Daily Tech Digest - May 19, 2025


Quote for the day:

"Leadership is liberating people to do what is required of them in the most effective and humane way possible." -- Max DePree


Adopting agentic AI? Build AI fluency, redesign workflows, don’t neglect supervision

AI upskilling is still majorly under-prioritized across organizations. Did you know that less than one-third of companies have trained even a quarter of their staff to use AI? How do leaders expect employees to feel empowered to use AI if education isn’t presented as the priority? Maintaining a nimble and knowledgeable workforce is critical, fostering a culture that embraces technological change. Team collaboration in this sense could take the form of regular training about agentic AI, highlighting its strengths and weaknesses and focusing on successful human-AI collaborations. For more established companies, role-based training courses could successfully show employees in different capacities and roles to use generative AI appropriately. ... Although gen AI will not substantially affect organizations’ workforce sizes in the short-term, we should still expect an evolution of role titles and responsibilities. For example, from service operations and product development to AI ethics and AI model validation positions. For this shift to successfully happen, executive-level buy-in is paramount. Senior leaders need a clearly-defined organization-wide strategy, including a dedicated team to drive gen AI adoption. We’ve seen that when senior leaders delegate AI integration solely to IT or digital technology teams, the business context can be neglected. 


Half of tech execs are ready to let AI take the wheel

“AI is not just an incremental change from digital business. AI is a step change in how business and society work,” he said. “A significant implication is that, if savviness across the C-suite is not rapidly improved, competitiveness will suffer, and corporate survival will be at stake.” CEOs perceived even the CIO, chief information security officer (CISO), and chief data officer (CDO) as lacking AI savviness. Respondents said the top two factors limiting AI’s deployment and use are the inability to hire adequate numbers of skilled people and an inability to calculate value or outcomes. “CEOs have shifted their view of AI from just a tool to a transformative way of working,” said Jennifer Carter, a principal analyst at Gartner. “This change has highlighted the importance of upskilling. As leaders recognize AI’s potential and its impact on their organizations, they understand that success isn’t just about hiring new talent. Instead, it’s about equipping their current employees with the skills needed to seamlessly incorporate AI into everyday tasks.” This focus on upskilling is a strategic response to AI’s evolving role in business, ensuring that the entire organization can adapt and thrive in this new paradigm. Sixty-six percent of CEOs said their business models are not fit for AI purposes, according to Gartner’s survey. 


What comes after Stack Overflow?

The most obvious option is the one that is already happening whether we like it or not: LLMs are the new Q&A platforms. In the immediate term, ChatGPT and similar tools have become the go-to source for many. They provide the convenience of natural language queries with immediate answers. It’s possible we’ll see official “Stack Overflow GPT” bots or domain-specific LLMs trained on curated programming knowledge. In fact, Stack Overflow’s own team has been experimenting with using AI to draft preliminary answers to questions, while linking back to the original human posts for context. This kind of hybrid approach leverages AI’s speed but still draws on the library of verified solutions the community has built over years. ... Additionally, it’s still possible that the social Q&A sites will save the experience through data partnerships. For example, Stack Overflow, Reddit, and others have moved toward paid licensing agreements for their data. The idea is to both control how AI companies use community content and to funnel some value back to the content creators. We may see new incentives for experienced developers to contribute knowledge. One proposal is that if an AI answer draws from your Stack Overflow post, you could earn reputation points or even a cut of the licensing fee.


8 security risks overlooked in the rush to implement AI

AI models are frequently deployed as part of larger application pipelines, such as through APIs, plugins, or retrieval-augmented generation (RAG) architectures. “Insufficient testing at this level can lead to insecure handling of model inputs and outputs, injection pathways through serialized data formats, and privilege escalation within the hosting environment,” Mindgard’s Garraghan says. “These integration points are frequently overlooked in conventional AppSec [application security] workflows.” ... AI systems may exhibit emergent behaviors only during deployment, especially when operating under dynamic input conditions or interacting with other services. “Vulnerabilities such as logic corruption, context overflow, or output reflection often appear only during runtime and require operational red-teaming or live traffic simulation to detect,” according to Garraghan. ... The rush to implement AI puts CISOs in a stressful bind, but James Lei, chief operating officer at application security testing firm Sparrow, advises CISOs to push back on the unchecked enthusiasm to introduce fundamental security practices into the deployment process. “To reduce these risks, organizations should be testing AI tools in the same way they would any high-risk software, running simulated attacks, checking for misuse scenarios, validating input and output flows, and ensuring that any data processed is appropriately protected,” he says.


A Brief History of Data Stewardship

Today, in leading-edge organizations, data stewardship is at the heart of data-driven transformation initiatives, such as DataOps, AI governance, and improved metadata management, which have evolved data stewardship beyond traditional data quality control. Data stewards can be found in every industry and in organizations of any size. Modern data stewards interact with:Automated data quality tools that identify and resolve data issues at scale. Data catalogs and data lineage applications that organize business and technical metadata and provide searchable inventories of data assets. AI/ML models that require extensive monitoring to ensure they are trained on unbiased, accurate datasets The scope of data stewardship has expanded to include ethical considerations, particularly concerning data privacy, algorithmic bias, and responsible AI. Data stewards are increasingly seen as the conscience of data within organizations, championing not only compliance but also fairness, transparency, and accountability. New organizational models, such as federated data stewardship – in which data stewardship responsibilities are distributed across teams – can promote improved collaboration and enable scaling data stewardship efforts alongside agile and decentralized business units.


Introducing strands agents, an Open Source AI agents SDK

In Strands’ model-driven approach, tools are key to how you customize the behavior of your agents. For example, tools can retrieve relevant documents from a knowledge base, call APIs, run Python logic, or just simply return a static string that contains additional model instructions. Tools also help you achieve complex use cases in a model-driven approach, such as with these Strands Agents example pre-built tools: Retrieve tool: This tool implements semantic search using Amazon Bedrock Knowledge Bases. Beyond retrieving documents, the retrieve tool can also help the model plan and reason by retrieving other tools using semantic search. For example, one internal agent at AWS has over 6,000 tools to select from! Models today aren’t capable of accurately selecting from quite that many tools. Instead of describing all 6,000 tools to the model, the agent uses semantic search to find the most relevant tools for the current task and describes only those tools to the model. ... Thinking tool: This tool prompts the model to do deep analytical thinking through multiple cycles, enabling sophisticated thought processing and self-reflection as part of the agent. In the model-driven approach, modeling thinking as a tool enables the model to reason about if and when a task needs deep analysis.


AI hallucinations and their risk to cybersecurity operations

“AI hallucinations are an expected byproduct of probabilistic models,” explains Chetan Conikee, CTO at Qwiet AI, emphasizing that the focus shouldn’t be on eliminating them entirely but on minimizing operational disruption. “The CISO’s priority should be limiting operational impact through design, monitoring, and policy.” That starts with intentional architecture. Conikee recommends implementing a structured trust framework around AI systems, an approach that includes practical middleware to vet inputs and outputs through deterministic checks and domain-specific filters. This step ensures that models don’t operate in isolation but within clearly defined bounds that reflect enterprise needs and security postures. Traceability is another cornerstone. “All AI-generated responses must carry metadata including source context, model version, prompt structure, and timestamp,” Conikee notes. Such metadata enables faster audits and root cause analysis when inaccuracies occur, a critical safeguard when AI output is integrated into business operations or customer-facing tools. For enterprises deploying LLMs, Conikee advises steering clear of open-ended generation unless necessary. Instead, organizations should lean on RAG grounded in curated, internal knowledge bases. 


Can Data Governance Set Us Free?

Internally, an important lesson has been to view data management as a federated service. This entails a shift from data management being a ‘governance’ activity – something people did because we pushed them to do it – to a service-driven activity – something people do because they want to. We worked with our User-Centred Service Design team to agree an underpinning set of principles to get buy-in across the organisation on the purpose of, and facets to, good data management. The overarching principle is that data are valuable, shared assets. We can maximise value by making data widely available, easy to use and understand, whilst ensuring data are protected and not misused. Bringing the service to life means getting four things right: First, a proportionate vision for service maturity. All data need to have basic information registered. But where data are widely used or feed into critical processes, it becomes instrumental to dedicate resources to supporting ease of access, use and quality for our users. We are increasingly tending toward managing these assets centrally. Second, the assignment of clear responsibilities across the federation. We are working through which datasets will be managed centrally and which will be managed by teams across the Bank that are expert in them. 


To Fix Platform Engineering, Build What Users Actually Want

If it takes developers and engineers months to become productive, your platform isn’t helping — it’s hindering. A great platform should be as frictionless and intuitive as a consumer-grade product. Internal platforms must empower instant productivity. If your platform offers compute, it shouldn’t just be raw power — it should be integrated, easy to adopt, and evolve seamlessly in the background. Let’s not create unnecessary cognitive load. Developers are adapting quickly to generative AI and new tech. The real value lies in solving real, tangible problems — not fictional ones. This brings us to a deeper look at what’s not working — and why so many efforts fail despite the best intentions. ... Most enterprises are hybrid by nature — legacy systems, siloed processes and complex workflows are the norm. The real challenge isn’t just technological; it’s integrating platform engineering into these messy realities without making it worse. Today, no single product solves this end-to-end. We’re still lacking a holistic solution that manages internal workflows, governance and hybrid complexity without adding friction. What’s needed is a shift in mindset — from assembling open source tools to building integrated, adoption-focused, business-aligned platforms. And that shift must be guided by clear trends in tooling and team structure.


Liquid cooling becoming essential as AI servers proliferate

“A lot of the carbon emissions of the data center happen in the build of it, in laying down the slab,” says Josh Claman, CEO at Accelsius, a liquid cooling company. “I hope that companies won’t just throw all that away and start over.” In addition to the environmental benefits, upgrading an air-cooled data center into a hybrid, liquid and air system has other advantages, says Herb Hogue, CTO at Myriad360, a global systems integrator. Liquid cooling is more effective than air alone, he says, and when used in combination with air cooling, the temperature of the air cooling systems can be increased slightly without impacting performance. “This reduces overall energy consumption and lowers utility bills,” he says. Liquid cooling also allows for not just lower but also more consistent operating temperatures, Hogue says. That leads to less wear on IT equipment, and, without fans, fewer moving parts per server. The downsides, however, include the cost of installing the hybrid system and needed specialized operations and maintenance skills. There might also be space constraints and other challenges. Still, it can be a smart approach for handling high-density server setups, he says. And there’s one more potential benefit, says Gerald Kleyn, vice president of customer solutions for HPC and AI at Hewlett Packard Enterprise. 

Daily Tech Digest - May 18, 2025


Quote for the day:

“We are all failures - at least the best of us are.” -- J.M. Barrie


Extra Qubits Slash Measurement Time Without Losing Precision

Fast and accurate quantum measurements are essential for future quantum devices. However, quantum systems are extremely fragile; even small disturbances during measurement can cause significant errors. Until now, scientists faced a fundamental trade-off: they could either improve the accuracy of quantum measurements or make them faster, but not both at once. Now, a team of quantum physicists, led by the University of Bristol and published in Physical Review Letters, has found a way to break this trade-off. The team’s approach involves using additional qubits, the fundamental units of information in quantum computing, to “trade space for time.” Unlike the simple binary bits in classical computers, qubits can exist in multiple states simultaneously, a phenomenon known as superposition. In quantum computing, measuring a qubit typically requires probing it for a relatively long time to achieve a high level of certainty. ... Remarkably, the team’s process allows the quality of a measurement to be maintained, or even enhanced, even as it is sped up. The method could be applicable to a broad range of leading quantum hardware platforms. As the global race to build the highest-performance quantum technologies continues, the scheme has the potential to become a standard part of the quantum read-out process.


The leadership legacy: How family shapes the leaders we become

We’ve built leadership around performance metrics, dashboards and influence. Yet the traits that truly sustain teams — empathy, accountability, consistency — are often born not in corporate training but in the everyday rituals of family life. On this International Day of Families, it’s time to reevaluate leadership models that have long been defined by clarity, charisma and control and define it with something deeper like care, connection and community. ... Here are five principles drawn from healthy family systems that can reframe leadership models: Consistency over chaos: Families thrive on routines and reliability. Leaders who bring emotional consistency, set clear expectations and avoid reactionary decisions foster psychological safety. Presence over performance: In families, presence often matters more than fixing the problem. Leaders who truly listen, offer time and engage with empathy build trust that performance alone cannot buy. Accountability with care: Families call out mistakes, but with the intent to support, not shame. Leaders who combine feedback with care build growth mindsets without fear. Shared purpose over solo glory: Families move together. In workplaces, this means shifting from individual heroism to collaborative wins. Leaders must champion shared success. Adaptability with anchoring: Just like families adjust to life stages, leaders need to flex without losing values. Adapt strategy, but anchor culture.


IPv4 was meant to be dead within a decade; what's happening with IPv6?

Globally, IPv6 is now approaching the halfway mark of Internet traffic. Google, which tracks the percentage of its users that reach it via IPv6, reports that around 46% of users worldwide access Google over IPv6 as of mid-May 2025. In other words, given the ubiquity of Google's usage, nearly half of Internet users have IPv6 capability today. While that’s a significant milestone, IPv4 still carries about half of the traffic, even though it was long expected to be retired by now. The growth has not been exponential, but it is persistent. ... The first, and arguably largest hurdle is that IPv6 was not designed to be backward-compatible with IPv4, a big criticism of IPv6 in general and largely blamed for its slow adoption. An IPv6-only device cannot directly communicate with an IPv4-only device without the help of a complex translation gateway, such as NAT64. This means networks usually run dual-stack support for both protocols, and IPv4 can't just be "switched off." This has major downsides, though; dual-stack operation doubles certain aspects of network management, requiring two address configurations, two sets of firewall rules, and more, which increases operational complexity for businesses and home users alike. This complexity causes a significant slowdown in deployment, as network engineers and software developers must ensure everything works on IPv6 in addition to IPv4. Any lack of feature parity or small misconfigurations can cause major issues.


Agentic mesh: The future of enterprise agent ecosystems

Many companies describe agents as “science experiments” that never leave the lab. Others complain about suffering the pain of “a thousand proof-of-concepts” with agents. The root cause of this pain? Most agents today aren’t designed to meet enterprise-grade standards. ... As enterprises adopt more agents, a familiar problem is emerging: silos. Different teams deploy agents in CRMs, data warehouses, or knowledge systems, but these agents operate independently, with no awareness of each other. ... An agentic mesh is a way to turn fragmented agents into a connected, reliable ecosystem. But it does more: It lets enterprise-grade agents operate in an enterprise-grade agent ecosystem. It allows agents to find each other and to safely and securely collaborate, interact, and even transact. The agentic mesh is a unified runtime, control plane, and trust framework that makes enterprise-grade agent ecosystems possible. ... Agentic mesh fulfills two major architectural goals: It lets you build enterprise-grade agents and it gives you an enterprise-grade run-time environment to support these agents. To support secure, scalable, and collaborative agents, an agentic mesh needs a set of foundational components. These capabilities ensure that agents don’t just run, but run in a way that meets enterprise requirements for control, trust, and performance.


OpenAI launches research preview of Codex AI software engineering agent for developers

The new Codex goes far beyond its predecessor. Now built to act autonomously over longer durations, Codex can write features, fix bugs, answer codebase-specific questions, run tests, and propose pull requests—each task running in a secure, isolated cloud sandbox. The design reflects OpenAI’s broader ambition to move beyond quick answers and into collaborative work. Josh Tobin, who leads the Agents Research Team at OpenAI, said during a recent briefing: “We think of agents as AI systems that can operate on your behalf for a longer period of time to accomplish big chunks of work by interacting with the real world.” Codex fits squarely into this definition. ... Codex executes tasks without internet access, drawing only on user-provided code and dependencies. This design ensures secure operation and minimizes potential misuse. “This is more than just a model API,” said Embiricos. “Because it runs in an air-gapped environment with human review, we can give the model a lot more freedom safely.” OpenAI also reports early external use cases. Cisco is evaluating Codex for accelerating engineering work across its product lines. Temporal uses it to run background tasks like debugging and test writing. Superhuman leverages Codex to improve test coverage and enable non-engineers to suggest lightweight code changes. 


AI-Driven Software: Why a Strong CI/CD Foundation Is Essential

While AI can significantly boost speed, it also drives higher throughput, increasing the demand for testing, QA monitoring, and infrastructure investment. More code means development teams need to find ways to shorten feedback loops, build times, and other key elements of the development process to keep pace. Without a solid DevOps framework and CI/CD engine to manage this, AI can create noise and distractions that drain engineers’ attention, slowing them down instead of freeing them to focus on what truly matters: delivering quality software at the right pace. ... By investing in a CI/CD platform with these capabilities, you’re not just buying a tool — you’re establishing the foundation that will determine whether AI becomes a force multiplier for your team or simply creates more noise in an already complex system. The right platform turns your CI/CD pipeline from a bottleneck into a strategic advantage, allowing your team to harness AI’s potential while maintaining quality, security, and reliability. To harness the speed and efficiency gains of AI-driven development, you need a CI/CD platform capable of handling high throughput, rapid iteration, and complex testing cycles while keeping infrastructure and cloud costs in check. ... It is easy to get caught up in the excitement of powerful technologies like AI and dive straight into experimentation without laying the right groundwork for success.


Quantum Algorithm Outpaces Classical Solvers in Optimization Tasks, Study Indicates

The study focuses on a class of problems known as higher-order unconstrained binary optimization (HUBO), which model real-world tasks like portfolio selection, network routing, or molecule design. These problems are computationally intensive because the number of possible solutions grows exponentially with problem size. On paper, those are exactly the types of problems that most quantum theorists believe quantum computers, once robust enough, would excel at solving. The researchers evaluated how well different solvers — both classical and quantum — could find approximate solutions to these HUBO problems. The quantum system used a technique called bias-field digitized counterdiabatic quantum optimization (BF-DCQO). The method builds on known quantum strategies by evolving a quantum system under special guiding fields that help it stay on track toward low-energy states. ... It is probably important to note that the researchers didn’t just rely on the quantum component and that the hybrid approach was essential in securing the quantum edge. Their BF-DCQO pipeline includes classical preprocessing and postprocessing, such as initializing the quantum system with good guesses from fast simulated annealing runs and cleaning up final results with simple local searches.


How human connection drives innovation in the age of AI

When we are working toward a shared goal, there are core values and shared aspirations that bind us. By actively seeking out this common ground and fostering positive interactions, we can all bridge divides, both in our personal lives and within our organizations.  Feeling connection is not just good for our own wellbeing, it is also crucial for business outcomes. According to research, 94% of employees say that feeling connected to their colleagues makes them more productive at work, and over four times as likely to feel job satisfaction and half as likely to leave their jobs within the next year.  ... As we integrate AI deeper into our workflows, we should be deliberate in cultivating environments that prioritize genuine human connection and the development of these essential human skills.  This means creating intentional spaces—both physical and virtual—that encourage open dialogue, active listening, and the respectful exchange of diverse perspectives. Leaders should champion empathy and relationship-building skill development within their teams, actively working to promote thoughtful opportunities for human connection in our AI-driven environment. Ultimately, the future of innovation and progress will be shaped by our ability to harness the power of AI in a way that amplifies our uniquely human capacities, especially our innate drive to connect with one another.


Enterprise Intelligence: Why AI Data Strategy Is A New Advantage

Forward-thinking enterprises are embracing cloud-native data platforms that abstract infrastructure complexity and enable a new class of intelligent, responsive applications. These platforms unify data access across object, file, and block formats while enforcing enterprise-grade governance and policy. They incorporate intelligent tiering and KV caching strategies that learn from access patterns to prioritize hot data, accelerating inference and reducing overhead. They support multimodal AI workloads by seamlessly managing petabyte-scale datasets across edge, core, and cloud locations—without burdening teams with manual tuning. And they scale elastically, adapting to growing demand without disruptive re-architecture. ... AI-driven businesses are no longer defined by how much compute power they can deploy but by how efficiently they can manage, access, and utilize data. The enterprises that rethink their data strategy—eliminating friction, reducing latency, and ensuring seamless integration across AI pipelines—will gain a decisive competitive edge. For CIOs, the message is clear: AI success isn’t just about faster algorithms or bigger models; it’s about creating a smarter, more agile data architecture. Organizations that embrace real-time, scalable data platforms will not only unlock AI’s full potential but also future-proof their operations in an increasingly data-driven world.


The future of the modern data stack: Trends and predictions

AI and ML are also key drivers of the modern data stack, because they are creating new (or greatly amplifying existing) demands on data infrastructure. Suddenly, the provenance and lineage of information is taking on new importance, as enterprises fight against “hallucinations” and accidental exposure of PII or PHI through AI mechanisms. Data sharing is also more important than ever, because no single organization is likely to host all the information needed by GenAI models itself, and will intrinsically rely on others to augment models, RAG, prompt engineering, and other approaches when building AI-based solutions. ... The goal of simplifying data management and giving more users more access to data has been around since long before computers were invented. But recent improvements in GenAI and data sharing have vastly accelerated these trends — suddenly, the idea that non-technical professionals can transform, combine, analyze, and utilize complex datasets from inside and outside an organization feels not just achievable, but probable. ... Advances in data sharing, especially heterogeneous data sharing, through common formats like Iceberg, governance approaches like Polaris, and safety and security mechanisms like Vendia IceBlock are quickly removing the historical challenges to data product distribution. 

Daily Tech Digest - May 17, 2025


Quote for the day:

“Only those who dare to fail greatly can ever achieve greatly.” -- Robert F.


Top 10 Best Practices for Effective Data Protection

Your first instinct may be to try to keep up with all your data, but this may be a fool's errand. The key to success is to have classification capabilities everywhere data moves, and rely on your DLP policy to jump in when risk arises. Automation in data classification is becoming a lifesaver thanks to the power of AI. AI-powered classification can be faster and more accurate than traditional ways of classifying data with DLP. Ensure any solution you are evaluating can use AI to instantly uncover and discover data without human input. ... Data loss prevention (DLP) technology is the core of any data protection program. That said, keep in mind that DLP is only a subset of a larger data protection solution. DLP enables the classification of data (along with AI) to ensure you can accurately find sensitive data. Ensure your DLP engine can consistently alert correctly on the same piece of data across devices, networks, and clouds. The best way to ensure this is to embrace a centralized DLP engine that can cover all channels at once. Avoid point products that bring their own DLP engine, as this can lead to multiple alerts on one piece of moving data, slowing down incident management and response. Look to embrace Gartner's security service edge approach, which delivers DLP from a centralized cloud service. 


4 Keys To Successful Change Management From The Bain Playbook

From the start, Bain was crystal clear about its case for change, according to Razdan. The company prioritized change management, which meant IT partnering with finance; it also meant cultivating a mindset conducive to change. “We owned the change; we identified a group of high performers within our finance and our IT teams. This community of super-users could readily identify and deal with any of the problems that typically arise in an implementation of this size and scale,” Mackey said. “This was less just changing their technology; it’s changing employee behaviors and setting us up for how we want to grow and change processes going forward.” ... “We actually set up a program to be always measuring the value,” Razdan said. “You have internal stakeholders, you have external stakeholders, you have partnerships; we kind of built an ecosystem of governance and partnership that enabled us to keep everybody on the same page because transparency and communication is critical to success.” Gauging progress via transparent key performance indicators was all the more impressive, given that most of this happened during the worldwide, pandemic-driven move to remote work. “We could assess the implementation, as we went through it, to keep us on track [and] course correct,” Mackey said. 


Emerging AI security risks exposed in Pangea's global study

A significant finding was the non-deterministic nature of large language model (LLM) security. Prompt injection attacks, a method where attackers manipulate input to provoke undesired responses from AI systems, were found to succeed unpredictably. An attack that fails 99 times could succeed on the 100th attempt with identical input, due to the underlying randomness in LLM processing. The study also revealed substantial risks of data leakage and adversarial reconnaissance. Attackers using prompt injection can manipulate AI models to disclose sensitive information or contextual details about the environment in which the system operates, such as server types and network access configurations. 'This challenge has given us unprecedented visibility into real-world tactics attackers are using against AI applications today,' said Oliver Friedrichs, Co-Founder and Chief Executive Officer of Pangea. 'The scale and sophistication of attacks we observed reveal the vast and rapidly evolving nature of AI security threats. Defending against these threats must be a core consideration for security teams, not a checkbox or afterthought.' Findings indicated that basic defences, such as native LLM guardrails, left organisations particularly exposed. 


Dynamic DNS Emerges as Go-to Cyberattack Facilitator

Dynamic DNS (DDNS) services automatically update a domain name's DNS records in real-time when the Internet service provider changes the IP address. Real-time updating for DNS records wasn't needed in the early days of the Internet when static IP addresses were the norm. ... It sounds simple enough, yet bad actors have abused the services for years. More recently, though, cybersecurity vendors have observed an increase in such activity, especially this year. The notorious cybercriminal collective Scattered Spider, for instance, has turned to DDNS to obfuscate its malicious activity and impersonate well-known brands in social engineering attacks. This trend has some experts concerned about a rise in abuse and a surge in "rentable" subdomains. ... In an example of an observed attack, Scattered Spider actors established a new subdomain, klv1.it[.]com, designed to impersonate a similar domain, klv1.io, for Klaviyo, a Boston-based marketing automation company. Silent Push's report noted that the malicious domain had just five detections on VirusTotal at the time of publication. The company also said the use of publicly rentable subdomains presents challenges for security researchers. "This has been something that a lot of threat actors do — they use these services because they won't have domain registration fingerprints, and it makes it harder to track them," says Zach Edwards, senior threat researcher at Silent Push.


The Growing and Changing Threat of Deepfake Attacks

To ensure their deepfake attacks are convincing, malicious actors are increasingly focusing on more believable delivery, enhanced methods, such as phone number spoofing, SIM swapping, malicious recruitment accounts and information-stealing malware. These methods allow actors to convincingly deliver deepfakes and significantly increase a ploy’s overall credibility. ... High-value deepfake targets, such as C-suite executives, key data custodians, or other significant employees, often have moderate to high volumes of data available publicly. In particular, employees appearing on podcasts, giving interviews, attending conferences, or uploading videos expose significant volumes of moderate- to high-quality data for use in deepfakes. This dictates that understanding individual data exposure becomes a key part of accurately assessing the overall enterprise risk of deepfakes. Furthermore, ACI research indicates industries such as consulting, financial services, technology, insurance and government often have sufficient publicly available data to enable medium-to high-quality deepfakes. Ransomware groups are also continuously leaking a high volume of enterprise data. This information can help fuel deepfake content to “talk” about genuine internal documents, employee relationships and other internal details. 


Binary Size Matters: The Challenges of Fitting Complex Applications in Storage-Constrained Devices

Although we are here focusing on software, it is important to say that software does not run in a vacuum. Having an understanding of the hardware our programs run on and even how hardware is developed can offer important insights into how to tackle programming challenges. In the software world, we have a more iterative process, new features and fixes can usually be incorporated later in the form of over-the-air updates, for example. That is not the case with hardware. Design errors and faults in hardware can at the very best be mitigated with considerable performance penalties. These errors can introduce the meltdown and spectre vulnerabilities, or render the whole device unusable. Therefore the hardware design phase has a much longer and rigorous process before release than the software design phase. This rigorous process also impacts design decisions in terms of optimizations and computational power. Once you define a layout and bill of materials for your device, the expectation is to keep this constant for production as long as possible in order to reduce costs. Embedded hardware platforms are designed to be very cost-effective. Designing a product whose specifications such as memory or I/O count are wasted also means a cost increase in an industry where every cent in the bill of materials matters.


Cyber Insurance Applications: How vCISOs Bridge the Gap for SMBs

Proactive risk evaluation is a game-changer for SMBs seeking to maintain robust insurance coverage. vCISOs conduct regular risk assessments to quantify an organization’s security posture and benchmark it against industry standards. This not only identifies areas for improvement but also helps maintain compliance with evolving insurer expectations. Routine audits—led by vCISOs—keep security controls effective and relevant. Third-party risk evaluations are particularly valuable, given the rise in supply chain attacks. By ensuring vendors meet security standards, SMBs reduce their overall risk profile and strengthen their position during insurance applications and renewals. Employee training programs also play a critical role. By educating staff on phishing, social engineering, and other common threats, vCISOs help prevent incidents before they occur. ... For SMBs, navigating the cyber insurance landscape is no longer just a box-checking exercise. Insurers demand detailed evidence of security measures, continuous improvement, and alignment with industry best practices. vCISOs bring the technical expertise and strategic perspective necessary to meet these demands while empowering SMBs to strengthen their overall security posture.


How to establish an effective AI GRC framework

Because AI introduces risks that traditional GRC frameworks may not fully address, such as algorithmic bias and lack of transparency and accountability for AI-driven decisions, an AI GRC framework helps organizations proactively identify, assess, and mitigate these risks, says Heather Clauson Haughian, co-founding partner at CM Law, who focuses on AI technology, data privacy, and cybersecurity. “Other types of risks that an AI GRC framework can help mitigate include things such as security vulnerabilities where AI systems can be manipulated or exposed to data breaches, as well as operational failures when AI errors lead to costly business disruptions or reputational harm,” Haughian says. ... Model governance and lifecycle management are also key components of an effective AI GRC strategy, Haughian says. “This would cover the entire AI model lifecycle, from data acquisition and model development to deployment, monitoring, and retirement,” she says. This practice will help ensure AI models are reliable, accurate, and consistently perform as expected, mitigating risks associated with model drift or errors, Haughian says. ... Good policies balance out the risks and opportunities that AI and other emerging technologies, including those requiring massive data, can provide, Podnar says. “Most organizations don’t document their deliberate boundaries via policy,” Podnar says. 


How to Keep a Consultant from Stealing Your Idea

The best defense is a good offense, Thirmal says. Before sharing any sensitive information, get the consultant to sign a non-disclosure agreement (NDA) and, if needed, a non-compete agreement. "These legal documents set clear boundaries on what can and can't do with your ideas." He also recommends retaining records -- meeting notes, emails, and timestamps -- to provide documented proof of when and where the idea in question was discussed. ... If a consultant takes an idea and commercializes it, or shares it with a competitor, it's time to consult legal counsel, Paskalev says. The legal case's strength will hinge on the exact wording within contracts and documentation. "Sometimes, a well-crafted cease-and-desist letter is enough; other times, litigation is required." ... The best way to protect ideas isn't through contracts -- it's by being proactive, Thirmal advises. "Train your team to be careful about what they share, work with consultants who have strong reputations, and document everything," he states. "Protecting innovation isn’t just a legal issue -- it's a strategic one." Innovation is an IT leader's greatest asset, but it's also highly vulnerable, Paskalev says. "By proactively structuring consultant agreements, meticulously documenting every stage of idea development, and being ready to enforce protection, organizations can ensure their competitive edge."


Even the Strongest Leaders Burn Out — Here's the Best Way to Shake the Fatigue

One of the most overlooked challenges in leadership is the inability to step back from the work and see the full picture. We become so immersed in the daily fires, the high-stakes meetings, the make-or-break moments, that we lose the ability to assess the battlefield objectively. The ocean, or any intense, immersive activity, provides that critical reset. But stepping away isn't just about swimming in the ocean. It's about breaking patterns. Leaders are often stuck in cycles — endless meetings, fire drills, back-to-back calls. The constant urgency can trick you into believing that everything is critical. That's why you need moments that pull you out of the daily grind, forcing you to reset before stepping back in. This is where intentional recovery becomes a strategic advantage. Top-performing leaders across industries — from venture capitalists to startup founders — intentionally carve out time for activities that challenge them in different ways. ... The most effective leaders understand that managing their energy is just as important as managing their time. When energy levels dip, cognitive function suffers, and decision-making becomes less strategic. That's why companies known for their progressive workplace cultures integrate mindfulness practices, outdoor retreats and wellness programs — not as perks, but as necessary investments in long-term performance.

Daily Tech Digest - May 16, 2025


Quote for the day:

"Different times need different types of leadership." -- Park Geun-hye


AI Agents: Protocols Driving Next-Gen Enterprise Intelligence

MCP substantially simplifies agentic AI adoption for developers. This roadmap created by the MCP community clearly defines priorities and direction, providing helpful guidance for implementation. Organizations will also benefit from the key initiatives outlined in the roadmap, like the MCP Registry, which enables developers to build a comprehensive network of agents. The emergence of OAuth as a complementary standard protocol strengthens agent ecosystems even more. As with any other framework, MCP has its challenges. MCP offers a wide array of tools to support LLM reasoning, but it doesn’t prioritize coordinated, high-quality task execution. ... ACP will make it easier to implement AI agents on edge and local devices. In instances where the majority of decision-making happens “on the go” in a disconnected environment, this protocol will be useful. Now, developers can build modular systems that can coordinate with a standard protocol to make edge AI easier. A2A will gain momentum and enable cross-platform agents to work together to deliver superior intelligence to customers. A2A will help coordinate agents built using diverse frameworks with a common standard. The main requirement for this is to build an Agent Card that allows agents to be used and consumed by others.


Critical Infrastructure Under Siege: OT Security Still Lags

Industrial organizations and other kinds of critical infrastructure are regularly near or at the top of vendor lists highlighting ransomware targets. It's easy to see why; the important assets a threat actor could compromise put immense pressure on affected organizations to pay up. Kurt Gaudette, vice president of intelligence and services at Dragos, tells Dark Reading that the OT side of the house is "where the bottom line is." And indeed, Sophos reported last year that 65% of respondent organizations in the manufacturing sector reported that they suffered a ransomware attack in the year preceding the report; of those, 62% of organizations paid the ransom. Compounding this, the security postures of organizations that use OT/ICS can vary dramatically compared with traditional IT settings. The importance of staying patched is complicated by the reality that some industrial processes are meant to run uninterrupted for long periods of time and can't be subjected to the downtime necessary to patch. Second, an organization like a local water treatment plant might not have a significant security budget to invest in tools and personnel. Also, ICS products tend to be expensive, and aging equipment is everywhere, with many fields like healthcare drowning in legacy, hard-to-patch products or those without built-in security features.


Your Security Training Isn't Wrong. The Content Is Just Outdated

Although AI makes threats harder to detect, many breaches aren't caused by sophisticated hacking. They happen because organizations might not realize employees let their kids play Minecraft on their corporate laptops, or an old server or forgotten IoT device is still online. If IT doesn't know an asset exists, or who uses it, the team can't secure it, and hackers look for forgotten, unmonitored devices to break in. ... Managing and securing multiple systems can tempt employees to repeat passwords for simplicity. If employees continue to avoid using tools like corporate password managers to enforce strong, unique passwords, IT teams need to ask themselves why. How can they make warnings about this more impactful without burdening staff? ... The trouble is that, even with corporate password managers and MFA in place, hackers are still finding ways to steal credentials. These tools are designed to prevent hackers from entering your home, but if the door is left open, they won't stop anyone from walking in. The average annual growth rate of exposed accounts is 28%. Session expiration policies based on risk level and adaptive access policies can trigger forced signouts if a session shows abnormal behavior (e.g., logging in from a new IP while still active on another), which will help reduce account session takeovers.


Check Point CISO: Network segregation can prevent blackouts, disruptions

In 2025, industry watchers expect there will be an increase in the public budget allocated to defense. In Spain, one-third of the budget will be allocated to increasing cybersecurity. But for Fischbein, training teams is much more important than the budget. “The challenge is to distribute the budget in a way that can be managed,” he notes, and to leverage intuitive and easy-to-use platforms, so that organizations don’t have to invest all the money in training. “When you have information, management, users, devices, mobiles, data centers, clouds, cameras, printers… the security challenge is very complex. ” he says. ” ... “In a security operations center (SOC), a person using Check Point tools could previously take between two and four hours to investigate the causes of an alert. Today that time has dropped to 20 minutes,” he says. He also explains how they work with vulnerabilities. “Currently, Check Point checks all of them in a few seconds and tells you whether you are protected or not. And if you are not, it tells you which network to protect.” Regarding attackers, he acknowledges that they now make “richer and more logical” attacks. “With AI, they check the data and social networks of any person to impersonate a friend of the attacked person, because when someone receives something more personal they lower the defenses against phishing,” he says.


The Future (and Past) of Child Online Safety Legislation: Who Minds the Implementation Gap?

Acknowledging the limitations of exclusively using ID as a form of verification, many state bills, including Montana, Louisiana, Arkansas, Utah, and New York, have left the door open for “commercially reasonable” age verification methods. However, they give very little clarification as to what should be considered “commercially reasonable”. For example, in Utah, they only specify that these options can, “[rely] on public or private transactional data to verify the age of the person attempting to access the material.” ... Throughout all of these bills, there is no insight as to what type of data is permissible, how this data should be sourced, or any consent mechanisms for leveraging the data. By leaving a loophole open for undefined measures of age verification, there is a risk of potentially invasive and privacy-violating data, such as biometric data, being required of everyone who intends to access social media platforms. Not only could this potentially compromise people’s ability to remain anonymous on the internet, but it could also lead to the consolidation of uniquely identifiable sensitive data within the entities performing these verifications. To combat this, all bills with specifications for commercially reasonable age verification methods prohibit the data being used for verification from being stored or retained after verification is complete.


Beyond Code Coverage: A Risk-Driven Revolution in Software Testing With Machine Learning

Risk-based testing measures the importance of criteria instead of conducting equal checks for every factor. It evaluates potential flaws based on failure impact, likelihood of failure, and business criticality. This approach ensures efficient resource management and improves software reliability by: Focusing on Critical Areas: Instead of testing everything equally, RBT ensures that high-risk components receive the most attention. Evaluating Failure Impact: Identifies and tests areas where defects could cause significant damage. Assessing Likelihood of Failure: Targets unstable parts of the software by analyzing complexity, frequent changes, and past defects. Prioritizing Business-Critical Functions: Ensures essential systems like payment processing remain stable and reliable. Optimizing Resources and Time: Reduces unnecessary testing efforts, allowing teams to focus on what matters most. Improving Software Dependability: Detects major issues early, leading to more stable and reliable software. ... Machine learning improves software testing by examining prior data (code changes, bug reports, and test results) to identify high-risk locations. It gives key tests top priority; it finds anomalies before failures start; it keeps getting better with fresh data. Automating risk assessment helps ML speed tests, improve accuracy, maximize resources, and make software testing smarter and more effective.


Integrating Cybersecurity Into Change Management for Critical Infrastructure

The cyber MOC specifically targets changes affecting connected and configurable technologies, such as PLCs, IIoT devices, and network switches. The specific implementation of this process will vary depending on the organization’s structure and operational needs, as will the composition of the teams responsible for its execution. The reality is that many existing MOC frameworks were conceived before cybersecurity became a critical concern. Consequently, they often prioritize physical safety, leaving a significant gap in addressing potential cyber vulnerabilities. Traditional MOC tools, designed to support these processes, lack the necessary mechanisms to evaluate changes that could compromise cybersecurity. This oversight is a significant risk, particularly as infrastructure organizations become increasingly reliant on interconnected technologies. To bridge this gap, a fundamental shift is required. MOC tools and workflows must be revamped to incorporate cybersecurity considerations. While preserving core data fields and attributes, new fields must be introduced to capture cyber-related information. Similarly, RACI (responsible, accountable, consulted, and informed) matrices, which define responsibilities, must be expanded to include cyber risk accountability.


Deepfake attacks could cost you more than money

Treat deepfakes like any other cyber threat and apply a zero-trust mindset. That means don’t assume anything is real just because it looks or sounds convincing. Update your response plan to include steps for verifying video or audio content, especially if it’s being used to request sensitive actions. Build a risk model that considers how deepfakes could be used to target critical business processes, such as executive communications, financial approvals, or customer interactions. Make sure your team knows how to spot red flags, who to alert, and how to document the incident. Use detection tools that can scan media in real time and save flagged content for review. The faster you can identify and act, the more damage you can prevent. In today’s environment, it’s safer to question first and trust only after you verify. ... Deepfake awareness should be built into regular training so employees can spot warning signs early. Utilizing the detection tools to support teams by scanning and flagging suspicious media in real time, helping them make faster, safer decisions. Incident response plans must also cover how to escalate, preserve evidence, and communicate if a deepfake is suspected. At the end of the day, questioning unusual communications must become the norm, not the exception


Secure Code Development News to Celebrate

Another big payoff comes from paying down security debt. Wysopal said organizations with the most mature secure development practices fix 10% of their vulnerabilities on an annual basis and avoid having any security debt that is more than a year old. By contrast, "the lagging companies fix less than 1% of open bugs per month," he said. This strategy isn't always feasible. Notably, "we found that 70% of critical debt was in third-party code," and teams that built software with third-party - or sometimes fourth or fifth party - dependencies sometimes must wait months for fixes to become available, Wysopal said. "Some software packages that are widely used by other software packages are harder to fix, so you have a lot what we call transitive dependencies." There's no easy solution for this challenge. "When you're using open source, you're really dependent on the fixing speed of another team that is not getting paid, and they're just doing it because they love to do that project," he said. ... Another wrinkle is that more code is built by artificial intelligence tools - Google and Microsoft each say roughly a third of their code is AI-generated. Developers report being more productive, shipping on average 50% more code when they use AI tools. Wysopal said such AI tools appear to produce code with vulnerabilities at the same rate as classical development tools. More code shipped risks a greater number of vulnerabilities.


Powering the AI revolution: Legal and infrastructure challenges for data center development

Developing and operating AI-ready data centers necessitates specialized legal expertise across multiple disciplines. Financing attorneys provide guidance in structuring capital arrangements that support data center development, which requires substantial upfront investment before generating any operational revenue. Capital arrangements must incorporate sufficient flexibility to accommodate the rapid evolution of AI technology availability and unique power supply challenges at an individual site. Energy lawyers guide PPA negotiations, facilitate utility discussions, manage interconnection filings with relevant authorities, and resolve rate disputes when they arise. Their specialized work ensures that facilities maintain access to reliable, cost-effective power resources that meet operational requirements under all anticipated conditions. As regulatory approaches to AI infrastructure continue to evolve, energy counsel must remain current on emerging policies and their potential impact on both existing and future facilities. Technology and intellectual property specialists address essential operational aspects of data centers, including complex licensing arrangements, service level agreements, comprehensive data governance frameworks, and cross-border data flow compliance strategies.

Daily Tech Digest - May 15, 2025


Quote for the day:

“Challenges are what make life interesting and overcoming them is what makes life meaningful.” -- Joshua J. Marine


How to use genAI for requirements gathering and agile user stories

The key to success is engaging end-users and stakeholders in developing the goals and requirements around features and user stories. ... GenAI should help agile teams incorporate more design thinking practices and increase feedback cycles. “GenAI tools are fundamentally shifting the role of product owners and business analysts by enabling them to prototype and iterate on requirements directly within their IDEs rapidly,” says Simon Margolis, Associate CTO at SADA. “This allows for more dynamic collaboration with stakeholders, as they can visualize and refine user stories and acceptance criteria in real time. Instead of being bogged down in documentation, they can focus on strategic alignment and faster delivery, with AI handling the technical translation.” ... “GenAI excels at aligning user stories and acceptance criteria with predefined specs and design guidelines, but the original spark of creativity still comes from humans,” says Ramprakash Ramamoorthy, director of AI research at ManageEngine. “Analysts and product owners should use genAI as a foundational tool rather than relying on it entirely, freeing themselves to explore new ideas and broaden their thinking. The real value lies in experts leveraging AI’s consistency to ground their work, freeing them to innovate and refine the subtleties that machines cannot grasp.”


5 Subtle Indicators Your Development Environment Is Under Siege

As security measures around production environments strengthen, which they have, attackers are shifting left—straight into the software development lifecycle (SDLC). These less-protected and complex environments have become prime targets, where gaps in security can expose sensitive data and derail operations if exploited. That’s why recognizing the warning signs of nefarious behavior is critical. But identification alone isn’t enough—security and development teams must work together to address these risks before attackers exploit them. ... Abnormal spikes in repository cloning activity may indicate potential data exfiltration from Software Configuration Management (SCM) tools. When an identity clones repositories at unexpected volumes or times outside normal usage patterns, it could signal an attempt to collect source code or sensitive project data for unauthorized use. ... While cloning is a normal part of development, a repository that is copied but shows no further activity may indicate an attempt to exfiltrate data rather than legitimate development work. Pull Request approvals from identities lacking repository activity history may indicate compromised accounts or an attempt to bypass code quality safeguards. When changes are approved by users without prior engagement in the repository, it could be a sign of malicious attempts to introduce harmful code or represent reviewers who may overlook critical security vulnerabilities.


Data, agents and governance: Why enterprise architecture needs a new playbook

The rapid evolution of AI and data-centric technologies is forcing organizations to rethink how they structure and govern their information assets. Enterprises are increasingly moving from domain-driven data architectures — where data is owned and managed by business domains — to AI/ML-centric data models that require large-scale, cross-domain integration. Questions arise about whether this transition is compatible with traditional EA practices. The answer: While there are tensions, the shift is not fundamentally at odds with EA but rather demands a significant transformation in how EA operates. ... Governance in an agentic architecture flips the script for EA by shifting focus to defining the domain authority of the agent to participate in an ecosystem. That encompasses the system they can interact with, the commands they can execute, the other agents they can interact with, the cognitive models they rely on and the goals that are set for them. Ensuring agents are good corporate citizens means enterprise architects must engage with business units to set the parameters for what an agent can and cannot do on behalf of the business. Further, the relationship and those parameters must be “tokenized” to authenticate the capacity to execute those actions. 

California’s location data privacy bill aims to reshape digital consent

“We’re really trying to help regulate the use of your geolocation data,” says the bill’s author, Democratic Assemblymember Chris Ward, who represents California’s 78th district, which covers parts of San Diego and surrounding areas. “You should not be able to sell, rent, trade, or lease anybody’s location information to third parties, because nobody signed up for that.” Among types of personal information, location data is especially sensitive. It reveals where people live, work, worship, protest, and seek medical care. It can expose routines, relationships, and vulnerabilities. As stories continue to surface about apps selling location data to brokers, government workers, and even bounty hunters, the conversation has expanded. What was once a debate about privacy has increasingly become a concern over how the exposure of this data infringes upon fundamental civil liberties. “Geolocation is very revealing,” says Justin Brookman, the director of technology policy at Consumer Reports, which supported the legislation. “It tells a lot about you, and it also can be a public safety issue if it gets into the wrong person’s hands.” ... Equally troubling, Ward argues, is who benefits. The companies collecting and selling this data are driven by profit, not transparency. As scholar Shoshana Zuboff has argued, surveillance capitalism doesn’t thrive because users want personalized ads. 


Digital Transformation Expert Discusses Trends

From day one, I emphasise that digital transformation isn’t just about adopting new tools—it’s about aligning those tools with business objectives, improving internal processes, and responding to changing customer expectations. To bring this to life, I use a blended approach that combines theory with real-world practice. Students explore frameworks and models that explain how businesses adapt to technological change, and then apply these to real case studies from global companies, SMEs, and my own entrepreneurial experiences. These examples give them insight into how digital transformation plays out in areas like operations, marketing, and customer relationship management (CRM). Active learning is central to my teaching. I use group work, live problem-solving, digital tool demonstrations, and hands-on simulations to help students experience digital transformation in action. I also introduce them to established business platforms and emerging technologies, encouraging them to assess their value and strategic impact. Ultimately, I aim to create an environment where students don’t just learn about digital transformation—they think like digital leaders, able to question, analyse, and apply what they’ve learned in real organisational contexts.


Building cybersecurity culture in science-driven organizations

The perception of security as a barrier is a challenge faced by many organizations, especially in environments where innovation is prioritized. The solution lies in shifting the narrative: Security are care givers for the value created in this organization. Most scientists and executives already understand the consequences of a cyberattack—lost research, stolen intellectual property, and disrupted operations. We involve them in the process. When lab leaders feel that their input has shaped security protocols, they’re more likely to support and champion those initiatives. Co-creating solutions ensures that security controls are not only effective but also practical for the scientific workflow. In short, building trust, demonstrating empathy for their challenges, and proving the value of security through action are what ultimately win buy-in. ... Shadow IT is a reality in any organization, but it’s particularly prevalent in environments like ours, where creativity and experimentation often outpace formal approval processes. While it’s important to communicate the risks of shadow IT clearly, we also recognize that outright bans are rarely effective. Instead, we focus on enabling secure alternatives. In the broader organization, we use tools to detect and prevent shadow IT, combined with strict communication around approved solutions. 


LastPass can now monitor employees' rogue reliance on shadow SaaS - including AI tools

With LastPass's browser extension for password management already well-positioned to observe -- and even restrict -- employee web usage, the security company has announced that it's diversifying into SaaS monitoring for small to midsize enterprises (SMEs). SaaS monitoring is part of a larger technology category known as SaaS Identity and Access Management, or SaaS IAM. As more employees are drawn to AI to improve productivity, the company is pitching an affordable solution to help SMEs contain the risks and costs associated with shadow SaaS; an umbrella of rogue SaaS procurement that's inclusive of shadow IT and its latest variant -- shadow AI. ... LastPass sees the new capabilities aligning with an organization's business objectives in a variety of ways. "One could be compliance," MacLennan told ZDNET. "Another could be the organization's internal sense of risk and risk management. Another could be cost because we're surfacing apps by category, in which case you'll see the whole universe of duplicative apps in use." MacLennan also noted that the new offering makes it easy to reduce costs due to the over-provisioning of SaaS licenses. For example, an organization is paying for 100 seats of some SaaS solution while the SaaS monitoring tool reveals that only 30 of those licenses are in active use.


Why ISO 42001 sets the standard for responsible AI governance

ISO 42001 is particularly relevant for organisations operating within layered supply chains, especially those building on cloud platforms. For these environments, where infrastructure, platform and software providers each play a role in delivering AI-powered services to end users, organisations must maintain a clear chain of responsibility and vendor due diligence. By defining roles across the shared responsibility model, ISO 42001 helps ensure that governance, compliance and risk management are consistent and transparent from the ground up. Doing so not only builds internal confidence but also enables partners and providers to demonstrate trustworthiness to customers across the value chain. As a result, trust management becomes a vital part of the picture by delivering an ongoing process of demonstrating transparency and control around the way organisations handle data, deploy technology, and meet regulatory expectations. Rather than treating compliance as a static goal, trust management introduces a more dynamic, ongoing approach to demonstrating how AI is governed across an organisation. By operationalising transparency, it becomes much easier to communicate security practices and explain decision-making processes to provide evidence of responsible development and deployment.


Beyond the office: Preparing for disasters in a remote work world

When disaster strikes, employees may be without electricity, internet, or cell service for days or weeks. They may have to evacuate their homes. They may be struggling with the loss of family members, friends, or neighbors. Just as organizations have disaster mitigation and recovery plans for main offices and data centers, they should be prepared to support remote employees in disaster situations they likely have never encountered before. Employers must counsel workers on what to do, provide additional resources, and above all, ensure that their mental health is attended to. ... Beyond cybersecurity risks, being forced to leave their home environment presents employees with another significant challenge: the potential loss of personal artifacts, from tax documents and family heirlooms to cherished photos. Lahiri refers to the process of safeguarding such items as “personal disaster recovery planning” and notes that this aspect of worker support is often overlooked. While companies have experience migrating servers from local offices to distributed teams, few have considered how to support employees on a personal level, he says. Lahiri urges IT teams to take a more empathetic approach and broaden their scope to include disaster recovery planning for employees’ home offices.


Beyond the Gang of Four: Practical Design Patterns for Modern AI Systems

Prompting might seem trivial at first. After all, you send free-form text to a model, so what could go wrong? However, how you phrase a prompt and what context you provide can drastically change your model's behavior, and there's no compiler to catch errors or a standard library of techniques. ... Few-Shot Prompting is one of the most straightforward yet powerful prompting approaches. Without examples, your model might generate inconsistent outputs, struggle with task ambiguity, or fail to meet your specific requirements. You can solve this problem by providing the model with a handful of examples (input-output pairs) in the prompt and then providing the actual input. You are essentially providing training data on the fly. This allows the model to generalize without re-training or fine-tuning. ... If you are a software developer trying to solve a complex algorithmic problem or a software architect trying to analyze complex system bottlenecks and vulnerabilities, you will probably brainstorm various ideas with your colleagues to understand their pros and cons, break down the problem into smaller tasks, and then solve it iteratively, rather than jumping to the solution right away. In Chain-of-Thought (CoT) prompting, you encourage the model to follow a very similar process and think aloud by breaking the problem down into a step-by-step process.