Daily Tech Digest by Kannan Subbiah: talent management

Showing posts with label talent management. Show all posts

Daily Tech Digest - June 05, 2026

Quote for the day:

“Without data, you’re just another person with an opinion.” -- W. Edwards Deming

🎧 Listen to this digest on YouTube Music

Duration: 22 mins • Perfect for listening on the go.

Industry 5.0’s Hidden Challenge: Managing Risk in the Hyperconnected Factory

As manufacturing transitions into Industry 5.0, the focus is shifting from simple automation to deep collaboration between human workers and advanced machinery. While these hyperconnected factories offer significant improvements in efficiency and customization, they also introduce serious, often overlooked vulnerabilities. The core issue lies in the merging of traditional physical equipment with modern internet-connected systems. This integration creates a massive target for cyber threats. When factory floors are wired directly to global networks, a single security breach can do more than steal data; it can halt physical production entirely. Furthermore, because these modern facilities rely on interconnected supply chains, a weakness in a smaller partner’s system can quickly spread to the main operation. Managing these risks requires a shift from reactive problem-solving to building long-term operational resilience. Manufacturers must implement strict security measures, such as dividing networks to contain potential breaches and ensuring constant monitoring of their equipment. More importantly, they need to invest in training their workforce to recognize and respond to these modern threats. Ultimately, as factories become more intelligent and connected, companies must treat security not as a separate IT problem, but as a fundamental part of the manufacturing process to keep operations running smoothly and safely.

Copilot Billing Shock Hits Developers

Following GitHub Copilot’s recent shift to a usage-based billing model, developers are facing unexpected and dramatically higher costs. Instead of offering unlimited premium requests, the new system charges users via AI credits based on their token consumption, which accounts for input, output, and cached data. Since this change took effect, many users have reported burning through massive portions of their monthly credit allotments in a single day, often just by running basic queries or making minor code adjustments. Some developers project monthly expenses to skyrocket from standard subscription rates to thousands of dollars, particularly when using advanced models or automated tools that process large amounts of context. While the reaction across developer communities has been largely critical, with many canceling their subscriptions and looking for alternative solutions, neither GitHub nor Microsoft has directly addressed the backlash. However, they have provided documentation on how to manage these new expenses. To keep costs under control, developers are encouraged to implement strict budget caps and monitor their daily usage closely. Practical strategies include switching to less expensive models for routine tasks, breaking large requests into smaller parts, avoiding pasting entire codebases into prompts, and limiting the use of automated background tools. By adopting these careful prompting habits, users can better manage resources and avoid financial surprises.

How Risk Management Frameworks Protect Organisations from Insider Threats

When dealing with cybersecurity, organizations frequently focus on external attacks and overlook the risks posed by their own employees, contractors, or vendors. Protecting against these insider threats requires more than just reactive measures; it demands a structured approach rooted in risk management frameworks. Standardized models like NIST or ISO 27001 provide a clear foundation to help organizations systematically identify, assess, and handle vulnerabilities before they result in serious damage. Rather than relying on guesswork, these frameworks encourage practical steps such as mapping user roles, reviewing asset inventories, and carefully analyzing data flow. A critical component is establishing strong governance that clearly defines who is accountable across departments, bridging the gap between IT, human resources, and legal teams. By integrating access controls, organizations can enforce strict permissions so individuals only access the information necessary for their specific roles. Furthermore, utilizing continuous monitoring and behavioral analytics allows security teams to detect unusual activities, such as irregular login times or massive data transfers, long before they escalate. Alongside technical defenses, effective frameworks outline clear incident response plans and emphasize the importance of cultivating a strong security culture. Ultimately, educating staff and fostering an environment where suspicious activity can be reported safely helps businesses maintain solid long-term resilience against internal security risks.

Segment With Purpose: A Zero Trust Blueprint For OT Network Segmentation In Manufacturing

Protecting manufacturing operations requires more than simply placing a firewall at the network perimeter. Because manufacturing systems control physical processes, security efforts must consider strict requirements for safety, uptime, and real-time performance. This makes network segmentation a vital engineering effort rather than just a standard IT project. The approach begins by identifying the core mission of the facility to ensure that new security controls do not disrupt daily production. From there, a combined team of IT and operational technology professionals should work together to inventory all systems based on their specific roles. Next, the team groups these systems into distinct security zones and carefully restricts communication between them to only what is necessary. Firewalls used in these environments must understand industrial protocols and enforce rules without causing unacceptable delays. High-risk pathways, such as remote access connections, require strict isolation, while physical safety systems need their own separate security domains to guarantee they function during emergencies. Because older industrial equipment cannot always support modern security software, network isolation acts as a necessary compensating control. Finally, testing these designs in a lab environment before a phased rollout prevents costly disruptions on the factory floor. Ultimately, a carefully planned architecture makes a manufacturing plant significantly harder to compromise and easier to recover.

Is the data center industry ready to change for the coming of the 1MW rack?

The data center industry is debating a major infrastructure shift: moving to one-megawatt server racks powered by 800-volt direct current systems. Historically, facilities have relied on alternating current power and managed rack densities averaging around 15 kilowatts. However, as artificial intelligence applications demand increasingly powerful hardware, companies like Nvidia are projecting the need for one-megawatt racks by 2028. Because traditional power systems hit practical capacity limits near 400 kilowatts due to cable congestion and space constraints, achieving this extreme density requires a fundamental redesign toward high-voltage direct current distribution. In the near term, operators might adapt by installing separate power sidecars next to standard racks, but eventually, entire facilities could require ground-up direct current electrical architectures. Despite these projections, industry experts question whether the broader market should undergo such an expensive overhaul based primarily on one company's product roadmap. While top-tier tech firms training massive models will certainly require this capability, other hardware developers are already focusing on more energy-efficient specialist chips. Additionally, as artificial intelligence matures, everyday tasks like answering questions or generating text will likely run on less demanding equipment. Ultimately, building completely redesigned data centers may prove lucrative for early adopters, but over-engineering facilities for a niche scenario could be highly risky for most operators.

The cost of rebuilding talent now exceeds the cost of retaining it

The real estate sector has traditionally relied on a straightforward hiring model: assembling teams for specific projects and dispersing them once the buildings are finished. However, as projects grow larger and more complex, this approach is reaching its limits. According to Mohan Monteiro, the Chief Human Resources Officer at House of Hiranandani, the financial and operational cost of constantly rebuilding teams now outweighs the cost of retaining them. Today's developments involve advanced engineering, tighter regulatory compliance, and buyers who expect consistent quality across all properties. In this environment, relying heavily on informal, temporary labor creates significant risks for both construction standards and accountability. This shift extends beyond the construction site into sales and management. Modern buyers do their own research before they even speak to a representative, meaning sales roles now require informed engagement and trust rather than aggressive closing tactics. When experienced staff leave, companies lose critical customer relationships and institutional knowledge that take months to replace. Monteiro notes that leading developers are recognizing the need for better organizational alignment, connecting site teams, sales, and corporate leadership with shared information. Ultimately, the industry is realizing that long-term workforce stability and continuity are no longer just human resources goals; they are essential commercial advantages required for future growth.

Your outsourcing contract needs XLAs, not just SLAs

When outsourcing IT services, traditional service level agreements (SLAs) are no longer sufficient because they only measure technical processes rather than actual human outcomes. While SLAs ensure baseline operational standards, like system uptime or ticket resolution speed, they often fail to capture whether employees actually feel supported or can efficiently do their jobs. To bridge this gap, organizations must incorporate experience level agreements (XLAs) into their vendor contracts. XLAs shift the focus toward tangible user outcomes, tracking metrics such as employee satisfaction, lost productivity time, ease of accessing support, and overall confidence in IT services. Introducing XLAs does not mean abandoning SLAs. Instead, the two work together to provide a complete picture of IT performance. To implement XLAs successfully, companies and providers need a shared baseline of current employee experience data. Contracts can then require fixed satisfaction scores, continuous metric improvements, or the creation of an experience measurement infrastructure by the provider. For these agreements to work, total transparency is essential; hiding poor scores destroys the accountability the model relies upon. Ultimately, moving to an XLA model represents a significant shift in how companies define IT value. Unless you explicitly demand better employee experiences in your outsourcing contracts, service providers are unlikely to prioritize them over basic technical compliance.

Context as Code - Build-time governance in the era of infinite syntax

In his article on context as code, Artur Huk explores the hidden costs of relying on artificial intelligence to rapidly generate software. Today, automated tools produce working code at incredible speeds, optimizing for quick feature delivery rather than long-term maintainability. Because these systems are designed to always fulfill a user's immediate request, they often bypass established design rules. For instance, an AI might inappropriately force new features directly into critical systems instead of following careful organizational patterns, creating software that works today but becomes a tangled liability tomorrow. Huk points out that we are losing a crucial historical defense mechanism. In the past, compilers acted as rigid gatekeepers that prevented fundamental errors before a program could even run. Now, human language acts as our control system, blurring the line between safe instructions and unpredictable data. This shifts significant risk away from the building phase directly to the live environment. To regain control, Huk suggests we must enforce strict constraints before the code is ever generated. Rather than relying on massive, complex libraries that hide how systems actually work, teams should build clear, transparent structures. By setting firm boundaries and effectively teaching AI tools when to say no, organizations can safely use automated generation without sacrificing their future stability.

Think Inside The Box: How Constraints Can Unleash Your Creativity And Unlock Decision Making

Empowering employees with autonomy over how they execute their tasks is one of the most effective ways to build engagement, pride, and accountability. While leaders often assign specific responsibilities, dictating every step of the process can suppress independent problem solving and create a workforce that simply waits for instructions. On the other hand, many managers hesitate to offer complete freedom due to the genuine financial, reputational, or regulatory risks involved in their operations. To balance these competing needs, organizations should implement a sandbox approach to decision making. In this model, leaders establish clear constraints that represent the acceptable limits of risk, forming the boundaries of the sandbox. Once these rigid parameters are defined, employees are given the full authority to experiment and find the best solutions within that secure space. Building this environment requires three straightforward steps: clearly outlining the goals, communicating the strict boundaries, and stepping back to let employees determine their own methods. Because the parameters can be adjusted for different roles or projects, this structured autonomy protects the company while still fostering innovation at every level. Ultimately, when people understand their limits but have the freedom to navigate within them, they are far more likely to produce meaningful work and deliver better outcomes for the organization.

Investing in Workers to Work with AI

As companies rush to adopt artificial intelligence, many are finding that buying the technology is only half the battle. A significant challenge lies in preparing the workforce. Currently, businesses spend the vast majority of their AI budgets on the technology itself, leaving very little for employee training. This imbalance often leads to poor adoption rates and deep-seated fears among workers that they will soon be replaced by automated systems. To counter this, forward-thinking organizations are developing structured training programs to help their employees confidently work alongside AI. Instead of leaving staff to figure out these complex tools on their own, companies in industries ranging from banking and law to manufacturing are providing dedicated instruction on core skills like clear prompt writing and data analysis. By treating AI as a supportive tool rather than a substitute for human labor, these programs reassure employees that their jobs are secure. When workers understand how to use these systems safely and effectively, they can automate repetitive tasks and focus their time on more valuable work. Ultimately, successful AI integration requires a strong commitment to education. Investing in comprehensive training not only builds trust and reduces anxiety, but it ensures that organizations actually see the productivity gains they expect from their technological investments.

Daily Tech Digest - December 07, 2025

Quote for the day:

"Definiteness of purpose is the starting point of all achievement." -- W. Clement Stone

Balancing AI innovation and cost: The new FinOps mandate

Yet as AI moves from pilot to production, an uncomfortable truth is emerging: AI is expensive. Not because of reckless spending, but because the economics of AI are unlike anything technology leaders have managed before. Most CIOs and CTOs underestimate the financial complexity of scaling AI. Models that double in size can consume ten times the compute. Exponential should be your watchword. Inference workloads run continuously, consuming GPU cycles long after training ends, which creates a higher ongoing cost compared to traditional IT projects. ... The irony is that even as AI drives operational efficiency, its own operating costs are becoming one of the biggest drags on IT budgets. IDC’s research shows that, without tighter alignment between line of business, finance, and platform engineering, enterprises risk turning AI from an innovation catalyst into a financial liability. ... AI workloads cut across infrastructure, application development, data governance, and business operations. Many AI workloads will run in a hybrid environment, meaning cost impacts for on-premises as well as cloud and SaaS are expected. Managing this multicloud and hybrid landscape demands a unified operating model that connects technical telemetry with financial insight. The new FinOps leader will need fluency in both IT engineering and economics — a rare but rapidly growing skill set that will define next-generation IT leadership.

Local clouds shape Europe’s AI future

The new “sovereign” offerings from US-based cloud providers like Microsoft, AWS, and Google represent a significant step forward. They are building cloud regions within the EU, promising that customer data will remain local, be overseen by European citizens, and comply with EU laws. They’ve hired local staff, established European governance, and crafted agreements to meet strict EU regulations. The goal is to reassure customers and satisfy regulators. For European organizations facing tough questions, these steps often feel inadequate. Regardless of how localized the infrastructure is, most global cloud giants still have their headquarters in the United States, subject to US law and potential political pressure. There is always a lingering, albeit theoretical, risk that the US government might assert legal or administrative rights over data stored in Europe. ... As more European organizations pursue digital transformation and AI-driven growth, the evidence is mounting: The new sovereign cloud solutions launched by the global tech giants aren’t winning over the market’s most sensitive or risk-averse customers. Those who require freedom from foreign jurisdiction and total assurance that their data is shielded from all external interference are voting with their budgets for the homegrown players. ... In the months and years ahead, I predict that Europe’s own clouds—backed by strong local partnerships and deep familiarity with regulatory nuance—will serve as the true engine for the region’s AI ambitions.

When Innovation and Risks Collide: Hexnode and Asia’s Cybersecurity Paradox

“If you look at the way most cyberattacks happen today—take ransomware, for example—they often begin with one compromised account. From there, attackers try to move laterally across the network, hunting for high-value data or systems. By segmenting the network and requiring re-authentication at each step, ZT essentially blocks that free movement. It’s a “verify first, then grant access” philosophy, and it dramatically reduces the attacker’s options,” Pavithran explained. Unfortunately, way too many organisations still view Zero Trust as a tool rather than a strategic framework. Others believe it requires ripping out existing infrastructure. In reality, however, Zero Trust can be implemented incrementally and is both adaptable and scalable. It integrates technologies such as multifactor authentication, microsegmentation, and identity and access management into a cohesive architecture. Crucially, Zero Trust is not a one-off project. It is a continuous process of monitoring, verification, and fine-tuning. As threats evolve, so too must policies and controls. “Zero Trust isn’t a box you check and move on from,” Pavithran emphasised. “It’s a continuous, evolving process. Threats evolve, technologies evolve, and so do business needs. That means policies and controls need to be constantly reviewed and fine-tuned. It’s about continuous monitoring and ongoing vigilance—making sure that every access request, every single time, is both appropriate and secure.”

CIOs take note: talent will walk without real training and leadership

“Attracting and retaining talent is a problem, so things are outsourced,” says the CIO of a small healthcare company with an IT team of three. “You offload the responsibility and free up internal resources at the risk of losing know-how in the company. But at the moment, we have no other choice. We can’t offer the salaries of a large private group, and IT talent changes jobs every two years, so keeping people motivated is difficult. We hire a candidate, go through the training, and see them grow only to see them leave. But our sector is highly specialized and the necessary skills are rare.” ... CIOs also recognize the importance of following people closely, empowering them, and giving them a precise and relevant role that enhances motivation. It’s also essential to collaborate with the HR function to develop tools for welfare and well-being. According to the Gi Group study, the factors that IT candidates in Italy consider a priority when choosing an employer are, in descending order, salary, a hybrid job offer, work-life balance, the possibility of covering roles that don’t involve high stress levels, and opportunities for career advancement and professional growth. But there’s another aspect that helps solve the age-old issue of talent management. CIOs need to recognize more of the role of their leadership. At the moment, Italian IT directors place it at the bottom of their key qualities.

Rethinking the CIO-CISO Dynamic in the Age of AI

Today's CIOs are perpetual jugglers, balancing budgets and helping spur technology innovation at speed while making sure IT goals are aligned with business priorities, especially when it comes to navigating mandates from boards and senior leaders to streamline and drive efficiency through the latest AI solutions. ... "The most common concern with having the CISO report into legal is that legal is not technically inclined," she said. "This is actually a positive as cybersecurity has become more of a business-enabling function over a technological one. It also requires the CISO to translate tech-speak into language that is understandable by non-tech leaders in the organization and incorporate business and strategic drivers." As organizations undergo digital transformation and incorporate AI into their tech stacks, more are creating alternate C-suite roles such as "Chief Digital Officer" and "Chief AI Officer." ... When it comes to AI systems, the CISO's organization may be better positioned to lead enterprise-wide transformation, Sacolick said. AI systems are nondeterministic - they can produce different outputs and follow different computational paths even when given the exact same input - and this type of technology may be better suited for CISOs. CIOs have operated in the world of deterministic IT systems, where code, infrastructure systems, testing frameworks and automation provide predictable and consistent outputs, while CISOs are immersed in a world of ever-changing, unpredictable threats.

The AI reckoning: How boards can evolve

AI-savvy boards will be able to help their companies navigate these risks and opportunities. According to a 2025 MIT study, organizations with digitally and AI-savvy boards outperform their peers by 10.9 percentage points in return on equity, while those without are 3.8 percent below their industry average.5 What boards should do, however, is the bigger question—and the focus of this article. The intensity of the board’s role will depend on the extent to which AI is likely to affect the business and its competitive dynamics and the resulting risks and opportunities. Those competitive dynamics should shape the company’s AI posture and the board’s governance stance. ... What matters is that the board aligns on the business’s aspirational strategy using a clear view of the opportunities and risks so that it can tailor the governance approach. As the business gains greater experience with AI, the board can modify its posture. ... Directors should focus on determining whether management has the entrepreneurial experience, technological know-how, and transformational leadership experience to run an AI-driven business. The board’s role is particularly important in scrutinizing the sustainability of these ventures—including required skills, implications on the traditional business, and energy consumption—while having a clear view of the range of risks to address, such as data privacy, cybersecurity, the global regulatory environment, and intellectual property (IP).

Do Tariffs Solicit Cyber Attention? Escalating Risk in a Fractured Supply Chain

Offensive cyber operations are a fourth possibility largely serving to achieve the tactical and strategic objectives of decisionmakers, or in the case of tariff imposition, retaliation. Depending on its goals, a government may use the cyber domain to steal sensitive information such as amount and duration of a potential tariff or try to ascertain the short- and long-term intent of the tariff-imposing government. A second option may be a more aggressive response, executing disruptive operations to signal its dissatisfaction over tariff rates. ... It’s tempting to think of tariffs as purely a policy lever, and a way to increase revenue or ratchet up pressure on foreign governments. But in today’s interconnected world, trade policy and cybersecurity policy are deeply intertwined. When they aren’t aligned, companies risk becoming collateral damage in the larger geopolitical space, where hostile actors jockey to not only steal data for profit, but also look to steal secrets, compromise infrastructure, and undermine trust. This offers adversaries new ways to facilitate cyber intrusion to accomplish all of these objectives, requiring organizations to up their efforts in countering these threats via a variety of established practices. These include rigorous third-party vetting; continuous monitoring of third-party access through updates, remote connections, and network interfaces; implementing zero trust architecture; and designing incident response playbooks specifically around supply-chain breaches, counterfeit-hardware incidents, and firmware-level intrusions.

Resilience: How Leaders Build Organizations That Bend, Not Break

Resilient leaders don’t aim to restore what was; they reinvent what’s next. Leadership today is less about stability and more about elasticity—the ability to stretch, adapt, and rebound without breaking. ... Resilient cultures don’t eliminate risk—they absorb it. Leaders who privilege learning over blame and transparency over perfection create teams that can think clearly under pressure. In my companies, we’ve operationalized this with short, ritualized cadences—weekly priorities, daily huddles, and tight AARs that focus on behavior, not ego. The goal is never to defend a plan; it’s to upgrade it. ... “Resilience is mostly about adaptation rather than risk mitigation.” The distinction matters. Risk mitigation reduces downside. Adaptation converts disruption into forward motion. The organizations that redefine their categories after shocks aren’t the ones that avoid volatility; they’re the ones that metabolize it. ... In uncertainty, people don’t expect perfection—they expect presence. Transparent leadership doesn’t eliminate volatility, but it changes how teams experience it. Silence erodes trust faster than any market correction; people fill gaps with assumptions that are worse than reality. ... Treat resilience as design, not reaction. Build cultures that absorb shock, operating systems that learn fast, and communication habits that anchor trust. In an era where strategy half-life keeps shrinking, these are the leaders—and organizations—that won’t just survive volatility.

AI-Powered Quality Engineering: How Generative Models Are Rewriting Test Strategies

Despite significant investments in automation, many organizations still struggle with the same bottlenecks. Test suites often collapse due to minor UI changes. Maintenance cycles grow longer each quarter. Even mature teams rarely achieve effective coverage that truly exceeds 70-80%. Regression cycles stretch for days or weeks, slowing down release velocity and diluting confidence across engineering teams. It isn’t just productivity that suffers; it’s trust. These problems reduce teams’ confidence in releasing immediately and diminish automation ROI in addition to slowing down delivery. Traditional test automation has reached its limits because it automates execution, not understanding. And this is exactly where Generative AI changes the conversation. ... Synthetic data that mirrors production variability can be produced without waiting for dependent systems. Scripts no longer break every time a button shifts. As AI self-heal selectors and locators without human assistance, tests start to regenerate themselves. While predictive signals identify defects early through examining past data and patterns, natural-language inputs streamline test descriptions. ... GenAI isn’t magic, though. When generative models are fed ambiguous input, they can produce brittle or incorrect test cases. Ingesting production logs without adequate anonymization introduces privacy and compliance risks. Risks to data privacy and compliance must be considered while using production traces.

The Great Cloud Exodus: Why European Companies Are Massively Returning to Their Own Infrastructure

Many European managers and policymakers live under the assumption that when they choose "Region Western Europe" (often physically located in datacenters around Amsterdam or Eemshaven), their data is safely shielded from American interference. "The data is in our country, isn't it?" is the oft-heard defense. This is, legally speaking, a dangerous illusion. American legislation doesn't look at the ground on which the server stands, but at who holds the keys to the front door. ... The legal criterion is not the location of the server, but the control ("possession, custody, or control") that the American parent company has over the data. Since Microsoft Corporation in Redmond, Washington, has full control over subsidiary Microsoft Netherlands BV, data in the datacenter in the Wieringermeer legally falls under the direct scope of an American subpoena. ... Additionally, Microsoft applies "consistent global pricing," meaning European customers often see additional increases to align Euro prices with the strong US dollar. This makes budgeting a nightmare of foreign exchange risks. AWS shows a similar pattern. The complexity of the AWS bill is now notorious; an entire industry of "FinOps" consultants has emerged to help companies understand their invoice. ... or organizations seeking ultimate control and data sovereignty, purchasing own hardware and placing it in a Dutch datacenter is the best option. This approach combines the advantages of on-premise with the infrastructure of a professional datacenter.

Daily Tech Digest - November 12, 2025

Quote for the day:

"Always remember, your focus determines your reality." -- George Lucas

Agentic AI and Solution Architects

are intelligent systems designed to operate with autonomy, agency, and authority—three foundational concepts that define their ability to act independently, pursue goals on behalf of users, and make impactful decisions within defined boundaries. These systems are often built using a , where multiple specialized or generalist agents collaborate, either in centralized or decentralized environments. ... As (IT) architects we drive change that creates business opportunities through technical innovation. One of the key activities of a Solution Architect is to design solutions by applying methods and techniques combined with technical and business expertise. The actual solution design process will follow a similar pattern to that of a creative technology design process. An architect will combine and group the different components together according to stakeholder group and will, over several sessions, develop concept views related to key architectural components, establishing different options. Deciding the “right” option will mean balancing the various criteria like functionality, value for money, compliance, quality, and sustainability. IT architecture design involves complex decision-making, planning, and problem-solving that require human expertise and experience. That is where most of the architect’s work is focused on – using knowledge and experience to research a particular subject, to apply design thinking and to solve problems to establish a solution.

Shadow AI risk: Navigating the growing threat of ungoverned AI adoption

Only half (52%) of global organizations claim to have comprehensive controls in place, with smaller companies lagging even further behind. This lack of robust governance and visibility leaves organizations vulnerable to , compliance failures, and . For many organizations, AI controls are lacking. ... As AI systems become more autonomous and capable of acting on behalf of users, the risks grow even more complex. The rise of agentic AI, which can make decisions and take independent action within systems, amplifies the impact of weak identity security controls. As these advanced AI systems are given more control over critical systems and data, the potential risk of security breaches and compliance failures grows exponentially. To keep pace, security teams must evolve their identity security strategies to include these emerging machine entities, treating them with the same rigor as human identities. ... To effectively mitigate the risks associated with and ungoverned AI adoption, organizations need to start with a solid foundation of governance and visibility. That means implementing clear acceptable use guidelines, access controls, activity logging and auditing, and identity governance for AI entities. By treating AI entities as identities that are subject to the same authentication, authorization, and monitoring as human users, organizations can safely harness the benefits of AI without compromising security.

Secure Product Development Framework: More Than Just Compliance

Security risk assessment is a key activity that starts early in development and continues throughout the product life cycle through on-market support and eventual product retirement. references AAMI SW96, “Standard for medical device security - Security risk management for device manufacturers,” as a recommended standard for a security risk assessment process. Security risk assessment considers both safety and business security risks ... Implementing a clear and consistent security risk assessment process within the SPDF can also save time (and money). Focus can be placed on those areas of the design with the highest security risk, instead of on design areas with little to no security risk. Decisions on whether patches need to be applied in the field are easier to make when based on security risk. Leveraging the same security risk process across products and business areas allows teams to focus on execution rather than designing a new process. Once a product is launched, an SPDF can assist with managing that product. Postmarket SPDF activities include vulnerability monitoring/disclosure, patch management, and incident response. A critical component of vulnerability monitoring is the maintenance and continuous use of a software bill of materials (SBOM). The SBOM provides a machine-readable inventory of all custom, commercial, open-source, and third-party software components within the device.

Vibe Coding Can Create Unseen Vulnerabilities

does accelerate app prototyping and makes software collaboration easier, but it also has several shortcomings. Security is a serious concern. Large language models (LLMs) are inherently vulnerable to security risks when used by those without sufficient security experience. Moreover, the risk is amplified by the fact that AI is so flexible that it’s impossible to give out simple, universal rules on how to make AI write secure code for you. LLMs may use outdated libraries, lack input validation, or fail to follow secure practices. AI code generators also lack an understanding of trust boundaries and system architectures. When using vibe coding, programmer oversight and review are necessary to prevent these issues from entering production code. Working with black-box code also makes it difficult to provide context about the app. For example, improper configurations may expose internal logic by sending sensitive code snippets to external APIs. This can be a real problem in highly regulated industries with strict rules about code handling. Vibe coding also tends to add technical debt, accumulating unreviewed or unexplained blocks of code. Over time, these code blocks proliferate, creating a glut and making code maintenance more difficult. Since less experienced developers tend to use vibe coding, they can overlook security issues. Consider the recent Tea Dating Advice hack. A hacker was able to access 72,000 images stored in a public

The state of cloud-native computing in 2025

“We’ve reached a level of maturity in the cloud-native ecosystem that people might think that things are now a bit boring. While AI is a natural extension of and cloud-native architectures, there are changes required in the architecture to support AI workloads compared to previous workloads. Platform engineering continues to have strong customer interest… and new AI enhancements allow for even greater productivity for developers and operators. ...” said Miniman ... “However, runaway complexity and cost threaten to derail mass enterprise success. The modern observability stack has become an exorbitant black hole, delivering insufficient value for its exorbitant cost and demands a fundamental rethink of data management. Simultaneously, the gamble failed, proving too complex and expensive. The imperative is clear and necessitates pulling workloads back from the brink with democratized data management to pull workloads back onto central platforms,” said Zilka. ... “The focus has shifted from how quickly I can deploy, to how I can get a handle on costs and how resilient my platform is to changes or outages like we saw recently with . Teams are recognising the overhead these technologies have introduced for developers and are centralising that work. We’re seeing more platform teams set best practices, use tooling to enforce them and move from “adoption mode” to “operational excellence,” said Rajabi.

Insurability now a core test for boardroom AI & climate strategy

Organisations face growing threats from data poisoning and cyber-attacks, prompting insurers to play a more decisive role in risk management. Levent Ergin, Chief Climate, Sustainability & AI Strategist at , highlighted the increasing scrutiny on what businesses can insure against. ... AI is now a fixture at board meetings due to its direct impact on company valuation. However, he observes a gap between current boardroom discussions and the transformative potential of AI. "AI is now a standing item in every board meeting because it directly shapes valuation. Investors see it as a signal of how forward-thinking a company really is. But many boards are still asking the wrong question: 'How can we use AI to automate or augment our existing processes?' when they should be asking 'What's possible?' It's not just about automating what already exists; it's about reimagining how things are done. ..." said Hanson. ... "Too many businesses still treat AI projects like any other investment, where the return has to be quantified against a specific outcome. In truth, they should be budgeting for failure. The best innovators plan for things not to work first time, just as pharmaceutical companies or tech giants do, because even a 98% failure rate can still produce world-changing results. The moment we stop fearing failure and start funding it, we'll see genuine AI innovation break through," said Hanson.

Are we in a cyber awareness crisis?

To improve cyber awareness, organizations need to move beyond box-ticking exercises and build engagement through relevance and creativity. This is the advice of Simon Backwell, a member of the Emerging Trends Working Group at professional association , and head of information security at software company . He advocates for interactive, rather than static training, where employees can explore why something was suspicious, as they learn by doing, rather than guessing the right answer and moving on. ... Not only does AI present new risks from its use within the business, but also from the way criminals are using it. “ frequently use gen AI chatbots, and , such as robocall scams, now use deepfakes,” notes Candrick. “AI puts social engineering on steroids, yet cybersecurity leaders are still using the same awareness measures that were already insufficient.” While regulatory pressure will play a role in improving AI-related cybersecurity, regulations will always struggle to keep pace, especially in the UK where the process takes time. For example, the is only now filtering through, much like did back in 2018, says Backwell. But with how fast AI is advancing – almost weekly – these rules risk becoming outdated as soon as they’re released. ... “As board alignment weakens, CISOs have to work harder to translate cyber risk into business impact, because boards now rank business valuation as their top post-incident concern,” says Cooke.

How to build a supercomputer

When it comes to ’s architecture, , head of HPC/AI EMEA research lab, at , describes the design as “the architecture that HPE, with its great heritage, builds for the top systems.” A single cabinet in an EX4000 system can hold up to 64 compute blades – high-density modular servers that share power, cooling, and network resources – within eight compute chassis, all of which are cooled by direct-attached liquid-cooled cold plates supported by a cooling distribution unit (CDU). “It's super integrated," he says. “The back part, which is the whole network infrastructure (), matches the front part, which contains the blades.” For Hunter, HLRS has selected hardware, but Haus explains that with Cray EX systems, customers can, more or less, select their processing unit of choice from whichever vendor they want, and the compute infrastructure can be slotted into the system without the need to total reconfiguration. “Should HLRS decide at some point to swap [Hunter’s] AMD plates for the next generation, or use another competitor’s, the rest of the system stays the same. They could have also decided not to use our network – keep the plates and put a different network in, if we have that in the form factor. [HPE Cray EX architecture] is really tightly matched, but at the same time, it’s flexible," he says. Hunter itself is intended as a transitional system to the , which is due to go online in 2027.

The AI Reskilling Imperative: Bridging India's talent and gender gap

Policies should shift from less general policies to specific interventions. Initiatives such as and need to be bolstered with AI-specific courses available online in the local language. The government can: Sponsor and encourage scholarships and mentorships for Women in AI. Develop financial reward systems for companies reaching gender diversity in their AI teams. Introduce AI literacy and ethics into the national education system, beginning at the secondary school level. ... As the main consumer of AI talent, the private sector should be at the forefront. The first one is the skills-first approach to hiring, but reskilling as an ongoing investment is not an option. Companies should: Devote a huge proportion of CSR budgets to simple AI and digital literacy efforts, especially among women in low-income and rural communities; Launch internal reskilling programs to shift existing workers out of positions at risk of automation (e.g., manual software testing, simple data entry) and into new roles, such as AI integrators or data annotators; Embrace explicit ethical standards for the application of AI, including a workforce transition and support strategy. ... The universities will be obliged to redesign courses that incorporate AI's technical wisdom and infuse them with morals, critical thinking, and subject knowledge. Collaboration between industry and academia is important to ensure courses are practical and incorporate real-world projects.

Enterprises to focus AI spend on cost savings & data control

"CIOs will move from experimenting with AI to orchestrating it, governing outcomes, agents, and data. AI leadership will evolve from pilots to performance. CIOs will be accountable for tangible business outcomes, defining clear frameworks that connect AI investments to enterprise KPIs and ROI. That means managing a new hybrid workforce of humans and digital agents, complete with job descriptions, correlated KPIs and measurement standards, and governance guardrails. Yet none of this will succeed without secure information management, ensuring that the data fueling and training these agents is accurate, compliant, and trustworthy. Simply put, good data results in good AI outcomes. As AI accelerates, traditional network and security operations will be reimagined for an always-on, agent-driven enterprise, where value is derived as much from data discipline as from innovation itself," said Bell. ... "A Major brand fallout will force AI accountability. In the next year, we'll likely see a major brand face real damage from AI misuse. It won't be a cyberattack in the traditional sense but something more subtle, like a plain text prompt injection that manipulates a model into acting against intent. These attacks can force hallucinations, expose proprietary or sensitive information, or break customer trust in seconds. Enterprises will need to verify AI behavior the same way they secure their networks, by checking every input and output. The companies that build AI systems with accountability and transparency at the core will be those that keep their reputations intact," said Berry.

Daily Tech Digest - November 10, 2025

Quote for the day:

"You can only lead others where you yourself are willing to go." -- Lachlan McLean

CISOs must prove the business value of cyber — the right metrics can help

With a foundational , and by aligning metrics to business priorities, cybersecurity leaders can ultimately prove the value of the cyber security function. Useful metrics examples in business terms include maturity, compliance, risk, budget, , and status of (shifting left) adoption, explains. But how does a cybersecurity expert learn what’s important to the business? ... “Boards are faced with complex matters such as impact on interest rates, tariffs, stock price volatility, supply chain issues, profitability, and acquisitions. Then the CISO enters the boardroom with their , patching metrics and ,” Hetner continues. “These metrics are not aligned to what the board is conditioned to reviewing.” ... Rather than just asking “are we secure?” business leaders are asking what metrics their cyber components are using to measure and quantify risk and how they’re spending against those risks. For CISO’s, this goes beyond measuring against frameworks such as NIST, listing a litany of security vulnerabilities they patched, or their mean time to response. “Instead, we can say, ‘This is our potential financial exposure’,” Nolen explains. “So now you’re talking dollars and cents rather than and technical scores that board members don’t care about. What they care about is the bottom line.”

Feeding the AI beast, with some beauty

is placing an unprecedented load on worldwide, and is poised to shoulder a large share of the incremental electricity, real estate, and cooling burden created by rising AI demand. The has estimated a trajectory that AI is accelerating at a rapid pace. Under realistic scenarios, AI workloads alone could require on the order of 1–1.5 GW of continuous IT power—equivalent to 8.8–13 TWh annually—in India by 2030. This translates into a significant new draw on grids, water resources, and capex for cooling and power infrastructure. Recent analyses indicate that while AI’s share of data centre power today stands in the single-digit to low-teens range, it could climb to 20–40 per cent or more by 2030 in some scenarios, fundamentally reshaping the power-consumption profile of digital infrastructure. ... As data centres grow in scale, sustainability is becoming a competitive differentiator—and that’s where Life Cycle Assessments (LCAs) and Environmental Product Declarations (EPDs) play a critical role. An LCA is a systematic method for evaluating the total environmental impact of a product, process, or system across its entire life cycle. For a data centre, this spans both upstream (embodied) impacts—such as construction materials, IT equipment manufacturing, and cooling and power infrastructure including —as well as operational impacts like electricity consumption.

8 IT leadership tips for first-time CIOs

Generally speaking, the first three years can make or break your IT leadership career, given that digital leaders globally tend to stay at one company for just over that length of time on average, according to the 2025 Nash Squared Digital Leadership Report. CIOs looking to sidestep that statistic are taking intentional measures, ensuring they get early wins, and perhaps most importantly, not coming into their role with preconceived ideas about how to lead or assuming what worked in a past job can be replicated. ... The CTO of staffing and recruiting firm Kelly says that “building momentum, finding ways to get quick wins from the low hanging fruit” will help build credibility with the leadership team. Then, you can parlay those into bigger wins and avoid spinning out, he says. ... While making connections and establishing relationships is critical, Lewis stresses the importance of not rushing to change things right away when you’re new to the job. “Let it set for a while,” he says. ... This is especially true of midsize and larger midsize organizations “where the clarity of strategy and clarity of what’s important … isn’t always well documented and well thought out,” Rosenbaum says. Knowing the maturity of your organization is really important, he says. “Some CIO roles are just about keeping the lights on, making sure security is good at a lower level. As the company starts to mature, they start thinking about technology as an enabler, and to that end, they start having maybe a more unified technology strategy.”

Drata’s VP of Data on Rethinking Data Ops for the AI Era: Crawl, Walk, Run — Then Sprint

While may be the shiny new tool, Solomon makes it clear that foundational work around ingestion and transformation is far from trivial. “We live and die by making sure that all the data has been ingested in a fresh manner into the data warehouse,” he explains. He describes the “bread and butter” of the team: synchronizing thousands of from a single-tenant production architecture into the warehouse — closer to real-time. “We do a lot of activities with regard to the , which is just like driving terabytes of data per day.” But the data team isn’t working in isolation. GTM executives return from conferences excited about GenAI. ... Rather than building fully-fledged pipelines from day one, the team prioritizes quick feedback loops — using sandboxes, cloud notebooks, or to test hypotheses. Once business impact is validated, the team gradually introduces cost tracking, governance, and scalability. If a stakeholder’s hypothesis lacks merit, there is no point in building complex data pipelines, governance frameworks, or cost-tracking systems. This shift in mindset, he explains, is something many data teams are grappling with today. Traditionally, data teams were trained to focus on building scalable, robust pipelines from day one — often requiring significant upfront effort. But this often led to cost inefficiencies and delays.

Model Context Protocol Servers: Build or Buy?

"The tension lies in whether you have the sustained capacity to keep pace with protocols that are still being debated by their maintainers," said Rishi Bhargava, co-founder at , a . "Are you prepared to build the plane while it's flying, or would you rather upgrade a finished plane mid-flight?" ... "From a business perspective, the build versus buy decision for boils down to strategic priorities and risk appetite," Jain said. Building MCP servers in-house gives you "complete control," but buying provides "speed, reliability, and lower operational burden," he said. But others think there's no reason to rush your decision. ... "Most companies shouldn't be doing either yet," he said, explaining that companies should first focus on the specific business goals they are trying to achieve, rather than on which existing applications they think should have AI features added. "Build when you have an actual AI application that requires custom data integration and you understand exactly what intelligence you're trying to deploy. If you're simply connecting to your , you don't need MCP at all," Prywata said. ... "It is usually best to build [MCP servers] in-house when compliance, performance tuning, or data sovereignty are key priorities for the business," said Marcus McGehee, founder at The AI Consulting Lab.

Every CIO Fails; The Smart Ones Admit It

There's a "hero CIO" myth deeply rooted in our mindset - the idea that you're the person who makes technology work, no matter what. Admitting failure feels like admitting incompetence, especially in boardrooms where few understand the complexity of IT. Organizational incentives also discourage openness. Many companies punish failure more than they reward learning. I've seen talented CIOs denied promotion because of a single delayed project, even when their broader portfolio delivered value. When institutional memory focuses on what went wrong rather than what was learned, people stop taking risks. The second factor is C-suite politics. In some environments, transparency becomes ammunition. Another team might use a project delay to justify requests for budget increases or to exert influence. And finally, CIOs worry about vendor perception, admitting setbacks could impact pricing, support or their reputation with partners. ... Build your transparency muscle in peacetime, not when something is on fire. By the time a crisis hits, it's too late to establish credibility. Make transparency habitual. Share work in progress, not just results. Celebrate learning, not perfection. Run "pre-mortems" where you assume a project failed and work backwards to identify what could go wrong. And when you make a mistake, own it publicly. The honesty earns you more trust than a polished explanation ever will.

6 proven lessons from the AI projects that broke before they scaled

In analyzing dozens of AI PoCs that sailed on through to full production use — or didn’t — six common pitfalls emerge. Interestingly, it’s not usually the quality of the technology but misaligned goals, poor planning or unrealistic expectations that caused failure. ... Define specific, measurable objectives upfront. Use . For example, aim for “reduce equipment downtime by 15% within six months” rather than a vague “make things better.” Document these goals and align stakeholders early to avoid scope creep. ... Invest in data quality over volume. Use tools like for preprocessing and Great Expectations for data validation to catch issues early. Conduct exploratory data analysis (EDA) with visualizations (like ) to spot outliers or inconsistencies. Clean data is worth more than terabytes of garbage. ... Start simple. Use straightforward algorithms like or from to establish a baseline. Only scale to complex models — — if the problem demands it. Prioritize explainability with tools like to build trust with stakeholders. ... Plan for production from day one. Package models in Docker containers and deploy with for scalability. Use or for efficient inference. Monitor performance with Prometheus and Grafana to catch bottlenecks early. Test under realistic conditions to ensure reliability.

Andela CEO talks about the need for ‘borderless talent’ amid work visa limitation

Globally, three of four IT employers say they lack the tech talent they need, and the outlook will only get more dire as AI creates a demand for high-skilled specialists like data engineers, senior architects, and agentic orchestrators. Visa programs aren’t designed by the laws of supply and demand. They’re defined by policy makers and are updated infrequently. So, they’ll never truly be in sync with the needs of the labor market. ... Brilliant people exist around the world. It’s why they want to sponsor people for . But hiring outside of those traditional pathways — to work with a brilliant machine learning engineer from Cairo or São Paulo, for example — is…a long, painful process that takes months and is inaccessible to them. They don’t know that they can find the right partner, someone who has sorted this all out and vetted talent and developed compliance with global labor and tax laws, etc. Once they understand that those partners exist, the global workforce becomes instantly accessible to them. ... Technical hiring still feels like a gamble, even though software development is, relatively speaking, packed with deterministic skills. There are two main problems. One problem is the data problem. There’s not enough reliable data about what a job actually requires and what a worker is capable of doing. Today, we rely on resumes and job descriptions.

The Overwhelm Epidemic: Why Resilience Begins with You

People have so much to do and not enough time. There’s nothing new with the phenomena of not enough time to do what needs to be done, but today it’s different. Today, it’s unique because this feeling of overwhelm has been continuously expanding since early 2020 as we experienced the pandemic. We’re being overwhelmed to an extent most people are not experienced to deal with. For you in operational resilience, I believe self-care is more critical now than it has ever been. You are only able to help your clients and their systems be resilient to the extent you are taking care of yourself and are resilient. ... Most say something like, “I’m going to double down and focus on this. I’m going to work harder and spend as much time as needed, even if it means cutting into my already precious personal time.” They think working harder is the best approach, but here’s the thing—they are wrong. When you are operating at high-stress levels, introducing more stress by doubling down and working harder, actually reduces your output. ... Bottom line, a thriving, elite mindset is the foundation of personal wellbeing and professional success.  Turning to positive psychology, underlying Martin Seligman‘s model for human flourishing, are 24 positive character strengths. While more research is still needed, the research to date has concluded that of the 24, the best predictor of living a flourishing, thriving life is gratitude.

Ask a Data Ethicist: What Are the Impacts of AI on Creativity, Schools, and Industry?

Generally speaking, if the goal is to reduce the cost of labour by replacing it with equipment (capital – or AI), then assuming the AI tool replaces the labour in a way that is acceptable to drive the desired outputs the business could possibly drive more profit. So that might be construed as positive for the business. However, businesses exist in the bigger context of society. To take an extreme example, if a large section of the population loses their jobs, they can’t buy your products, and that could hurt your organization. It also puts more burdens on society for a social safety net, perhaps resulting in tax increases or some other impacts to business to pay for those services. ... I think it’s important to disclose the use of AI in a process. For video, audio or images – a symbol or some text to say “AI generated” can accomplish that goal. There is also watermarking that content which is a more technical method. For text, it’s trickier. I don’t think everyone needs to be told about every instance of a spellchecker (to use an extreme example) but if the whole thing is generated, then it is important to say that. This is where a policy can be helpful. For example, one might apply the 80/20 rule – if less than 20% is generated, perhaps it’s not necessary to disclose it. That said, there better not be any inaccuracies or errors in the content if you choose NOT to disclose it. See this case in Australia. This is an example of why I think disclosing, overall, is a good idea.

Daily Tech Digest - October 28, 2025

Quote for the day:

"Ideas are easy, implementation is hard." -- Guy Kawasaki

India’s AI Paradox: Why We Need Cloud Sovereignty Before Model Sovereignty

As is clear, cloud sovereignty is the new pillar supporting national security and having control over infrastructure, data, and digital operations. It has the capacity to safeguard the country’s national interests, including (but not limited to) industrial data, citizen information, and AI workloads. For India, specifically, building a sovereign digital infrastructure guarantees continuity and trust. It gives the country power to enforce its own data laws, manage computing resources for homegrown AI systems, and stay insulated from the tremors of foreign policy decisions or transnational outages. It’s the digital equivalent of producing energy at home—self-reliant, secure, and governed by national priorities. ... Sovereign infrastructure is less a matter of where data sits and more about who controls it and how securely it is managed. With connected systems, AI workloads spread across networks. This makes it imperative for security to be built into every layer and stage. As systems grow more connected and AI workloads spread across networks, security needs to be built into every layer of technology, not added as an afterthought. That’s where edge computing and modern cloud-security frameworks come in. ... There is a real cost involved in neglecting cloud sovereignty. If our AI models continue to depend upon infrastructure that lies outside our jurisdiction, any changes in foreign regulations might suddenly restrict access to critical training datasets.

Do CISOs need to rethink service provider risk?

Security leaders face mounting pressure from boards to provide assurance about third-party risks, while services provider vetting processes are becoming more onerous — a growing burden for both CISOs and their providers. At the same time, AI is becoming integrated into more business systems and processes, opening new risks. CISOs may be forced to rethink their vetting processes with partners to maintain a focus on risk reduction while treating partnerships as a shared responsibility. ... When looking to engage a services provider, his vetting process starts with building relationships first and then working towards a formal partnership and delivery of services. He believes dialogue helps establish trust and transparency and underpin the partnership approach. “A lot of that is ironed out in that really undocumented process. You build up those relationships first, and then the transactional piece comes after that.” ... “If your questions stop once the form is complete, you’ve missed the chance to understand how a partner really thinks about security,” Thiele says. “You learn a lot more from how they explain their risk decisions than from a yes/no tick box.” Transparency and collaboration are at the heart of stronger partnerships. “You can’t outsource accountability, but you can become mature in how you manage shared responsibility,” Thiele says. ... With AI, Cruz has started to monitor vendors acquiring ISO 42001 certification for AI governance. “It’s a trend I’m seeing in some of the work that we’re doing,” she says.

The Silent Technical Debt: Why Manual Remediation Is Costing You More Than You Think

A far more challenging and costly form of this debt has silently embedded itself into the daily operations of nearly every software development team, and most leaders don’t even have a line item for it. This liability is remediation debt: The ever-growing cost of manually fixing vulnerabilities in the open source components that form the backbone of modern applications. For years, we’ve accepted this process as a necessary chore. A scanner finds a flaw, an alert is sent, and a developer is pulled from their work to hunt down a patch. ... The complexity doesn’t stop there. The report reveals that 65% of manual remediation attempts for a single critical vulnerability require updating at least five additional “transitive” dependencies, or a dependency of a dependency. This is the dreaded “dependency conundrum” that developers lament, where fixing one problem creates a cascade of new compatibility issues. ... It’s time to reframe our way of dealing with this: the goal is not just to find vulnerabilities faster but to remediate them instantly. The path forward lies in shifting from manual labor to intelligent remediation. This means evolving beyond tools that simply populate dashboards with problems and embracing platforms that solve them at their source. Imagine a system where a vulnerability is identified, and instead of creating a ticket, the platform automatically builds, tests, and delivers a fully patched and compatible version of the necessary component directly to the developer.

AI Isn’t Coming for Data Jobs – It’s Coming for Data Chaos

Data chaos arises when organizations lose control of their information landscape. It’s the confusion born from fragmentation, duplication, and inconsistency when multiple versions of “truth” compete for authority. Poor data quality and disconnected data governance processes often amplify this chaos. This chaos manifests as conflicting reports, inaccurate dashboards, mismatched customer profiles, and entire departments working from isolated datasets that refuse to align. ... Recent industry analyses reveal an accelerating imbalance in the data economy. While nearly 90% of the world’s data has been generated in just the past two years, data professionals and data stewards represent only about 3% of the enterprise workforce, creating a widening gap between information growth and the human capacity to govern it. ... Data chaos doesn’t just strain systems, it strains people. As enterprises struggle to keep pace with growing data volume and complexity, the very professionals tasked with managing it find themselves overwhelmed by maintenance work. ... When applied strategically, AI can transform the data management lifecycle from ingestion to governance reducing human toil and freeing engineers to focus on design, quality, and strategy. Paired with an intelligent data catalog, these systems make information assets instantly discoverable and reusable across business domains. AI-driven data classification tools now tag, cluster, and prioritize assets automatically, reducing manual oversight.

Why IT projects still fail

Failure today means an IT project doesn’t deliver expected benefits, according to CIOs, project leaders, researchers, and IT consultants. Failure can also mean a project doesn’t produce returns, runs so late as to be obsolete when completed, or doesn’t engage users who then shun it in response. ... IT leaders and now business leaders, too, get enamored with technologies, despite years of admonishments not to do so. The result is a misalignment between the project objectives and business goals, experienced CIOs and veteran project managers say. ... Stettler says a business owner with clear accountability is needed to ensure that business resources are available when required as well as to ensure process changes and worker adoption happen. He notes that having CIOs — instead of a business owner — try to make those things happen “would be a tail-wagging-the-dog scenario.” ... “Executives need to make more time and engage across all levels of the program. They can’t just let the leaders come talk to them. They need to do spot checks and quality reviews of deliverable updates, and check in with those throughout the program,” Stettler says. “And they have to have the attitude of ‘Bring stuff to me when I can be helpful.’” ... Phillips acknowledges that project teams don’t usually overlook entire divisions, but they sometimes fail to identify and include all the stakeholders they should in the project process. Consequently, they miss key requirements to include, regulations to consider, and opportunities to capitalize on.

The Human Plus AI Quotient: Inside Ascendion's strategy to make AI an amplifier of human talent

Technical skills evolve—mainframes lasted forty years, client-server about twenty, and digital waves even less. Skills will come and go, so we focus on candidates with a strong willingness to learn and invest in themselves. That’s foundational. What’s changed now is the importance of being open to AI. We don’t require deep AI expertise at the outset, but we do look for those who are ready to embrace it. This approach explains why our workforce is so quick to adapt to AI—it’s ingrained in how we hire and develop our people. ... The war for talent has always existed—it’s just the scale and timing that change. For us, the quality of work and the opportunities we provide are key to retention. Being fundamentally an AI-first company is a big differentiator, and our “AI-first” mindset is wired into our DNA. Our employees see a real difference in how we approach projects, always asking how AI can add value. We’ve created an environment that encourages experimentation and learning, and the IP our teams develop—sometimes even around best practices for AI adoption—becomes part of our organisational knowledge base. ... The good news is that for a large cross-section of the workforce, "skilling in AI" is not about mastery of mathematics; it's about improving English writing skills to prompt effectively. We often share prompt libraries with clients because the ability to ask the right question and interpret the output is a significant win.

Recruitment Class: What CIOs Want in Potential New Hires

Candidates should be comfortable operating in a very complex, deep digital ecosystem, Avetisyan said. Now, digital fluency means much more than knowing how to use a certain tool that is currently popular, including AI tools. There needs to be an awareness of the broader implications and responsibilities that come with implementing AI. "It's about integrating AI responsibly and designing for accessibility," Avetisyan said -- both of which represent big challenges that must be tackled and kept continuously top of mind. AI should elevate user experiences. ... There's still a need to demonstrate technical skills with human skills such as problem-solving, communication, and ethical awareness, she said. "You can't just be an exceptional coder and right away be effective in our organization if you don't understand all these other aspects," she said. One more thing: While vibe coding -- letting AI shoulder much or most of the work -- is a buzzy concept, she said she is not ready to turn her shop of developers into vibe coders. A more grounded approach to teaching AI fluency is -- or should be -- the educational mission. ... As for programming? A programmer is still a programmer, but the job has evolved to become more strategic, Ruch said. Technical talent will be needed; however, the first few revisions of code will be pre-written based on the specifications given to AI, he said.

Do programming certifications still matter?

“Certifications are shifting from a checkbox to a compass. They’re less about proving you memorized syntax and more about proving you can architect systems, instruct AI coding assistants, and solve problems end-to-end,” says Faizel Khan, lead AI engineer at Landing Point, an executive search and recruiting firm. ... Certifications really do two things, Khan adds. “First, they force you to learn by doing,” he says. “If you’re taking AWS Solutions Architect or Terraform, you don’t pass by guessing—you plan, build, and test systems. That practice matters. Second, they act as a public signal. Think of it like a micro-degree. You’re not just saying, ‘I know cloud.’ You’re showing you’ve crossed a bar that thousands of other engineers recognize.” But there are cons, too. “In tech, employers don’t just want credentials, they want proof you can deliver,” says Kevin Miller, CTO at IFS. “Programming certifications can be a valuable indicator of your baseline knowledge and competencies, especially if you’re early in your career or pivoting into tech, but their importance is dwindling.” ... “I’m more interested in a candidate’s attitude and aptitude: what problems they’ve solved, what they’ve built, and how they’ve approached challenges,” Watts says. “Certifications can show commitment and discipline, and they’re especially useful in highly specialized roles. But I’m cautious when someone presents a laundry list of certifications with little evidence of real-world application.”

Guarding the Digital God: The Race to Secure Artificial Intelligence

Securing an AI is fundamentally different from securing a traditional computer network. A hacker doesn’t need to breach a firewall if they can manipulate the AI’s “mind” itself. The attack vectors are subtle, insidious, and entirely new. ... The debate over whether people or AI should lead this effort presents a false choice. The only viable path forward is a deep, symbiotic partnership. We must build a system where the AI is the frontline soldier and the human is the strategic commander. The guardian AI should handle the real-time, high-volume defense: scanning trillions of data points, flagging suspicious queries, and patching low-level vulnerabilities at machine speed. The human experts, in turn, must set the strategy. They define the ethical red lines, design the security architecture, and, most importantly, act as the ultimate authority for critical decisions. If the guardian AI detects a major, system-level attack, it shouldn’t act unilaterally; it should quarantine the threat and alert a human operator who makes the final call. ... The power of artificial intelligence is growing at an exponential rate, but our strategies for securing it are lagging dangerously behind. The threats are no longer theoretical. The solution is not a choice between humans and AI, but a fusion of human strategic oversight and AI-powered real-time defense. For a nation like the United States, developing a comprehensive national strategy to secure its AI infrastructure is not optional.

Managing legacy medical devices that can no longer be patched

First, hospitals need to recognize that it is rarely possible to instantaneously remove a medical device, but what you can do is build a wall around that device so that only trusted, validated network traffic will be able to reach the device. Secondly, close collaboration with vendors is critical to understand available upgrade paths. Most vendors don’t want customers running legacy technologies that heighten security risk. From my perspective, if a device is too old to be secured, that’s a serious concern. Collaborate with your providers early and be transparent about budget and timeline constraints. This enables vendors to design a phased roadmap for replacing legacy systems, steadily reducing security risk over time. ... We can take a cue from manufacturing, where cyber resilience is essential to limiting the impact of attacks on the production line and broader ecosystem. No single breach should be able to bring down the entire operation. Yet many organizations still run forgotten, outdated systems. It’s critical to retire legacy assets, streamline the environment, and continuously identify and manage risk. ... We’ve seen meaningful progress when dozens of technology vendors pledged to self-regulate and build cyber resilience into their products from the outset. Unfortunately, that momentum has slowed. In my experience, however, the strongest gains often come from non‑legislative, industry‑led initiatives, when organizations voluntarily choose to prioritize security.