Daily Tech Digest by Kannan Subbiah: tech talk

Showing posts with label tech talk. Show all posts

Daily Tech Digest - September 23, 2026

Quote for the day:

"Every great story on the planet happened when someone decided not to give up, but kept going no matter what." -- Spryte Loriano

🎧 Listen to the audio debrief on YouTube

▶ Play Audio Digest

Duration: 26 mins • Perfect for listening on the go.

Observability should start with business outcomes, not infrastructure

The article, "Observability should start with business outcomes, not infrastructure" by Vjacheslav Mikitjuk, argues that technical metrics alone are inadequate for understanding the actual performance of IT systems. The article points out that while an engineering dashboard might show a system running efficiently, it could simultaneously be experiencing a serious customer-facing failure. Therefore, IT teams need to translate technical severity into business severity to provide management with a clear picture of the impact on customers, transaction values, and overall business operations. Mikitjuk suggests that observability needs to follow a chain starting from business outcomes down to telemetry. This approach involves defining service objectives based on user experience rather than just infrastructure metrics. He emphasizes that the translation between technical and business performance should be a shared responsibility across the organization, involving business leadership, product owners, and engineering teams. Furthermore, he advises that business observability must be designed proactively during the service and product design phases, rather than being an afterthought during an incident. The article also highlights that observability priorities should be determined by business criticality, focusing efforts where degradation would have the most significant consequences. Finally, while AI can assist in interpreting data, it requires the foundational context of business goals to be truly effective.

Redefining Cyber Recovery Requirements in the Era of Modern Cyberattacks

Cyber recovery is fundamentally different from traditional disaster recovery, requiring a practical approach to combat modern threats. While disaster recovery focuses on quickly restoring the most recent backup after an outage, cyber recovery prioritizes data integrity. Because attackers often dwell inside networks for days or weeks before causing damage, the newest backup is usually infected. Therefore, IT teams must work backward to find a genuinely clean copy. This process is complicated by the fact that the vast majority of modern intrusions leave no malicious files behind. Instead, attackers use stolen credentials and existing administrative tools to move silently. As a result, standard antivirus scans on powered-off backups are no longer sufficient. To ensure a backup is truly safe, organizations must power it on and carefully observe its behavior over time to detect hidden threats. Because powering on a compromised system risks reinfecting the entire network, this behavioral analysis must happen inside a strictly isolated clean room. Solutions like VMware Cloud Foundation and Advanced Cyber Compliance automate this critical testing environment. By integrating secure, quarantined recovery workflows, organizations can confidently identify uncorrupted data and restore operations safely, moving beyond outdated backup strategies to address the reality of modern fileless attacks.

Data embassies and sovereign dispersion

Data embassies and sovereign dispersion present a new approach to managing the trade-off between data residency and resilience, moving beyond traditional data localization. Driven by geopolitical instability and cyber threats, governments—particularly smaller, highly digitized nations like Estonia—are establishing legally protected digital enclaves on foreign soil. Unlike multi-region cloud backups subject to host nation laws, genuine data embassies operate under bilateral treaties granting them diplomatic immunity. They maintain an active "digital twin" to ensure core civic services, like tax systems and central bank ledgers, run smoothly during domestic crises such as cyberattacks or power failures. Gartner anticipates that by 2029, 15% of nations in unstable regions will have formalized data embassy agreements. Estonia established the first in 2015, partnering with Luxembourg for its Tier IV data centers, setting a precedent that requires specific intergovernmental contracts. Security relies on principles like "encryption as a border," ensuring the origin state retains decryption keys. While replicating this model is challenging for private enterprises, IT leaders can adopt similar technical resilience strategies. By decoupling encryption keys from cloud providers and avoiding over-reliance on a single vendor or location, businesses can enhance their operational continuity and mitigate risks associated with physical data concentration.

How to Handle the Growing Data Complexity Challenge in Cyber Incident Response

The article explains that cyber incident response has become far more complicated than simply handling large volumes of data after a breach. Modern organizations generate information across cloud platforms, collaboration tools, mobile devices, enterprise applications, and third‑party services, creating a sprawling and interconnected data environment. Regulators now expect investigators to identify and analyze a wider range of sensitive information, from traditional personal data to device identifiers, geolocation details, and behavioral patterns. The piece highlights how today’s breaches often involve structured and unstructured data, multimedia files, and systems that store overlapping records, making it difficult to determine what truly matters. Traditional keyword‑based search methods are no longer enough, especially when investigators must uncover “unknown unknowns” hidden across diverse systems. AI‑assisted tools can help by recognizing entities, relationships, and context, but the article stresses that any AI‑driven process must remain legally defensible through documented workflows, validation, and human oversight. Notification decisions—often the hardest part—require consolidating identities, applying jurisdictional rules, and ensuring accuracy at scale. The author concludes that organizations need a disciplined, context‑aware approach to data mining, combining technology, expertise, and defensible processes to understand risk and respond confidently under tight timelines.

7 decisions that make an Azure landing zone enterprise-ready

Creating an effective, enterprise-ready Azure landing zone requires thinking beyond basic reference architectures to build a platform that supports engineering teams rather than hindering them. The article highlights seven key design decisions to achieve this balance between security and developer autonomy. First, treat the landing zone as an operating model—not just a network—by separating platform resources from application workloads using management groups and subscriptions to create clear governance boundaries. Second, opt for Azure Virtual WAN over a self-managed hub-and-spoke setup to simplify cross-region connectivity and route management. Third, integrate your security model, such as a next-generation firewall, directly into the routing architecture from day one rather than bolting it on later. Fourth, implement governance as guardrails that manage risk without turning routine engineering tasks into a constant exception process. Fifth, separate your observability tools for operational health from your SIEM tools for security monitoring to reduce noise and clarify responsibilities. Sixth, treat CI/CD networking as a core platform component, using solutions like private GitHub runners to securely deploy to isolated resources. Finally, ensure an active-active architecture truly works by making both regions fully production-ready and capable of independently supporting the workload during a failure.

AI adoption in OT security accelerates as legacy infrastructure and poor data expose readiness gaps

Many industrial organizations are eager to implement AI for operational technology (OT) security, but their current infrastructure often isn't ready. A recent survey highlights that while nearly 88% of organizations are using or planning to use AI, under 8% have deployed it across multiple functions. The main hurdles are poor data quality and the challenges of integrating AI with legacy systems. Most industrial facilities were built long before AI was a consideration, resulting in control systems that produce inconsistent data. Experts point out that legacy environments frequently lack the necessary identity and access management infrastructure and cloud connectivity required for modern AI models. This gap is especially problematic because AI depends on high-quality data and complete asset context to function accurately. Without these, AI tools can produce incorrect assumptions, leading to false positives or missed threats. Furthermore, poor data quality in OT can have serious physical consequences, including equipment damage or safety incidents. To make AI work effectively and safely in these environments, organizations must first focus on improving their architectural foundations. This includes better data normalization, consistent telemetry, and modernized security architectures that provide a stronger base for AI-enabled tools.

Operational Technology Scope Expands as Security Matures

The article describes how operational technology (OT) security has matured as industrial organizations face more frequent and costly cyber incidents. According to Honeywell’s 2026 OT Cybersecurity Benchmark Report, major attacks now cause an average of 16 hours of downtime, with losses reaching up to $500,000 per hour. As a result, companies across energy, manufacturing, healthcare, maritime, and other critical sectors are shifting from a narrow, technology‑centric mindset to a broader focus on business resilience. Leaders increasingly view OT security as essential to safety, uptime, and service continuity, especially as digital connectivity expands across industrial control systems, field devices, building management systems, IoT sensors, and medical equipment. The report shows that organizations with mature programs detect and respond to threats faster, largely because they maintain strong asset inventories and continuous monitoring. Yet visibility remains a major gap: only one‑third have integrated OT systems into a centralized SOC, and just one‑fifth continuously monitor IoT devices. Legacy systems, staffing shortages, and budget constraints add further strain. Many organizations are adopting AI for detection and monitoring, though fully autonomous decision‑making remains rare. The article concludes that resilience depends on extending security across every connected system and closing visibility gaps that still hinder effective response.

I Wasn’t Trying to Predict the Future. I Was Trying to Build One I Could Tolerate

The article is a reflective piece in which the author explains that his work with AI did not begin as an attempt to predict the future but as a practical response to a narrowing set of acceptable options. He frames his journey not as a heroic narrative but as a form of “niche construction,” a security practice focused on shaping an environment that can support more viable futures. Throughout his career in cybersecurity, supply‑chain assurance, information sharing, and industrial systems, he learned that security is rarely about protecting a single object. Instead, it is about maintaining the conditions that allow systems to survive and adapt. He illustrates this through stories of living on self‑built boats, where survival depended on constant maintenance, awareness, and the ability to respond to change. When his own circumstances tightened in 2025, he turned to a large language model as one of the few available tools and began a sustained, iterative collaboration that produced frameworks, documents, code, and new institutional structures. He describes this as building a generative set—an evolving system that creates new possibilities rather than following a fixed plan. The article concludes that meaningful security often comes from constructing environments where better futures can emerge, not from defending the present in isolation.

CISOs can no longer ignore the nation-state threat

The accelerating use of AI by nation-state actors is forcing Chief Information Security Officers (CISOs) to rethink their threat models and treat geopolitical threats as urgent enterprise risks. Historically, CISOs focused on quickly expelling adversaries from networks, while government agencies preferred to monitor them for intelligence. However, AI is now lowering the barrier to entry, allowing even amateur cybercriminals to launch sophisticated attacks that mimic nation-state activity. This shift blurs the line between national security threats and ordinary business risks. A major challenge for organizations is recognizing their own strategic value to foreign adversaries. Companies in seemingly benign industries, such as agriculture, can become targets if they possess valuable intellectual property or supply chain access. AI worsens this by compressing the time between a vulnerability's discovery and its exploitation to mere seconds, making traditional patching processes insufficient. To adapt, security leaders must recognize that AI enables faster, broader pre-positioning by attackers within organizational assets. Experts advise CISOs to prepare for fully autonomous attacks, plan to operate through compromises during major disruptions, and focus on core security controls like zero trust and multi-factor authentication. Crucially, CISOs need board-level support and funding to implement these necessary resilience measures.

AI slop is creating more work, not less. Here’s why

The rise of generative AI in the workplace was promised to boost productivity, but it is increasingly resulting in "AI slop"—low-quality, generic, and often unverified content that shifts the workload onto other employees. In a recent Today in Tech episode, host Keith Shaw and Commvault’s Chris Bevil discussed how tools that instantly generate emails, reports, and presentations create a hidden "review tax." While an executive might save time using AI to summarize a long document or draft a memo, the receiving employees must often spend significant time fact-checking, correcting context, and deciphering vague, polished-but-empty drafts. This disconnect explains why executives frequently report high productivity gains from AI, while non-managers feel bogged down by new verification processes. AI slop resembles a "first draft wearing a tie"—it looks professional and confident on the surface but lacks underlying substance or clear judgment. As this unverified content spreads rapidly across organizations, it risks becoming accepted corporate knowledge. To truly benefit from AI, companies must move beyond simply generating more content and emphasize proper governance, human review, and clear workflows to prevent productivity gains at the top from becoming a burden at the bottom.

Daily Tech Digest - May 31, 2026

Quote for the day:

“Make sure you don’t start seeing yourself through the eyes of those who don’t value you.” -- Anonymous

🎧 Listen to this digest on YouTube Music

▶ Play Audio Digest

Duration: 21 mins • Perfect for listening on the go.

AI observability: How CIOs can see past their org blind spots

The article discusses AI observability, highlighting how traditional IT monitoring tools are insufficient for evaluating artificial intelligence performance. As AI applications expand across modern businesses, CIOs frequently struggle with deep blind spots regarding system usage, model drift, performance degradation, and unauthorized "shadow AI" tools. Unlike standard software that relies on predictable metrics like uptime, AI systems operate probabilistically, meaning the exact same inputs can yield wildly varying outcomes. This inherent unpredictability creates compounding risks, especially as enterprises connect multiple autonomous agents into complex workflows where minor data issues can quietly corrupt downstream results for weeks before finally breaking. To address these organizational vulnerabilities, experts suggest shifting from front-loaded risk assessments to continuous, full-stack visibility. This comprehensive approach involves setting up automated guardrails for model outputs, maintaining a clear catalog of active systems, and establishing an integrated control plane. By compiling system telemetry, semantic mapping, and risk thresholds into a single shared interface, different corporate stakeholders, such as finance, human resources, and security teams, can easily monitor the metrics relevant to their own departments. Ultimately, treating observability as a core design principle rather than an afterthought enables leadership to safely scale their AI initiatives, manage ballooning costs, and build lasting organizational trust.

The Validation Gap Is Costing You More Than You Think

According to a report on software delivery, development teams are writing more code than ever, but less of it is actually reaching production. Analysis of millions of workflows reveals that while development throughput has spiked, main branch success rates have fallen to a five-year low of roughly seventy percent. This drop stems from a gap in how software is validated. Traditional continuous integration systems were designed for humans who commit code gradually. Today, automated artificial intelligence tools generate code at a rapid pace that completely overwhelms traditional review processes. When errors are caught late in the shared integration system, it results in expensive compute costs, wasted time, and broken focus as the automated tools have already moved on to other tasks. To solve this dilemma, engineering teams must shift testing much earlier into the initial writing phase. By running smaller, targeted tests while the automated code generator is still actively focused on a task, teams can fix errors immediately without draining infrastructure resources. When this early testing stage and the final integration pipeline share historical information, the entire delivery system becomes smarter and more efficient. Ultimately, addressing this validation imbalance helps organizations safely increase their software output without absorbing downstream failures.

Why Attack Surface Management Breaks in OT (and What Actually Works)

Traditional Attack Surface Management (ASM) fails in Operational Technology (OT) environments because industrial infrastructure operates on fundamentally different principles than standard enterprise IT systems. Many legacy industrial protocols, such as Modbus, DNP3, and BACnet, were created decades ago without built-in encryption, session management, or authentication mechanisms. Consequently, their lack of security is an inherent property of the system design rather than a simple configuration mistake that can easily be patched. Furthermore, the active interrogation techniques standard in IT security can severely disrupt operational networks; sending aggressive probes often overwhelms the limited network stacks of Programmable Logic Controllers (PLCs), causing critical physical machinery to misbehave or shut down entirely. Because these industrial environments do not support software agents or standard diagnostic queries, establishing a reliable asset inventory is remarkably difficult. To mitigate risks effectively, security teams must reverse their usual enterprise instincts by defaulting to passive network monitoring and treating active probing as a tightly managed privilege. Utilizing passive internet search data allows analysts to map exposed external components safely without introducing disruptive traffic to live plants. Ultimately, embedding clear safety workflows and strict rate limits into automated security tools ensures that scanning efforts do not cause unintended physical operational downtime.

Backup and recovery architecture best practices for UK SMEs

The Security Boulevard article explains that smaller businesses in the UK should treat backup and recovery as a practical safety measure rather than a simple file storage task. A sensible backup plan focuses entirely on restoration outcomes, ensuring a company can keep trading after an incident like an accidental deletion, system failure, or cyberattack. Instead of buying expensive software tools first, these organizations should prioritize their systems based on how a disruption directly impacts their daily operations, clearly defining how much downtime and data loss they can realistically handle. To build stronger protection, companies must keep multiple copies of their files across separate locations and accounts so that a single compromise or mistake cannot destroy both the live data and the backups. Furthermore, restricting access to named administrative accounts, applying settings that prevent recent copies from being altered or deleted, and choosing backup styles that match different types of systems will lower overall risk. Because copying data does not automatically mean a system can be successfully rebuilt, regular testing is necessary to catch unexpected delays and overlooked technical connections. Ultimately, the article recommends documenting these steps in short, straightforward guides with clear ownership so that staff can respond calmly when an unexpected outage occurs.

Challenging AI Assumptions

In his Forbes article, John Werner encourages readers to reconsider common assumptions about artificial intelligence that might limit our ability to effectively navigate the future. He notes that early technology milestones, such as the IBM Watson era, conditioned the public to view machine intelligence as a centralized database focused entirely on factual recall, rapid calculation, and deterministic logic. However, as the field quickly moves toward a future centered on autonomous software agents, Werner argues that continuing to rely on these old centralized frameworks is a foundational mistake. Drawing from insights shared at a recent MIT-linked conference, he suggests that the true development of artificial intelligence will ultimately mirror biological organisms and complex economic networks rather than centralized computer hardware. Because the long-term impact of this technology on global society is frequently compared to foundational discoveries like fire or electricity, our structural approach must evolve accordingly. Instead of designing isolated, top-down systems, we should foster collaborative, decentralized, and biologically inspired ecosystems of digital agents. By shifting our perspective away from rigid central control, human society can establish cooperative frameworks that allow these increasingly autonomous systems to be integrated smoothly, sustainably, and safely into everyday life.

The Architecture Questions I Ask Before an Initiative Starts

In his article, Eetu Niemi outlines three practical architectural questions to ask before any major business project begins, aiming to clarify scope and prevent costly downstream surprises. The first question focuses on what is actually changing within the organization. Project names can often be deceptive, so teams must carefully distinguish between a project's stated scope and its actual, wider impact. If a change only alters a single isolated system, heavy architectural planning is rarely needed. The second question addresses visible dependencies, identifying which software applications, data streams, teams, or external vendors the project relies upon. Uncovering this scattered knowledge early helps avoid scheduling or financial surprises down the line without over-documenting every minor connection. The final question evaluates which decisions would be expensive to reverse later on. While choices regarding technology platforms, data models, or core software might seem like minor delivery choices initially, they quickly harden into fixed constraints once other systems are built around them. By addressing what is changing, identifying dependencies, and flagging irreversible choices early on, architects can guide decision-making through plain conversations and basic diagrams. This upfront evaluation allows organizations to balance development speed with long-term operational stability without drowning teams in unnecessary paperwork or rigid governance structures.

Building a Quantum-Safe Foundation: WWT and Cisco Accelerate Post-Quantum Readiness

The article outlines how World Wide Technology and Cisco are working together to help organizations secure their networks against future quantum computing threats. Central to this effort is the use of Cisco 8000 Series Secure Routers, which address post-quantum security in two main areas: protecting data in transit with encryption that resists quantum attacks, and maintaining internal device integrity through hardware-anchored trust and secure boot processes. Importantly, these routers already contain the necessary hardware components to run these new cryptographic standards, meaning companies do not need to replace their existing infrastructure and can implement the updates through straightforward configuration changes. This compatibility allows quantum-safe equipment to run on the same network as older systems, removing the need for a risky, immediate complete network overhaul. To guide organizations through this transition, World Wide Technology provides planning and deployment support through its specialized security division and its Advanced Technology Center lab facility. In this testing lab, engineering teams can evaluate encryption tunnel behaviors and test fallback systems under realistic network conditions before rolling them out. Ultimately, the collaboration highlights that achieving security against quantum threats is an ongoing program requiring careful testing, technical depth, and phased adjustments rather than a simple product purchase.

The Next Wow Factor: A Conversation with Sidney Lu, Chairman and CEO, Foxconn Interconnect Technology (FIT)

In this interview, Sidney Lu, the chairman and chief executive officer of Foxconn Interconnect Technology, reflects on his forty year career and personal leadership philosophy. He oversees a large global workforce that manufactures vital electrical parts, such as connectors and cables, for common electronics like smartphones, electric vehicles, and computer servers. Lu credits his way of leading to a balance of Eastern discipline and Western workplace confidence, which he gained while studying and working in the United States. A foundational lesson from his mother taught him to take full responsibility, avoid self pity, and quickly move past mistakes, a clear mindset he later applied to difficult engineering problems. As a leader, Lu strongly emphasizes supporting his employees by taking personal blame for business setbacks rather than shifting it downward to others. To stay relevant and avoid falling behind, he consistently challenges his team to deliver an unexpected, fresh product or advancement every three years. Under his quiet guidance, the company has expanded significantly while building long lasting relationships with clients based on deep trust. Ultimately, Lu attributes his steady motivation to a simple, genuine enjoyment of his daily work and a constant curiosity about what comes next.

Post-quantum cryptography is not the future. It is your current reality

The article explains that post-quantum cryptography is an immediate operational necessity rather than a distant concern. Major tech companies and governments are already deploying these new algorithms because waiting for a functional quantum computer introduces severe, immediate risks to digital infrastructure. Chief among these is the "Harvest Now, Decrypt Later" strategy, where adversaries actively intercept and store encrypted network traffic today with the intention of decrypting it once advanced quantum hardware becomes available. Additionally, existing digital signatures and root certificates face future retroactive forgery, threatening the core authenticity of secure software supply chains. Successfully upgrading an enterprise is rarely an issue of funding or algorithm selection; the real challenge is an absolute lack of visibility. Modern corporate networks contain countless forgotten encryption points hidden within legacy software, cloud environments, and device firmware. To address this, organizations must establish a continuous inventory, known as a Cryptography Bill of Materials, to locate and evaluate their vulnerable assets. Once an organization maps these internal elements, it can cultivate true cryptographic agility, enabling systems to swap underlying protocols smoothly without disrupting daily operations or breaking system compatibility. Rather than delaying, companies must prioritize data based on its overall longevity and methodically adapt to finalized standards, securing their systems before the available implementation runway runs out entirely.

Non-Human Identities Are Outgrowing Your Governance Model

Many companies have developed dependable systems to manage human user identities, but they are falling behind when it comes to non-human accounts. Machine identities, such as service accounts, API keys, security certificates, and automated workloads, now vastly outnumber human credentials, particularly in cloud computing environments. Because these digital entities lack individual managers, specific start dates, or standard offboarding processes, they often slip through traditional corporate tracking systems completely unnoticed. This ongoing management gap leads to significant security problems, including orphaned accounts that maintain high-level administrative access years after a project ends, static passwords that are never rotated, and old third-party integrations that leave access doors wide open to former external vendors. Additionally, neglecting these machine identities creates serious compliance exposure during regulatory audits under strict frameworks like SOC 2 or ISO 27001, which mandate clear internal accountability and regular access reviews. To fix these issues, organizations need to update their tracking strategies and treat non-human credentials with the exact same discipline applied to human staff. This approach means assigning clear owners to every automated account, mapping their actual usage patterns, setting up predictable update cycles, and deleting them automatically when software is retired. By establishing this structured oversight, security teams can successfully close dangerous operational loopholes and maintain control.

Daily Tech Digest - May 07, 2026

Quote for the day:

"You learn more from failure than from success. Don't let it stop you. Failure builds character." -- Unknown

🎧 Listen to this digest on YouTube Music

▶ Play Audio Digest

Duration: 21 mins • Perfect for listening on the go.

Designing front-end systems for cloud failure

In the InfoWorld article "Designing front-end systems for cloud failure," Niharika Pujari argues that frontend resilience is a critical yet often overlooked aspect of engineering. Since cloud infrastructure depends on numerous moving parts, failures are frequently partial rather than absolute, manifesting as temporary network instability or slow downstream services. To maintain a usable and calm user experience during these hiccups, developers should adopt a strategy of . This begins with distinguishing between critical features, which are essential for core tasks, and non-critical components that provide extra richness. When non-essential features fail, the interface should isolate these issues—perhaps by hiding sections or displaying cached data—to prevent a total system outage. Technical implementation involves employing controlled retries with exponential backoff and jitter to manage transient errors without overwhelming the backend. Additionally, protecting user work in form-heavy workflows is vital for maintaining trust. Effective failure handling also requires a shift in communication; specific, reassuring error messages that explain what still works and provide a clear recovery path are far superior to generic "something went wrong" alerts. Ultimately, resilient frontend design focuses on isolating failures, rendering partial content, and ensuring that the interface remains functional and informative even when underlying cloud dependencies falter.

Scaling AI into production is forcing a rethink of enterprise infrastructure

The article "Scaling AI into production is forcing a rethink of enterprise infrastructure" explores the critical shift from AI experimentation to large-scale deployment across real business environments. As organizations move beyond proofs of concept, executives Tarkan Maner and Thomas Cornely argue that the emergence of is a primary driver of this transformation. Agentic systems introduce complex, autonomous, multi-step workflows that traditional infrastructures are often unequipped to handle efficiently. These sophisticated agents require real-time orchestration and secure, on-premises data access to protect sensitive enterprise information. While many organizations initially utilized the public cloud for rapid experimentation, the transition to production highlights serious concerns regarding ongoing cost, strict governance, and data control, prompting a significant shift toward private or hybrid environments. The article emphasizes that AI is designed to augment human capability rather than replace it, seeking a harmonious integration between human decision-making and automated agentic workflows. Practical applications are already emerging across various sectors, from retail’s cashier-less checkouts and targeted marketing to healthcare’s remote diagnostic tools. Ultimately, scaling AI successfully necessitates a foundational rethink of how modern enterprises coordinate their underlying infrastructure, data, and security protocols to support unpredictable workloads while maintaining overall operational stability and long-term cost efficiency.

Why ransomware attacks succeed even when backups exist

The BleepingComputer article "Why ransomware attacks succeed even when backups exist" explains that modern ransomware operations have evolved into sophisticated campaigns that systematically target and destroy an organization's backup infrastructure before deploying encryption. Rather than just locking files, attackers follow a predictable sequence: gaining initial access, stealing administrative credentials, moving laterally across the network, and then identifying and deleting backups. This includes wiping , hypervisor snapshots, and cloud repositories to ensure no easy recovery path remains. Several common organizational failures contribute to this vulnerability, such as the lack of network isolation between production and backup environments, weak access controls like shared admin credentials or missing multi-factor authentication, and the absence of . Furthermore, many organizations suffer from untested recovery processes or siloed security tools that fail to detect attacks on backup systems. To combat these threats, the article emphasizes the necessity of integrated cyber protection, featuring immutable backups with enforced retention locks, dedicated credentials, and continuous monitoring. By neutralizing the traditional "safety net" of backups, ransomware gangs effectively force victims into paying ransoms. This strategic shift highlights that basic, unprotected backups are no longer sufficient in the face of modern, targeted ransomware tactics.

Document as Evidence vs. Data Source: Industrial AI Governance

In the article "Document as Evidence vs. Data Source: Industrial AI Governance," Anthony Vigliotti highlights a critical distinction in how organizations manage information for . Most current programs utilize a "data source" model, where documents are treated as raw material; data is extracted, and the original document is archived or orphaned. This terminal approach severs the link between data and its context, creating significant governance risks, particularly in brownfield manufacturing where legacy records carry decades of operational history. Conversely, the "evidence" model treats documents as permanent artifacts with ongoing legal and operational standing. This framework ensures documents are preserved with high fidelity, validated before downstream use, and permanently linked to any derived data through a navigable citation trail. By adopting an evidence-based posture, organizations can build a robust "Accuracy and Trust Layer" that makes AI-driven decisions defensible and auditable. This is essential for safety-critical operations and regulatory compliance, where being able to prove the provenance of data is as vital as the accuracy of the AI output itself. Transitioning from a throughput-focused extraction mindset to one centered on trust allows industrial enterprises to scale AI safely while mitigating the long-term governance debt associated with disconnected data silos.

Method for stress-testing cloud computing algorithms helps avoid network failures

Researchers at MIT have developed a groundbreaking method called to stress-test cloud computing algorithms, helping prevent large-scale network failures and service outages that impact millions of users. In massive cloud environments, engineers often rely on ""—simplified shortcut algorithms that route data quickly but can unexpectedly break down under unusual traffic patterns or sudden demand spikes. Traditionally, stress-testing these heuristics involved manual, time-consuming simulations using human-designed test cases, which frequently missed critical "blind spots" where the algorithm might fail. MetaEase revolutionizes this evaluation process by utilizing to analyze an algorithm’s source code directly. By mapping out every decision point within the code, the tool automatically searches for and identifies worst-case scenarios where performance gaps and underperformance are most significant. This automated approach allows engineers to proactively catch potential failure modes before deployment without requiring complex mathematical reformulations or extensive manual labor. Beyond standard networking tasks, the researchers highlight MetaEase’s potential for auditing risks associated with AI-generated code, ensuring these systems remain resilient under unpredictable real-world conditions. In comparative experiments, this technique identified more severe performance failures more efficiently than existing state-of-the-art methods. Moving forward, the team aims to enhance MetaEase’s scalability and versatility to process more complex data types and applications.

Hacker Conversations: Joey Melo on Hacking AI

In the SecurityWeek article "Hacker Conversations: Joey Melo on Hacking AI," Principal Security Researcher Joey Melo shares his journey and methodology within the evolving field of artificial intelligence red teaming. Melo, who developed a passion for manipulating software environments through childhood gaming, now applies that curiosity to "" and "data poisoning" AI models. Unlike traditional penetration testing, focuses on bypassing sophisticated guardrails without altering source code. Melo describes jailbreaking as a process of "liberating" bots via complex context manipulation—such as tricking an LLM into believing it is operating in a future where current restrictions no longer apply. Furthermore, he explores data poisoning, where researchers test if models can be influenced by malicious prompt ingestion or untrustworthy web scraping. Despite possessing the skills to exploit these vulnerabilities for personal gain, Melo emphasizes a commitment to ethical, responsible disclosure. He views his work as a vital contribution to an ongoing "cat-and-mouse game" aimed at hardening machine learning defenses against increasingly creative threats. Ultimately, Melo believes that while AI security will continue to improve, the constant evolution of technology ensures that red teaming will remain a necessary, creative endeavor to identify and mitigate emerging risks.

Global Push for Digital KYC Faces a Trust Problem

The global movement toward digital Know Your Customer (KYC) frameworks is gaining significant momentum, as evidenced by the United Arab Emirates’ recent launch of a standardized national platform designed to streamline onboarding and bolster anti-money laundering efforts. While domestic systems are becoming increasingly sophisticated, the concept of portable, cross-border KYC remains largely elusive due to a fundamental lack of trust between international regulators. Governments and financial institutions are eager to reduce duplication and speed up compliance processes to match the rapid growth of instant payments and digital banking. However, significant hurdles persist because KYC extends beyond simple identity verification to include complex assessments of ownership structures and risk profiles, which are heavily influenced by local market contexts and legal frameworks. National regulators often prioritize sovereign control and data protection, making them hesitant to rely on third-party verification performed in different jurisdictions. Consequently, even when countries share broad anti-money laundering goals, their divergent definitions of adequate due diligence and monitoring requirements create a fragmented landscape. Ultimately, the transition to a unified digital identity ecosystem depends less on technological innovation and more on establishing mutual recognition and trust among global supervisory bodies, ensuring that sensitive identity data can be securely and reliably shared across borders.

How To Ensure Business Continuity in the Midst of IT Disaster Recovery

The content provided by the Disaster Recovery Journal (DRJ) at the specified URL serves as a foundational guide for professionals navigating the complexities of organizational stability through the lens of business continuity (BC) and disaster recovery (DR) planning. The material emphasizes that while these two disciplines are closely interconnected, they serve distinct roles in safeguarding an organization. Business continuity is presented as a holistic, high-level strategy focused on maintaining essential operations across all departments during a crisis, ensuring that personnel, facilities, and processes remain functional. In contrast, disaster recovery is defined as a specialized technical subset of BC, primarily concerned with the restoration of information technology systems, critical data, and infrastructure following a disruptive event. A primary theme of the planning process is the requirement for a structured lifecycle, which begins with a rigorous Business Impact Analysis (BIA) and Risk Assessment to identify vulnerabilities and prioritize critical functions. By defining clear Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO), organizations can create targeted response strategies that minimize operational downtime. Furthermore, the resource highlights that modern planning must evolve to address contemporary challenges, such as cyber threats, hybrid work environments, and artificial intelligence integration. Regular testing, cross-functional collaboration, and plan maintenance are essential to transform static documentation into a dynamic, resilient framework capable of withstanding diverse disasters.

The Agentic AI Challenge: Solve for Both Efficiency and Trust

According to the article from The Financial Brand, agentic artificial intelligence represents the next inevitable evolution in banking, marking a fundamental shift from reactive generative AI chatbots to autonomous, proactive systems. While nearly all financial institutions are currently exploring agentic technology, a significant "execution gap" persists; most organizations remain stuck in the pilot phase due to legacy infrastructure, fragmented data silos, and outdated governance frameworks. Unlike traditional AI that merely offers recommendations, agentic systems are designed to act—executing complex workflows, coordinating multi-step transactions, and managing customer financial health in real time with minimal human intervention. The report emphasizes that while banks have historically prioritized low-value applications like back-office automation and fraud prevention, the true potential of agentic AI lies in fulfilling broader ambitions for hyper-personalization and revenue growth. As fintech competitors increasingly rebuild their transaction stacks for real-time execution and autonomous validation, traditional banks face a critical strategic choice. They must modernize their leadership mindset and core technical architecture to support the "self-driving bank" model or risk being permanently outpaced. Ultimately, embracing agentic AI is not merely a technological upgrade but a necessary structural evolution required for banks to remain competitive in an increasingly automated financial ecosystem.

Multi-model AI is creating a routing headache for enterprises

According to F5’s 2026 State of Application Strategy Report, enterprises are rapidly transitioning AI inference into core production environments, with 78% of organizations now operating their own inference services. As 77% of firms identify inference as their primary AI activity, the focus has shifted from experimentation to operational integration within hybrid multicloud infrastructures. Organizations currently manage or evaluate an average of seven distinct AI models, reflecting a diverse landscape where no single model fits every use case. This multi-model approach creates significant architectural complexities, turning AI delivery into a sophisticated traffic management challenge and AI security into a rigorous governance priority. Companies are increasingly adopting identity-aware infrastructure and centralized control planes to manage the routing, observability, and protection of inference workloads. To mitigate operational strain and rising costs, enterprises are integrating shared protection systems and cross-model observability tools. Furthermore, the convergence of AI delivery and security around inference highlights the necessity of managing multiple services to ensure availability and compliance. Ultimately, the report emphasizes that successful AI adoption depends on treating inference as a managed workload subject to the same delivery and resilience requirements as traditional enterprise applications, ensuring faster and safer operational execution.

Daily Tech Digest - November 07, 2025

Quote for the day:

"The best teachers are those who don't tell you how to get there but show the way." -- @Pilotspeaker

AI spending may slow down as ROI remains elusive

Some AI experts agree with Forrester that an AI market correction is on the way. Microsoft founder Bill Gates recently talked about the existence of an AI bubble, and industry observers have noted that some AI excitement is dimming. Many don’t see an AI bubble that will burst in the near future, but it’s deflating a bit. Still others don’t see much of a slowdown in the near term. ... Some organizations are not achieving the accuracy they need from AI tools, and others are not finding their data to be easily accessible or properly structured, says Sam Ferrise, CTO of IT consulting firm Trinetix. “Many organizations are realizing that their expectations for AI accuracy and performance don’t always align with the level of investment they’re willing — or able — to make,” he says. “The key is calibrating expectations relative to both the investment and the use case.” In other cases, enterprises deploying AI are running into privacy or security problems, he adds. “Many teams successfully prove a use case with clear ROI, only to realize later that they must harden the solution before it can safely move into production,” Ferrise says. “When that alignment isn’t there, it’s natural for organizations to pause or delay spending until they can justify the value.” The prospect of a bubble bursting may be an overly dramatic scenario, although not impossible, he adds. It’s been easy for organizations to overlook intangible costs such as training, compliance, and governance.

Why can’t enterprises get a handle on the cloud misconfiguration problem?

“Microsoft, Google, and Amazon have handed us a problem,” says Andrew Wilder, CSO at Vetcor, a national network of more than 900 veterinary hospitals. “By default, everything is insecure, and you have to put security on top of it. It would be much better if they just gave us out-of-the-box secure stuff. Would you buy a car that doesn’t have locks? They wouldn’t even sell that car.” This security gap is what allows third-party vendors to exist, he says. “You should be building products — and I’m talking to you, Google, Microsoft, and Amazon — that are secure by design, so you don’t have to get a third-party tool. They should be out of the box secure.” ... When administrators or users make changes to cloud configurations in the cloud management consoles, it’s difficult to track those changes and to revert them if something goes wrong. Plus, humans can easily make mistakes. The solution experts advise is to adopt the principle of “infrastructure as code” and use configuration management tools so that all changes are checked against policies, tracked and audited, and can easily be rolled back. ... Companies will often have monitoring for major cloud services, but shadow IT deployments are left in the dark. This is less a technology problem than a management one and can be addressed by better communications with business units and a more disciplined approach to deploying technology on an enterprise-wide level.

The Supply Chain Blind Spot: Protecting Data in Expanding IT Ecosystems

Data growth is no longer linear, it is exponential. The rise of AI, automation, and digital platforms has transformed how information is created, stored, and shared. In India, this acceleration is particularly visible. The country’s data centre industry has grown from 590 MW in 2019 to 1.4 GW in 2024, a 139% jump, and is projected to reach 3 GW by 2030, driven by cloud adoption, AI demand, and data localisation initiatives. This infrastructure boom, while positive, brings new operational realities. Most enterprises now operate across hybrid environments, combining on-premises, public cloud and SaaS-based data stores. Without unified oversight, these fragmented environments risk becoming silos. True resilience depends not just on protecting data but understanding where it lives, how it moves, and who controls it. ... Globally, enterprises are reframing resilience as a core business capability. This approach requires integrating resilience principles into decision-making: from procurement and architecture design to crisis response. Simulated attacks, failover testing and dependency audits are becoming part of daily operational culture, not annual exercises. For Indian organizations, this mindset shift is vital. RBI’s ICT risk management directives and the DPDP Act establish the baseline; the differentiator lies in how proactively organizations operationalize these expectations.

The power of low-tech in a high-tech world

Our high-tech society is impressive in the collective. But it robs individuals of skills. Most kids now can’t write cursive. And they can’t read it, either. They can’t read an analog clock or a paper map. The acceleration of technological innovation also accelerates the rate at which we lose skills. Videogames, smartphones, and dating apps — aided and abetted by the trauma of the COVID-19 lockdowns a few years ago — have left many young people alone without the skills to meet and connect with anyone, leading to a loneliness epidemic among the young. But losing old-fashioned skills and old-school tech knowledge is a choice we don’t have to make. ... Thousands of scientific reports all lead us to the same conclusion: Over-reliance on advanced technologies dulls critical thinking, weakens memory, reduces problem-solving skills, limits creativity, erodes attention spans, and fosters passive dependence on automated systems. ... What all these old-school approaches have in common is that they’re harder and take longer — and they leave you smarter and better connected. In other words, if you strategically cultivate the skills, habits, discipline and practice of older tech, you’ll be much more successful in your career and your life. And here’s one final point: The more high-tech our culture becomes, the more impactful old-school tech will be. So yes, by all means become brilliantly skilled at AI chatbot prompt engineering.

Why Leaders Cannot Outsource Communication

When communication is delegated to a proxy, that signal weakens. Employees notice the gap between what the leader says or doesn’t say, and what the organization does. This is why communication has an outsized impact on engagement. Gallup finds that 70% of the variance in employee engagement is explained by managers and leaders, not perks or policies. When leaders own the message, they create psychological safety: the sense that it’s safe to commit, speak up and take risks. When they don’t, that safety erodes. ... Delegating communication is tempting. Leaders are busy. They hire communications officers and agencies to manage the message. These roles are valuable, but they can’t substitute for the leader’s voice. A speechwriter can shape phrasing and a PR team can guide timing, but only the leader can deliver authenticity. As Murphy has written, “Leaders are accountable to employees: Candor about bad news as well as the good, and feedback that aligns with expectations.” Authenticity requires candor, even when the message is difficult. When communication comes from anyone else, it’s interpreted as institutional rather than personal. And people follow people, not institutions. ... The Operator Economy demands a new kind of scale, one built not on capital or code, but on human alignment. Communication is infrastructure. The CEO becomes the signal source around which all systems calibrate. When leaders “scale themselves” through clarity and consistency, they convert trust into throughput.

Breaking the Burnout Cycle: How Smart Automation and ASPM Can Restore Developer Joy

Smart automation can rescue developers from repetitive drudgery by using AI to handle routine tasks like test writing, bug fixing, and documentation. Modern application security posture management (ASPM) platforms exemplify this approach by providing contextualized risk assessments rather than overwhelming vulnerability dumps, helping security teams first understand which issues actually matter and then giving developers actionable info on the risk and how it should be fixed. These platforms excel at managing the volume and unpredictability of AI-generated code, turning what was once a blind spot into manageable, prioritized work. ... Technology alone isn't enough. Organizations must also prioritize developer growth by creating opportunities for experimentation, architectural decisions, and end-to-end project ownership while automation handles routine tasks. This means shifting from measuring output volume to focusing on meaningful metrics like code quality and developer satisfaction. AI represents an opportunity for developers to gain expertise in an emerging technology. ... The developer talent crisis is solvable. While AI has introduced new complexities to the software development and security landscape, it also presents unprecedented opportunities for organizations willing to rethink how they support their development teams.

The CIO’s Role In Data Democracy: Empowering Teams Without Losing Control

The modern CIO is at a point where they can choose between innovation and control. In the past, IT departments were thought of as people who took care of infrastructure and enforced strict regulations about who could access data. The CIO needs to reassess this way of doing things today. They shouldn’t prohibit access; instead, they should make it safe by building frameworks. The job has changed from saying “no” to making sure that when the company says “yes,” it does it smartly. The CIO is now both an architect and a guardian. They create systems that make data easy to get to, understand, and act on, all while keeping security and compliance in mind. ... The CIO is no longer a gatekeeper; they are instead a designer of trust. The goal is to make governance a part of systems such that it is seamless, automatic, and easy to use. This change lets companies keep an eye on things and stay in control without making decisions take longer. Unified data taxonomies are the first step in building this framework. This means that all departments use the same naming standards and definitions. When everyone uses the same “data language,” there is less confusion and more cooperation. ... Effective governance demands collaboration between IT, compliance, and business leaders. The CIO must champion cross-functional alignment where all parties share responsibility for data integrity and use.

What keeps phishing training from fading over time

Employees who want to be helpful or appear responsive can become easier targets than those reacting to fear or haste. For CISOs, this reinforces the need to teach users about manipulation through trust and cooperation, not just the warning signs of urgent or threatening messages. ... Dubniczky said maintaining employee engagement over time is a major challenge for most organizations. “In contrast with other research in the area, a key contribution of ours was a mandatory training after each failed phishing attack,” he explained. “This strikes a good balance between not needlessly bothering careful employees with monthly or quarterly trainings while making sure that the highest risk individuals are constantly trained.” He recommended that organizations vary their phishing simulations to keep users alert. “We’d recommend performing monthly penetration tests on smaller groups of people in diverse departments of the organization with a seemingly random pattern, and making re-training mandatory in case of successful attacks,” he said. “It’s also difficult to generalize on this, but this approach seems much more effective than periodic presentation-style trainings.” ... One of the most striking findings involves the timing of feedback. When employees clicked a phishing link and then received an immediate explanation and training prompt, they were far less likely to repeat the behavior. Around seven in ten employees who failed once did not do so again.

The new QA playbook: Leveraging AI to amplify expertise, not replace it

Many quality teams have been part of the AI journey from the very beginning, contributing from concept to implementation and helping evaluate large language models to ensure quality and reliability. However, many AI features are not developed by QA practitioners, so it is essential to evaluate them through a QA lens. First, ensure the system can produce what your teams actually use, whether that is step lists, BDD-style scenarios, or free text that fits your templates and automation. Next, map the full data journey. Know whether prompts or results are kept, how encryption and minimization are applied, and where any content is stored. Finally, require fine-grained controls so you can limit usage by environment, project, and role. Regulated teams require an audit trail and clear accountability, which means governance must keep pace with adoption, or speed will outpace safety. Once review-first habits are in place, build on them. True oversight requires more than simply checking AI outputs; it demands deeper knowledge and understanding than the AI itself to spot gaps, inaccuracies, or misleading information. That’s what separates a passive reviewer from an effective human in the loop. ... Real gains from AI will not come from automation alone but from people who know how to guide it with clarity, context, and care. The future of testing depends on professionals who can combine technical fluency with critical thinking, ethical judgment, and a sense of ownership over quality.

Your outage costs more than you think – so design with resilience in mind

Service providers are under strain to deliver the rapid speeds and constant network uptime that modern life demands, with areas like remote working, financial transactions, cloud access and streaming services expected to work seamlessly as part of the daily lives of many end users. For many enterprises, their business depends on this connectivity. Even a single hour of network disruption can cost an organisation more than $300,000, and the long-term damage to customer trust often exceeds any immediate financial loss. Despite this, many organisations still rely on outdated infrastructure that cannot support the requirements of today’s end users. Legacy environments struggle with explosive data growth, the soaring demands of AI, and the complexity of distributed, cloud-first applications. At the same time, power limitations, infrastructure strain and inconsistent service levels put businesses at risk of falling behind. The gap between what service providers and enterprises need, and what their infrastructure can deliver, is widening. ... For service providers, investing in robust colocation and high-performance networking is not just about upgrading infrastructure, but enabling customers and partners worldwide to thrive in today’s fast-paced digital landscape. By offering resilient and scalable connectivity, providers can differentiate their service offering, attract high-value enterprise clients, and create new revenue streams based on reliability and performance.

Daily Tech Digest - September 18, 2025

Quote for the day:

"When your life flashes before your eyes, make sure you’ve got plenty to watch.” -- Anonymous

The new IT operating model: cloud-managed networking as a strategic lever

Enterprises are navigating an environment where the complexity of IT is increasing exponentially. Hybrid work requires consistent connectivity across homes, offices, and campuses. Edge computing and IoT generate massive volumes of data at distributed sites. Security risks escalate as the attack surface grows. Traditional, hardware-centric approaches leave IT teams struggling to keep up. Managing dozens or hundreds of controllers, patching firmware manually, and troubleshooting issues site by site is not sustainable. Cloud-managed networking changes that equation. By centralizing management, applying AI-driven intelligence, and extending visibility across distributed environments, it enables IT to shift from reactive firefighting to proactive strategy. ... Enterprises adopting cloud-managed networking are making a decisive shift from complexity to clarity. Success requires more than technology alone. It demands a partner that understands how to translate advanced capabilities into measurable business outcomes. ... Cloud-managed networking is not just another IT trend. It is the operating model that will define enterprise technology for the next decade. By elevating the network from infrastructure to strategy, it enables organizations to move faster, stay secure, and innovate with confidence.

Why Shadow AI Is the Next Big Governance Challenge for CISOs

In many respects, shadow AI is a subset of a broader shadow IT problem. Shadow IT is an issue that emerged more than a decade ago, largely emanating from employee use of unauthorized cloud apps, including SaaS. Lohrmann noted that cloud access security broker (CASB) solutions were developed to deal with the shadow IT issue. These tools are designed to provide organizations with full visibility of what employees are doing on the network and on protected devices, while only allowing access to authorized instances. However, shadow AI presents distinct challenges that CASB tools are unable to adequately address. “Organizations still need to address other questions related to licensing, application sprawl, security and privacy policies, procedures and more ..,” Lohrmann noted. A key difference between IT and AI is the nature of data, the speed of adoption and the complexity of the underlying technology. In addition, AI is often integrated into existing IT systems, including cloud applications, making these tools more difficult to identify. Chuvakin added, “With shadow IT, unauthorized tools often leave recognizable traces – unapproved applications on devices, unusual network traffic or access attempts to restricted services. Shadow AI interactions, however, often occur entirely within a web browser or personal device, blending seamlessly with regular online activity or not leaving any trace on any corporate system at all.”

Cisco strengthens integrated IT/OT network and security controls

Melding IT and OT networking and security is not a new idea, but it’s one that has seen growing attention from Cisco. ... Cisco also added a new technology called AI-powered asset clustering to its Cyber Vision OT management suite. Cyber Vison keeps track of devices connected to an industrial network, builds a real-time map of how these devices talk to each other and to IT systems, and can detect abnormal behavior, vulnerabilities, or policy violations that could signal malware, misconfigurations, or insider threats, Cisco says. ... Another significant move that will help IT/OT integration is the planned integration of the management console for Cisco’s Catalyst and Meraki networks. That combination will allow IT and OT teams to see the same dashboard for industrial OT and IT enterprise/campus networks. Cyber Vision will feeds into the dashboard along with other Cisco management offerings such as ThousandEyes, which gives customers a shared inventory of assets, traffic flows and security. “What we are focusing on is helping our customers have the secure networking foundation and architecture that lets IT teams and operational teams kind of have one fabric, one architecture, that goes from the carpeted spaces all the way to the far reaches of their OT network,” Butaney said.

Global hiring risks: What you need to know about identity fraud and screening trends

Most organizations globally include criminal record checks in their pre-employment screening. Employment and education verifications are also common, especially in EMEA and APAC. ... “Employers that fail to strengthen their identity verification processes or overlook recurring discrepancy patterns could face costly consequences, from compliance failures to reputational harm,” said Euan Menzies, President and CEO of HireRight. ... More than three-quarters of businesses globally found at least one discrepancy in a candidate’s background over the past year. Thirteen percent reported finding one discrepancy for every five candidates screened. Employment verification remains the area where most inconsistencies are discovered, especially in APAC and EMEA. These discrepancies range from minor errors like incorrect dates to more serious issues such as fabricated job histories. ... Companies are increasingly adopting post-hire screening to address risks that emerge after someone is hired. In North America, only 38 percent of companies now say they do no post-hire screening, a sharp drop from 57 percent last year. Common post-hire checks include driver monitoring and periodic rescreening for regulated roles. These efforts help companies catch new issues such as undisclosed criminal activity, changes in legal eligibility to work, or evolving insider threats.

Doomprompting: Endless tinkering with AI outputs can cripple IT results

Some LLMs appear to be designed to encourage long-lasting conversation loops, with answers often spurring another prompt. ... “When an individual engineer is prompting an AI, they get a pretty good response pretty quick,” he says. “It gets in your head, ‘That’s pretty good; surely, I could get to perfect.’ And you get to the point where it’s the classic sunk-cost fallacy, where the engineer is like, ‘I’ve spent all this time prompting, surely I can prompt myself out of this hole.’” The problem often happens when the project lacks definitions of what a good result looks like, he adds. “Employees who don’t really understand the goal they’re after will spin in circles not knowing when they should just call it done or step away,” Farmer says. “The enemy of good is perfect, and LLMs make us feel like if we just tweak that last prompt a little bit, we’ll get there.” ... Govindarajan has seen some IT teams get stuck in “doom loops” as they add more and more instructions to agents to refine the outputs. As organizations deploy multiple agents, constant tinkering with outputs can slow down deployments and burn through staff time, he says. “The whole idea of doomprompting is basically putting that instruction down and hoping that it works as you set more and more instructions, some of them contradicting with each other,” he adds. “It comes at the sacrifice of system intelligence.”

Vanishing Public Record Makes Enterprise Data a Strategic Asset

“We are rapidly running out of public data that is credible and usable. More and more enterprises will start to assign value to their data and go beyond partnerships to monetize it. For example, wind measurements captured by a wind turbine company could be helpful to many businesses that are not competitors,” said Olga Kupriyanova, principal consultant of AI and data engineering at ISG. ... "We’re entering a defining moment in AI where access to reliable, scalable, and ethical data is quickly becoming the central bottleneck, and also the most valuable asset. As legal and regulatory pressure tightens access to public data, due to copyright lawsuits, privacy concerns, or manipulation of open data repositories, enterprises are being forced to rethink where their AI advantage will come from,” said Farshid Sabet, CEO and co-founder at Corvic AI, developer of a GenAI management platform. ... The economic consequences of such data loss are already visible. Analysts estimate that U.S. public data underpinned nearly $750 billion of business activity as recently as 2022, according to the Department of Commerce. The loss of such data blinds companies that build models for everything from supply chain forecasting to investment strategy and predictions.

The Architecture of Responsible AI: Balancing Innovation and Accountability

The field of AI governance suffers from what Mackenzie et al reaffirm as the “principal-agent problem,” where one party (the principal) delegates tasks to another party (the agent). But their interests are not perfectly aligned, leading to potential conflicts and inefficiencies. ... Architects occupy a unique position in this landscape. Unlike regulators who may impose constraints post-design, architects work at the intersection of possibility and constraint. They must balance competing requirements, such as performance and privacy, efficiency and equity, speed and safety, within coherent system designs. Every architectural decision must embed values, priorities, and assumptions about how systems should behave. ... current AI guidance suffers from systematic weaknesses: evidence quality is sacrificed for speed, commercial interests masquerade as objective advice, and some perspectives dominate while broader stakeholder voices remain unheard ... Architects, being well-placed to bridge the gap between strategy and technology, hold a key role in establishing the principles that govern how systems behave, interact, and evolve. In the context of AI, this principle set extends beyond technical design. It encompasses the ethical, social, and legal aspects as well. .

AI will make workers ‘busier in the future’ – so what’s the point exactly?

“I have to admit that I’m afraid to say that we are going to be busier in the future than now,” he told host Liz Claman. “And the reason for that is because a lot of different things that take a long time to do are now faster to do. I’m always waiting for work to get done because I’ve got more ideas.” ... “The more productive we are, the more opportunity we get to pursue new ideas,” Huang continued. Reading between the lines here, it seems the so-called efficiency gains afforded by AI will mean workers have more work dumped in their laps – onto the next task, no rest for the wicked, etc. Huang’s comments run counter to the prevailing sentiment among big tech executives on exactly what AI will deliver for both enterprises and individual workers. ... We’ve all read the marketing copy and heard it regurgitated by tech leaders on podcasts and keynote stages – AI will allow us to focus on the “more rewarding” aspects of our jobs. They’ve never fully explained what this entails, or how it will pan out in the workplace. To be quite honest, I don’t think they know what it means. Marketing probably made it up and they’ve stuck with it. ... Will we be busier spending time on those rewarding aspects of our jobs? I have to say, I’m doubtful. The reality is that workers will be pulled into other tasks and merely end up drowning in the same cumbersome workloads they’ve been dealing with since the pandemic.

Building Safer Digital Experiences Through Robust Testing Practices

Secure software testing forms the bedrock of resilient applications, proactively uncovering flaws before they become critical. Early testing practices can significantly reduce risks, costs, and exposure to threats. According to Global Market Insights, the growing number and size of data breaches have increased the need for security testing services. Organizations that heavily use security AI and automation save an average of USD 1.76 million compared to those that don’t. About 51% plan to increase their security spending. Early integration of techniques like Static Application Security Testing (SAST) can detect vulnerabilities in existing code. It can also help to fix bugs during development. ... Organizations must verify that their systems handle personal data securely and comply with global regulations like GDPR and CCPA. Testing ensures sensitive information is protected from leaks or unauthorized use. Americans are highly concerned about how companies use their private data. ... Stress testing evaluates how applications perform under extreme loads. It helps identify potential failures in scalability, response times, and resource management. Vulnerability assessments concentrate on uncovering security gaps. Verified Market Reports notes that, after recent financial crises, governments are putting stronger emphasis on stress testing.

Prompt Engineering Is Dead – Long Live PromptOps

PromptOps is gaining traction rapidly because it has the potential to address major challenges in the use of LLMs, such as prompt drift and suboptimal output. Yet incorporating PromptOps effectively into an organization is far from simple, requiring a structured and clear process, the right tools, and a mindset that enables collaboration and effective centralization. Digging deeper into what PromptOps is, why it is needed, and how it can be implemented effectively can help companies to find the right approach when incorporating this methodology for improving their LLM applications usage. ... Before PromptOps is implemented, an organization typically has prompts scattered across multiple teams and tools, with no structured management in place. The first stage of implementing PromptOps involves gathering every detail on LLM applications usage within an organization. It is essential to understand precisely which prompts are being used, by which teams, and with which models. The next stage is to build consistency into this practice by incorporating versioning and testing. Adding secure access control at this stage is also important, in order to ensure only those who need it have access to prompts. With these practices in place, organizations will be well-positioned to introduce cross-model design and embed core compliance and security practices into all prompt crafting.