisers. This controversy underscores a deepening tension between corporate data-harvesting business models and global privacy standards, exposing both users and advertisers to significant legal and security risks.

Daily Tech Digest - January 27, 2026

Quote for the day:

"Supreme leaders determine where generations are going and develop outstanding leaders they pass the baton to." -- Anyaele Sam Chiyson

Why code quality should be a C-suite concern

At first, speed feels like progress. Then the hidden costs begin to surface: escalating maintenance effort, rising incident frequency, delayed roadmaps and growing organizational tension. The expense of poor code slowly eats into return on investment — not always in ways that show up neatly on a spreadsheet, but always in ways that become painfully visible in daily operations. ... During the planning phase, rushed architectural decisions often lead to tightly coupled, monolithic systems that are expensive and risky to change. During development, shortcuts accumulate into what we call technical debt: duplicated logic, brittle integrations and outdated dependencies that appear harmless at first but quietly erode system stability over time. Like financial debt, technical debt compounds. ... Architecture always comes first. I advocate for modular growth — whether through a well- structured modular monolith that can later evolve into microservices, or through service-oriented architectures with clear domain boundaries. Platforms such as Kubernetes enable independent scaling of components, but only when the underlying architecture is cleanly segmented. Language and framework choices matter more than most leaders realize. ... The technologies we select, the boundaries we define and the failure modes we anticipate all place invisible limits on how far an organization can grow. From what I’ve seen, you simply cannot scale a product on a foundation that was never designed to evolve.

How to regulate social media for teens (and make it stick)

Noting that age assurance proposals have broad support from parents and educators, Allen says “the question is not whether children deserve safeguarding (they do) but whether prohibition is an effective tool for achieving it.” “History suggests that bans succeed or fail not on the basis of intention, but on whether they align with demand, supply, moral legitimacy and enforcement capacity. Prohibition does not remove human desire; it reallocates who fulfils it. Whether that reallocation reduces harm or increases it depends on how well policy engages with the underlying economics and psychology of behaviour.” ... “There is little evidence that young people themselves view social media as morally repugnant. On the contrary, it is where friendships are maintained, identities are explored and social status is negotiated. That does not mean it is harmless. It means it is meaningful.” “This creates a problem for prohibition. Where demand remains strong, supply will be found.” Here, Allen’s argument falters somewhat, in that it follows the logic that says bans push kids onto less regulated and more dangerous platforms. I.e., “the risk is not simply that prohibition fails. It is that it succeeds in changing who supplies children’s social connectivity.” The difference is that, while a basket of plums and some ingenuity are all you need to produce alcohol, social media platforms have their value in the collective. Like Star Trek’s Borg, they are more powerful the more people they assimilate.

The era of agentic AI demands a data constitution, not better prompts

If a data pipeline drifts today, an agent doesn't just report the wrong number. It takes the wrong action. It provisions the wrong server type. It recommends a horror movie to a user watching cartoons. It hallucinates a customer service answer based on corrupted vector embeddings. ... In traditional SQL databases, a null value is just a null value. In a vector database, a null value or a schema mismatch can warp the semantic meaning of the entire embedding. Consider a scenario where metadata drifts. Suppose your pipeline ingests video metadata, but a race condition causes the "genre" tag to slip. Your metadata might tag a video as "live sports," but the embedding was generated from a "news clip." When an agent queries the database for "touchdown highlights," it retrieves the news clip because the vector similarity search is operating on a corrupted signal. The agent then serves that clip to millions of users. At scale, you cannot rely on downstream monitoring to catch this. By the time an anomaly alarm goes off, the agent has already made thousands of bad decisions. Quality controls must shift to the absolute "left" of the pipeline. ... Engineers generally hate guardrails. They view strict schemas and data contracts as bureaucratic hurdles that slow down deployment velocity. When introducing a data constitution, leaders often face pushback. Teams feel they are returning to the "waterfall" era of rigid database administration.

QA engineers must think like adversaries

Test engineers are now expected to understand pipelines, cloud-native architectures, and even prompt engineering for AI tools. The mindset has become more preventive than detective. AI has become part of QA’s toolkit, helping predict weak spots and optimise testing. At the same time, QA must validate the integrity and fairness of AI systems — making it both a user and a guardian of AI. ... With DevOps, QA became embedded into the pipeline — automated test execution, environment provisioning, and feedback loops are all part of CI/CD now. With SecOps, we’re adding security scans and penetration checks earlier, creating a DevTestSecOps model. QA is no longer a separate stage. It’s a mindset that exists throughout the lifecycle — from requirements to observability in production. ... Regression testing has become AI-augmented and data-driven. Instead of re-running all test cases, systems now prioritise based on change impact analysis. The SDET role is also evolving — they now bridge coding, observability, and automation frameworks, often owning quality gates within CI/CD. ... Security checks are now embedded as automated gates within pipelines. Performance testing, too, is moving earlier — with synthetic monitoring and API-level load simulations. In effect, security and speed can coexist, provided teams integrate validation rather than treat it as an afterthought.

The biggest AI bottleneck isn’t GPUs. It’s data resilience

The risks of poor data resilience will be magnified as agentic AI enters the mainstream. Whereas generative AI applications respond to a prompt with an answer in the same manner as a search engine, agentic systems are woven into production workflows, with models calling each other, exchanging data, triggering actions and propagating decisions across networks. Erroneous data can be amplified or corrupted as it moves between agents, like the party game “telephone.” ... Experts cite numerous reasons data protection gets short shrift in many organizations. A key one is an overly intense focus on compliance at the expense of operational excellence. That’s the difference between meeting a set of formal cybersecurity metrics and being able to survive real-world disruption. Compliance guidelines specify policies, controls and audits, while resilience is about operational survivability, such as maintaining data integrity, recovering full business operations, replaying or rolling back actions and containing the blast radius when systems fail or are attacked. ... “Resilience and compliance-oriented security are handled by different teams within enterprises, leading to a lack of coordination,” said Forrester’s Ellis. “There is a disconnect between how prepared people think they are and how prepared they actually are.” ... Missing or corrupted data can lead models to make decisions or recommendations that appear plausible but are far off the mark.

When open science meets real-world cybersecurity

If there is no collaboration, usually the product that emerges is a great scientific specimen with very risky implementations. The risk is usually caught by normal cyber processes and reduced accordingly; however, scientists who see the value in IT/cyber collaboration usually also end up with a great scientific specimen. There is also managed risk in the implementation with almost no measurable negative impacts or costs. We’ve seen that if collaboration is planned into the project very early on, cybersecurity can provide value. ... Cybersecurity researchers often are confused and look for issues on the internet where they stumble onto the laboratory IT footprint and make claims that we are leaking non-public information. We clearly label and denote information that is releasable to the public, but it always seems there are folks who are quicker to report than to read the dissemination labels. ... Encryption at rest (EIR) is really a control to prevent data loss when the storage medium is no longer in your control. So, when the data has been reviewed for public release, we don’t spend the extra time, effort, and money to apply a control to data stores that provide no value to either the implementation or to a cyber control. ... You can imagine there are many custom IT and OT parts that run that machine. The replacement of components is not on a typical IT replacement schedule. This can present longer than ideal technology refresh cycles. The risk here is that integrating modern cyber technology into an older IT/OT technology stack has its challenges.

4 issues holding back CISOs’ security agendas

CISOs should aim to have team members know when and how to make prioritization calls for their own areas of work, “so that every single team is focusing on the most important stuff,” Khawaja says. “To do that, you need to create clear mechanisms and instructions for how you do decision-support,” he explains. “There should be criteria or factors that says it’s high, medium, low priority for anything delivered by the security team, because then any team member can look at any request that comes to them and they can confidently and effectively prioritize it.” ... According to Lee, the CISOs who keep pace with their organization’s AI strategy take a holistic approach, rather than work deployment to deployment. They establish a risk profile for specific data, so security doesn’t spend much time evaluating AI deployments that use low-risk data and can prioritize work on AI use cases that need medium- or high-risk data. They also assign security staffers to individual departments to stay on top of AI needs, and they train security teams on the skills needed to evaluate and secure AI initiatives. ... the challenge for CISOs not being about hiring for technical skills or even soft skills, but what he called “middle skills,” such as risk management and change management. These skills he sees becoming more crucial for aligning security to the business, getting users to adopt security protocols, and ultimately improving the organization’s security posture. “If you don’t have [those middle skills], there’s only so far the security team can go,” he says.

Rethinking data center strategy for AI at scale

Traditional data centers were engineered for predictable, transactional workloads. Your typical enterprise rack ran at 8kW, cooled with forced air, powered through 12-volt systems. This worked fine for databases, web applications, and cloud storage. Yet, AI workloads are pushing rack densities past 120kW. That's not an incremental change—it's a complete reimagining of what a data center needs to be. At these densities, air cooling becomes physically impossible. ... Walk into a typical data center today. The HVAC system has its own monitoring dashboard. Power distribution runs through a separate SCADA system. Compute performance lives in yet another tool. Network telemetry? Different stack entirely. Each subsystem operates in isolation, reporting intermittently through proprietary interfaces that don't talk to each other. Operators see dashboards, not decisions. ... Cooling systems can respond instantly to thermal changes, and power orchestration becomes adaptive rather than provisioned for theoretical peaks. AI clusters can scale based not just on demand, but in coordination with available power, cooling capacity, and network bandwidth. ... Real-time visibility, unified data architectures, and adaptive control will define performance, efficiency, and competitiveness in AI-ready data centers. The organizations that thrive in the AI era won't necessarily be those with the most data centers or the biggest chips; they'll be the ones that treat infrastructure as an intelligent, responsive system capable of sensing, adapting, and optimizing in real time.

Microsoft handed over BitLocker keys to law enforcement, raising enterprise data control concerns

The US Federal Bureau of Investigation approached Microsoft with a search warrant in early 2025, seeking keys to unlock encrypted data stored on three laptops in a case of alleged fraud involving the COVID unemployment assistance program in Guam. As the keys were stored on a Microsoft server, Microsoft adhered to the legal order and handed over the encryption keys ... While the encryption of BitLocker is robust, enterprises need to be mindful of who has custody of the keys, as this case illustrates. ... Enterprises using BitLocker should treat the recovery keys as highly sensitive, and avoid default cloud backup unless there is a clear business requirement and the associated risks are well understood and mitigated. ... CISOs should also ensure that when devices are repurposed, decommissioned, or moved across jurisdictions, keys should be regenerated as part of the workflow to ensure old keys cannot be used. ... If recovery keys are stored with a cloud provider, that provider may be compelled, at least in its home jurisdiction, to hand them over under lawful order, even if the data subject or company is elsewhere without notifying the company. This becomes even more critical from the point of view of a pharma company, semiconductor firm, defence contractor, or critical-infrastructure operator, as it exposes them to risks such as exposure of trade secrets in cross‑border investigations.

Moore’s law: the famous rule of computing has reached the end of the road, so what comes next?

For half a century, computing advanced in a reassuring, predictable way. Transistors – devices used to switch electrical signals on a computer chip – became smaller. Consequently, computer chips became faster, and society quietly assimilated the gains almost without noticing. ... Instead of one general-purpose processor trying to do everything, modern systems combine different kinds of processors. Traditional processing units or CPUs handle control and decision-making. Graphics processors, are powerful processing units that were originally designed to handle the demands of graphics for computer games and other tasks. AI accelerators (specialised hardware that speeds up AI tasks) focus on large numbers of simple calculations carried out in parallel. Performance now depends on how well these components work together, rather than on how fast any one of them is. Alongside these developments, researchers are exploring more experimental technologies, including quantum processors (which harness the power of quantum science) and photonic processors, which use light instead of electricity. ... For users, life after Moore’s Law does not mean that computers stop improving. It means that improvements arrive in more uneven and task-specific ways. Some applications, such as AI-powered tools, diagnostics, navigation, complex modelling, may see noticeable gains, while general-purpose performance increases more slowly.

Daily Tech Digest - April 10, 2025

Quote for the day:

"Positive thinking will let you do everything better than negative thinking will." -- Zig Ziglar

Strategies for measuring success and unlocking business value in cloud adoption

Transitioning to a cloud-based operation involves a dual-pronged strategy. While cost optimization, requires right-sizing resources, leveraging discounted instances, and implementing auto-scaling based on demand, accurately forecasting demand and navigating complex cloud pricing structures can be difficult. Likewise, while scalability is enabled by containerization, serverless computing, and infrastructure automation, managing complex applications, ensuring security during scaling, and avoiding vendor lock-in present additional challenges. Therefore, organizations must continuously monitor and adapt their strategies while addressing these challenges. ... An effective cloud strategy aligns business goals through a strong governance framework that prioritizes security, compliance, and cost optimization, while being flexible to accommodate growth. Piloting non-critical applications can help refine this strategy before larger migrations. ... Companies must first assess their maturity model to identify areas for improvement. This includes optimizing their cloud mix by exploring different cloud providers or cost structures, providing regular policy updates for compliance, cultivating a continuous improvement culture, proactively addressing challenges, and having active leadership involvement in the cloud vision for stakeholder buy-in.

Three Keys to Mastering High Availability in Your On-Prem Data Center

A cornerstone of high availability is the redundancy of IT infrastructure. By identifying potential critical single points of failure and, where possible, ensuring there is an option for failover to a secondary resource, you can reduce the risk of downtime in the event of an incident. Redundancy should extend across both hardware and software layers. Implementing failover clusters, resilient networking paths, storage redundancy using RAID, and offsite data replication for disaster recovery are proven strategies. Adopting a hybrid or multi-cloud approach can also reduce reliance on any single service provider. If you operate an off-site data center, ensure it is not dependent on the same power source as your main campus. Be sure to have a disaster recovery and business continuity plan that includes local and offsite backup storage. ... Whether your infrastructure is on-premises, cloud-based, or hybrid, the other key component to achieving high availability is the establishment of failover clusters to facilitate – and even automate – the movement of services and workloads to a secondary resource. Whether hardware (SAN-based) or software (SANless), clusters support the seamless failover of services to back up resources and ensure continuity in the event of a severely degraded performance or an outage incident.

Targeted phishing gets a new hook with real-time email validation

The problem facing defenders is the tactic prevents security teams from doing further analysis and investigation, says the Cofense report. Automated security crawlers and sandbox environments also struggle to analyze these attacks because they cannot bypass the validation filter, the report adds. ... “The only real solution,” he said, “is to move away from traditional credentials to phishing-safe authentication methods like Passkeys. The goal should be to protect from leaked credentials, not block user account verification.” Attackers verifying e-mail addresses as deliverable, or being associated with specific individuals, is nothing fundamentally new, he added. Initially, attackers used the mail server’s “VRFY” command to verify if an address was deliverable. This still works in a few cases. Next, attackers relied on “non-deliverable receipts,” the bounce messages you may receive if an email address does not exist, to figure out if an email address existed. Both techniques work pretty well to determine if an email address is deliverable, but they do not distinguish whether the address is connected to a human, or if its messages are read. The next step, Ullrich said, was sending obvious spam, but including an “unsubscribe” link. If a user clicks on the “unsubscribe” link, it confirms that the email was opened and read.

Data Hurdles, Expertise Loss Hampering BCBS 239 Compliance

It was abundantly clear that there was a gulf between ECB expectations and banks’ delivery soon after BCBS 239 was introduced. In late 2018 the central bank found that 59 per cent of in-scope institutions turned in regulatory reports with at least one failing validation rule and almost 7 per cent of data points were missing from them. The ECB began a “supervisory strategy” in 2022 to close the gap, running until 2024. In May of that year it published a guide that clarified what the overseers expected of banks and embarked on targeted reviews of RDARR capabilities. ... The supervisor blamed “deficiencies” on governance shortcomings, fragmented IT infrastructures and a high level of manual aggregation processing, but admitted “remediation of RDARR deficiencies is often costly, carries significant risk and takes time”. Carroll said that the breadth of the data management effort needed to comply with BCBS 239 has slowed adoption of the capabilities necessary for compliance. “They’re spending so much time planning for BCBS and thinking about what they need to do and what they need to have in place, and the tools that they need and the frameworks that they might need to put in place,” he said. ... “Hindered by outdated IT systems unsuitable for modern data management functions, they struggle with data silos and inconsistent, inaccurate risk reporting,” Ergin told Data Management Insight.

Can We Learn to Live with AI Hallucinations?

Sometimes, LLMs hallucinate for no good reason. Vectara CEO Amr Awadallah says LLMs are subject to the limitations of data compression on text as expressed by the Shannon Information Theorem. Since LLMs compress text beyond a certain point (12.5%), they enter what’s called “lossy compression zone” and lose perfect recall. That leads us to the inevitable conclusion that the tendency to fabricate isn’t a bug, but a feature, of these types of probabilistic systems. What do we do then? ... Instead of using a general-purpose LLM, fine-tuning open source LLMs on smaller sets of domain- or industry-specific data can also improve accuracy within that domain or industry. Similarly, a new generation of reasoning models, such as DeepSeek-R1 and OpenAI o1, that are trained on smaller domain-specific data sets, include a feedback mechanism that allows the model to explore different ways to answer a question, the so-called “reasoning” steps. Implementing guardrails is another technique. Some organizations use a second, specially crafted AI model to interpret the results of the primary LLM. When a hallucination is detected, it can tweak the input or the context until the results come back clean. Similarly, keeping a human in the loop to detect when an LLM is headed off the rails can also help avoid some of LLM’s worst fabrications.

How Technical Debt Can Quietly Kill Your Company — And the metrics that can save you

Beyond the direct financial drain, technical debt imposes a crippling operational gridlock. Development velocity plummets — Protiviti suggest significant slowdowns, potentially up to 30%, as teams battle complexity. For Product and Delivery, this means longer lead times, missed deadlines, reduced predictability, and a sluggish response to market changes. Each new feature built on a weak foundation takes longer than the last. Maintenance costs simultaneously escalate. Developers spend disproportionate time debugging obscure issues, patching old components, and managing complex workarounds. These activities can consume up to 40% of the total value of a technology estate over its lifetime — an escalating “maintenance tax” diverting focus from value creation. Crucially, technical debt is a major barrier to innovation. Nearly 70% of organizations acknowledge this according to Protiviti’s polls. When teams are constantly firefighting, constrained by legacy architecture, and navigating brittle code, their capacity for creative problem-solving and experimentation evaporates. The operational drag prevents exploration, limiting the company’s potential for growth and differentiation. Nokia’s decline serves as a stark cautionary tale of operational gridlock leading to strategic failure. Their dominance in mobile phones evaporated with the rise of smartphones.

How tech giants like Netflix built resilient systems with chaos engineering

Chaos Engineering is a discipline within software engineering that focuses on testing the limits and vulnerabilities of a system by intentionally injecting chaos—such as failures or unexpected events—into it. The goal is to uncover weaknesses before they impact real users, ensuring that systems remain robust, self-healing, and reliable under stress. The idea is based on the understanding that systems will inevitably experience failures, whether due to hardware malfunctions, software bugs, network outages, or human error. ... Netflix is widely regarded as one of the pioneers in applying Chaos Engineering at scale. Given its global reach and the importance of providing uninterrupted service to millions of users, Netflix knew that simply assuming everything would work smoothly all the time was not an option. Its microservices architecture, a collection of loosely coupled services, meant that even the smallest failure could cascade and result in significant downtime for its customers. The company wanted to ensure that it could continue to stream high-quality video content, provide personalized recommendations, and maintain a stable infrastructure—no matter what failure scenarios might arise. To do so, Netflix turned to Chaos Engineering as a cornerstone of its resilience strategy.

The AI model race has suddenly gotten a lot closer, say Stanford scholars

Bommasani and team don't make any predictions about what happens next in the crowded field, but they do see a very pressing concern for the benchmark tests used to evaluate large language models. Those tests are becoming saturated -- even some of the most demanding, such as the HumanEval benchmark created in 2021 by OpenAI to test models' coding skills. That affirms a feeling seen throughout the industry these days: It's becoming harder to accurately and rigorously compare new AI models. ... In response, note the authors, the field has developed new ways to construct benchmark tests, such as Humanity's Last Exam, which has human-curated questions formulated by subject-matter experts; and Arena-Hard-Auto, a test created by the non-profit Large Model Systems Corp., using crowd-sourced prompts that are automatically curated for difficulty. ... Bommasani and team conclude that standardizing across benchmarks is essential going forward. "These findings underscore the need for standardized benchmarking to ensure reliable AI evaluation and to prevent misleading conclusions about model performance," they write. "Benchmarks have the potential to shape policy decisions and influence procurement decisions within organizations, highlighting the importance of consistency and rigor in evaluation."

From likes to leaks: How social media presence impacts corporate security

Cybercriminals can use social media to build a relationship with employees and manipulate them into performing actions that jeopardize corporate security. They can impersonate colleagues, business partners, or even executives, using information obtained from social media to sound convincing. ... Many employees use the same passwords for personal social media accounts as for their work accounts, putting corporate data at risk. While convenient, this practice means that if a personal account is compromised, attackers could gain access to work-related systems as well. ... CISOs must now account for employee behavior beyond the firewall. The attack surface no longer ends at corporate endpoints; it stretches into LinkedIn profiles, Instagram vacation posts, and casual tweets. Companies should establish policies regarding what employees are permitted to post on social media, especially about their work and workplace. ... The problem with social media posts is there is a thin line between privacy and company security. CISOs have to walk a thin line, keeping the company secure without policing what employees do on their own time. This is why privacy awareness training should be integrated with cybersecurity policies.

Tariffs will hit data centers and cloud providers, but hurt customers

The tariffs applied vary country to country - with a baseline of 10 percent placed on all imported goods coming into the US - and much higher being applied to those countries described by Trump as “the worst offenders," up to 99 percent in the case of the French archipelago Saint Pierre and Miquelon. However, most pertinent to the cloud computing industry are the tariffs that will hit countries that provide essential computing hardware, and materials necessary to data center construction. ... While cloud service providers (CSPs) will certainly be hit by the inevitable rising costs, it is hard to really think of the hyperscalers as the "victims" in this story. Microsoft, Amazon, and Alphabet all lie in the top five companies by market cap, and none have taken particularly drastic hits to their stock value since the news of the tariffs was announced. ... "The high tariffs on servers and other IT equipment imported from China and Taiwan are highly likely to increase CSPs costs. If CSPs pass on cost increases, customers may feel trapped (because of lock-in) and disillusioned with cloud and their provider (because they've committed to building on a cloud provider assuming costs would be constant or even decline over time). On the other hand, if CSPs don't increase prices with rising costs, their margins will decline. It's a no-win situation," Rogers explained.

Daily Tech Digest - December 22, 2022

Data forecast for 2023: Time to extract more value

Using data effectively relies in large part on being able to properly manage and control how data is used. That's where data governance comes into play, with tools and technologies that help organizations govern the data they use. Data governance will have an expanded role in 2023, according to Eckerson Research analyst Kevin Petrie. There will be a growing use of ML technologies to improve data governance technology by helping to automate processes and policies for data. Petrie said he also expects a rising number of data governance platforms to help organize, document and apply policies to ML models alongside other data assets in 2023. Benefitting from data to improve business outcomes entails collecting product and service data. That's where the concept of data as a product -- also referred to as data product -- will have growing relevance in 2023. Barr Moses, CEO of data observability vendor Monte Carlo, predicted that nearly every product will become a data product as organizations seek to optimize operations. "In 2023, more and more companies will seek to integrate ways to track and monetize data generated by their products as part of their core offerings to drive competitive advantage," Moses said.

The Future of Skills: Preparing for Industry 4.0 and Beyond

Industry 4.0—Industrial Internet of Things or the 4th Industrial revolution, as it is popularly addressed—has arrived with lots of opportunities and challenges that have the potential to transform the marketplace completely. Industry 4.0 refers to the “smart” and connected production systems that are designed to sense, predict and interact with the physical world so as to make decisions that support production in real-time, increasing productivity, energy efficiency and sustainability. McKinsey estimates that IoT has the potential to unlock an economic value somewhere between US$5.5 to $12.6 trillion by 2030. Therefore, with so many changes happening so quickly, neither employers nor employees (both employed and yet to be employed) can afford to ignore them or to stay in their comfort zone following the same old practices or skills. A report by World Economic Forum states that 84 percent of employers are set to rapidly digitalize working processes with the potential to move 44 percent of their workforce to operate remotely, and the top skills needed as we lead up to 2025 are critical thinking and analysis, problem solving, active learning, resilience, stress tolerance and flexibility.

What is DataOps? Collaborative, cross-functional analytics

Enterprises today are increasingly injecting machine learning into a vast array of products and services and DataOps is an approach geared toward supporting the end-to-end needs of machine learning. “For example, this style makes it more feasible for data scientists to have the support of software engineering to provide what is needed when models are handed over to operations during deployment,” Ted Dunning and Ellen Friedman write in their book, Machine Learning Logistics. “The DataOps approach is not limited to machine learning,” they add. “This style of organization is useful for any data-oriented work, making it easier to take advantage of the benefits offered by building a global data fabric.” ... Because DataOps builds on DevOps, cross-functional teams that cut across “skill guilds” such as operations, software engineering, architecture and planning, product management, data analysis, data development, and data engineering are essential, and DataOps teams should be managed in ways that ensure increased collaboration and communication among developers, operations professionals, and data experts.

Amplified security trends to watch out for in 2023

Cybercriminals target employees across different industries to surreptitiously recruit them as insiders, offering them financial enticements to hand over company credentials and access to systems where sensitive information is stored. This approach isn’t new, but it is gaining popularity. A decentralized work environment makes it easier for criminals to target employees through private social channels, as the employee does not feel that they are being watched as closely as they would in a busy office setting. Aside from monitoring user behavior and threat patterns, it’s important to be aware of and be sensitive about the conditions that could make employees vulnerable to this kind of outreach – for example, the announcement of a massive corporate restructuring or a round of layoffs. Not every employee affected by a restructuring suddenly becomes a bad guy, but security leaders should work with Human Resources or People Operations and people managers to make them aware of this type of criminal scheme, so that they can take the necessary steps to offer support to employees who could be affected by such organizational or personal matters.

How deep learning will ignite the metaverse in 2023 and beyond

Currently, the digital realities being developed by different companies have their own attributes and integrated functionalities, and are at different development levels. Many of these multiverse platforms are expected to converge, and this junction is where AI and data science domains, such as deep learning, will be critical in taking users to a new stage in their metaverse journey. Success in these endeavors will be contingent upon understanding vital elements of the algorithmic models and their metrics. Deep learning-based software is already being integrated into virtual worlds; some examples include autonomously driving chatbots and other forms of natural language processing to ensure seamless interactions. For another example, in AR technology, deep learning-enabled AI is used in camera pose estimation, immersive rendering, real-world object detection and 3D object reconstruction, helping to guarantee the variety and usability of AR applications. ... “Companies have an interesting opportunity for their customers and community to interact with their brand(s) in new and exciting ways, and deep learning-based artificial intelligence plays a major role in facilitating those experiences,” said Stephenson.

Introducing Cadl: Microsoft’s concise API design language

Microsoft has begun to move much of its API development to a language called Cadl, which helps you define API structures programmatically before compiling to OpenAPI definitions. The intent is to do for APIs what Bicep does for infrastructure, providing a way to repeatably deliver API definitions. By abstracting design away from definition, Cadl can deliver much more concise outputs, ensuring that the OpenAPI tool in platforms like Visual Studio can parse it quickly and efficiently. What is Cadl? At first glance it’s a JavaScript-like language with some similarities to .NET languages. Microsoft describes it as “TypeScript for APIs,” intending it to be easy to use for anyone familiar with C#. Like Microsoft’s other domain-specific languages, Cadl benefits from Microsoft’s long history as a development tools company, fitting neatly into existing toolchains. You can even add Cadl extensions to the language server in Visual Studio and Visual Studio Code, ensuring that you get support from built-in syntax highlighting, code completion, and linting. Making Cadl a language makes a lot of sense; it allows you to encapsulate architectural constraints into rules and wrap common constructs in libraries.

CIOs in 2023: Guiding Business Strategies Through Data-Driven Decisions

“CIOs need to take on a data mindset by first understanding the data, and then determining how critical the data architecture and data governance is,” he says. For understanding the business process, they need to think about how they can move the needle for the company, prioritize the projects that drive business, and implement or evolve the systems they already have. “The third important thing is building business partnerships across the organization,” Kancharla adds. “Having all levels of relationships will go a long way for the CIOs to be successful. The last thing is really thinking of what optimizations they can bring to the company, especially next year.” He points out that next year, every company will have to bring down costs, which means streamlining and optimizing the software within the company and deploying the tools they already have to the full potential. Segovia adds effective CIOs must also be able to understand the tech and recommendations their teams are executing on. “They need to understand areas in a reasonably deep manner in order to lead teams of wide technical and digital acumen,” he says.

Social media use can put companies at risk: Here are some ways to mitigate the danger

The concern is that foreign-owned applications might share the information they collect with government intelligence agencies. That information includes personally identifiable information, keystroke patterns (PII), location information based on SIM card or IP address, app activity, browser and search history, and biometric information. Personal use of social media by employees can impact the company’s brand as well as endanger the firm or employees themselves—bad actors could use social media to identify where a person works, the division in which they work, and possibly their physical location. The potential harm is higher for high-risk employees such as senior executives or those with authority to execute financial transactions. Of course, there are plenty of good reasons for employees to use social media. It can enhance marketing campaigns, announce news or critical information, and otherwise raise the profile of an organization. Social media channels can be used to monitor risks and threats against a government or critical infrastructure.

The power of generosity in ecosystems

A traditional approach to competition, rooted in the business mindset of one company gaining an advantage over another, can make it difficult to play in an ecosystem as a participant. For example, one of the risks of being part of an ecosystem is the dependency on its orchestrator. Increased reliance on Big Tech and the consolidation of many industries have created an increased risk of a few powerful cash-generator businesses that need to reward shareholders with consistent, attractive margins and will not think twice about burdening their partners to keep those margins—for example, by asking for discounts in exchange for participating in the ecosystem. But what if there was more of a sense of mutual collaboration? Benjamin Gomes-Casseres of Brandeis University has published research with Harvard Business Review Press on different business combinations (his term for business ecosystems). He states that for an ecosystem to logically exist, the players within an ecosystem must fairly share the benefits, creating added value for the entire ecosystem that exceeds the level of value each company could create independently.

6 BI challenges IT teams must address

There can be obstacles, however, to taking the self-service approach. Having too much access across many departments, for example, can result in a kitchen full of inexperienced cooks running up costs and exposing the company to data security problems. And do you want your sales team making decisions based on whatever data it gets, and having the autonomy to mix and match to see what works best? Central, standardized control over tool rollout is key. And to do it correctly, IT needs to govern the data well. Because of these tradeoffs, organizations must ensure they select the BI approach best-suited for the business application at hand. “We have more than 100,000 associates in addition to externals working for us, and that’s quite a large user group to serve,” says Axel Goris, global visual analytics lead at Novartis, the multinational pharmaceutical corporation based in Basel, Switzerland. “A key challenge was organization around delivery — how do you organize delivery, because a pharmaceutical company is highly regulated.” An IT-managed BI delivery model, Goris explains, requires a lot of effort and process, which wouldn’t work for some parts of the business.

Quote for the day:

"Nothing so conclusively proves a man's ability to lead others as what he does from day to day to lead himself." -- Thomas J. Watson

Daily Tech Digest - September 21, 2022

IT Talent Crunch Shifts Tech Investment Strategies

Prasad Ramakrishnan, CIO at Freshworks, points out that low- and no-code tools enable businesses to do more with less, and the easy-to-use, configuration-based user experience of these tools means anyone can use them. He adds tech stacks have become bloated and complex, with features end users typically don't care about. “In an attempt to check every box, technology went from being purpose-built, to tailored to no one,” he says. “The pandemic has made this trend more pronounced.” Ramakrishnan conducts an “app rationalization” exercise regularly with his team, evaluating software applications in terms of integrations needed, their security, whether they are being used (to retire if needed) and how much they are being used (to reduce licenses if needed). “Constantly audit your tech stack,” he advises. “We also involve the end user to make sure everyone is part of the process, akin to a democratized process.” From his perspective, leaders need to create space for end-user feedback -- without it, companies could be taking away valuable tools that employees use and leave them with bloated applications they never use.

Why Investors & Founders Need To Embed Corporate Governance

There have been numerous tweets and posts about governance, the blame game, and other topics. Governance, in my opinion, begins with the founders and senior management. The investors/board have no way of knowing about fraud or any of the aforementioned issues because they are not involved in the day-to-day operations. However, once discovered, the board of directors and investors are responsible for resolution. Consider the case of a company in the news: many prominent Sillicon Valley and New York-based investors participated despite the fact that one of the cofounders was convicted of identity theft. If they believe in second chances, why not make this cofounder a full-fledged director of the company? There is also the role of regulatory bodies such as the RBI, given that some of these startups (particularly fintech) are governed by them because they have a stake in a bank. Laws and regulations that encourage collaboration to ensure there is no “conflict” or, for example, our regulations make it impossible for investors to liquidate and take their money back.

Introduction to SOLID Principles of Software Architecture

Per the Single Responsibility Principle, every class should not have more than one responsibility, (i.e., it should have one and only one purpose). If you have multiple responsibilities, the functionality of the class should be split into multiple classes, with each of them handling a specific responsibility. ... When classes are open for extension but closed for modification, developers can extend the functionality of a class without having to modify the existing code in that class. In other words, programmers should make sure their code can handle new requirements without compromising on the existing functionality. Bertrand Meyer is credited with introducing this principle in his book entitled “Object-Oriented Software Construction.” According to Meyer, “a software entity should be open for extension but closed for modification.” The idea behind this principle is that it allows developers to extend software functionality while preserving the existing functionality. In practical terms, this means that new functionality should be added by extending the code of an existing class rather than by modifying the code of that class.

The Uber Hack’s Devastation Is Just Starting to Reveal Itself

“It’s disheartening, and Uber is definitely not the only company that this approach would work against,” says offensive security engineer Cedric Owens of the phishing and social engineering tactics the hacker claimed to use to breach the company. “The techniques mentioned in this hack so far are pretty similar to what a lot of red teamers, myself included, have used in the past. So, unfortunately, these types of breaches no longer surprise me.” The attacker, who could not be reached by WIRED for comment, claims that they first gained access to company systems by targeting an individual employee and repeatedly sending them multifactor authentication login notifications. After more than an hour, the attacker claims, they contacted the same target on WhatsApp pretending to be an Uber IT person and saying that the MFA notifications would stop once the target approved the login. Such attacks, sometimes known as “MFA fatigue” or “exhaustion” attacks, take advantage of authentication systems in which account owners simply have to approve a login through a push notification on their device rather than through other means, such as providing a randomly generated code.

Does your password policy align with NIST recommendations?

“NIST outlines several simple steps to strengthen passwords against modern password-based attacks. Organizations that ignore NIST’s recommendations are leaving an essential authentication security layer vulnerable,” notes Josh Horwitz, chief operating officer at Enzoic. ... As hacking threats increase and many IT teams are understaffed, upgrading your password policy may seem like a nice-to-have. However, password hardening is easy to do, leverages the existing investment in passwords and, unlike most security policies, actually makes things easier for users and administrators. The right solution reduces user frustration around frequent required resets and complex rules. Technology can also lower administrative burden and spend by using automation to reduce password reset calls and boost cybersecurity. Adopting modern technology such as Enzoic for Active Directory can help you avoid security breaches, prevent ransomware attacks and avoid account takeovers. “Organizations need a way to identify when passwords become compromised,” says Horwitz, adding, “Otherwise, their users and administrators can’t follow or enforce the NIST requirement to not reuse compromised passwords.”

Cybersecurity as an employee benefit

Many business leaders and human resources professionals believe that cybersecurity is the responsibility of their information technology staff and managed services provider. However, ensuring that employees and their families have appropriate cybersecurity protection is an employee benefit that benefits employers as well. Mistakes, lack of awareness and general vulnerability of employees remains the most significant cyber security risk for most employers. Simply training employees about cyber threats typically fails to reduce that risk sufficiently. To have a truly cyber-mature workforce, employers need to engage employees in cybersecurity. Teaching employees about the threats to themselves and their families, and making personal protection services available to them, is a much better method to engage employees in cybersecurity. Cybersecurity training is not most people’s idea of a good time. However, employees sit up and take notice when trainers talk to them about the prevalence and severity of the cyber threats to themselves personally, including their identities, credit files, financial accounts, personal devices and home networks.

Meta, TikTok, YouTube and Twitter dodge questions on social media and national security

Whistleblowers and industry have repeatedly raised alarms about inadequate content moderation in other languages, an issue that gets inadequate attention due to a bias toward English language concerns, both at the companies themselves and at U.S.-focused media outlets. In a different hearing yesterday, Twitter’s former security lead turned whistleblower Peiter “Mudge” Zatko noted that half of the content flagged for review on the platform is in a language the company doesn’t support. Facebook whistleblower Frances Haugen has also repeatedly called attention to the same issue, observing that the company devotes 87% of its misinformation spending to English language moderation even though only 9% of the platform’s users speak English. In another eyebrow-raising exchange, Twitter’s Jay Sullivan declined to specifically deny accusations that the company “willfully misrepresented” information given to the FTC. “I can tell you, Twitter disputes the allegations,” Sullivan said, referring to testimony from the Twitter whistleblower on Tuesday.

5 steps to designing an embedded software architecture, Step 1

First, they are not very portable. For example, what happens if a microcontroller suddenly becomes unavailable? (Chip shortage, anyone?). If the code is tightly coupled, attempting to move the application code to run on a new microcontroller becomes a herculean effort. Application code is tightly coupled to low-level hardware calls on the microcontroller! I know a lot of companies who have suffered through this recently. If they didn’t update their architecture, they had to go back through all their code and change every line that interacted with the hardware. The companies that updated their architecture broke their architecture coupling through abstractions and dependency injection. Second, unit testing the application in a development environment rather than on the target hardware is nearly impossible. If the application code makes direct calls to the hardware, a lot of work will go into the test harness to successfully run that test, or the testing will need to be done on the hardware. Testing on hardware is slow and is often a manual rather than an automated process.

The promise of sustainable AI may not outweigh the organizational challenges

Without help from technology, outlining sustainability goals would be a limiting and difficult exercise. Enterprises today struggle with quantifying the risk of climate change, especially when it comes to digital transformation. In fact, only 43% of global executives say they are aware of their organization’s IT footprint. Data analytics and AI offer a solution to this challenge, as they provide meaningful insights across industries to understand where those gaps exist and thus can help companies incorporate more sustainable practices. Research shows that 89% of organizations recycle less than 10% of their IT hardware. However, if a company is to truly reap all the environmental benefits of sustainable AI, IT must play a crucial role in using this technology as the organization’s biggest helper, not its adversary. There are four broad areas that offset the sustainability impact of AI machinery and technology: reporting, cloud, circular economy, and coding. Accurate metrics and reporting will keep the AI systems intact and constantly improving, while cloud promotes sustainability because users only pay for the infrastructure per use, eliminating the need to run data centers at full threshold.

Measuring performance in agile

It’s really easy to destroy the culture of an agile team with metrics. We need to be sure that what we measure encourages the right behaviour. Using a team’s velocity as a performance measurement comes with a strong warning label: “Scrum’s team-level velocity measure is not all that meaningful outside of the context of a particular team. Managers should never attempt to compare velocities of different teams or aggregate estimates across teams. Unfortunately, we have seen team velocity used as a measure to compare productivity between teams, a task for which it is neither designed nor suited. Such an approach may lead teams to “game” the metric, and even to stop collaborating effectively with each other. In any case, it doesn’t matter how many stories we complete if we don’t achieve the business outcomes we set out to achieve in the form of program-level target conditions” We’ve all heard about working smarter, not harder, yet by focusing on story points as a measurement, we find that although in the short term we will succeed at getting people to complete more story points by simply working harder, this approach will not necessarily achieve the outcomes that we want.

Quote for the day:

"Nobody in your organization will be able to sustain a level of motivation higher than you have as their leader." -- Danny Cox