Daily Tech Digest by Kannan Subbiah: upskilling

Showing posts with label upskilling. Show all posts

Daily Tech Digest - May 11, 2026

Quote for the day:

“The entrepreneur builds an enterprise; the technician builds a job.” -- Michael Gerber

🎧 Listen to this digest on YouTube Music

Duration: 17 mins • Perfect for listening on the go.

If AI Owns the Decision, What Happens to Your Bank? 4 Smart Moves Now Will Aid Survival

The article from The Financial Brand explores the transformative role of artificial intelligence in reshaping consumer financial decision-making and the banking landscape. As AI tools become more sophisticated, they are moving beyond simple automation to provide hyper-personalized financial coaching and autonomous management. This shift allows consumers to delegate complex tasks—such as optimizing savings, managing debt, and selecting investment portfolios—to algorithms that analyze vast amounts of real-time data. For financial institutions, this evolution presents both a challenge and an opportunity; banks must transition from being mere transactional platforms to becoming proactive financial partners. The integration of generative AI is particularly highlighted as a catalyst for creating more intuitive user interfaces that can explain financial nuances in natural language. However, the piece also emphasizes the critical importance of trust and transparency. For AI to be truly effective in a banking context, providers must ensure ethical data usage and maintain a "human-in-the-loop" approach to mitigate algorithmic bias and security risks. Ultimately, the future of banking lies in a hybrid model where technology handles the heavy analytical lifting, enabling customers to achieve better financial health through data-driven confidence and streamlined digital experiences.

AI tool poisoning exposes a major flaw in enterprise agent security

In this VentureBeat article, Nik Kale examines the emerging threat of AI tool poisoning, which exposes a fundamental flaw in enterprise agent security architectures. Modern AI agents select tools from shared registries by matching natural-language descriptions, but these descriptions lack human verification. This oversight enables selection-time threats like tool impersonation and execution-time issues such as behavioral drift. While traditional software supply chain controls like code signing and Software Bill of Materials (SBOMs) effectively ensure artifact integrity, they fail to address behavioral integrity—whether a tool actually does what it claims. A malicious tool might pass all artifact checks while containing prompt-injection payloads or altering its server-side behavior post-publication to exfiltrate sensitive data. To counter this, Kale proposes a runtime verification layer using the Model Context Protocol (MCP). This system employs discovery binding to prevent bait-and-switch attacks, endpoint allowlisting to block unauthorized network connections, and output schema validation to detect suspicious data patterns. By implementing a machine-readable behavioral specification, organizations can establish a tamper-evident record of a tool's intended operations. Kale advocates for a graduated security model, beginning with mandatory endpoint allowlisting, to protect enterprise AI ecosystems from the growing risks of automated agent manipulation and data theft.

Why OT security needs bilingual leaders

The article from e27 emphasizes the critical necessity for "bilingual" leadership in the realm of Operational Technology (OT) security to bridge the widening gap between industrial operations and Information Technology (IT). As critical infrastructure becomes increasingly digitized, the traditional silos separating shop-floor engineers and corporate cybersecurity teams have become a significant liability. The author argues that true bilingual leaders are those who possess a deep technical understanding of industrial control systems alongside a sophisticated grasp of modern cybersecurity protocols. These leaders act as essential translators, capable of explaining the nuances of "uptime" and physical safety to IT departments, while simultaneously articulating the urgency of threat landscapes and data integrity to plant managers. The piece highlights that the convergence of these two worlds often results in friction due to differing priorities—where IT focuses on confidentiality, OT prioritizes availability. By fostering leadership that speaks both "languages," organizations can implement holistic security frameworks that do not compromise production efficiency. Ultimately, the article contends that the future of industrial resilience depends on a new generation of executives who can navigate the complexities of both the digital and physical domains, ensuring that cybersecurity is integrated into the very fabric of industrial engineering rather than treated as an external afterthought.

The agentic future has a technical debt problem

In the article "The Agentic Future Has a Technical Debt Problem," Barr Moses argues that the rapid, competitive deployment of AI agents is mirroring the early mistakes of the cloud migration era. Drawing on a survey of 260 technology practitioners, Moses highlights a significant disconnect between engineering leaders and the "builders" on the ground. While leadership often maintains a high level of confidence in system reliability, nearly two-thirds of organizations admitted to deploying agents faster than their teams felt prepared to support. This haste has led to a massive accumulation of technical debt; over 70% of fast-deploying builders anticipate needing to significantly rearchitect or rebuild their systems. Critical operational foundations, such as observability, governance, and traceability, are frequently sacrificed for speed, leaving engineers to deal with agents that access unauthorized data or lack manual override switches. The survey reveals that visibility into agent behavior remains a primary blind spot, with most production issues being discovered via customer complaints rather than automated monitoring. Ultimately, the piece warns that without a shift toward prioritizing infrastructure and instrumentation, the industry faces an inevitable "rebuild reckoning." Moving forward, organizations must bridge the perception gap between management and developers to ensure that agentic systems are not just shipped, but are sustainable and controllable.

In regulated industries, faster testing still has to be defensible

The article "In Regulated Industries, Faster Testing Still Has to Be Defensible" explores the delicate balance software engineering teams in sectors like healthcare and finance must maintain between rapid AI-driven innovation and stringent compliance requirements. While there is significant pressure from stakeholders to accelerate release cycles through generative AI for test generation and defect analysis, the author emphasizes that speed must not come at the expense of auditability. In regulated environments, software must not only function correctly but also possess a comprehensive audit trail, including documented validation, end-to-end traceability, and clear evidence of control. The piece argues that AI-generated artifacts should be subject to the same rigorous version control and formal human review as traditional engineering outputs, as accountability cannot be delegated to an algorithm. Crucially, traceability should be integrated early into the planning phase rather than treated as a post-development cleanup task. Ultimately, the adoption of AI in quality engineering is most effective when it strengthens release discipline and supports human-led verification processes. By prioritizing narrow scopes, clear data access policies, and ongoing education, organizations can leverage modern technology to achieve faster delivery without sacrificing the defensibility of their testing records or risking non-compliance with regulatory frameworks.

DevSecOps explained for growing technology businesses

The article "DevSecOps explained for growing technology businesses," authored by Clear Path Security Ltd, details how small-to-medium enterprises (SMEs) can integrate security into their development lifecycles without sacrificing speed. The article defines DevSecOps as a cultural and procedural shift where security is woven into daily delivery flows rather than being a separate concluding step. For growing firms, the primary advantage lies in reducing expensive rework and late-stage surprises by catching vulnerabilities early. The framework rests on three pillars: people, process, and tooling. Instead of overwhelming teams with complex enterprise-grade protocols, the author suggests a risk-based, gradual implementation focusing on high-impact areas like customer-facing apps and sensitive data handling. Core initial controls should include automated code scanning, dependency checks, and secret detection. Success is measured not by the volume of tools, but by practical metrics like the reduction of post-release vulnerabilities and the speed of high-priority remediation. To ensure adoption, businesses are advised to follow a phased 90-day plan, starting with visibility and basic automation before scaling complexity. Ultimately, the piece argues that DevSecOps acts as a business enabler, fostering confidence and stability by aligning development speed with robust risk management through lightweight, proportionate controls that fit the organization’s specific size and technical needs.

Cuts are coming: is now the time to upskill?

The article "Cuts are coming: is now the time to upskill?" explores the critical need for IT professionals to embrace continuous learning amidst a volatile tech landscape defined by rising redundancies and the disruptive influence of artificial intelligence. Despite persistent skills shortages, the job market has tightened significantly, forcing individuals to take greater personal responsibility for their professional development, often through self-funded and self-directed methods. This shift is characterized by a move away from traditional classroom settings toward agile micro-credentials, cloud-based labs, and specialized certifications in high-demand areas like cloud computing, data analytics, and cybersecurity. While organizations recognize that upskilling existing talent is more cost-effective and resilience-building than external hiring, employer-led investment in training has paradoxically declined over the last decade. Consequently, workers are increasingly motivated by job security concerns, with a majority considering reskilling to maintain their relevance. However, the article highlights an "AI trust paradox," noting that many businesses struggle to implement transformative AI because they lack the necessary foundational data skills and internal expertise. Ultimately, staying competitive in the modern economy requires a proactive approach to skill acquisition, as the widening gap between institutional needs and available talent places the onus of career longevity squarely on the individual professional.

Cloud Security Alliance Expands Agentic AI Governance Work

The Cloud Security Alliance (CSA) has significantly expanded its commitment to securing agentic AI systems through the introduction of three major governance milestones aimed at "Securing the Agentic Control Plane." During the CSA Agentic AI Security Summit, the organization’s CSAI Foundation announced the launch of the STAR for AI Catastrophic Risk Annex, a dedicated initiative running from mid-2026 through 2027 to address high-stakes risks associated with advanced AI autonomy. Furthermore, the CSA achieved authorization as a CVE Numbering Authority via MITRE, allowing it to formally track and categorize vulnerabilities specific to the AI landscape. In a strategic move to standardize security protocols, the CSA also acquired two critical specifications: the Agentic Autonomous Resource Model and the Agentic Trust Framework. The latter, developed by Josh Woodruff of MassiveScale.AI, integrates Zero Trust principles into AI agent operations and aligns with international standards like the NIST AI Risk Management Framework and the EU AI Act. These developments reflect the CSA’s proactive approach to managing the security challenges posed by autonomous AI entities, ensuring that governance, risk management, and compliance keep pace with rapid technological evolution. By centralizing these resources, the CSA aims to provide a unified, transparent architecture for organizations to safely deploy and manage agentic technologies within their enterprise cloud environments.

Stop treating identity as a compliance step. It’s infrastructure now

In the article "Stop treating identity as a compliance step: it’s infrastructure now," Harry Varatharasan of ComplyCube argues that identity verification (IDV) has transcended its traditional role as a back-office compliance task to become foundational digital infrastructure. Across fintech, telecoms, and government services, IDV now serves as the primary mechanism for establishing trust and preventing fraud at scale. Varatharasan highlights a significant industry shift where businesses prioritize orchestration and interoperability, moving toward single, reusable identity layers rather than fragmented, siloed checks. For IDV to function as true infrastructure, it must exhibit three defining characteristics: reliability at scale, trust by design, and—most importantly—interoperability that addresses both technical compatibility and legal liability transfer. The author notes that while the UK’s digital identity consultation is a vital milestone, policy frameworks still struggle to keep pace with the industry's current reality, where the boundaries between public and private verification systems are already dissolving. Fragmentation remains a major hurdle, increasing compliance costs and creating user friction through repetitive verification steps. Ultimately, the article emphasizes that the focus must shift from simply mandating verification to governing it as a shared, portable resource, ensuring that national standards reflect the modern integrated digital economy and future cross-sector needs, while providing a seamless experience for the end-user.

The rapidly evolving digital assets and payments regulatory landscape: What you need to know

The Dentons alert outlines Australia’s sweeping regulatory overhaul of digital assets and payments, signaling the end of previous legal ambiguities. Central to this shift is the Corporations Amendment (Digital Assets Framework) Act 2026, which, starting April 2027, integrates cryptocurrency exchanges and custodians into the Australian Financial Services Licence (AFSL) regime via new categories: Digital Asset Platforms and Tokenised Custody Platforms. Concurrently, a new activity-based payments framework replaces the outdated "non-cash payment facility" concept with Stored Value Facilities (SVF) and Payment Instruments. This system captures diverse services like payment initiation and digital wallets, while excluding self-custodial software. Key consumer protections include a mandate for licensed providers to hold client funds in statutory trusts and enhanced disclosure for stablecoin issuers. Furthermore, "major SVF providers" exceeding AU$200 million in stored value will face prudential oversight by APRA. While exemptions exist for small-scale platforms and low-value services, the firm emphasizes that the transition is complex. With ASIC’s "no-action" position set to expire on June 30, 2026, and parallel AML/CTF obligations already in effect, businesses must urgently assess their licensing needs. This landmark reform ensures that digital asset and payment providers operate under a rigorous, transparent framework equivalent to traditional financial services.

Daily Tech Digest - February 20, 2026

Quote for the day:

"Hold yourself responsible for a higher standard than anybody expects of you. Never excuse yourself." -- Henry Ward Beecher

From in-house CISO to consultant. What you need to know before making the leap

A growing number of CISOs are either moving into consulting roles or seriously considering it. The appeal is easy to see: more flexibility and quicker learning, alongside steady demand for experienced security leaders. Some of these professionals work as virtual CISOs (vCISOs), advising companies from a distance. Others operate as fractional CISOs, embedding into the organization one or two days a week. ... CISOs line up their first clients while they’re still employed. Otherwise, he says, it can take a long time to build momentum. And the pressure to make it work can quickly turn into panic. In that moment, security professionals may start “underpricing themselves because they need money immediately,” he says. Once rates are set out of desperation, they’re often hard to reset without straining the relationship. Other CISOs-turned-consultants also emphasize preparation. ... Many of the skills CISOs honed inside large organizations translate directly to the new consulting job, while others suddenly matter more than they ever did before. In addition to technical skills, it is often the practical ones that prove most valuable. The ability to prioritize — sharpened over years in a CISO role — becomes especially important in consulting. ... Crisis management is another essential skill. Paired with hands-on knowledge of cybersecurity processes and best practices, it gives former CISOs a real advantage as they move into consulting.

New phishing campaign tricks employees into bypassing Microsoft 365 MFA

The message purports to be about a corporate electronic funds payment, a document about salary bonuses, a voicemail, or contains some other lure. It also includes a code for ‘Secure Authorization’ that the user is asked to enter when they click on the link, which takes them to a real Microsoft Office 365 login page. Victims think the message is legitimate, because the login page is legitimate, so enter the code. But unknown to the victim, it’s actually the code for a device controlled by the threat actor. What the victim has done is issued an granting the hacker’s device access to their Microsoft account. From there, the hacker has access to everything the account allows the employee to use. Note that this isn’t about credential theft, although if the attacker wants credentials, they can be stolen. It’s about stealing the victim’s OAuth access and refresh tokens for persistent access to their Microsoft account, including to applications such as Outlook, Teams, and OneDrive. ... The main defense against the latest version of this attack is to restrict the applications users are allowed to connect to their account, he said. Microsoft provides enterprise administrators with the ability to allowlist specific applications that the user may authorize via OAuth. ... The easiest defense is to turn off the ability to add extra login devices to Office 365, unless it’s needed, he said. In addition, employees should also be continuously educated about the risks of unusual login requests, even if they come from a familiar system.

The 200ms latency: A developer’s guide to real-time personalization

The first hurdle every developer faces is the “.” How do you personalize for a user with no history or an anonymous session? Traditional collaborative filtering fails here because it relies on a sparse matrix of past interactions. If a user just landed on your site for the first time, that matrix is empty. To solve this within a 200ms budget, you cannot afford to query a massive data warehouse to look for demographic clusters. You need a strategy based on session vectors. We treat the user’s current session as a real-time stream. ... Another architectural flaw I frequently encounter is the dogmatic attempt to run everything in real-time. This is a recipe for cloud bill bankruptcy and latency spikes. You need a strict decision matrix to decide exactly what happens when the user hits “load.” We divide our strategy based on the “Head” and “Tail” of the distribution. ... Speed means nothing if the system breaks. In a distributed system, a 200ms timeout is a contract you make with the frontend. If your sophisticated AI model hangs and takes 2 seconds to return, the frontend spins and the user leaves. We implement strict circuit breakers and degraded modes. ... We are moving away from static, rule-based systems toward agentic architectures. In this new model, the system does not just recommend a static list of items. It actively constructs a user interface based on intent. This shift makes the 200ms limit even harder to hit. It requires a fundamental rethink of our data infrastructure.

Spec-Driven Development – Adoption at Enterprise Scale

Spec-Driven Development emerged as AI models began demonstrating sustained focus on complex tasks for extended periods of time. Operating in a continuous back-and-forth pattern, instructional interactions between humans and AI is not the best use of this capability. At the same time, allowing AI to operate independently for long periods risks significant deviation from intended outcomes. We need effective context engineering to ensure intent alignment in this scenario. SDD addresses this need by establishing a shared understanding with AI, with specs facilitating dialogue between humans and AI, rather than serving as instruction manuals. ... When senior engineers collaborate, communication is conversational, rather than one-way instructions. We achieve shared understanding through dialogue. That shared understanding defines what we build. SDD facilitates this same pattern between humans and AI agents, where agents help us think through solutions, challenge assumptions, and refine intent before diving into execution. ... Given this significant cultural dimension, treating SDD as a technical rollout leaves substantial value on the table. SDD adoption is an organizational capability to develop, not just a technical practice to install. Those who have lived through enterprise agile adoption will recognize the pattern. Tools and ceremonies are easy to install, but without the cultural shifts we risk "SpecFall" (the equivalent of "Scrumerfall").

Tech layoffs in 2026: Why skills matter more than experience in tech

The impact of is becoming visible as companies prioritise data science and machine learning skills over conventional IT roles. During decades, layoffs were typically associated with the economic recession or lack of revenue in companies. The difference between the present wave is the involvement of automation and strategic restructuring. Although automation has had beneficial impacts on increasing productivity, it implies that jobs that aim at routine and repetitive duties continue to be at risk. ... The traditional career trajectories based on experience or seniority are replaced by market needs of niche skills in machine learning, data engineering, cloud architecture, and product leadership. Employees whose skills have not increased are more exposed to displacement in the event of reorganisation of the companies. These developments explain why tech professionals must reskill to remain employable in an AI-driven industry. The tech labor force in India, which is also one of the largest in the world, is especially vulnerable to the change. ... The future of tech jobs in India 2026 will favour professionals who combine technical expertise with analytical and problem-solving skills. The layoffs in early 2026 explain why the technology industry is vulnerable to job losses because corporate interests can change rapidly. To individuals, it entails being future-ready through the development of skills that would be relevant in the industry direction, including AI integration, cybersecurity, cloud computing, and advanced analytics.

Secrets Management Failures in CI/CD Pipelines

are still the most entrenched security issue. API keys, access tokens and private certificates continue to live in the configuration files of the pipeline, shell scripts or application manifests. While the repository is private, security exposure is the result of only one misconfiguration or breached account. Once committed, secrets linger for months or even years, far outlasting the necessary rotation period. Another common failure is secret sprawl. accumulate credentials over time with no clear ownership. Old tokens remain active because nobody remembers which service depends on them. Thus, as the pipeline develops, secrets management becomes reactive rather than intentional, compromising the likelihood of exposing credentials. Over-permissioned credentials make things worse. ... Technology is not the reason for most secrets management failures; it’s people. Developers tend to copy and paste credentials when they’re trying to get to the bottom of some problem or other. They might even just bypass the security safeguards because things are tight against the wire. It’s pretty easy for nobody to keep absolutely on top of their security posture as your CI/CD pipelines evolve. It’s just exactly for this reason that a DevSecOps culture is important. It has got to be more than just the tools; it has got to be how we all work together to get the job done. Security teams must recognize that what is needed is to consider the CI/CD pipeline as production infrastructure, not some internal tool that can be altered ‘on the fly’.

Agentic AI systems don’t fail suddenly — they drift over time

As organizations move from experimentation to real operational deployment of agentic AI, a new category of risk is emerging — one that traditional AI evaluation, testing and governance practices often struggle to detect. ... Most enterprise AI governance practices evolved around a familiar mental model: a stateless model receives an input and produces an output. Risk is assessed by measuring accuracy, bias or robustness at the level of individual predictions. Agentic systems strain that model. The operational unit of risk is no longer a single prediction, but a behavioral pattern that emerges over time. An agent is not a single inference. It is a process that reasons across multiple steps, invokes tools and external services, retries or branches when needed, accumulates context over time and operates inside a changing environment. Because of that, the unit of failure is no longer a single output, but the sequence of decisions that leads to it. ... In real environments, degradation rarely begins with obviously incorrect outputs. It shows up in subtler ways, such as verification steps running less consistently, tools being used differently under ambiguity, retry behavior shifting or execution depth changing over time. ... Without operational evidence, governance tends to rely more on intent and design assumptions than on observed reality. That’s not a failure of governance so much as a missing layer. Policy defines what should happen, diagnostics help establish what is actually happening and controls depend on that evidence.

Prompt Control is the New Front Door of Application Security

Application security has always been built around a simple assumption: There is a front door. Traffic enters through known interfaces, authentication establishes identity, authorization constrains behavior, and controls downstream enforcement of policy. That model still exists, but our most recent research shows it no longer captures where risk actually concentrates in AI-driven systems. ... are where intent enters the system. They define not only what a user is asking, but how the model should reason, what context it should retain, and which safeguards it should attempt to bypass. That is why prompt layers now outrank traditional integration points as the most impactful area for both application security and delivery. ... Output moderation still matters, and our research shows it remains a meaningful concern. But its lower ranking is telling. Output controls catch problems after the system has already behaved badly. They are essential guardrails, not primary defenses. It’s always more efficient to stop the thief on the way in rather than try to catch him after the fact, and in the case of inference, it’s less costly because stopping on the ingress means no token processing costs incurred. ... Our second set of findings reinforces this point. Authentication and observability lead the methods organizations use to secure and deliver AI inference services, cited by 55% and 54% of respondents, respectively. This holds true across roles, with the exception of developers, who more often prioritize protection against sensitive data leaks.

The 'last-mile' data problem is stalling enterprise agentic AI — 'golden pipelines' aim to fix it

Traditional ETL tools like dbt or Fivetran prepare data for reporting: structured analytics and dashboards with stable schemas. AI applications need something different: preparing messy, evolving operational data for model inference in real-time. calls this distinction "inference integrity" versus "reporting integrity." Instead of treating data preparation as a separate discipline, golden pipelines integrate normalization directly into the AI application workflow, collapsing what typically requires 14 days of manual engineering into under an hour, the company says. Empromptu's "golden pipeline" approach is a way to accelerate data preparation and make sure that data is accurate. ... "Enterprise AI doesn't break at the model layer, it breaks when messy data meets real users," Shanea Leven, CEO and co-founder of Empromptu told VentureBeat in an exclusive interview. "Golden pipelines bring data ingestion, preparation and governance directly into the AI application workflow so teams can build systems that actually work in production." ... Golden pipelines target a specific deployment pattern: organizations building integrated AI applications where data preparation is currently a manual bottleneck between prototype and production. The approach makes less sense for teams that already have mature data engineering organizations with established ETL processes optimized for their specific domains, or for organizations building standalone AI models rather than integrated applications.

From installation to predictive maintenance: The new service backbone of AI data centers

bring together several shifts at once: much higher rack densities, more dynamic load profiles, new forms of cooling, and tighter integration between electrical and digital systems. A single misconfiguration in the power chain can have much wider consequences than would have been the case in a traditional facility. This is happening at a time when many operators struggle to recruit and retain experienced operations and maintenance staff. The personnel on site often have to cope with hybrid environments that combine legacy air-cooled rooms with liquid-ready zones, energy storage, and multiple software layers for control and monitoring. In such an environment, services are not a ‘nice to have’. ... As architectures become more intricate, human error remains one of the main residual risks. AI-ready infrastructures combine complex electrical designs, liquid cooling circuits, high-density rack layouts, and multiple software layers such as . Operating and maintaining such systems safely requires clear procedures and a high level of discipline. ... In an AI-driven era, service strategy is as important as the choice of UPS topology, cooling technology or energy storage. Commissioning, monitoring, maintenance, and training are not isolated activities. Together, they form a continuous backbone that supports the entire lifecycle of the data center. Well-designed service models help operators improve availability, optimise energy performance and make better use of the assets they already have.

Daily Tech Digest - February 03, 2026

Quote for the day:

"In my whole life, I have known no wise people who didn't read all the time, none, zero." -- Charlie Munger

How risk culture turns cyber teams predictive

Reactive teams don’t choose chaos. Chaos chooses them, one small compromise at a time. A rushed change goes in late Friday. A privileged account sticks around “temporarily” for months. A patch slips because the product has a deadline, and security feels like the polite guest at the table. A supplier gets fast-tracked, and nobody circles back. Each event seems manageable. Together, they create a pattern. The pattern is what burns you. Most teams drown in noise because they treat every alert as equal and security’s job. You never develop direction. You develop reflexes. ... We’ve seen teams with expensive tooling and miserable outcomes because engineers learned one lesson. “If I raise a risk, I’ll get punished, slowed down or ignored.” So they keep quiet, and you get surprised. We’ve also seen teams with average tooling but strong habits. They didn’t pretend risk was comfortable. They made it speakable. Speakable risk is the start of foresight. Foresight enables the right action or inaction to achieve the best result! ... Top teams collect near misses like pilots collect flight data. Not for blame. For pattern. A near miss is the attacker who almost got in. The bad change that almost made it into production. The vendor who nearly exposed a secret. The credential that nearly shipped in code. Most organizations throw these away. “No harm done.” Ticket closed. Then harm arrives later, wearing the same outfit.

Why CIOs are turning to digital twins to future-proof the supply chain

The ways in which digital twin models differ from traditional models are that they can be run as what-if scenarios and simulated by creating models based on cause-and-effect. Examples of this would include a demand increase in volume of supply chain product in a short time frame, or changes involving a facility shutting down because of severe weather conditions. The model will look at how this will affect a supply chain’s inventory levels, shipping schedule and delivery date, and even worker availability if any. All of this allows companies to move their decision-making process away from reactive firefighting to the more proactive planning process. For a CIO, using a digital twin model eliminates the historical siloing of enterprise architecture of supply chain-related data. ... Although the value of the digital twin technology is evident, scaling digital twins remains a significant challenge. Integration of data from multiple sources including ERP, WMS, IoT, and partner systems is a primary challenge for all. High fidelity simulation requires high computational capacity, which in turn requires trade-offs between realism, performance, and cost. There are also governance issues associated with digital twins. As digital twin models drift or are modified due to the physical state of the model changing, potential security vulnerabilities also increase as continuing data is streamed from cloud and edge environments.

Quantum computing is getting closer, but quantum-proof encryption remains elusive

“Everybody’s well into the belief that we’re within five years of this cryptocalypse,” says Blair Canavan, director of alliances for the PKI and PQC portfolio at Thales, a French multinational company that develops technologies for aerospace, defense, and digital security. “I see it and hear it in almost every circle.” Fortunately, we already have new, quantum-safe encryption technology. NIST released its fifth quantum-safe encryption algorithm in early 2025. The recommended strategy is to build encryption systems that make it easy to swap out algorithms if they become obsolete and new algorithms are invented. And there’s also regulatory pressure to act. ... CISA is due to release its PQC category list, which will establish PQC standards for data management, networking, and endpoint security. And early this year, the Trump administration is expected to release a six-pillar cybersecurity strategy document that includes post-quantum cryptography. But, according to the Post Quantum Cryptography Coalition’s state of quantum migration report, when it comes to public standards, there’s only one area in which we have broad adoption of post-quantum encryption, and that’s with TLS 1.3, and only with hybrid encryption — not pre or post quantum encryption or signatures. ... The single biggest driver for PQC adoption is contractual agreements with customers and partners, cited by 22% of respondents.

From compliance to competitive edge: How tech leaders can turn data sovereignty into a business advantage

Data sovereignty - where data is subject to the laws and governing structures of the nation in which it is collected, processed, or held - means that now more than ever, it’s incredibly important that you understand where your organization’s data comes from, and how and where it’s being stored. Understandably, that effort is often seen through the lens of regulation and penalties. If you don’t comply with GDPR, for example, you risk fines, reputational damage, and operational disruption. But the real conversation should be about the opportunities it could bring, and that involves looking beyond ticking boxes, towards infrastructure and strategy. ... Complementing the hybrid hub-and-spoke model, distributed file systems synchronize data across multiple locations, either globally or only within the boundaries of jurisdictions. Instead of maintaining separate, siloed copies, these systems provide a consistent view of data wherever it is needed and help teams collaborate while keeping sensitive information within compliant zones. This reduces delays and duplication, so organizations can meet data sovereignty obligations without sacrificing agility or teamwork. Architecture and technology like this, built for agility and collaboration, are perfectly placed to transform data sovereignty from a barrier into a strategic enabler. They support organizations in staying compliant while preserving the speed and flexibility needed to adapt, compete, and grow.

Why digital transformation fails without an upskilled workforce

“Capability” isn’t simply knowing which buttons to click. It’s being able to troubleshoot when data doesn’t reconcile. It’s understanding how actions in the system cascade through downstream processes. It’s recognizing when something that’s technically possible in the system violates a business control. It’s making judgment calls when the system presents options that the training scenarios never covered. These capabilities can’t be developed through a three-day training session two weeks before go-live. They’re built through repeated practice, pattern recognition, feedback loops and reinforcement over time. ... When upskilling is delayed or treated superficially, specific operational risks emerge quickly. In fact, in the implementations I’ve supported, I’ve found that organizations routinely experience productivity declines of as much as 30-40% within the first 90 days of go-live if workforce capability hasn’t been adequately addressed. ... Start by asking your transformation team this question: “Show me the behavioral performance standards that define readiness for the roles, and show me the evidence that we’re meeting them.” If the answer is training completion dashboards, course evaluation scores or “we have a really good training vendor,” you have a problem. Next, spend time with actual end users not power users, not super users, but the people who will do this work day in and day out.

How Infrastructure Is Reshaping the U.S.–China AI Race

Most of the early chapters of the global AI race were written in model releases. As LLMs became more widely adopted, labs in the U.S. moved fast. They had support from big cloud companies and investors. They trained larger models and chased better results. For a while, progress meant one thing. Build bigger models, and get stronger output. That approach helped the U.S. move ahead at the frontier. However, China had other plans. Their progress may not have been as visible or flashy, but they quietly expanded AI research across universities and domestic companies. They steadily introduced machine learning into various industries and public sector systems. ... At the same time, something happened in China that sent shockwaves through the world, including tech companies in the West. DeepSeek burst out of nowhere to show how AI model performance may not be as contrained by hardware as many of us thought. This completely reshaped assumptions about what it takes to compete in the AI race. So, instead of being dependent on scale, Chinese teams increasingly focused on efficiency and practical deployment. Did powerful AI really need powerful hardware? Well, some experts thought DeepSeek developers were not being completely transparent on the methods used to develop it. However, there is no doubt that the emergence of DeepSeek created immense hype. ... There was no single turning point for the emergence of the infrastructure problem. Many things happened over time.

Why AI adoption keeps outrunning governance — and what to do about it

The first problem is structural. Governance was designed for centralized, slow-moving decisions. AI adoption is neither. Ericka Watson, CEO of consultancy Data Strategy Advisors and former chief privacy officer at Regeneron Pharmaceuticals, sees the same pattern across industries. “Companies still design governance as if decisions moved slowly and centrally,” she said. “But that’s not how AI is being adopted. Businesses are making decisions daily — using vendors, copilots, embedded AI features — while governance assumes someone will stop, fill out a form, and wait for approval.” That mismatch guarantees bypass. Even teams with good intentions route around governance because it doesn’t appear where work actually happens. ... “Classic governance was built for systems of record and known analytics pipelines,” he said. “That world is gone. Now you have systems creating systems — new data, new outputs, and much is done on the fly.” In that environment, point-in-time audits create false confidence. Output-focused controls miss where the real risk lives. ... Technology controls alone do not close the responsible-AI gap. Behavior matters more. Asha Palmer, SVP of Compliance Solutions at Skillsoft and a former US federal prosecutor, is often called in after AI incidents. She says the first uncomfortable truth leaders confront is that the outcome was predictable. “We knew this could happen,” she said. “The real question is: why didn’t we equip people to deal with it before it did?”

How AI Will ‘Surpass The Boldest Expectations’ Over The Next Decade And Why Partners Need To ‘Start Early’

The key to success in the AI era is delivering fast ROI and measurable productivity gains for clients. But integrating AI into enterprise workflows isn’t simple; it requires deep understanding of how work gets done and seamless connection to existing systems of record. That’s where IBM and our partners excel: embedding intelligence into processes like procurement, HR, and operations, with the right guardrails for trust and compliance. We’re already seeing signs of progress. A telecom client using AI in customer service achieved a 25-point Net Promoter Score (NPS) increase. In software development, AI tools are boosting developer productivity by 45 percent. And across finance and HR, AI is making processes more efficient, error-free, and fraud-resistant. ... Patience is key. We’re still in the early innings of enterprise AI adoption — the players are on the field, but the game is just beginning. If you’re not playing now, you’ll miss it entirely. The real risk isn’t underestimating AI; it’s failing to deploy it effectively. That means starting with low-risk, scalable use cases that deliver measurable results. We’re already seeing AI investments translate into real enterprise value, and that will accelerate in 2026. Over the next decade, AI will surpass today’s boldest expectations, driving a tenfold productivity revolution and long-term transformation. But the advantage will go to those who start early.

Five AI agent predictions for 2026: The year enterprises stop waiting and start winning

By mid-2026, the question won't be whether enterprises should embed AI agents in business processes—it will be what they're waiting for if they haven't already. DIY pilot projects will increasingly be viewed as a risker alternative to embedded pre-built capabilities that support day-to-day work. We're seeing the first wave of natively embedded agents in leading business applications across finance, HR, supply chain, and customer experience functions. ... Today's enterprise AI landscape is dominated by horizontal AI approaches: broad use cases that can be applied to common business processes and best practices. The next layer of intelligence - vertical AI - will help to solve complex industry-specific problems, delivering additional P&L impact. This shift fundamentally changes how enterprises deploy AI. Vertical AI requires deep integration with workflows, business data, and domain knowledge—but the transformative power is undeniable. ... Advanced enterprises in 2026 will orchestrate agent teams that automatically apply business rules, maintain a tight control on compliance, integrate seamlessly across their technology stack, and scale human expertise rather than replace it. This orchestration preserves institutional knowledge while dramatically multiplying its impact. Organizations that master multi-agent workflows will operate with fundamentally different economics than those managing point automation solutions.

How should AI agents consume external data?

Agents benefit from real-time information ranging from publicly accessible web data to integrated partner data. Useful external data might include product and inventory data, shipping status, customer behavior and history, job postings, scientific publications, news and opinions, competitive analysis, industry signals, or compliance updates, say the experts. With high-quality external data in hand, agents become far more actionable, more capable of complex decision-making and of engaging in complex, multi-party flows. ... According to Lenchner, the advantages of scraping are breadth, freshness, and independence. “You can reach the long tail of the public web, update continuously, and avoid single‑vendor dependencies,” he says. Today’s scraping tools grant agents impressive control, too. “Agents connected to the live web can navigate dynamic sites, render JavaScript, scroll, click, paginate, and complete multi-step tasks with human‑like behavior,” adds Lenchner. Scraping enables fast access to public data without negotiating partnership agreements or waiting for API approvals. It avoids the high per-call pricing models that often come with API integration, and sometimes it’s the only option, when formal integration points don’t exist. ... “Relying on official integrations can be positive because it offers high-quality, reliable data that is clean, structured, and predictable data through a stable API contract,” says Informatica’s Pathak. “There is also legal protection, as they operate under clear terms of service, providing legal clarity and mitigating risk.”

Daily Tech Digest - September 29, 2025

Quote for the day:

"Remember that stress doesn't come from what is going on in your life. It comes from your thoughts on what is going on in your life." -- Andrew Bernstein

Agentic AI in IT security: Where expectations meet reality

The first decision regarding AI agents is whether to layer them onto existing platforms or to implement standalone frameworks. The add-on model treats agents as extensions to security information and event management (SIEM), security orchestration, automation and response (SOAR), or other security tools, providing quick wins with minimal disruption. Standalone frameworks, by contrast, act as independent orchestration layers, offering more flexibility but also requiring heavier governance, integration, and change management. ... Agentic AI adoption rarely happens overnight. As Checkpoint’s Weigman puts it, “Most security teams aren’t swapping out their whole SOC for some shiny new AI system, and one can understand that: It’s expensive, and it demands time and human effort, which at the end of the day could appear be too disruptive and costly.” Instead, leaders look for ways to incrementally layer new capabilities without jeopardizing ongoing operations, which makes pilots a common first step. ... “An agent designed to carry out a sequence of actions in response to a threat could inadvertently create new risks if misused or deployed inappropriately,” says Goje. “For instance, there’s potential for unregulated scripts or newly discovered vulnerabilities.” ... “Pricing remains a friction point,” says Fifthelement.ai’s Garini. “Vendors are playing with usage-based models, but organizations are finding value when they tie spend to analyst hours saved rather than raw compute or API calls.”

Anthropic, surveillance and the next frontier of AI privacy

Democratic legal systems are built on due process: Law enforcement must have grounds to investigate. Surveillance is meant to be targeted, not generalized. Allowing AI to conduct mass, speculative profiling would invert that principle, treating everyone as a potential suspect and granting AI the power to decide who deserves scrutiny. By saying “no” to this use case, Anthropic has drawn a red line. It is asserting that there are domains where the risk of harm to civil liberties outweighs the potential utility. ... How much should technology companies be able to control how their products are used, particularly once they are sold into government? Better yet, do they have a responsibility to ensure their products are used as intended? There is no easy answer. Enforcement of “terms of service” in highly sensitive contexts is notoriously difficult. A government agency may purchase access to an AI model and then apply it in ways that the provider cannot see or audit. ... The real challenge ahead is to establish publicly accountable frameworks that balance security needs with fundamental rights. Surveillance powered by AI will be more powerful, more scalable and more invisible than anything that came before. It has enormous potential when it comes to national security use cases. Yet without clear limits, it threatens to normalize perpetual, automated suspicion.

How attackers poison AI tools and defenses

AI systems that act with a high degree of autonomy carry another risk: impersonating users or trusting impostors. One tactic is known as a “Confused Deputy” attack. Here, an AI agent with high privileges performs a task on behalf of a low-privileged attacker. Another involves spoofed API access, where attackers trick integrations with services like Microsoft 365 or Gmail into leaking information or sending fraudulent emails. ... One crucial step is to make filters aware of how LLMs generate content, so they can flag anomalies in tone, behavior or intent that might slip past older systems. Another is to validate what AI systems remember over time. Without that check, poisoned data can linger in memory and influence future decisions. Isolation also matters. AI assistants should run in contained environments where unverified actions are blocked before they can cause damage. Identity management needs to follow the principle of least privilege, giving AI integrations only the access they require. Finally, treat every instruction with skepticism. Even routine requests must be verified before execution if zero-trust principles are to hold. ... The next wave of threats will involve agentic AI-powered systems that reason, plan and act on their own. While these tools can deliver tremendous productivity gains to users, their autonomy makes them attractive targets. If attackers succeed in steering an agent, the system could make decisions, launch actions or move data undetected.

‘AI and ML the main focus in tech right now’

AI and machine learning are undoubtedly the main focuses in technology right now, with mentions everywhere. A great way to upskill in this area is by attending talks and seminars, which are frequently held and provide valuable insights into how these technologies are being applied in the industry. These events also help you stay up to date on the latest developments. If you have a strong interest in the field, taking an online course, even a free one, can be a great way to grasp the fundamentals, learn the terminology, and understand how to effectively apply these technologies in your current role. Cloud technology is another area that’s here to stay. It’s widely adopted and incredibly versatile. Cloud certifications are highly accessible, with plenty of resources available to help you prepare for the exams and follow the learning paths they offer. ... Being a people person is incredibly beneficial in this field. A significant part of the job involves communication – whether it’s sharing ideas or networking with coworkers in your area. Building these connections can greatly enhance your ability to perform and succeed in your role. Problem-solving is another key aspect of software engineering, and it’s something I’ve always enjoyed. While it can be particularly challenging at times, the sense of accomplishment and reward when your efforts pay off is unmatched.

Better Data Beats Better Models: The Case for Data Quality in ML

Data quality is a broad and abstract concept, but it becomes more measurable when we break it down into different dimensions. Accuracy is the most important and obvious one: If the input data is wrong (e.g., mislabeled transactions in fraud detection models), the model will simply learn incorrect patterns. Completeness is equally important. Without a high degree of coverage for important features, the model will lack context and produce weaker predictions. For example, a recommender system missing key user attributes will fail to provide personalized recommendations. Freshness plays a subtle but powerful role in data quality. Outdated data appears correct, but does not reflect real-world conditions. ... Detecting data quality issues is not just about a single check but rather about continuous monitoring. Statistical distribution checks are the first line of defense, helping detect anomalies or sudden shifts that can indicate broken data pipelines. ... Ignoring data quality can often turn out to be very expensive. Teams spend large amounts of compute to retrain models on flawed data, to observe little to no business impact. Launch timelines get pushed back since teams spend weeks debugging data issues, a time that could have been spent otherwise on feature development. In industries that are regulated, like finance and healthcare, poor data quality can cause compliance violations and increased legal expenses.

DORA 2025: Faster, But Are We Any Better?

The newest DORA report — the “State of AI-Assisted Software Development” — lands at a time when AI is eating everything from code generation to documentation to operations. And just like those early DORA reports reframed speed versus stability, this one is reframing what AI is actually doing to our software delivery pipelines. Spoiler alert: It’s not as simple as “AI makes everything better.” ... Now here’s the counterintuitive part. For the first time, DORA shows AI adoption is linked to higher throughput. That’s right — teams using AI are moving work through the system faster than those who aren’t. But before you pop the champagne, look at the other half of the finding: Instability is still higher in AI-heavy teams. Faster, yes. Safer? Not so much. If you’ve been around the block, this won’t shock you. We saw the same thing in the early days of automation — speed without discipline just meant you hit the wall quicker. ... Another gem buried in the report is the role of value stream management. AI tends to deliver “local optimizations” — an engineer codes faster, a test suite runs quicker — but without VSM, those wins don’t always roll up into business outcomes. With VSM in place, AI-driven productivity gains translate into measurable improvements at the team and product level. That, to me, is vintage DORA. Remember when they proved that culture — psychological safety, autonomy, collaboration — wasn’t just a warm fuzzy HR concept but directly correlated with elite performance? Same here. VSM turns AI from a toy into a force multiplier.

The 5 Technology Trends For 2026 Everyone Must Prepare For Now

In recent years, we've seen industry, governments, education and everyday folk scrambling to adapt to the disruptive impact of AI. But by 2026, we're starting to get answers to some of the big questions around its effect on jobs, business and day-to-day life. Now, the focus shifts from simply reacting to reinventing and reshaping in order to find our place in this brave, different and sometimes frightening new world. ... In tech, agents were undoubtedly the hot buzzword of 2025, representing a meaningful evolution over previous AI applications like chatbots and generative AI. Rather than simply answering questions and generating content, agents take action on our behalf, and in 2026, this will become an increasingly frequent and normal occurrence in everyday life. From automating business decision-making to managing and coordinating hectic family schedules, AI agents will handle the “busy work” involved in planning and problem-solving, freeing us up to focus on the big picture or simply slowing down and enjoying life. ... Quantum computing harnesses the strange and seemingly counterintuitive behavior of particles at the sub-atomic level to accomplish many complex computing tasks millions of times faster than "classic" computers. For the last decade, there's been excitement and hype over their performance in labs and research environments, but in 2026, we are likely to see further adoption in the real world.

GreenOps and FinOps: Strategic Convergence in the Cloud Transformation Journey

FinOps, short for “Financial Operations,” is a cultural practice designed to bring financial accountability to the cloud. It blends engineering, finance, and business teams to manage cloud costs collaboratively and transparently. The goal is clear: maximize business value from the cloud by making spending decisions grounded in data and aligned with business objectives. ... GreenOps, on the other hand, is all about sustainability in cloud operations. It’s a discipline that encourages organizations to monitor, manage, and minimize the environmental footprint of their cloud usage. GreenOps revolves around using renewable energy-powered cloud resources, recycling or reusing digital assets, optimizing workloads, and selecting eco-friendly services, all with the aim of reducing carbon emissions and supporting broader sustainability goals. ... In practical terms, GreenOps activities such as deleting unused storage volumes, rightsizing virtual machines, and consolidating workloads not only shrink the carbon footprint but also slash monthly cloud bills. Thus, sustainability efforts act as “passive” cost optimizers—delivering FinOps benefits without explicit financial tracking. ... FinOps and GreenOps aren’t one-off projects but ongoing practices. Regular reviews, “cost and sustainability audits,” and optimization sprints keep teams focused.

Rethinking AI’s Role in Mental Health with GPT-5

GPT-5 has surfaced critical questions in the AI mental health community: What happens when people treat a general purpose chatbot as a source of care? How should companies be held accountable for the emotional effects of design decisions? What responsibilities do we bear, as a health care ecosystem, in ensuring these tools are developed with clinical guardrails in place? ... OpenAI has since taken steps to restore user confidence by making its personality “warmer and friendlier,” and encouraging breaks during extended sessions. However, it doesn’t change the fact that ChatGPT was built for engagement, not clinical safety. The interface may feel approachable, especially appealing to those looking to process feelings around high-stigma topics – from intrusive thoughts to identity struggles – but without thoughtful design, that comfort can quickly become a trap. ... Designing for engagement alone won’t get us there, and we must design for outcomes rooted in long-term wellbeing. At the same time, we should broaden our scope to include AI systems that shape the care experience, such as reducing the administrative burden on clinicians by streamlining billing, reimbursement, and other time-intensive tasks that contribute to burnout. Achieving this requires a more collaborative infrastructure to help shape what that looks like, and co-create technology with shared expertise from all corners of the industry including AI ethicists, clinicians, engineers, researchers, policymakers and users themselves.

Cybersecurity skills shortage: can upskilling close the talent gap?

According to reports, the global cybersecurity workforce gap exceeded 4 million professionals in 2023, with India alone requiring more than 500,000 skilled experts to meet current demand. This shortage is not merely a hiring challenge; it is a business risk. ... The traditional answer to talent shortages has been to hire more people. But in cybersecurity, where demand far outstrips supply, hiring alone cannot solve the problem. Upskilling training existing employees to meet evolving requirements offers a sustainable solution. Upskilling is not about starting from scratch. It leverages existing talent pools, such as IT administrators, network engineers, or even software developers, and equips them with cybersecurity expertise. ... While technology plays a central role in cybersecurity, the human factor remains the ultimate line of defense. Many high-profile breaches stem not from technical weaknesses but from human errors such as phishing clicks or misconfigured systems. Upskilling programs must therefore go beyond technical mastery to also emphasise behavioral awareness, ethical responsibility, and decision-making under pressure. ... The cybersecurity talent gap is unlikely to vanish overnight. However, the organisations that will thrive are those that view the challenge not as a bottleneck but as an opportunity to reimagine workforce development. Upskilling is the most pragmatic path forward, enabling companies to build resilience, retain talent, and remain competitive in an era of escalating cyber risks.

Daily Tech Digest - September 21, 2025

Quote for the day:

"The world's most deadly disease is hardening of the attitudes." -- Zig Ziglar

AI sharpens threat detection — but could it dull human analyst skills?

While AI offers clear advantages, there are real risks when used without caution. Blind trust in AI-generated recommendations can lead to missed threats or incorrect actions, especially when professionals rely too heavily on prebuilt threat scores or automated responses. A lack of curiosity to validate findings weakens analysis and limits learning opportunities from edge cases or anomalies. This mirrors patterns seen in internet search behavior, where users often skim for quick answers rather than dig deeper. It bypasses critical thinking that strengthens neural connections and sparks new ideas. In cybersecurity — where stakes are high and threats evolve fast — human validation and healthy skepticism remain essential. ... AI literacy is becoming a must-have skill for cybersecurity teams, especially as more organizations adopt automation to handle growing threat volumes. Incorporating AI education into security training and tabletop exercises helps professionals stay sharp and confident when working alongside intelligent tools. When teams can spot AI bias or recognize hallucinated outputs, they’re less likely to take automated insights at face value. This kind of awareness supports better judgment and more effective responses. It also pays off, as organizations that use security AI and automation extensively save an average of $2.22 million in prevention costs.

Repatriation games: the mid-market reevaluates its public cloud consumption

Many IT decision-makers were quick to blame public cloud service providers. But it’s more likely that the applications and workloads were never intended for public cloud environments. Or that cloud-enabled applications and workloads were incorrectly configured. Either way, poor application and workload performance meant that the expected efficiency gains and cost savings from public cloud adoption did not materialize. This led to budgeting and resourcing problems, as well as friction between IT management, senior leadership teams, and other stakeholders. ... Concerns over data sovereignty and compliance have also influenced decisions to repatriate public cloud workloads and adopt a hybrid cloud model, particularly due to worries about DORA, GDPR and the US Cloud Act compliance. DORA and GDPR both place greater emphasis on data sovereignty, so organizations need to have greater control over where their data resides. This makes a strong case for repatriation of specific workloads to maintain compliance with both sets of regulations – especially within highly regulated industries or for sensitive information such as HR or financial data. ... Nearly a third of respondents say cybersecurity specialists are the most difficult roles to hire or retain. Some mid-market organizations may lack the in-house skills to configure and manage cybersecurity in public cloud environments or even understand their default settings.

A guide to de-risking enterprise-wide financial transformation

Distilling the lessons from these large-scale initiatives, a clear blueprint emerges for leaders embarking on their own transformation journeys:Define a data-driven vision: A successful transformation begins with a clear vision for how data will function as a strategic asset. The goal should be to create a single source of truth that is granular, accessible and enables a shift from reactive reporting to proactive analysis. Lead with process, not technology: Technology is an enabler, not the solution itself. Invest heavily in understanding and harmonizing end-to-end business processes before a single line of code is written. This effort is the foundation for a sustainable, low-customization system. De-risk with a phased, modular approach: Avoid the “big bang.” Break the program into logical phases, delivering tangible business value at each step. This builds momentum, facilitates organizational learning and significantly reduces the risk of catastrophic failure. Prioritize the user experience: Even the most powerful system will fail if it is not adopted. Engage end users throughout the design and implementation process. Build intuitive tools, like the FIRST microsite, and invest in robust training and change management to drive adoption and proficiency. ... Such forums are critical for breaking down silos and ensuring the end-to-end process is optimized. ... Transforming the financial core of a global technology leader is not merely a technical undertaking, it is a strategic imperative for enabling scale, agility and insight.

5 things IT managers get wrong about upskilling tech teams

One of the most pervasive issues in IT upskilling is what Patrice Williams-Lindo, CEO at career coaching service Career Nomad, called the “training-and-forgetting” approach. “Many managers send teams to training without any plan for application,” she said. “Employees return to overloaded sprints” with no guidance on how to incorporate what they’ve learned. Without application in their work, “new skills atrophy fast.” This problem is rooted in basic learning science. ... Another major pitfall is the overemphasis on certifications as proof of capability. Managers often assume that a certification is going to solve a problem without considering whether it fits the day-to-day job, said Tim Beerman, CTO at managed service provider Ensono. What’s more, certification alone doesn’t equal real-world capability and doesn’t necessarily indicate that a person is competent, according to CGS’ Stephen. While a certification shows that someone has the capability to obtain learned knowledge, he said, it doesn’t guarantee practical application skills. ... Many IT managers fall into the trap of pursuing trendy technologies without connecting them to actual business needs. Williams-Lindo warned that focusing on hype skills without business alignment backfires. While AI, cloud, and blockchain sound strategic, she said, if they aren’t tied to current or near-future business objectives, teams will spend time learning irrelevant tools while core needs are ignored.

Gen AI risks are getting clearer. How much would you pay for digital trust?

“As AI becomes more pervasive and kind of invades various dimensions of our lives and our work, how we interact with it and how safe and trustworthy it is, has become paramount,” said Dan Hays ... What do trust and safety issues look like, when it comes to AI agents in customer interactions? Hays gave several examples: Should AI agents remember everything that a particular customer says to them, or should it “forget” interactions, particularly as years or decades pass? The memory capabilities of bots also relate to the question of, what parameters should be placed on how AI agents are allowed to interact with customers? ... “As organizations across nearly all industries dive head-first into AI and digital transformations, they’re running into new risks that could undermine the trust they’ve built with consumers. Right now, many don’t have the guardrails or experience to handle these evolving threats — and the ripple effects are being felt across entire companies and industries,” the PwC report said. However, it seems that people who can, are willing to pay for digital environments and services that they can trust — much like subscribers to paywalled content sites can generally trust what they are getting, while those looking for free news might end up reading information that is garbled or deliberately twisted with the help of AI.

Object Storage: The Last Line of Defense Against Ransomware

Object storage provides intrinsic advantages in immutability, as it does not provide “edit in place” functionality as with file systems which are designed to allow direct file modifications. Unlike traditional file or block storage, object storage interacts through “get and put” access and write APIs, which means malware and ransomware actors have to attempt to write (or overwrite modified objects) via the API to the object store. ... As ransomware continues to evolve, organizations must design storage strategies that protect at every level. Cyber resilience in the storage layer involves a layered defense that spans architecture, APIs, and operational practices. ... A successful data center attack not only disrupts service but also undermines the partner’s reputation for reliability. Technology partners must demonstrate their infrastructure can isolate tenants, withstand attacks, and deliver continuous availability even in adverse conditions. In both cases, cyber-resilient storage is no longer optional. ... Business continuity leaders should prioritize S3-compatible object storage with ransomware-proof capabilities such as object locking, versioning, and multi-layered access controls. Just as importantly, they should evaluate whether their current storage platforms deliver end-to-end cyber resilience that spans both technology and process.

Time to Embrace Offensive Security for True Resilience

Offensive engagements utilize an attacker mindset to focus on truly exploitable weaknesses, weeding out the noise of unprioritized lists of vulnerabilities. Through remediation of high-impact findings, organizations prevent spreading resources over low-impact issues. Additionally, offloading sophisticated simulations to specialized teams or utilizing automated penetration testing speeds testing cycles and maximizes security investments. Essentially, each dollar invested in offensive testing can pre-empt multiples of breach response, legal penalties, lost productivity, and reputational loss. Successful security testing takes more than shallow scans; it needs fully immersed, real-world simulations that mimic the methods employed by actual threat actors to test your systems. Below is an overview of the most effective methods: ... Red teaming exercises goes beyond standard testing by simulating skilled threat actors with secretive, multi-step attack scenarios. These exercises check not just technical weaknesses but also the organization’s ability to notice, respond to, and recover from real security breaches. Red teams often use methods like social engineering, lateral movement, and privilege escalation to test incident response teams. This uncovers flaws in technology and human procedures during realistic attack simulations.

7 Enterprise Architecture Best Practices for 2025

The foundational principle of effective enterprise architecture is its direct and unbreakable link to business strategy. This alignment ensures that every technological decision, architectural blueprint, and IT investment serves a clear business purpose. It transforms the EA function from a cost center focused on technical standards into a strategic partner that drives business value, innovation, and competitive advantage. ... Adopting a framework establishes a shared understanding among stakeholders, from IT teams to business leaders. It provides a standardized set of tools, templates, and terminologies, which reduces ambiguity and improves communication. This structured approach is fundamental to creating a holistic and integrated view of the enterprise, allowing architects to manage complexity, mitigate risks, and align technology initiatives with strategic goals in a systematic way. ... While a strong strategy provides the direction for enterprise architecture, robust governance provides the necessary guardrails and decision-making framework to keep it on track. EA governance establishes the processes, standards, and controls that ensure architectural decisions align with business objectives and are implemented consistently across the organization. It transforms architecture from a set of recommendations into an enforceable, value-driven discipline.

Why Cloud Repatriation is Critical Post-VMware Exit

What began as a tactical necessity evolved into an expensive operational habit, with monthly bills that continue climbing without corresponding business value. The rush to cloud often bypassed careful workload assessment, resulting in applications running in expensive public cloud environments that would be more cost-effective on-premises. ... Equally important, the technology landscape has evolved since the initial cloud migration wave. We now have universal infrastructure-wide operating platforms that deliver cloud-like experiences on-premises, eliminating the operational gaps that initially drove workloads to public cloud. Combined with universal migration capabilities that can move workloads seamlessly from any source—whether VMware, other hypervisors, or major cloud providers—organizations finally have the tools needed to make cloud repatriation both technically feasible and economically compelling. ... The forced VMware migration creates the perfect opportunity to reassess the entire infrastructure portfolio holistically rather than making isolated platform decisions. ... This infrastructure reset enables IT teams to ask fundamental questions that operational inertia prevents: Which workloads benefit from cloud deployment? What applications could run more affordably on modern on-premises infrastructure? How can we optimize our total infrastructure spend across both on-premises and cloud environments?

4 Ways AI Revolutionizes Modern Cybersecurity Strategy

AI's true value doesn't lie in marketing promises, but in concrete results(link is external), such as reducing false positives, cutting detection time, and reducing operational costs. These are documented results from organizations that have implemented AI-human collaboration models balancing automation with expert judgment. This capability significantly exceeds the efficiency of human security teams, fundamentally transforming threat detection and response. Imagine a zero-day exploit detected and contained within minutes, not days, drastically reducing the window of vulnerability. ... Accelerating the transformation of legacy code represents one of the most impactful ways organizations are using AI to mitigate vulnerabilities. Legacy code accounts for a staggering 70% of identified vulnerabilities(link is external), but manually overhauling monolithic code bases is rarely feasible. Security teams know these vulnerabilities exist, but often lack the resources to address them. ... Manual SBOM creation cannot scale, not even for a 10-person startup. DevSecOps teams already stretched thin can't reasonably be expected to monitor the thousands of components in modern software stacks. Any sustainable approach to SBOM management for software-producing organizations must necessarily include automation. ... Compliance remains one of security's greatest frictions.