Daily Tech Digest by Kannan Subbiah: sovereign cloud

Showing posts with label sovereign cloud. Show all posts

Daily Tech Digest - April 03, 2026

Quote for the day:

"Any fool can write code that a computer can understand. Good programmers write code that humans can understand." -- Martin Fowler

🎧 Listen to this digest on YouTube Music

▶ Play Audio Digest

Duration: 21 mins • Perfect for listening on the go.

Cybersecurity in the age of instant software

In "Cybersecurity in the Age of Instant Software," explores how artificial intelligence is revolutionizing the software lifecycle and the resulting arms race between attackers and defenders. AI facilitates the rise of "instant software"—customized, ephemeral applications created on demand—which fundamentally alters traditional security paradigms. While AI significantly enhances an attacker's ability to automatically discover and exploit vulnerabilities in open-source, commercial, and legacy IoT systems, it simultaneously empowers defenders with sophisticated tools for automated patch creation and deployment. Schneier envisions a potentially optimistic future featuring where AI agents continuously scan and repair code, shifting the defensive advantage toward those who can share intelligence and coordinate responses. However, significant challenges remain, including the persistence of unpatchable legacy systems and the risk of attackers shifting their focus to social engineering, deepfakes, and the manipulation of defensive AI models themselves. Ultimately, the cybersecurity landscape will depend on how effectively AI can transition from writing insecure code to producing vulnerability-free applications. This evolution requires not only technological advancement but also policy shifts regarding software licensing and the right to repair to ensure a resilient digital infrastructure in an era of rapid, AI-driven software generation.

Scaling a business: A leadership guide for the rest of us

Scaling a business effectively requires a strategic shift in leadership from direct management to systemic architectural design. According to the article, scaling is defined as the ability to increase outcomes—such as revenue or customer value—faster than the growth of effort and costs. Unlike mere growth, which can amplify inefficiencies, successful scaling creates organizational leverage, resilience, and operational flow. The leadership playbook for this transition focuses on several key pillars: aligning the team around a shared definition of scale, conducting disciplined experiments to learn without excessive risk, and managing resources by decoupling capability from location. Leaders must prioritize process flow over bureaucratic control by standardizing repeatable tasks and clarifying decision rights to prevent bottlenecks. Furthermore, scaling is fundamentally a human endeavor; it necessitates making culture explicit through role clarity and psychological safety while developing a new generation of leaders. Ultimately, the executive's role evolves from being a hands-on hero who resolves every crisis to an architect who builds repeatable systems capable of handling increased volume without a proportional rise in stress. By treating scaling as a coordinated set of moves involving metrics, technology, and people, organizations can achieve sustainable expansion while protecting the core values that initially drove their success.

Why your business needs cyber insurance

has evolved from a niche product into an essential safety net for modern businesses facing an increasingly hostile digital landscape. While many firms still lack coverage, the article highlights how catastrophic incidents, such as the multi-billion-pound breach at , demonstrate the extreme danger of absorbing full recovery costs alone. Unlike self-insuring, which is risky due to the unpredictable nature of cyberattack expenses, a comprehensive policy provides financial protection against data breaches, ransomware, and business interruption. Beyond monetary compensation, reputable insurers offer immediate access to vetted security specialists and incident response teams, effectively aligning their interests with the victim's to ensure a rapid and cost-effective recovery. However, the market is maturing; insurers now demand rigorous security hygiene, including and regular patching, before granting coverage. Consequently, the application process itself serves as a practical security roadmap for proactive organizations. To navigate this complex terrain, businesses should engage specialist brokers and maintain total transparency on proposal forms to avoid inadvertently invalidating their claims. Ultimately, cyber insurance is no longer just about liability—it is a critical component of operational resilience, providing the expertise and resources necessary to survive a major digital crisis in an interconnected world.

How To Help Employees Grow And Strengthen Your Company

The Forbes Business Council article, "How To Help Employees Grow And Strengthen Your Company," outlines eight critical strategies for leaders to foster professional development while simultaneously enhancing organizational performance. Central to this approach is the paradigm shift of accepting that employment is often temporary; by preparing employees for their future careers through skill enhancement and ownership, companies build a powerful network of loyal alumni and advocates. Development should begin on day one, with roles designed to offer real stakes and exposure to decision-making. Furthermore, the article emphasizes investing in future-focused learning, particularly regarding emerging technologies, to ensure the workforce remains competitive and engaged. Growth must be ingrained as a core organizational value and integrated into the cultural fabric, rather than treated as an occasional initiative. Leaders are encouraged to provide employees with commercial context and genuine responsibility, transforming them into appreciating assets whose confidence compounds over time. Finally, the piece highlights the necessity of prioritizing and measuring development activities to ensure a clear return on investment in the form of improved morale and loyalty. By equipping team members to evolve continuously, leaders create a lasting legacy of success that strengthens the firm’s reputation and attracts top-tier talent

Tokenomics: Why IT leaders need to pay attention to AI tokens

In the evolving digital landscape, "" has transitioned from the cryptocurrency sector to become a vital framework for enterprise IT leaders managing and large language models (LLMs). Tokens represent the fundamental currency of AI services, encompassing the input, reasoning, and output units processed during any interaction. As AI tasks grow in complexity—particularly with the rise of agentic AI that consumes tokens at every step—understanding these metrics is essential for effective financial planning and operational governance. Most public API providers utilize tiered or volume-based pricing, making token consumption the primary driver of operational expenses. Consequently, technology executives must balance model capabilities with cost by implementing metered usage models or negotiated enterprise licenses. Beyond simple expense management, mastering tokenomics allows organizations to achieve a measurable return on investment through significant OPEX reduction. By automating mundane business processes like market analysis or medical coding, AI can shrink task completion times from days to minutes. Ultimately, treating tokens as a strategic resource enables IT leaders to allocate departmental budgets effectively, ensuring that AI deployments remain financially sustainable while delivering high-speed, high-quality results across the organization. This shift necessitates a new policy perspective where token limits and usage visibility become core components of the modern IT toolkit.

The Death of the Perimeter: A Deep Dive into Zero Trust for Modern Applications

In his article, Kannan Subbiah explores the obsolescence of traditional perimeter-based security, arguing that cloud adoption and remote work have rendered "castle-and-moat" defenses ineffective in the modern era. The shift toward is presented as a necessary response, grounded in the core philosophy of "." This comprehensive model relies on three fundamental principles: explicit verification of every access request based on context, the implementation of least privilege access, and the continuous assumption of a breach. By transitioning to an identity-centric security posture, organizations can significantly reduce their "blast radius" and improve visibility through AI-driven analytics. However, Subbiah acknowledges significant implementation hurdles, such as legacy technical debt, extreme policy complexity, and the potential for developer friction. Successful adoption requires a strategic, phased approach—focusing first on "crown jewels" while utilizing micro-segmentation, mutual TLS, and continuous authentication methods. Ultimately, Zero Trust is described not as a one-time product purchase but as a fundamental cultural and architectural journey. It moves security from defending a static network boundary to protecting the data itself, ensuring that trust is earned dynamically for every single transaction across today’s increasingly complex and distributed application environments.

Event-Driven Patterns for Cloud-Native Banking: Lessons from What Works and What Hurts

In the article "Event-Driven Patterns for Cloud-Native Banking," Chris Tacey-Green explores the strategic shift toward event-driven architecture (EDA) in the financial sector. While traditional monolithic systems often struggle with scalability, EDA enables banks to decouple internal services and create transparent, immutable activity trails essential for regulatory compliance. However, the author emphasizes that EDA is not a simple shortcut; it introduces significant complexity and new failure modes that require a fundamental mindset shift. To ensure reliability in high-stakes banking environments, developers must implement robust patterns such as the transactional outbox, idempotent consumers, and explicit fault handling to prevent data loss or duplication. A critical architectural distinction highlighted is the difference between commands—intentional requests for action—and events, which are historical statements of fact. By maintaining lean event payloads and separating internal domain events from external integration events, organizations can protect their internal models from leaking across system boundaries. Ultimately, successful adoption depends as much on organizational investment in shared standards and developer training as it does on the underlying technology. Transitioning to this model allows banks to innovate rapidly by subscribing to existing data streams rather than modifying core platforms, though it necessitates a disciplined approach to manage its inherent operational challenges.

Why Enterprise AI will depend on sovereign compute infrastructure

The rapid evolution of enterprise artificial intelligence is shifting focus from model capabilities to the necessity of sovereign compute infrastructure. As organizations in sectors like finance, healthcare, and government move beyond pilot programs, they face challenges in scaling AI while maintaining control over sensitive proprietary data. While public clouds remain relevant, approximately 80% of enterprise data resides within internal systems, making data movement costly and risky. Sovereign infrastructure extends beyond mere data localization; it encompasses control over operational layers, including identity management, telemetry, and administrative planes. This ensures that critical systems remain under an organization’s authority, even if the hardware is physically domestic. In India, where the AI market is projected to contribute significantly to the GDP by 2025, this shift is particularly vital. Consequently, enterprises are increasingly adopting private and hybrid AI architectures that bring computation closer to where the data resides. This maturation of AI strategy reflects a transition where long-term success is defined not just by advanced algorithms, but by the ability to deploy them within secure, governed environments. Ultimately, sovereign compute infrastructure provides a practical path for businesses to harness AI's power without compromising their most valuable assets or operational autonomy.

Just because they can – the biometric conundrum for law enforcement

In "Just because they can – the biometric conundrum for law enforcement," Professor Fraser Sampson explores the complex ethical and legal landscape surrounding the use of biometric technology, such as live facial recognition (LFR), in policing. Historically, the debate has centered on the principle that technical capability does not mandate usage; however, Sampson suggests this perspective is shifting toward a potential liability for inaction. Drawing on recent legal cases where companies were found negligent for failing to mitigate foreseeable harms, he posits that law enforcement may face similar scrutiny if they bypass available tools that could prevent serious crimes, such as child exploitation. As biometrics become increasingly reliable and affordable, they redefine the standards for an "effective investigation" under human rights frameworks. Sampson argues that while privacy concerns remain valid, the failure to utilize effective technology creates significant moral and legal risks for the state. Consequently, the police find themselves in a precarious position: if they insist these tools are essential for modern safety, they simultaneously increase their accountability for not deploying them. The article underscores an urgent need for robust regulatory frameworks to resolve these gaps between technological potential, public expectations, and the legal obligations of the state.

The State of Trusted Open Source Report

The "State of Trusted Open Source Report," published by Chainguard and featured on The Hacker News in April 2026, provides a comprehensive analysis of open-source consumption trends across container images, language libraries, and software builds. Drawing from extensive product data and customer insights, the report highlights a critical tension in modern engineering: while developers aspire to innovate, they are increasingly bogged down by the maintenance of aging, vulnerable software components. A primary focus of the study is the persistent prevalence of known vulnerabilities (CVEs) in standard container images, often contrasting them with "hardened" or "trusted" alternatives that aim for a zero-CVE baseline. The report underscores that the security of the software supply chain is no longer just about identifying flaws but about the speed and efficiency of remediation. By examining what teams actually pull and deploy in real-world environments, the findings reveal a growing shift toward minimal, secure-by-default images as organizations seek to reduce their attack surface and meet stricter compliance mandates. Ultimately, the report serves as a call to action for the industry to prioritize "trusted" open source as the foundation for secure software development life cycles, moving beyond reactive patching to proactive, systemic security.

Daily Tech Digest - February 25, 2026

Quote for the day:

"To strongly disagree with someone, and yet engage with them with respect, grace, humility and honesty, is a superpower" -- Vala Afshar

Is ‘sovereign cloud’ finally becoming something teams can deploy – not just discuss?

Historically, sovereign cloud discussions in Europe have been driven primarily by risk mitigation. , legal jurisdiction, and protection from international legislation have dominated the narrative. These concerns are valid, but they have framed sovereign cloud largely as a defensive measure – a way to reduce exposure – rather than as an enabler of innovation or value creation. Without a clear value proposition beyond compliance, sovereign cloud has struggled to compete with hyperscale public cloud platforms that offer scale, maturity, and rich developer ecosystems. The absence of enforceable regulation has further compounded this. ... Policymakers and enterprises are also beginning to ask a more practical question: where does sovereign cloud actually create the most value? The answer increasingly points to innovation ecosystems, critical national capabilities, and trust. First, there is a growing recognition that sovereign cloud can underpin domestic innovation, particularly in areas such as AI, advanced research, and data-intensive start-ups. Organisations working with sensitive datasets, intellectual property, or public funding often require cloud environments that are both scalable and secure. ... Second, the sovereign cloud is increasingly being aligned with critical digital infrastructure. Sectors like healthcare, energy, transportation, and defence depend on continuity, accountability, and control.

India’s DPDP rules 2025: Why access controls are priority one for CIOs

The security stack has traditionally broken down at the point of data rendering or exfiltration. Firewalls and encryption protect the data in transit and at rest, but once the data is rendered on a screen, the risk of data breaches from smartphone cameras, screenshots, or unauthorized sharing occurs outside of the security stack’s ability to protect it. ... Poor enterprise access practices amplify this risk. Over-provisioned user accounts, inconsistent multi-factor authentication, poor logging, and the absence of contextual checks make it easy for insider threats, credential compromise, and supply chain breaches to succeed. Under DPDP, accountability also extends to processors, so third-party CRM or cloud access must meet the same security standards. ... Shift from trust by implication to trust by verification. Implement to ensure users view only required apps and data. Add device posture with device binding, location, time, watermarking and behavior analysis to deny suspicious access. ... Implement identity infrastructure for just-in-time access and automated de-Provisioning based on role changes. Record fine-grained, immutable logs (user, device, resource, date/time) for breach analysis and annual retention. ... Enable dynamic, user-level watermarks (injecting username, IP address, timestamp) for forensic analysis. Prohibit unauthorized screen capture, sharing, or download activity during sensitive sessions, while permitting approved business processes.

What really caused that AWS outage in December?

The back-story was broken by the Financial Times, which reported the 13-hour outage was caused by a that decided to improve operations by deleting and then recreating a key environment. AWS on Friday shot back to flag what it dubbed “inaccuracies” in the FT story. “The brief service interruption they reported on was the result of user error — specifically — not AI as the story claims,” AWS said. ... “The issue stemmed from a misconfigured role — the same issue that could occur with any developer tool (AI powered or not) or manual action.” That’s an impressively narrow interpretation of what happened. AWS then promised it won’t do it again. ... The key detail missing — which AWS would not clarify — is just what was asked and how the engineer replied. Had the engineer been asked by Kiro “I would like to delete and then recreate this environment. May I proceed?” and the engineer replied, “By all means. Please do so,” that would have been user error. But that seems highly unlikely. The more likely scenario is that the system asked something along the lines of “Do you want me to clean up and make this environment more efficient and faster?” Did the engineer say “Sure” or did the engineer respond, “Please list every single change you are proposing along with the likely result and the worst-case scenario result. Once I review that list, I will be able to make a decision.”

Model Inversion Attacks: Growing AI Business Risk

A is a form of privacy attack against machine learning systems in which an adversary uses the outputs of a model to infer sensitive information about the data used to train it. Rather than breaching a database or stealing credentials, attackers observe how a model responds to input queries and leverage those outputs, often including confidence scores or probability values, to reconstruct aspects of the training data that should remain private. ... This type of attack differs fundamentally from other ML attacks, such as membership inference, which aims to determine whether a specific data point was part of the training set, and model extraction, which seeks to copy the model itself. ... Successful model inversion attacks can inflict significant damage across multiple areas of a business. When attackers extract sensitive training data from machine learning models, organizations face not only immediate financial losses but also lasting reputational harm and operational setbacks that continue well beyond the initial incident. ... Attackers target inference-time privacy by moving through multiple stages, submitting carefully crafted queries, studying the model’s responses, and gradually reconstructing sensitive attributes from the outputs. Because these activities can resemble normal usage patterns, such attacks frequently remain undetected when monitoring systems are not specifically tuned to identify machine learning–related security threats.

It’s time to rethink CISO reporting lines

The age-old problem with reporting into CIOs is that it could present — or at least appear to present — a conflict of interest. Cybersecurity consultant Brian Levine, a former federal prosecutor who serves as executive director of FormerGov, says that concern is even more warranted today. “It’s the legacy model: Treat security as a technical function instead of an enterprise‑wide risk discipline,” he says. ... Enterprise CISOs should be reporting a notch higher, Levine argues. “Ideally, the CISO would report to the CEO or the general counsel, high-level roles explicitly accountable for enterprise risk. Security is fundamentally a risk and governance function, not a cost‑center function,” Levine points out. “When the CISO has independence and a direct line to the top, organizations make clearer decisions about risk, not just cheaper ones." ... Painter is “less dogmatic about where the CISO reports and more focused on whether they actually have a seat at the table,” he says. “Org charts matter far less than influence,” he adds. “Whether the CISO reports to the CIO, the CEO, or someone else, the real question is this: Are they brought in early, listened to, and empowered to shape how the business operates? When that’s true, the structure works. When it’s not, no reporting line will save it.” ... “When the CISO reports to the CIO, risk can be filtered, prioritized out of sight, or reshaped to fit a delivery narrative. It’s not about bad actors. It’s about role tension. And when that tension exists within the same reporting line, risk loses.”

AI drives cyber budgets yet remains first on the chop list

Cybersecurity budgets are rising sharply across large organisations, but a new multinational survey points to a widening gap between spending on artificial intelligence and the ability to justify that spending in business terms. ... "Security leaders are getting mandates to invest in AI, but nobody's given them a way to prove it's working. You can't measure AI transformation with pre-AI metrics," Wilson said. He added that security teams struggle to translate operational data into board-level evidence of reduced risk. "The problem isn't that security teams lack data. They're drowning in it. The issue is they're tracking the wrong things and speaking a language the board doesn't understand. Those are the budgets that get cut first. The window to fix this is closing fast," Wilson said. ... "We need new ways to measure security effectiveness that actually show business impact, because boards don't fund faster ticket closure, they fund measurable risk reduction and business resilience. We have to show that we're not just responding quickly but eliminating and improving the conditions that allow incidents to happen in the first place," he said. ... Security leaders reported pressure to invest in AI, while also struggling to link those investments to outcomes executives recognise as resilience and risk reduction. The report argues this tension may become harder to sustain if economic conditions tighten and boards begin looking for costs to cut.

A cloud-smart strategy for modernizing mission-critical workloads

As enterprises mature in their cloud journeys, many CIOs and senior technology leaders are discovering that modernization is not about where workloads run — it’s about how deliberately they are designed. This realization is driving a shift from cloud-first to cloud-smart, particularly for systems the business cannot afford to lose. A cloud-smart strategy, as highlighted by the Federal Cloud Computing Strategy, encourages agencies to weigh the long-term, total costs of ownership and security risks rather than focusing only on immediate migration. ... Sticking indefinitely with legacy systems can lead to rising maintenance costs, inability to support new business initiatives, security vulnerabilities and even outages as old hardware fails. Many organizations reach a tipping point where they must modernize to stay competitive. The key is to do it wisely — balancing speed and risk and having a solid strategy in place to navigate the complexity. ... A cloud-smart strategy aligns workload placement with business risk, performance needs and regulatory expectations rather than ideology. Instead of asking whether a system can move to the cloud, cloud-smart organizations ask where it performs best. ... Rather than lifting and shifting entire platforms, teams separate core transaction engines from decisioning, orchestration and experience layers. APIs and event-driven integration enable new capabilities around stable cores, allowing systems to evolve incrementally without jeopardizing operational continuity.

Enterprises still can't get a handle on software security debt – and it’s only going to get worse

Four-in-five organizations are drowning in software security debt, new research shows, and the backlog is only getting worse. ... "The speed of software development has skyrocketed, meaning the pace of flaw creation is outstripping the current capacity for remediation,” said Chris Wysopal, chief security evangelist at Veracode. “Despite marginal gains in fix rates, security debt is becoming a much larger issue for many organizations." Organizations are discovering more vulnerabilities as their testing programs mature and expand. Meanwhile, the accelerating pace of software releases creates a continuous stream of new code before existing vulnerabilities can be addressed. ... "Now that AI has taken software development velocity to an unprecedented level, enterprises must ensure they’re making deliberate, intelligent choices to stem the tide of flaws and minimize their risk," said Wysopal. The rise in flaws classed as both “severe” and “highly exploitable” means organizations need to shift from generic severity scoring to prioritization based on real-world attack potential, advised Veracode. As such, researchers called for a shift from simple detection toward a more strategic framework of Prioritize, Protect, and Prove. ... “We are at an inflection point where running faster on the treadmill of vulnerability management is no longer a viable strategy. Success requires a deliberate shift,” said Wysopal.

Protecting your users from the 2026 wave of AI phishing kits

To protect your users today, you have to move past the idea of reactive filtering and embrace . This means your software needs to be smart enough to validate that a user is who they say they are, regardless of the credentials they provide. We’re seeing a massive shift toward behavioral analytics. Instead of just checking a password, your platform should be looking at communication patterns and login behaviors. If a user who typically logs in from Chicago suddenly tries to authorize a high-value financial transfer from a new device in a different country, your system should do more than just send a push notification. ... Beyond the tech, you need to think about the “human” friction you’re creating. We often prioritize convenience over security, but in the current climate, that’s a losing bet. Implementing “probabilistic approval workflows” can help. For example, if your system’s AI is 95% sure a login is legitimate, let it through. If that confidence drops, trigger a more rigorous verification step. ... The phishing scams of 2026 are successful because they leverage the same tools we use for productivity. To counter them, we have to be just as innovative. By building identity validation and phishing-resistant protocols into the core of your product, you’re doing more than just securing data. You’re securing the trust that your business is built on.

GitOps Implementation at Enterprise Scale — Moving Beyond Traditional CI/CD

Most engineering organizations running traditional CI/CD pipelines eventually hit the ceiling. Deployments work until they don’t, and when they break, the fixes are manual, inconsistent and hard to trace. ... We kept Jenkins and GitHub Actions in the stack for build and test stages where they already worked well. Harness remained an option for teams requiring more sophisticated approval workflows and governance controls. We ruled out purely script-based push deployment approaches because they offered poor drift control and scaled badly. ... Organizational resistance proved more challenging to address than the technical work. Teams feared the new approach would introduce additional bureaucracy. Engineers accustomed to quick kubectl fixes worried about losing agility. We ran hands-on workshops demonstrating that GitOps actually produced faster deployments, easier rollbacks and better visibility into what was running where. We created golden templates for common deployment patterns, so teams did not have to start from scratch. ... Unexpected benefits emerged after full adoption. Onboarding improved as deployment knowledge now lived in Git history and manifests rather than in senior engineers’ heads. Incident response accelerated because traceability let teams pinpoint exactly what changed and when, and rollback became a consistent, reliable operation. The shift from push-based to pull-based operations improved security posture by limiting direct cluster access.

Daily Tech Digest - February 14, 2026

Quote for the day:

"Always remember, your focus determines your reality." -- George Lucas

UK CIOs struggle to govern surge in business AI agents

The findings point to a growing governance challenge alongside the rapid spread of agent-based systems across the enterprise. AI agents, which can take actions or make decisions within software environments, have moved quickly from pilots into day-to-day operations. That shift has increased demands for monitoring, audit trails and accountability across IT and risk functions. UK CIOs also reported growing concern about the spread of internally built tools. ... The results suggest "shadow AI" risks are becoming a mainstream issue for large organisations. As AI development tools get easier to use, more staff outside IT can build automated workflows, chatbots and agent-like applications. This trend has intensified questions about data access, model behaviour, and whether organisations can trace decisions back to specific inputs and approvals. ... The findings also suggest governance gaps are already affecting operations. Some 84% of UK CIOs said traceability or explainability shortcomings have delayed or prevented AI projects from reaching production, highlighting friction between the push to deploy AI and the work needed to demonstrate effective controls. For CIOs, the issue also intersects with enterprise risk management and information security. Unmonitored agents and rapidly developed internal apps can create new pathways into sensitive datasets and complicate incident response if an organisation cannot determine which automated process accessed or changed data.

You’ve Generated Your MVP Using AI. What Does That Mean for Your Software Architecture?

While the AI generates an MVP, teams can’t control the architectural decisions that the AI made. They might be able to query the AI on some of the decisions, but many decisions will remain opaque because the AI does not understand why the code that it learned from did what it did. ... From the perspective of the development team, AI-generated code is largely a black-box; even if it could be understood, no one has time to do so. Software development teams are under intense time pressure. They turn to AI to partially relieve this pressure, but in doing so they also increase the expectations of their business sponsors regarding productivity. ... As a result, the nature of the work of architecting will shift from up-front design work to empirical evaluation of QARs, i.e. acceptance testing of the MVA. As part of this shift, the development team will help the business sponsors figure out how to test/evaluate the MVP. In response, development teams need to get a lot better at empirically testing the architecture of the system. ... The team needs to know what trade-offs it may need to make, and they need to articulate those in the prompts to the AI. The AI then works as a very clever search engine to find possible solutions that might address the trade-offs. As noted above, these still need to be evaluated empirically, but it does save the team some time in coming up with possible solutions.

Successful Leaders Often Lack Self-Awareness

As a leader, how do you respond in emotionally charged situations? It's under pressure that emotions can quickly escalate and unexamined behavioral patterns emerge—for all of us. In my work with senior executives, I have seen time and again how these unconscious “go-to” reactions surface when stakes are high. This is why self-awareness is not a one-time achievement but a lifelong practice—and for many leaders, it remains their greatest blind spot. Why? ... Turning inward to develop self-awareness naturally places you in uncomfortable territory. It challenges long-standing assumptions and exposes blind spots. One client came to me because a colleague described her as harsh. She genuinely did not see herself that way. Another sought my help after his CEO told him he struggled to communicate with him. Through our work together, we uncovered how defensively he responded to feedback, often without realizing it. ... As leaders rise to the top, the accolades that propel them forward are rooted in talent, strategic decision-making and measurable outcomes. However, once at the highest levels, leadership expands beyond execution. The role now demands mastery of relationships—within the organization and beyond, with clients, partners and customers. At this level, self-awareness is no longer optional; it becomes essential.

How Should Financial Institutions Prepare for Quantum Risk?

“Post-quantum cryptography is about proactively developing and building capabilities to secure critical information and systems from being compromised through the use of quantum computers,” said Rob Joyce, then director of cybersecurity for the National Security Agency, in an August 2023 statement. In August 2024, NIST published three post-quantum cryptographic standards — ML-KEM, ML-DSA and SLH-DSA — designed to withstand quantum attacks. These standards are intended to secure data across systems such as digital banking platforms, payment processing environments, email and e-commerce. NIST has encouraged organizations to begin implementation as soon as possible. ... A critical first step is conducting an assessment of which systems and data assets are most at risk. The ISACA IT security organization recommends building a comprehensive inventory of systems vulnerable to quantum attacks and classifying data based on sensitivity, regulatory requirements and business impact. For financial institutions, this assessment should prioritize customer PII, transaction data, long-term financial records and proprietary business information. Understanding where the greatest financial, reputational and regulatory exposure exists enables IT leaders to focus mitigation efforts where they matter most. Institutions should also conduct executive briefings, staff training and tabletop exercises to build awareness.

The cure for the AI hype hangover

The way AI dominates the discussions at conferences is in contrast to its slower progress in the real world. New capabilities in generative AI and machine learning show promise, but moving from pilot to impactful implementation remains challenging. Many experts, including those cited in this CIO.com article, describe this as an “AI hype hangover,” in which implementation challenges, cost overruns, and underwhelming pilot results quickly dim the glow of AI’s potential. Similar cycles occurred with cloud and digital transformation, but this time the pace and pressure are even more intense. ... Too many leaders expect AI to be a generalized solution, but AI implementations are highly context-dependent. The problems you can solve with AI (and whether those solutions justify the investment) vary dramatically from enterprise to enterprise. This leads to a proliferation of small, underwhelming pilot projects, few of which are scaled broadly enough to demonstrate tangible business value. In short, for every triumphant AI story, numerous enterprises are still waiting for any tangible payoff. For some companies, it won’t happen anytime soon—or at all. ... Beyond data, there is the challenge of computational infrastructure: servers, security, compliance, and hiring or training new talent. These are not luxuries but prerequisites for any scalable, reliable AI implementation. In times of economic uncertainty, most enterprises are unable or unwilling to allocate the funds for a complete transformation.

4th-Party Risk: How Commercial Software Puts You At Risk

Unlike third-party providers, however, there are no contractual relationships between businesses and their fourth-party vendors. That means companies have little to no visibility into those vendors' operations, only blind spots that are fueling an even greater need to shift from trust-based to evidence-based approaches. That lack of visibility has severe consequences for enterprises and other end-user organizations. ... Illuminating 4th-party blind spots begins with mapping critical dependencies through direct vendors. As you go about this process, don't settle for static lists. Software supply chains are the most common attack vector, and every piece of software you receive contains evidence of its supply chain. This includes embedded libraries, development artifacts, and behavioral patterns. ... Businesses must also implement some broader frameworks that go beyond the traditional options, such as NIST CSF or ISO 27001, which provide a foundation but ultimately fall short by assuming businesses lack control in their fourth-party relationships. This stems from the fact that no contractual relationships exist that far downstream, and without contractual obligations, a business cannot conduct risk assessments, demand compliance documentation, or launch an audit as it might with a third-party vendor. ... Also consider SLSA (Supply Chain Levels for Software Artifacts). These provide measurable security controls to prevent tampering and ensure integrity. For companies operating in regulated industries, consider aligning with emerging requirements.

Geopatriation and sovereign cloud: how data returns to the source

The key to understanding a sovereign cloud, adds Google Cloud Spain’s national technology director Héctor Sánchez Montenegro, is that it’s not a one-size-fits-all concept. “Depending on the location, sector, or regulatory context, sovereignty has a different meaning for each customer,” he says. Google already offers sovereign clouds, whose guarantee of sovereignty isn’t based on a single product, but on a strategy that separates the technology from the operations. “We understand that sovereignty isn’t binary, but rather a spectrum of needs we guarantee through three levels of isolation and control,” he adds. ... One of the certainties of this sovereign cloud boom is it’s closely connected to the context in which organizations, companies, and other cloud end users operate. While digital sovereignty was less prevalent at the beginning of the century, it’s now become ubiquitous, especially as political decisions in various countries have solidified technology as a key geostrategic asset. “Data sovereignty is a fundamental part of digital sovereignty, to the point that in practice, it’s becoming a requirement for employment contracts,” says María Loza ... With the technological landscape becoming more unsure and complex, the goal is to know and mitigate risks where possible, and create additional options. “We’re at a crucial moment,” Loza Correa points out. “Data is a key business asset that must be protected.”

Managing AI Risk in a Non-Deterministic World: A CTO’s Perspective

Drawing parallels to the early days of cloud computing, Chawla notes that while AI platforms will eventually rationalize around a smaller set of leaders, organizations cannot afford to wait for that clarity. “The smartest investments right now are fearlessly establishing good data infrastructure, sound fundamentals, and flexible architectures,” she explains. In a world where foundational models are broadly accessible, Chawla argues that differentiation shifts elsewhere. ... Beyond tooling, Chawla emphasizes operating principles that help organizations break silos. “Improve the quality at the source,” she says. “Bring DevOps principles into DataOps. Clean it up front, keep data where it is, and provide access where it needs to be.” ... Bias, hallucinations, and unintended propagation of sensitive data are no longer theoretical risks. Addressing them requires more than traditional security controls. “It’s layering additional controls,” Chawla says, “especially as we look at agentic AI and agentic ops.” ... Auditing and traceability are equally critical, especially as models are fine-tuned with proprietary data. “You don’t want to introduce new bias or model drift,” she explains. “Testing for bias is super important.” While regulatory environments differ across regions, Chawla stresses that existing requirements like GDPR, data sovereignty, PCI, and HIPAA still apply. AI does not replace those obligations; it intensifies them.

CVEs are set to top 50,000 this year, marking a record high – here’s how CISOs and security teams can prepare for a looming onslaught

"Much like a city planner considering population growth before commissioning new infrastructure, security teams benefit from understanding the likely volume and shape of vulnerabilities they will need to process," Leverett added. "The difference between preparing for 30,000 vulnerabilities and 100,000 is not merely operational, it’s strategic." While the figures may be jarring for business leaders, Kevin Knight, CEO of Talion, said it’s not quite a worst-case scenario. Indeed, it’s the impact of the vulnerabilities within their specific environments that business leaders and CISOs should be focusing on. ... Naturally, security teams could face higher workloads and will be contending with a more perilous threat landscape moving forward. Adding insult to injury, Knight noted that security teams are often brought in late during the procurement process - sometimes after contracts have been signed. In some cases, applications are also deployed without the CISO’s knowledge altogether, creating blind spots and increasing the risk that critical vulnerabilities are being missed. Meanwhile, poor third-party risk management means organizations can unknowingly inherit their suppliers’ vulnerabilities, effectively expanding their attack surface and putting their sensitive data at risk of being breached. "As CVE disclosures continue to rise, businesses must ensure the CISO is involved from the outset of technology decisions," he said.

Data Privacy in the Age of AI

The first challenge stems from the fact that AI systems run on large volumes of customer data. This “naturally increases the risk of data being used in ways that go beyond what customers originally expected, or what regulations allow,” says Chiara Gelmini, financial services industry solutions director at Pegasystems. This is made trickier by the fact that some AI models can be “black boxes to a certain degree,” she says. “So it’s not always clear, internally or to customers, how data is used or how decisions are actually made," she tells SC Media UK. ... AI is “fully inside” the existing data‑protection regime the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Gelmini explains. Under these current laws, if an AI system uses personal data, it must meet the same standards of lawfulness, transparency, data minimisation, accuracy, security and accountability as any other processing, she says. Meanwhile, organisations are expected to prove they have thought the area through, typically by carrying out a Data Protection Impact Assessment (DPIA) before deploying high‑risk AI. ... The growing use of AI can pose a risk, but only if it gets out of hand. As AI becomes easier to adopt and more widespread, the practical way to stay ahead of these risks is “strong, AI governance,” says Gelmini. “Firms should build privacy in from the start, mask private data, lock down security, make models explainable, test for bias, and keep a close eye on how systems behave over time."

Daily Tech Digest - January 20, 2026

Quote for the day:

"The level of morale is a good barometer of how each of your people is experiencing your leadership." -- Danny Cox

The culture you can’t see is running your security operations

Non-observable culture is everything happening inside people’s heads. Their beliefs about cyber risk. Their attitudes toward security. Their values and priorities when security conflicts with convenience or speed. This is where the real decisions get made. You can’t see someone’s belief that “we’re too small to be targeted” or “security is IT’s job, not mine.” You can’t measure their assumption that compliance equals security. You can’t audit their gut feeling that reporting a mistake will hurt their career. But these invisible forces shape every security decision your people make. Non-observable culture includes beliefs about the likelihood and severity of threats. It includes how people weigh security against productivity. It includes their trust in leadership and their willingness to admit mistakes. It includes all the cognitive biases that distort risk perception. ... Implicit culture is the stuff nobody talks about because nobody even realizes it’s there. The unspoken assumptions. The invisible norms. The “way things are done here” that everyone knows but nobody questions. This is the most powerful layer because it operates below conscious awareness. People don’t choose to follow implicit norms. They do. Automatically. Without thinking. Implicit culture includes unspoken beliefs like “security slows us down” or “leadership doesn’t really care about this.” It contains hidden power dynamics that determine who can challenge security decisions and who can’t.

The top 6 project management mistakes — and what to do instead

Project managers are trained to solve project problems. Scope creep. Missed deadlines. Resource bottlenecks. ... Start by helping your teams understand the business context behind the work. What problem are we trying to solve? Why does this project matter to the organization? What outcome are we aiming for? Your teams can’t answer those questions unless you bring them into the strategy conversation. When they understand the business goals, not just the project goals, they can start making decisions differently. Their conversations change to ensure everyone knows why their work matters. ... Right from the start of the project, you need to define not just the business goal but how you’ll measure it was successful in business terms. Did the project reduce cost, increase revenue, improve the customer experience? That’s what you and your peers care about, but often that’s not the focus you ask the project people to drive toward. ... People don’t resist because they’re lazy or difficult. They resist because they don’t understand why it’s happening or what it means for them. And no amount of process will fix that. With an accelerated delivery plan designed to drive business value, your project teams can now turn their attention to bringing people with them through the change process. ... To keep people engaged in the project and help it keep accelerating toward business goals, you need purpose-driven communication designed to drive actions and decisions.

AI has static identity verification in its crosshairs. Now what?

Identity models based on “joiner–mover–leaver” workflows and static permission assignments cannot keep pace with the fluid and temporary nature of AI agents. These systems assume identities are created carefully, permissions are assigned deliberately, and changes rarely happen. AI changes all of that. An agent can be created, perform sensitive tasks, and terminate within seconds. If your verification model only checks identity at login, you’re leaving the entire session vulnerable. ... Securing AI-driven enterprises requires a shift similar to what we saw in the move from traditional firewalls to zero-trust architectures. We didn’t eliminate networks; we elevated policy and verification to operate continuously at runtime. Identity verification for AI must follow the same path. This means building a system that can: Assign verifiable identities to every human and machine actor; Evaluate permissions dynamically based on context and intent; Enforce least privilege at high velocity; Verify actions, not just entry points; ... This is why frameworks like SPIFFE and modern workload identity systems are receiving so much attention. They treat identity as a short-lived, cryptographically verifiable construct that can be created, used, and retired in seconds, exactly the model AI agents require. Human activity is becoming the minority as autonomous systems that can act faster than we can are being spun up and terminated before governance can keep up. That’s why identity verification must shift from a checkpoint to a real-time trust engine that evaluates every action from every actor, human or AI.

AWS European cloud service launch raises questions over sovereignty

AWS established a new legal entity to operate the European Sovereign Cloud under a separate governance and operational model. The new company is incorporated in Germany and run exclusively by EU residents, AWS said. ... “This is the elephant in the room,” said Rene Buest, senior director analyst at Gartner. There are two main concerns regarding the operation of AWS’s European Sovereign Cloud for businesses in Europe. The first relates to the 2018 US Cloud Act, which could require AWS to disclose customer data stored in Europe to the United States, if requested by US authorities. The second involves the possibility of US government sanctions: If a business that uses AWS services is subject to such sanctions, AWS may be compelled to block that company’s access to its cloud services, even if its data and operations are based in Europe. ... It’s an open question at this stage, said Dario Maisto, senior analyst at Forrester. “Cases will have to be tested in court before we can have a definite answer,” he said. “The legal ownership does matter, and this is one of the points that may not be addressed by the current setup of the AWS sovereign cloud.” AWS’s European Sovereign Cloud represents one of several ways that European business can approach the challenge of digital sovereignty. Gartner identifies a spectrum that ranges from global hyperscaler public cloud services through to regional cloud services that are based on non-hyperscaler technology.

Why peripheral automation is the missing link in end-to-end digital transformation?

While organisations have successfully modernized their digital cores, the “last mile” of business operations often remains fragmented, manual, and surprisingly analogue. This gap is why Peripheral Automation is emerging not merely as a tactical correction but as the critical missing link in achieving true, end-to-end digital transformation. ... Peripheral Automation offers a strategic resolution to this paradox. It’s an architectural philosophy that advocates “differential innovation.” Rather than disrupting stable cores to accommodate fleeting business needs, organisations build agile, tailored applications and workflows that sit on top of the core systems. This approach treats the enterprise as a layered ecosystem. The core remains the single source of truth, but the periphery becomes the “system of engagement”. By leveraging modern low-code platforms and composable architecture, leaders can deploy lightweight, purpose-built automation tools that address specific friction points without altering the underlying infrastructure. ... Peripheral automation reduces process latency, manual effort, and rework. By addressing specific pain points rather than attempting broad, multi-year system redesigns, companies unlock measurable efficiency in weeks. This precision improves throughput, reduces cycle times, and frees teams to focus on high-value work.

How does agentic ops transform IT troubleshooting?

AI Canvas introduces a fundamentally different user experience for network troubleshooting. Rather than navigating through multiple dashboards and CLI interfaces, engineers interact with a dynamic canvas that populates with relevant widgets as troubleshooting progresses. You could say that the ‘canvas’ part of the name AI Canvas is the most important part of it. That is, AI Canvas is actually a blank canvas every time you start troubleshooting. It fills the canvas with boxes and on the fly widgets, among other things, during the troubleshooting. Sampath confirms this: “When you ask a question, it’s using and picking the right types of tools that it can go and execute on a specific task and calls agents to be able to effectively take a task to completion and returns a response back.” The system can spin up monitoring agents that continuously provide updated information, creating a living troubleshooting environment rather than static reports. ... AI Canvas doesn’t exist in isolation. It builds on Cisco’s existing automation foundation. The company previously launched Workflows, a no-code network automation engine, and AI assistants with specific skills for network operations. “All of the automations that are already baked into the workflows, the skills that were built inside of the assistants, now manifest themselves inside of the canvas,” Sampath details. This creates a continuum from deterministic workflows to semi-autonomous assistants to fully autonomous agentic operations.

UK government launches industry 'ambassadors' scheme to champion software security improvements

"By acting as ambassadors, signatories are committing to a process of transparency, development and continuous improvement. The implementation of this code of practice will take time and, in doing so, may bring to light issues that need to be addressed," DSIT said in a statement confirming the announcement. "Signatories and policymakers will learn from these issues as well as the successes and challenges for each organization and, where appropriate, will share information to help develop and strengthen this government policy." ... The Software Security Code of Practice was unveiled by the NCSC in May last year, setting out a series of voluntary principles defining what good software security looks like across the entire software lifecycle. Aimed at technology providers and organizations that develop, sell, or procure software, the code offers best practices for secure design and development, build-environment security, and secure deployment and maintenance. The code also emphasizes the importance of transparent communication with customers on potential security risks and vulnerabilities. ... “The code moves software security beyond narrow compliance and elevates it to a board-level resilience priority. As supply chain attacks continue to grow in scale and impact, a shared baseline is essential and through our global community and expertise, ISC2 is committed to helping professionals build the skills needed to put secure-by-design principles into practice.”

Privacy teams feel the strain as AI, breaches, and budgets collide

Where boards prioritize privacy, AI use appears more frequently and follows defined direction. Larger enterprises, particularly those with broader risk and compliance functions, also report higher uptake. In smaller organizations, or those where privacy has limited visibility at the leadership level, AI adoption remains tentative. Teams that apply privacy principles throughout system development report higher use of AI for privacy tasks. In these environments, AI supports ongoing work rather than introducing new approaches. ... Respondents working in organizations where privacy has active board backing report more consistent use of privacy by design. Budget stability shows a similar pattern, with better-funded teams reporting stronger integration of privacy into design and engineering work. The study also shows that privacy by design on its own does not stop breaches. Organizations that experienced breaches report similar levels of design practice as those that did not. The data places privacy by design mainly in a governance and compliance role, with limited connection to incident prevention. ... Governance shapes how teams view that risk. Professionals in organizations where privacy lacks board priority report higher expectations of a breach in the coming year. Gaps between privacy strategy and broader business goals also appear alongside higher breach expectations, suggesting that structural alignment influences outlook as much as technical controls. Confidence remains common, even among organizations that have experienced breaches.

Cyber Insights 2026: Information Sharing

The sheer volume of cyber threat intelligence being generated today is overwhelming. “Information sharing channels often help condense inputs and highlight genuine signals amid industry noise,” says Caitlin Condon, VP of security research at VulnCheck. “The very nature of cyber threat intelligence demands validation, context, and comparison. Information sharing allows cybersecurity professionals to more rigorously assess rising threats, identify new trends and deviations, and develop technically comprehensive guidance.” ... “The importance of the Cybersecurity Information Sharing Act of 2015 for U.S. national security cannot be overstated,” says Crystal Morin, cybersecurity strategist at Sysdig. “Without legal protections, many legal departments would advise security teams to pull back from sharing threat intelligence, resulting in slower, more cautious processes. ...” CISOs have developed their own closed communities where they can discuss current incidents with other CISOs. This is done via channels such as Slack, WhatsApp and Signal. Security of the channels is a concern, but who better than multiple CISOs to monitor and control security? ... “Much of today’s threat intelligence remains reactive, driven by short-lived IoCs that do little to help agencies anticipate or disrupt cyberattacks,” comments BeyondTrust’s Greene. “We need to modernize our information-sharing framework to emphasize behavior-based analytics enriched with identity-centric context,” he continues.

Edge AI: The future of AI inference is smarter local compute

The bump in edge AI goes hand in hand with a broader shift in focus from AI training, the act of preparing machine learning (ML) models with the right data, to inference, the practice of actively using models to apply knowledge or make predictions in production. “Advancements in powerful, energy-efficient AI processors and the proliferation of IoT (internet of things) devices are also fueling this trend, enabling complex AI models to run directly on edge devices,” says Sumeet Agrawal ... “The primary driver behind the edge AI boom is the critical need for real-time data processing,” says David. The ability to analyze data on the edge, rather than using centralized cloud-based AI workloads, helps direct immediate decisions at the source. Others agree. “Interest in edge AI is experiencing massive growth,” says Informatica’s Agrawal. For him, reduced latency is a key factor, especially in industrial or automotive settings where split-second decisions are critical. There is also the desire to feed ML models personal or proprietary context without sending such data to the cloud. “Privacy is one powerful driver,” says Johann Schleier-Smith ... A smaller footprint for local AI is helpful for edge devices, where resources like processing capacity and bandwidth are constrained. As such, techniques to optimize SLMs will be a key area to aid AI on the edge. One strategy is quantization, a model compression technique that reduces model size and processing requirements.

Daily Tech Digest - December 07, 2025

Quote for the day:

"Definiteness of purpose is the starting point of all achievement." -- W. Clement Stone

Balancing AI innovation and cost: The new FinOps mandate

Yet as AI moves from pilot to production, an uncomfortable truth is emerging: AI is expensive. Not because of reckless spending, but because the economics of AI are unlike anything technology leaders have managed before. Most CIOs and CTOs underestimate the financial complexity of scaling AI. Models that double in size can consume ten times the compute. Exponential should be your watchword. Inference workloads run continuously, consuming GPU cycles long after training ends, which creates a higher ongoing cost compared to traditional IT projects. ... The irony is that even as AI drives operational efficiency, its own operating costs are becoming one of the biggest drags on IT budgets. IDC’s research shows that, without tighter alignment between line of business, finance, and platform engineering, enterprises risk turning AI from an innovation catalyst into a financial liability. ... AI workloads cut across infrastructure, application development, data governance, and business operations. Many AI workloads will run in a hybrid environment, meaning cost impacts for on-premises as well as cloud and SaaS are expected. Managing this multicloud and hybrid landscape demands a unified operating model that connects technical telemetry with financial insight. The new FinOps leader will need fluency in both IT engineering and economics — a rare but rapidly growing skill set that will define next-generation IT leadership.

Local clouds shape Europe’s AI future

The new “sovereign” offerings from US-based cloud providers like Microsoft, AWS, and Google represent a significant step forward. They are building cloud regions within the EU, promising that customer data will remain local, be overseen by European citizens, and comply with EU laws. They’ve hired local staff, established European governance, and crafted agreements to meet strict EU regulations. The goal is to reassure customers and satisfy regulators. For European organizations facing tough questions, these steps often feel inadequate. Regardless of how localized the infrastructure is, most global cloud giants still have their headquarters in the United States, subject to US law and potential political pressure. There is always a lingering, albeit theoretical, risk that the US government might assert legal or administrative rights over data stored in Europe. ... As more European organizations pursue digital transformation and AI-driven growth, the evidence is mounting: The new sovereign cloud solutions launched by the global tech giants aren’t winning over the market’s most sensitive or risk-averse customers. Those who require freedom from foreign jurisdiction and total assurance that their data is shielded from all external interference are voting with their budgets for the homegrown players. ... In the months and years ahead, I predict that Europe’s own clouds—backed by strong local partnerships and deep familiarity with regulatory nuance—will serve as the true engine for the region’s AI ambitions.

When Innovation and Risks Collide: Hexnode and Asia’s Cybersecurity Paradox

“If you look at the way most cyberattacks happen today—take ransomware, for example—they often begin with one compromised account. From there, attackers try to move laterally across the network, hunting for high-value data or systems. By segmenting the network and requiring re-authentication at each step, ZT essentially blocks that free movement. It’s a “verify first, then grant access” philosophy, and it dramatically reduces the attacker’s options,” Pavithran explained. Unfortunately, way too many organisations still view Zero Trust as a tool rather than a strategic framework. Others believe it requires ripping out existing infrastructure. In reality, however, Zero Trust can be implemented incrementally and is both adaptable and scalable. It integrates technologies such as multifactor authentication, microsegmentation, and identity and access management into a cohesive architecture. Crucially, Zero Trust is not a one-off project. It is a continuous process of monitoring, verification, and fine-tuning. As threats evolve, so too must policies and controls. “Zero Trust isn’t a box you check and move on from,” Pavithran emphasised. “It’s a continuous, evolving process. Threats evolve, technologies evolve, and so do business needs. That means policies and controls need to be constantly reviewed and fine-tuned. It’s about continuous monitoring and ongoing vigilance—making sure that every access request, every single time, is both appropriate and secure.”

CIOs take note: talent will walk without real training and leadership

“Attracting and retaining talent is a problem, so things are outsourced,” says the CIO of a small healthcare company with an IT team of three. “You offload the responsibility and free up internal resources at the risk of losing know-how in the company. But at the moment, we have no other choice. We can’t offer the salaries of a large private group, and IT talent changes jobs every two years, so keeping people motivated is difficult. We hire a candidate, go through the training, and see them grow only to see them leave. But our sector is highly specialized and the necessary skills are rare.” ... CIOs also recognize the importance of following people closely, empowering them, and giving them a precise and relevant role that enhances motivation. It’s also essential to collaborate with the HR function to develop tools for welfare and well-being. According to the Gi Group study, the factors that IT candidates in Italy consider a priority when choosing an employer are, in descending order, salary, a hybrid job offer, work-life balance, the possibility of covering roles that don’t involve high stress levels, and opportunities for career advancement and professional growth. But there’s another aspect that helps solve the age-old issue of talent management. CIOs need to recognize more of the role of their leadership. At the moment, Italian IT directors place it at the bottom of their key qualities.

Rethinking the CIO-CISO Dynamic in the Age of AI

Today's CIOs are perpetual jugglers, balancing budgets and helping spur technology innovation at speed while making sure IT goals are aligned with business priorities, especially when it comes to navigating mandates from boards and senior leaders to streamline and drive efficiency through the latest AI solutions. ... "The most common concern with having the CISO report into legal is that legal is not technically inclined," she said. "This is actually a positive as cybersecurity has become more of a business-enabling function over a technological one. It also requires the CISO to translate tech-speak into language that is understandable by non-tech leaders in the organization and incorporate business and strategic drivers." As organizations undergo digital transformation and incorporate AI into their tech stacks, more are creating alternate C-suite roles such as "Chief Digital Officer" and "Chief AI Officer." ... When it comes to AI systems, the CISO's organization may be better positioned to lead enterprise-wide transformation, Sacolick said. AI systems are nondeterministic - they can produce different outputs and follow different computational paths even when given the exact same input - and this type of technology may be better suited for CISOs. CIOs have operated in the world of deterministic IT systems, where code, infrastructure systems, testing frameworks and automation provide predictable and consistent outputs, while CISOs are immersed in a world of ever-changing, unpredictable threats.

The AI reckoning: How boards can evolve

AI-savvy boards will be able to help their companies navigate these risks and opportunities. According to a 2025 MIT study, organizations with digitally and AI-savvy boards outperform their peers by 10.9 percentage points in return on equity, while those without are 3.8 percent below their industry average.5 What boards should do, however, is the bigger question—and the focus of this article. The intensity of the board’s role will depend on the extent to which AI is likely to affect the business and its competitive dynamics and the resulting risks and opportunities. Those competitive dynamics should shape the company’s AI posture and the board’s governance stance. ... What matters is that the board aligns on the business’s aspirational strategy using a clear view of the opportunities and risks so that it can tailor the governance approach. As the business gains greater experience with AI, the board can modify its posture. ... Directors should focus on determining whether management has the entrepreneurial experience, technological know-how, and transformational leadership experience to run an AI-driven business. The board’s role is particularly important in scrutinizing the sustainability of these ventures—including required skills, implications on the traditional business, and energy consumption—while having a clear view of the range of risks to address, such as data privacy, cybersecurity, the global regulatory environment, and intellectual property (IP).

Do Tariffs Solicit Cyber Attention? Escalating Risk in a Fractured Supply Chain

Offensive cyber operations are a fourth possibility largely serving to achieve the tactical and strategic objectives of decisionmakers, or in the case of tariff imposition, retaliation. Depending on its goals, a government may use the cyber domain to steal sensitive information such as amount and duration of a potential tariff or try to ascertain the short- and long-term intent of the tariff-imposing government. A second option may be a more aggressive response, executing disruptive operations to signal its dissatisfaction over tariff rates. ... It’s tempting to think of tariffs as purely a policy lever, and a way to increase revenue or ratchet up pressure on foreign governments. But in today’s interconnected world, trade policy and cybersecurity policy are deeply intertwined. When they aren’t aligned, companies risk becoming collateral damage in the larger geopolitical space, where hostile actors jockey to not only steal data for profit, but also look to steal secrets, compromise infrastructure, and undermine trust. This offers adversaries new ways to facilitate cyber intrusion to accomplish all of these objectives, requiring organizations to up their efforts in countering these threats via a variety of established practices. These include rigorous third-party vetting; continuous monitoring of third-party access through updates, remote connections, and network interfaces; implementing zero trust architecture; and designing incident response playbooks specifically around supply-chain breaches, counterfeit-hardware incidents, and firmware-level intrusions.

Resilience: How Leaders Build Organizations That Bend, Not Break

Resilient leaders don’t aim to restore what was; they reinvent what’s next. Leadership today is less about stability and more about elasticity—the ability to stretch, adapt, and rebound without breaking. ... Resilient cultures don’t eliminate risk—they absorb it. Leaders who privilege learning over blame and transparency over perfection create teams that can think clearly under pressure. In my companies, we’ve operationalized this with short, ritualized cadences—weekly priorities, daily huddles, and tight AARs that focus on behavior, not ego. The goal is never to defend a plan; it’s to upgrade it. ... “Resilience is mostly about adaptation rather than risk mitigation.” The distinction matters. Risk mitigation reduces downside. Adaptation converts disruption into forward motion. The organizations that redefine their categories after shocks aren’t the ones that avoid volatility; they’re the ones that metabolize it. ... In uncertainty, people don’t expect perfection—they expect presence. Transparent leadership doesn’t eliminate volatility, but it changes how teams experience it. Silence erodes trust faster than any market correction; people fill gaps with assumptions that are worse than reality. ... Treat resilience as design, not reaction. Build cultures that absorb shock, operating systems that learn fast, and communication habits that anchor trust. In an era where strategy half-life keeps shrinking, these are the leaders—and organizations—that won’t just survive volatility.

AI-Powered Quality Engineering: How Generative Models Are Rewriting Test Strategies

Despite significant investments in automation, many organizations still struggle with the same bottlenecks. Test suites often collapse due to minor UI changes. Maintenance cycles grow longer each quarter. Even mature teams rarely achieve effective coverage that truly exceeds 70-80%. Regression cycles stretch for days or weeks, slowing down release velocity and diluting confidence across engineering teams. It isn’t just productivity that suffers; it’s trust. These problems reduce teams’ confidence in releasing immediately and diminish automation ROI in addition to slowing down delivery. Traditional test automation has reached its limits because it automates execution, not understanding. And this is exactly where Generative AI changes the conversation. ... Synthetic data that mirrors production variability can be produced without waiting for dependent systems. Scripts no longer break every time a button shifts. As AI self-heal selectors and locators without human assistance, tests start to regenerate themselves. While predictive signals identify defects early through examining past data and patterns, natural-language inputs streamline test descriptions. ... GenAI isn’t magic, though. When generative models are fed ambiguous input, they can produce brittle or incorrect test cases. Ingesting production logs without adequate anonymization introduces privacy and compliance risks. Risks to data privacy and compliance must be considered while using production traces.

The Great Cloud Exodus: Why European Companies Are Massively Returning to Their Own Infrastructure

Many European managers and policymakers live under the assumption that when they choose "Region Western Europe" (often physically located in datacenters around Amsterdam or Eemshaven), their data is safely shielded from American interference. "The data is in our country, isn't it?" is the oft-heard defense. This is, legally speaking, a dangerous illusion. American legislation doesn't look at the ground on which the server stands, but at who holds the keys to the front door. ... The legal criterion is not the location of the server, but the control ("possession, custody, or control") that the American parent company has over the data. Since Microsoft Corporation in Redmond, Washington, has full control over subsidiary Microsoft Netherlands BV, data in the datacenter in the Wieringermeer legally falls under the direct scope of an American subpoena. ... Additionally, Microsoft applies "consistent global pricing," meaning European customers often see additional increases to align Euro prices with the strong US dollar. This makes budgeting a nightmare of foreign exchange risks. AWS shows a similar pattern. The complexity of the AWS bill is now notorious; an entire industry of "FinOps" consultants has emerged to help companies understand their invoice. ... or organizations seeking ultimate control and data sovereignty, purchasing own hardware and placing it in a Dutch datacenter is the best option. This approach combines the advantages of on-premise with the infrastructure of a professional datacenter.