Daily Tech Digest by Kannan Subbiah

Daily Tech Digest - November 02, 2025

Quote for the day:

“Identify your problems but give your power and energy to solutions.” -- Tony Robbins

AI Agents: Elevating Cyber Threat Intelligence to Autonomous Response

Embedded across the security stack, AI agents can ingest vast volumes of threat data, triage alerts, correlate intelligence, and distribute insights in real time. For instance, agents can automate threat triage by filtering out false positives and flagging high-priority threats based on severity and relevance, thereby refining threat intelligence. They also enrich threat intelligence by cross-referencing multiple data sources to add meaningful context and track Indicators of Behavior (IoBs) that might otherwise go unnoticed. ... A major challenge for security teams is the inherent complexity they face. Often, the issue isn’t a lack of data or tools, but rather a lack of understanding the relevancy, coordination, collaboration and contextual actioning. Threat intelligence is frequently fragmented across systems, teams, and workflows, creating blind spots, unknowns and delays that attackers can exploit. ... As enterprises evolve, they can transform from leveraging one model to another. Both approaches have value, but striking the right balance between integrating smarter tools and securing cyber threat intelligence depends on clearly defining responsibilities. For most, a hybrid model will be the best fit, allowing AI agents to scale routine tasks while keeping humans in control of complex, high-stakes decisions within the framework of smarter cyber threat intelligence.

The Future Of Leadership Is Human: Why Empathy Outweighs Authority

When employees feel understood and valued, their brains operate in a state conducive to creativity and problem-solving. Conversely, when they perceive threat or indifference from leadership, their cognitive resources shift to self-preservation, limiting their capacity for innovation and collaboration. ... Developing empathetic leadership requires intentional systems and cultural changes. At our company, we've implemented several practices that have transformed our leadership culture, drawing inspiration from organizations that are leading this shift. ... Skeptics often question whether empathetic leadership can coexist with aggressive business goals and competitive markets, but evidence suggests the opposite. Empathetic leadership enables more aggressive goals because it unlocks human potential in ways that authority alone cannot. When people feel genuinely valued and understood, they contribute discretionary effort, share innovative ideas and advocate for the organization in ways that drive measurable business results. ... These results didn't happen overnight; they required genuine commitment to changing how we interact with our team members daily. I've personally shifted from viewing my role as "providing answers" to "asking better questions." Instead of dictating solutions in meetings, I now spend more time understanding the challenges my team faces and creating space for them to develop solutions.

Why password controls still matter in cybersecurity

Despite all the advanced authentication technologies, passwords continue to be the primary way attackers move through corporate networks. That makes it more important than ever to ensure your organization employs robust password controls. Today's IT environments are a tangled web of systems that defy simple security solutions. On-premises servers, cloud platforms, and remote work setups each add another layer of complexity to password management. ... Legacy accounts are like forgotten spare keys hidden under old doormats, just waiting for someone to find them. Windows Active Directory domains, standalone systems, and specialized application accounts have become the digital equivalent of unlocked side doors that nobody remembers to check. These forgotten entry points are a hacker's dream, offering easy access to networks that think they're buttoned up tight. ... Risk-based authentication takes this a step further, dynamically assessing each password change request based on context like device, location, and user behavior. It's like having a digital bouncer that knows exactly who should and shouldn't get past the velvet rope. ... Passwords aren't going anywhere. They remain the fallback for even the most advanced authentication methods. By implementing intelligent, dynamic password controls, your organization can turn them from a constant security challenge into a resilient defense mechanism.

What most companies get wrong about AI—and how to fix it, explains Ahead’s CPO

Despite the hype, Supancich is realistic about where most companies stand in their AI journey. Many, she says, know they need to "do something" with AI but lack clarity on what that should be. For Supancich, the priority is mapping processes, identifying the best use cases, and going deep in targeted areas to build real capability, rather than spreading efforts too thin. At Ahead, this means investing in both internal transformation and external consulting capabilities. The company has made AI training mandatory for all employees, equipping them with practical skills and demystifying the technology. The response, she reports, has been overwhelmingly positive, with employees discovering new ways to enhance their work and add value. Supancich is also alert to the data and privacy implications of AI, working closely with the CIO to ensure that the organisation’s approach is both innovative and secure. ... Throughout the conversation, one theme recurs: the centrality of leadership in navigating the future of work. Supancich sees the CPO as both guardian and architect of culture, a strategic partner who must be deeply involved in every aspect of the business. The future belongs to those who can blend technical fluency with emotional intelligence, strategic acumen with a passion for people.

Bake Ruthless Compliance Into CI/CD Without Slowing Releases

Compliance breaks when we glue it onto the end of a release, or when it’s someone’s “side job” to assemble evidence after the fact. The fix is to treat controls as non-functional requirements with acceptance criteria, put those criteria into policy-as-code, and make pipelines refuse to ship when the criteria aren’t met. A second source of breakage is ambiguity about shared responsibility. We push to managed services, assume the provider “has it,” and then discover that logging, encryption, or key rotation was our part of the dance. Map what belongs to us versus the platform, and turn that into explicit checks. The third killer is evidence debt. If we can’t answer “who approved what, when, with what config and tests” in under five minutes, the debt collectors will arrive during audit season. ... Compliance isn’t a meeting; it’s a pipeline step. Our CI/CD pipelines generate the evidence we need while doing the work we already do: building, testing, signing, scanning, and shipping. We don’t rely on optional post-build scanners or a “security stage” we can skip under pressure. Instead, we make the happy path compliant by default and fail fast when something’s off. That means SBOMs built with every image, vulnerability scanning with defined SLAs, provenance signed and attached to artifacts, and deployment gates that verify attestations.

Inside AstraZeneca’s AI Strategy: CDO Brian Dummann on Innovation, Governance and Speed

“One of our core values as a company is innovation. Our business is wired to be curious — to push the boundaries of science. And to be pioneers in science, we’ve got to be pioneers in technology.” That curiosity has created a healthy tension between demand and delivery. “I’ve got a company full of employees outside of the IT organization who are thirsty to get their hands on data and AI tools,” he says. “It’s a blessing and a challenge. They want new models, new platforms, and they want them now. It’s never fast enough.” ... Empowering employees to innovate is one thing; enabling them to do it safely and quickly is another. That’s where AstraZeneca’s AI Accelerator comes in — a cross-functional initiative designed to shorten the time between idea and implementation. “The ultimate goal is to accelerate how we can experiment with AI and use it to innovate across all areas of our business,” he says. “We’ve built an AI Accelerator whose sole purpose is to work through how to accelerate the introduction of new technologies or quickly review use cases.” Legacy processes, once measured in weeks or months, now need to operate in hours or days. The AI Accelerator brings together technology, legal, compliance, and governance teams to streamline assessments and approvals. ... “We’re now putting a lot more decision-making in the hands of our employees and empowering them,” he says. “With great power comes greater responsibility.”

8 ways to help your teams build lasting responsible AI

"For tech leaders and managers, making sure AI is responsible starts with how it's built," Rohan Sen, principal for cyber, data, and tech risk with PwC US and co-author of the survey report, told ZDNET. "To build trust and scale AI safely, focus on embedding responsible AI into every stage of the AI development lifecycle, and involve key functions like cyber, data governance, privacy, and regulatory compliance," said Sen. "Embed governance early and continuously. ... "Start with a value statement around ethical use," said Logan. "From here, prioritize periodic audits and consider a steering committee that spans privacy, security, legal, IT, and procurement. Ongoing transparency and open communication are paramount so users know what's approved, what's pending, and what's prohibited. Additionally, investing in training can help reinforce compliance and ethical usage." ... "A new AI capability will be so exciting that projects will charge ahead to use it in production. The result is often a spectacular demo. Then things break when real users start to rely on it. Maybe there's the wrong kind of transparency gap. Maybe it's not clear who's accountable if you return something illegal. Take extra time for a risk map or check model explainability. The business loss from missing the initial deadline is nothing compared to correcting a broken rollout."

Rising Identity Crime Losses Take a Growing Emotional Toll

What is changing now is how easily attackers can operationalize personal information data, observed Henrique Teixeira, a senior vice president for strategy at Saviynt, an identity governance and access management company in El Segundo, Calif. “In a recent attack I personally experienced, a criminal logged into one of my accounts using stolen credentials and then launched a subscription bombing campaign, flooding my inbox with hundreds of fake mailing list signups to bury legitimate fraud alerts,” he told TechNewsWorld. ... Kevin Lee, senior vice president for trust and safety at Sift, a fraud-prevention company for digital businesses, in San Francisco, called the suicide numbers “stark and concerning.” “Part of what’s driving this is probably the sheer magnitude of the losses,” he told TechNewsWorld. “When people are losing $100,000 or even $1 million due to identity theft, they’re losing years of savings they’ve built up. The financial devastation is compounded by feelings of shame and embarrassment, which keep people from seeking help.” There’s also the repeat victimization factor, he added. “When someone gets hit once and then targeted again, it creates this sense of helplessness,” he explained. “They feel like they can’t protect themselves, and that vulnerability is deeply traumatic.” “The report shows that victims who reach out to the ITRC have lower rates of suicidal thoughts, which tells us that having support and resources makes a real difference,” he said.

The Learning Gap in Generative AI Deployment

The learning gap is best understood as the space between what organisations experiment with and what they are able to deploy and scale effectively. It is an organisational phenomenon, as much about culture, governance, and leadership as about technology. ... Beyond training, the learning gap is perpetuated by structural and organisational barriers. One critical factor is the absence of effective feedback mechanisms. Generative AI tools are most valuable when they evolve in response to human inputs, errors, and changing contexts. Without monitoring systems and structured feedback loops, AI deployments remain static, brittle, and context-blind. Organisations that do not track performance, error rates, or user corrections fail to create a continuous learning cycle, leaving both humans and machines in a state of stagnation. ... Closing the learning gap requires a shift in focus from technology to organisation. Pilots must be anchored in real business problems, with measurable objectives that align with workflow needs. Incremental, context-sensitive deployment allows organisations to refine AI applications in situ, providing both employees and AI systems the feedback necessary to improve over time. Small-scale success builds confidence, generates data for iteration, and lays the groundwork for broader adoption. Equally important is the creation of structured learning opportunities within operational contexts.

How to Integrate Quantum-Safe Security into Your DevOps Workflow

To ensure that your DevOps workflow holds up against quantum threats, you must secure the information at rest and in transit. Consider implementing quantum-resistant encryption for your backups, credentials, pipeline secrets, and even internal communications, so that even your most sensitive data transfers remain safe. Some organizations are even experimenting with quantum key distribution solutions to safeguard the most critical communications, while others are taking a hybrid approach combining encryption with post-quantum algorithms. If you often exchange build outputs, orchestration signals, and credentials in your communication, you are going to need all the security you can get. ... For smoother integration of post-quantum security protocols, DevOps teams must opt for a phased and crypto-agile strategy that lets them leverage their legacy and quantum-safe algorithms. Doing so can also help DevOps maintain interoperability and reduce any operational disruption. ... Quantum security is not a one-time undertaking and is a recurring initiative that requires consistent efforts and time from your end. As the standards for cyberattacks and cyberdefense evolve, monitoring and improving our quantum security protocols should be an important part of your security strategy. You can also enhance your dashboards with quantum-specific metrics, such as cryptographic events and anomalies in encrypted traffic.

Daily Tech Digest - November 01, 2025

Quote for the day:

"Definiteness of purpose is the starting point of all achievement." -- W. Clement Stone

How to Fix Decades of Technical Debt

Technical debt drains companies of time, money and even customers. It arises whenever speed is prioritized over quality in software development, often driven by the pressure to accelerate time to market. In such cases, immediate delivery takes precedence, while long-term sustainability is compromised. The Twitter Fail Whale incident between 2007 and 2012 is testimony to the adage: "Haste makes waste." ... Gartner says companies that learn to manage technical debt will achieve at least 50% faster service delivery times to the business. But organizations that fail to do this properly can expect higher operating expenses, reduced performance and a longer time to market. ... Experts say the blame for technical debt should not be put squarely on the IT department. There are other reasons, and other forms of debt that hold back innovation. In his blog post, Masoud Bahrami, independent software consultant and architect, prefers to use terms such as "system debt" and "business debt," arguing that technical debt does not necessarily stem from outdated code, as many people assume. "Calling it technical makes it sound like only developers are responsible. So calling it purely technical is misleading. Some people prefer terms like design debt, organizational debt or software obligations. Each emphasizes a different aspect, but at its core, it's about unaddressed compromises that make future work more expensive and risky," he said.

Modernizing Collaboration Tools: The Digital Backbone of Resilience

Resilience is not only about planning and governance—it depends on the tools that enable real-time communication and decision-making. Disruptions test not only continuity strategies but also the technology that supports them. If incident management platforms are inaccessible, workforce scheduling collapses, or communication channels fail, even well-prepared organizations may falter. ... Crisis response depends on speed. When platforms are not integrated, departments must pass information manually or through multiple channels. Each delay multiplies risks. For example, IT may detect ransomware but cannot quickly communicate containment status to executives. Without updates, communications teams may delay customer notifications, and legal teams may miss regulatory deadlines. In crises, minutes matter. ... Integration across functions is another essential requirement. Incident management platforms should not operate in silos but instead bring together IT alerts, HR notifications, supply chain updates, and corporate communications. When these inputs are consolidated into a centralized dashboard, the resilience council and crisis management teams can view the same data in real time. This eliminates the risk of misaligned responses, where one department may act on incomplete information while another is waiting for updates. A truly integrated platform creates a single source of truth for decision-making under pressure.

AI-powered bug hunting shakes up bounty industry — for better or worse

Security researchers turning to AI is creating a “firehose of noise, false positives, and duplicates,” according to Ollmann. “The future of security testing isn’t about managing a crowd of bug hunters finding duplicate and low-quality bugs; it’s about accessing on demand the best experts to find and fix exploitable vulnerabilities — as part of a continuous, programmatic, offensive security program,” Ollmann says. Trevor Horwitz, CISO at UK-based investment research platform TrustNet, adds: “The best results still come from people who know how to guide the tools. AI brings speed and scale, but human judgment is what turns output into impact.” ... As common vulnerability types like cross-site scripting (XSS) and SQL injection become easier to mitigate, organizations are shifting their focus and rewards toward findings that expose deeper systemic risk, including identity, access, and business logic flaws, according to HackerOne. HackerOne’s latest annual benchmark report shows that improper access control and insecure direct object reference (IDOR) vulnerabilities increased between 18% and 29% year over year, highlighting where both attackers and defenders are now concentrating their efforts. “The challenge for organizations in 2025 will be balancing speed, transparency, and trust: measuring crowdsourced offensive testing while maintaining responsible disclosure, fair payouts, and AI-augmented vulnerability report validation,” HackerOne’s Hazen concludes.

Achieving critical key performance indicators (KPIs) in data center operations

KPIs like PUE, uptime, and utilization once sufficed. But in today’s interconnected data center environments, they are no longer enough. Legacy DCIM systems measure what they can see – but not what matters. Their metrics are static, siloed, and reactive, failing to reflect the complex interplay between IT, facilities, sustainability, and service delivery. ... Organizations embracing UIIM and AI tools are witnessing measurable improvements in operational maturity: Manual audits are replaced by automated compliance checks; Capacity planning evolves from static spreadsheets to predictive, data-driven modeling; Service disruptions are mitigated by foresight, not firefighting. These are not theoretical gains. For example, a major international bank operating over 50 global data centers successfully transitioned from fragmented legacy DCIM tools to Rit Tech’s XpedITe platform. By unifying management across three continents, the bank reduced implementation timelines by up to three times, lowered energy and operational costs, and significantly improved regulatory readiness – all through centralized, real-time oversight. ... Enduring digital infrastructure thinks ahead – it anticipates demand, automates risk mitigation, and scales with confidence. For organizations navigating complex regulatory landscapes, emerging energy mandates, and AI-scale workloads, the choice is stark: evolve to intelligent infrastructure management, or accept the escalating cost of reactive operations.

Accelerating Zero Trust With AI: A Strategic Imperative for IT Leaders

Zero trust requires stringent access controls and continuous verification of identities and devices. Manually managing these policies in a dynamic IT environment is not only cumbersome but also prone to error. AI can automate policy enforcement, ensuring that access controls are consistently applied across the organization. ... Effective identity and access management is at the core of zero trust. AI can enhance IAM by providing continuous authentication and adaptive access controls. “AI-driven access control systems can dynamically set each user's access level through risk assessment in real-time,” according to the CSA report. Traditional IAM solutions often rely on static credentials, such as passwords, which can be easily compromised. ... AI provides advanced analytics capabilities that can transform raw data into actionable insights. In a zero-trust framework, these insights are invaluable for making informed security decisions. AI can correlate data from various sources — such as network logs, endpoint data and threat intelligence feeds — to provide a holistic view of an organization’s security posture. ... One of the most significant advantages of AI in a zero-trust context is its predictive capabilities. The CSA report notes that by analyzing historical data and identifying patterns, AI can predict potential security incidents before they occur. This proactive approach enables organizations to address vulnerabilities and threats in their early stages, reducing the likelihood of successful attacks.

Zombie Projects Rise Again to Undermine Security

"Unlike a human being, software doesn’t give up in frustration, or try to modify its approach, when it repeatedly fails at the same task," she wrote. Automation "is great when those renewals succeed, but it also means that forgotten clients and devices can continue requesting renewals unsuccessfully for months, or even years." To solve the problem, the organization has adopted rate limiting and will pause account-hostname pairs, immediately rejecting any requests for a renewal. ... Automation is key to tackling the issue of zombie services, devices, and code. Scanning the package manifests in software, for example, is not enough, because nearly two-thirds of vulnerabilities are transitive — they occur in software package imported by another software package. Scanning manifests only catches about 77% of dependencies, says Black Duck's McGuire. "Focus on components that are both outdated and contain high [or] critical-risk vulnerabilities — de-prioritize everything else," he says. "Institute a strict and regular update cadence for open source components — you need to treat the maintenance of a third-party library with the same rigor you treat your own code." AI poses an even more complex set of problems, says Tenable's Avni. For one, AI services span across a variety of endpoints. Some are software-as-a-service (SaaS), some are integrated into applications, and others are AI agents running on endpoints.

Are room-temperature superconductors finally within reach?

Predicting superconductivity -- especially in materials that could operate at higher temperatures -- has remained an unsolved challenge. Existing theories have long been considered accurate only for low-temperature superconductors, explained Zi-Kui Liu, a professor of materials science and engineering at Penn State. ... For decades, scientists have relied on the Bardeen-Cooper-Schrieffer (BCS) theory to describe how conventional superconductors function at extremely low temperatures. According to this theory, electrons move without resistance because of interactions with vibrations in the atomic lattice, called phonons. These interactions allow electrons to pair up into what are known as Cooper pairs, which move in sync through the material, avoiding atomic collisions and preventing energy loss as heat. ... The breakthrough centers on a concept called zentropy theory. This approach merges principles from statistical mechanics, which studies the collective behavior of many particles, with quantum physics and modern computational modeling. Zentropy theory links a material's electronic structure to how its properties change with temperature, revealing when it transitions from a superconducting to a non-superconducting state. To apply the theory, scientists must understand how a material behaves at absolute zero (zero Kelvin), the coldest temperature possible, where all atomic motion ceases.

Beyond Accidental Quality: Finding Hidden Bugs with Generative Testing

Automated tests are the cornerstone of modern software development. They ensure that every time we build new functionalities, we do not break existing features our users rely on. Traditionally, we tackle this with example-based tests. We list specific scenarios (or test cases) that verify the expected behaviour. In a banking application, we might write a test to assert that transferring $100 to a friend’s bank account changes their balance from $180 to $280. However, example-based tests have a critical flaw. The quality of our software depends on the examples in our test suites. This leaves out a class of scenarios that the authors of the test did not envision – the "unknown unknowns". Generative testing is a more robust method of testing software. It shifts our focus from enumerating examples to verifying the fundamental invariant properties of our system. ... generative tests try to break the property with randomized inputs. The goal is to ensure that invariants of the system are not violated for a wide variety of inputs. Essentially, it is a three step process:Given a property (aka invariant); Generate varying inputs; To find the smallest input for which the property does not hold. As opposed to traditional test cases, inputs that trigger a bug are not written in the test – they are found by the test engine. That is crucial because finding counter examples to code written by us is not easy or an accurate process. Some bugs simply hide in plain sight – even in basic arithmetic operations like addition.

Learning from the AWS outage: Actions and resources

Drawing on lessons from this and previous incidents, here are three essential steps every organization should take. First, review your architecture and deploy real redundancy. Leverage multiple availability zones within your primary cloud provider and seriously consider multiregion and even multicloud resilience for your most critical workloads. If your business cannot tolerate extended downtime, these investments are no longer optional. Second, review and update your incident response and disaster recovery plans. Theoretical processes aren’t enough. Regularly test and simulate outages at the technical and business process levels. Ensure that playbooks are accurate, roles and responsibilities are clear, and every team knows how to execute under stress. Fast, coordinated responses can make the difference between a brief disruption and a full-scale catastrophe. Third, understand your cloud contracts and SLAs and negotiate better terms if possible. Speak with your providers about custom agreements if your scale can justify them. Document outages carefully and file claims promptly. More importantly, factor the actual risks—not just the “guaranteed” uptime—into your business and customer SLAs. Cloud outages are no longer rare. As enterprises deepen their reliance on the cloud, the risks rise. The most resilient businesses will treat each outage as a crucial learning opportunity to strengthen both technical defenses and contractual agreements before the next problem occurs.

When AI Is the Reason for Mass Layoffs, How Must CIOs Respond?

CIOs may be tempted to try and protect their teams from future layoffs -- and this is a noble goal -- but Dontha and others warn that this focus is the wrong approach to the biggest question of working in the AI age. "Protecting people from AI isn't the answer; preparing them for AI is," Dontha said. "The CIO's job is to redeploy human talent toward high-value work, not preserve yesterday's org chart." ... When a company describes its layoffs as part of a redistribution of resources into AI, it shines a spotlight on its future AI performance. CIOs were already feeling the pressure to find productivity gains and cost savings through AI tools, but the stakes are now higher -- and very public. ... It's not just CIOs at the companies affected that may be feeling this pressure. Several industry experts described these layoffs as signposts for other organizations: That AI strategy needs an overhaul, and that there is a new operational model to test, with fewer layers, faster cycles, and more automation in the middle. While they could be interpreted as warning signs, Turner-Williams stressed that this isn't a time to panic. Instead, CIOs should use this as an opportunity to get proactive. ... On the opposite side, Linthicum advised leaders to resist the push to find quick wins. He observed that, for all the expectations and excitement around AI's impact, ROI is still quite elusive when it comes to AI projects.

Daily Tech Digest - October 31, 2025

Quote for the day:

“The more you loose yourself in something bigger than yourself, the more energy you will have.” -- Norman Vincent Peale

Breaking the humanoid robot delusion

The robot is called . The company says NEO is the world’s first consumer-ready humanoid robot for the home. It is designed to automate routine chores and offer personal help so you can spend time on other things. ... Full autonomy in perceiving, planning, and manipulating like a human is a massive technology challenge. Robots have to be meticulously and painstakingly trained on every single movement, learn to recognize every object, and “understand” — for lack of a better word — how things move, how easily they break, what goes where, and what constitute appropriate actions. One major way humanoid robots are trained is with . A person wearing special equipment remotely controls prototype robots, training them for many hours on how to, say, fold a shirt. Many hours more are required to train the robot how to fold a smaller child’s shirt. Every variable, from the height of the folding table to the flexibility of the fabrics has to be trained separately. ... The temptation to use impressive videos of remotely controlled robots where you can’t see the person controlling them to raise investment money, inspire stock purchases and outright sell robot products, appears to be too strong to resist. Realistically, the technology for a home robot that operates autonomously the way the NEO appears to do in the videos in arbitrary homes under real-world conditions is many years in the future, possibly decades.

Your vendor’s AI is your risk: 4 clauses that could save you from hidden liability

The frontier of exposure now extends to your partners’ and vendors’ use. The main question being: Are they embedding AI into their operations in ways you don’t see until something goes wrong? ... Require vendors to formally disclose where and how AI is used in their delivery of services. That includes the obvious tools and embedded functions in productivity suites, automated analytics and third-party plug-ins. ... Include explicit language that your data may not be used to train external models, incorporated into vendor offerings or shared with other clients. Require that all data handling comply with the strictest applicable privacy laws and specify that these obligations survive the termination of the contract. ... Human oversight ensures that automated outputs are interpreted in context, reviewed for bias and corrected when the system goes astray. Without it, organizations risk over-relying on AI’s efficiency while overlooking its blind spots. Regulatory frameworks are moving in the same direction: for example, high-risk AI systems must have documented human oversight mechanisms under the . ... Negotiate liability provisions that explicitly cover AI-driven issues, including discriminatory outputs, regulatory violations and errors in financial or operational recommendations. Avoid generic indemnity language. Instead, AI-specific liability should be made its own section in the contract, with remedies that scale to the potential impact.

AI chatbots are sliding toward a privacy crisis

The problem reaches beyond internal company systems. Research shows that some of the most used AI platforms collect sensitive user data and share it with third parties. Users have little visibility into how their information is stored or reused, leaving them with limited control over its life cycle. This leads to an important question about what happens to the information people share with chatbots. ... One of the more worrying trends in business is the growing use of , where employees turn to unapproved tools to complete tasks faster. These systems often operate without company supervision, allowing sensitive data to slip into public platforms unnoticed. Most employees admit to sharing information through these tools without approval, even as IT leaders point to data leaks as the biggest risk. While security teams see shadow AI as a serious problem, employees often view it as low risk or a price worth paying for convenience. “We’re seeing an even riskier form of shadow AI,” says Tim Morris, “where departments, unhappy with existing GenAI tools, start building their own solutions using open-source models like .” ... Companies need to do a better job of helping employees understand how to use AI tools safely. This matters most for teams handling sensitive information, whether it’s medical data or intellectual property. Any data leak can cause serious harm, from damaging a company’s reputation to leading to costly fines.

The true cost of a cloud outage

The top 2000 companies in the world pay approximately $400 billion for downtime each year. A simple calculation reveals that these organizations, including the Dutch companies , , , , and , lose around $200 million from their annual accounts due to unplanned downtime. Incidentally, what the Splunk study really revealed were the hidden costs of financial damage caused by problems with security tools, infrastructure, and applications. These can wipe billions off market values. ... A more conservative estimate of downtime costs can be found at Information Technology Intelligence Consulting, which conducted research on behalf of . The majority of the parties surveyed had more than 200 employees, but the combination was more diverse than the top 2000 companies worldwide. The costs of downtime were substantial: at least $300,000 per hour for 90 percent of the companies in question. Forty-one percent stated that IT outages cost between $1 million and $5 million. ... In theory, the largest companies can rely on a . In addition, hyperscalers absorb many local outages by routing traffic to other regions. However, multicloud is not something that you can just set up as a start-up SME. In addition, you usually do not build your applications in a fully redundant form in different clouds. Furthermore, it is quite possible that you can continue to work yourself, but that your product is inaccessible.

5 Reasons Why You’re Not Landing Leadership Roles

Is your posture confident? Do you maintain steady eye contact? Is the cadence, pace and volume of your voice engaging, assertive and compelling? Recruiters assess numerous factors on the . ... Are you showing a grasp of the prospective employer’s pain points and demonstrating an original point of view for how you will approach these problems? Treat senior level interviews like – you are an expert on their business, uncovering potential opportunities with insightful questions, and sharing enough of your expertise that you’re perceived as the solution. ... Title bumps are rare, so you need to give the impression that you are already operating at the in order to be hired as such. Your interview examples should include stories about how you initiated new ideas or processes, as well as measurable results that impact the bottom line. Your examples should specify how many people and dollars you have managed. Ideally, you have stories that show you can get results in up and down markets. ... The hiring process extends over multiple rounds, especially for leadership roles. Keep track of everyone that you have met, as well as what you have specifically discussed with each of them. Send personalized follow-up emails that engage each interviewer uniquely based on what you discussed. This differentiates you as someone who listens and cares about them specifically.

Why understanding your cyber exposure is your first line of defence

Thanks to AI, attacks are faster, more targeted and increasingly sophisticated. As the lines between the physical and digital blur, the threat is no longer isolated to governments or critical national infrastructure. Every organisation is now at risk. Understanding your cyber exposure is the key to staying ahead. This isn’t just a buzzword either; it’s about knowing where you stand and what’s at risk. Knowing every asset, every connection, every potential weakness across your digital ecosystem is now the first step in building a defence that can keep pace with modern threats. But before you can manage your exposure, you need to understand what’s driving it – and why the modern attack surface is so difficult to defend. ... By consolidating data from across the environment and layering it with contextual intelligence, cyber exposure management allows security teams to move beyond passive monitoring. It’s not just about seeing more, it’s about knowing what matters and acting on it. That means identifying risks earlier, prioritising them more effectively and taking action before they escalate. ... Effective and modern cybersecurity is shifting to shaping the battlefield before threats even arrive. That’s down to the value of understanding your cyber exposure. After all, it’s not just about knowing what’s in your environment, it’s about knowing how it all fits together – what’s exposed, what’s critical and where the next threat is likely to emerge.

Applications and the afterlife: how businesses can manage software end of life

Both enterprise software and personal applications have a lifecycle, set by the vendor’s support and maintenance. Once an application or operating system goes out of support, it will continue to run. But there will be no further feature updates and vitally, often no security patches. ... When software end of life is unexpected, it can cause serious disruption to business processes. In the very worst-case scenarios, enterprises will only know there is a problem when a key application no longer functions, or if a malicious actor exploits a vulnerability. The problem for CIOs and CISOs is keeping track of the end of life dates for applications across their entire stack, and understanding and mapping dependencies between applications. This applies equally to in-house applications, off the shelf software and open source. “End of life software is not necessarily bad,” says Matt Middleton-Leal, general manager for EMEA at Qualys. “It’s just not updated any more, and that can lead to vulnerabilities. According to our research, nearly half of the issues on the CISA Known Exploited Vulnerabilities (KEV) list are found in outdated and unsupported software.” As CISA points out, attackers are most likely to exploit older vulnerabilities, and to target unpatched systems. Risks come from old, and known vulnerabilities, which IT teams should have patched.

Tips for CISOs switching between industries

Building a transferable skill set is essential for those looking to switch industries. For Dell’s first-ever CISO, Tim Youngblood, adaptability was never a luxury but a requirement. His early years as a consultant at gave him a front-row seat to the challenges of multiple industries before he ever moved into cybersecurity. Those early years also taught Youngblood that while every industry has its own nuances, the core security principles remain constant. ... Making the jump into a new industry isn’t about matching past job titles but about proving you can create impact in a new context. DiFranco says the key is to demonstrate relevance early. “When I pitch a candidate, I explain what they did, how they did it, and what their impact was to their organization in their specific industry,” he says. “If what they did and how they did it, and what their impact was on the organization resonates where that company wants to go, they’re a lot more likely to say, ‘I don’t really care where this person comes from because they did exactly what I want done in this organization’. ... The biggest career risk for many CISOs isn’t burnout or data breach, it’s being seen as a one-industry operator. Ashworth’s advice is to focus on demonstrating transferable skills. “It’s a matter of getting whatever job you’re applying for, to realise that those principles are the same, no matter what industry you’re in. Whether it’s aerospace, healthcare, or finance, the principles are the same. Show that, and you’ll avoid being pigeonholed.”

Awareness Is the New Armor: Why Humans Matter Most in Cyber Defense

People remain the most unpredictable yet powerful variable in cybersecurity. Lapses like permission misconfiguration, accidental credential exposure, or careless data sharing continue to cause most incidents. Yet when equipped with the right tools and timely information, individuals can become the strongest line of defense. The challenge often stems from behavior rather than intent. Employees frequently bypass security controls or use unapproved tools in pursuit of productivity, unintentionally creating invisible vulnerabilities that go unnoticed within traditional defences. Addressing this requires more than restrictive policies. Security must be built into everyday workflows so that safe practices become second nature. ... Since technology alone cannot secure an organization, a culture of security-first thinking is essential. Leaders must embed security into everyday workflows, promote upskilling, and focus on reinforcement rather than punishment. This creates a workforce that takes ownership of cybersecurity, checking email sources, verifying requests, and maintaining vigilance in every interaction. is both a reminder and a rallying cry. India’s digital economy presents immense opportunity, but its threat surface expands just as fast.

Creepy AI Crawlers Are Turning the Internet into a Haunted House

The degradation of the internet and market displacement caused by commercial AI crawlers directly undermines people’s ability to access information online. This happens in various ways. First, the put significant technical strain on the internet, making it more difficult and expensive to access for human users, as their activity increases the time needed to access websites. Second, the trained on this scraped content now provide answers directly to user queries, reducing the need to visit the original sources and cutting off the traffic that once sustained content creators, including media outlets. ... AI crawlers represent a fundamentally different economic and technical proposition––a vampiric relationship rather than a symbiotic one. They harvest content, news articles, blog posts, and open-source code without providing the semi-reciprocal benefits that made traditional crawling sustainable. Little traffic flows back to sources, especially when search engines like Google start to provide AI generated summaries rather than sending traffic on to the websites their summaries are based on. ... What makes this worse is that these actors aren’t requesting books to read individual stories or conduct genuine research, they’re extracting the entire collection to feed massive language model systems. The library’s resources are being drained not to serve readers, but to build commercial AI products that will never send anyone back to the library itself.

Daily Tech Digest - October 30, 2025

Quote for the day:

"Leadership is like beauty; it's hard to define, but you know it when you see it." -- Warren Bennis

Why CIOs need to master the art of adaptation

Adaptability sounds simple in theory, but when and how CIOs should walk away from tested tools and procedures is another matter. ... “If those criteria are clear, then saying no to a vendor or not yet to a CEO is measurable and people can see the reasoning, rather than it feeling arbitrary,” says Dimitri Osler ... Not every piece of wisdom about adaptability deserves to be followed. Mantras like fail fast sound inspiring but can lead CIOs astray. The risk is spreading teams too thin, chasing fads, and losing sight of real priorities. “The most overrated advice is this idea you immediately have to adopt everything new or risk being left behind,” says Osler. “In practice, reckless adoption just creates technical and cultural debt that slows you down later.” Another piece of advice he’d challenge is the idea of constant reorganization. “Change for the sake of change doesn’t make teams more adaptive,” he says. “It destabilizes them.” Real adaptability comes from anchored adjustments, where every shift is tied to a purpose, otherwise, you’re just creating motion without progress, Osler adds. ... A powerful way to build adaptability is to create a culture of constant learning, in which employees at all levels are expected to grow. This can be achieved by seeing change as an opportunity, not a disruption. Structures like flatter hierarchies can also play a role because they can enable fast decision-making and give people the confidence to respond to shifting circumstances, Madanchian adds.

Building Responsible Agentic AI Architecture

The architecture of agentic AI with guardrails defines how intelligent systems progress from understanding intent to taking action—all while being continuously monitored for compliance, contextual accuracy, and ethical safety. At its core, this architecture is not just about enabling autonomy but about establishing structured accountability. Each layer builds upon the previous one to ensure that the AI system functions within defined operational, ethical, and regulatory boundaries. ... Implementing agentic guardrails requires a combination of technical, architectural, and governance components that work together to ensure AI systems operate safely and reliably. These components span across multiple layers — from data ingestion and prompt handling to reasoning validation and continuous monitoring — forming a cohesive control infrastructure for responsible AI behavior. ... The deployment of AI guardrails spans nearly every major industry where automation, decision-making, and compliance intersect. Guardrails act as the architectural assurance layer that ensures AI systems operate safely, ethically, and within regulatory and operational constraints. ... While agentic AI holds extraordinary potential, recent failures across industries underscore the need for comprehensive governance frameworks, robust integration strategies, and explicit success criteria.

Decoding Black Box AI: The Global Push for Explainability and Transparency

The relationship between regulatory requirements and standards development highlights the connection between legal, technical, and institutional domains. Regulations like the AI Act can guide standardization, while standards help put regulatory principles into practice across different regions. Yet, on a global level, we mostly see recognition of the importance of explainability and encouragement of standards, rather than detailed or universally adopted rules. To bridge this gap, further research and global coordination are needed to harmonize emerging standards with regulatory frameworks, ultimately ensuring that explainability is effectively addressed as AI technologies proliferate across borders. ... However, in practice, several of these strategies tend to equate explainability primarily with technical transparency. They often frame solutions in terms of making AI systems’ inner workings more accessible to technical experts, rather than addressing broader societal or ethical dimensions. ... Transparency initiatives are increasingly recognized in fostering stakeholder trust and promoting the adoption of AI technologies, especially when clear regulatory directives on AI explainability are not developed yet. By providing stakeholders with visibility into the underlying algorithms and data usage, these initiatives demystify AI systems and serve as foundational elements for building credibility and accountability within organizations.

How neighbors could spy on smart homes

Even with strong wireless encryption, privacy in connected homes may be thinner than expected. A new study from Leipzig University shows that someone in an adjacent apartment could learn personal details about a household without breaking any encryption. ... the analysis focused on what leaks through side channels, the parts of communication that remain visible even when payloads are protected. Every wireless packet exposes timing, size, and signal strength. By watching these details over time, the researcher could map out daily routines. ... Given the black box nature of this passive monitoring, even if the CSI was accurate, you would have no ground truth to ‘decode’ the readings to assign them to human behavior. So technically it would be advantageous, but you would have a hard time in classifying this data.” Once these patterns were established, a passive observer could tell when someone was awake, working, cooking, or relaxing. Activity peaks from a smart speaker or streaming box pointed to media consumption, while long quiet periods matched sleeping hours. None of this required access to the home’s WiFi network. ... The findings show that privacy exposure in smart homes goes beyond traditional hacking. Even with WPA2 or WPA3 encryption, network traffic leaks enough side information for outsiders to make inferences about occupants. A determined observer could build profiles of daily schedules, detect absences, and learn which devices are in use.

Ransom payment rates drop to historic low as attackers adapt

The economics of ransomware are changing rapidly. Historically, attackers relied on broad access through vulnerabilities and credentials, operating with low overheads. The introduction of the RaaS model allowed for greater scalability, but also brought increased costs associated with access brokers, data storage, and operational logistics. Over time, this has eroded profit margins and fractured trust among affiliates, leading some groups to abandon ransomware in favour of data-theft-only operations. Recent industry upheaval, including the collapse of prominent RaaS brands in 2024, has further destabilised the market. ... In Q3 2025, both the average ransom payment (USD $376,941) and median payment (USD $140,000) dropped sharply by 66% and 65% respectively compared with the previous quarter. Payment rates also fell to a historic low of 23% across incidents involving encryption, data exfiltration, and other forms of extortion, underlining the challenges faced by ransomware groups in securing financial rewards. This trend reflects two predominant factors: Large enterprises are increasingly refusing to pay ransoms, and attacks on smaller organisations, which are more likely to pay, generally result in lower sums. The drop in payment rates is even more pronounced in data exfiltration-only incidents, with just 19% resulting in a payout in Q3, down to another record low.

Shadow AI’s Role in Data Breaches

The adoption barrier is nearly zero: no procurement process, no integration meetings, no IT tickets. All it takes is curiosity and an internet connection. Employees see immediate productivity gains, faster answers, better drafts, cleaner code, and the risks feel abstract. Even when policies prohibit certain AI tools, enforcement is tricky. Blocking sites might prevent direct access, but it won’t stop someone from using their phone or personal laptop. The reality is that AI tools are designed for frictionless use, and that very frictionlessness is what makes them so hard to contain. ... For regulated industries, the compliance fallout can be severe. Healthcare providers risk HIPAA violations if patient information is exposed. Financial institutions face penalties for breaking data residency laws. In competitive sectors, leaked product designs or proprietary algorithms can hand rivals an unearned advantage. The reputational hit can be just as damaging, and once customers or partners lose confidence in your data handling, restoring trust becomes a long-term uphill climb. Unlike a breach caused by a known vulnerability, the root cause in shadow AI incidents is often harder to patch because it stems from behavior, not just infrastructure. ... The first instinct might be to ban unapproved AI outright. That approach rarely works long-term. Employees will either find workarounds or disengage from productivity gains entirely, fostering frustration and eroding trust in leadership.

Deepfake Attacks Are Happening. Here’s How Firms Should Respond

The quality of deepfake technology is increasing “at a dramatic rate,” agrees Will Richmond-Coggan, partner and head of cyber disputes at Freeths LLP. “The result is that there can be less confidence that real-time audio deepfakes, or even video, will be detectable through artefacts and errors as it has been in the past.” Adding to the risk, many people share images and audio recordings of themselves via social media, while some host vlogs or podcasts. ... As the technology develops, Tigges predicts fake Zoom meetings will become more compelling and interactive. “Interviews with prospective employees and third-party vendors may be malicious, and conventional employees will find themselves battling state sponsored threat actors more regularly in pursuit of their daily remit.” ... User scepticism is critical, agrees Tigges. He recommends "out of band authentication.” “If someone asks to make an IT-related change, ask that person in another communication method. If you're in a Zoom meeting, shoot them a Slack message.” To avoid being caught out by deepfakes, it is also important that employees are willing to challenge authority, says Richmond-Coggan. “Even in an emergency it will be better for someone in leadership to be challenged and made to verify their identity, than the organisation being brought down because someone blindly followed instructions that didn’t make sense to them, or which they were too afraid to challenge.”

Obsidian: SaaS Vendors Must Adopt Security Standards as Threats Grow

The problem is the SaaS vendors tend to set their own rules, he wrote, so security settings and permissions can differ from app to app – hampering risk management – posture management is hobbled by limited-security APIs that restrict visibility into their configurations, and poor logs and data telemetry make threats difficult to detect, investigate, and respond to. “For years, SaaS security has been a one-way street,” Tran wrote. “SaaS vendors cite the shared responsibility model, while customers struggle to secure hundreds of unique applications, each with limited, inconsistent security controls and blind spots.” ... Obsidian’s Tran pointed to the recent breaches of hundreds of Salesforce customers due to OAuth tokens associated with a third party, Salesloft and its Drift AI chat agent, being compromised, allowing the threat actors access into both Salesforce and Google Workspace instances. The incidents illustrated the need for strong security in SaaS environments. “The same cascading risks apply to misconfigured AI agents,” Tran wrote. “We’ve witnessed one agent download over 16 million files while every other user and app combined accounted for just one million. AI agents not only move unprecedented amounts of data, they are often overprivileged. Our data shows 90% of AI agents are over-permissioned in SaaS.” ... Given the rising threats, “SaaS customers are sounding the alarm and demanding greater visibility, guardrails and accountability from vendors to curb these risks,” he wrote.

Why your Technology Spend isn’t Delivering the Productivity you Expected

Firms essentially spend years building technical debt faster than they can pay it down. Even after modernisation projects, they can’t bring themselves to decommission old systems. So they end up running both. This is the vicious cycle. You keep spending to maintain what you have, building more debt, paying what amounts to a complexity tax in time and money. This problem compounds in asset management because most firms are running fragmented systems for different asset classes, with siloed data environments and no comprehensive platform. Integrating anything becomes a nightmare. ... Here’s where it gets interesting, and where most firms stop short. Virtualisation gives you access to data wherever it lives. That’s the foundation. But the real power comes when you layer on a modern investment management platform that maintains bi-temporal records (which track both when something happened and when it was recorded) as well as full audit trails. Now you can query data as it existed at any point in time. Understand exactly how positions and valuations evolved. ... The best data strategy is often the simplest one: connect, don’t copy, govern, then operationalise. This may sound almost too straightforward given the complexity most firms are dealing with. But that’s precisely the point. We’ve overcomplicated data architecture to the point where 80 per cent of our budget goes to maintenance instead of innovation.

Beyond FUD: The Economist's Guide to Defending Your Cybersecurity Budget

Budget conversations often drift toward "Fear, Uncertainty, and Doubt." The language signals urgency without demonstrating scale, which weakens credibility with financially minded executives. Risk programs earn trust when they quantify likelihood and impact using recognized methods for risk assessment and communication. ... Applied to cybersecurity, VaR frames exposure as a distribution of financial outcomes rather than a binary event. A CISO can estimate loss for data disclosure, ransomware downtime, or intellectual-property theft and present a 95% confidence loss figure over a quarterly or annual horizon, aligning the presentation with established financial risk practice. NIST's guidance supports this structure by emphasizing scenario definition, likelihood modeling, and impact estimation that feed enterprise risk records and executive reporting. The result is a definitive change from alarm to analysis. A board hears an exposure stated as a probability-weighted magnitude with a clear confidence level and time frame. The number becomes a defensible metric that fits governance, insurance negotiations, and budget trade-offs governed by enterprise risk appetite. ... ELA quantifies the dollar value of risk reduction attributable to a control. The calculation values avoided losses against calibrated probabilities, producing a defensible benefit line item that aligns with financial reporting.

Daily Tech Digest - October 29, 2025

Quote for the day:

“If you don’t have a competitive advantage, don’t compete.” -- Jack Welch

Intuit learned to build AI agents for finance the hard way: Trust lost in buckets, earned back in spoonfuls

Intuit's technical strategy centers on a fundamental design decision. For financial queries and business intelligence, the system queries actual data, rather than generating responses through large language models (LLMs). Also critically important: That data isn't all in one place. Intuit's technical implementation allows to ingest data from multiple distinct sources: native Intuit data, -connected third-party systems like for payments and user-uploaded files such as spreadsheets containing vendor pricing lists or marketing campaign data. This creates a unified data layer that AI agents can query reliably. ... Beyond the technical architecture, Intuit has made a core user experience across its AI agents. This goes beyond simply providing correct answers: It means showing users the reasoning behind automated decisions. When Intuit's accounting agent categorizes a transaction, it doesn't just display the result; it shows the reasoning. This isn't marketing copy about , it's actual UI displaying data points and logic. ... In domains where accuracy is critical, consider whether you need content generation or data query translation. Intuit's decision to treat AI as an orchestration and natural language interface layer dramatically reduces hallucination risk and avoids using AI as a generative system.

Step aside, SOC. It’s time to ROC

The typical SOC playbook is designed to contain or remediate issues after the fact by applying a patch or restoring a backup, but they don’t anticipate or prevent the next hit. That structure leaves executives without the proper context or language they need to make financially sound decisions about their risk exposure. ... At its core, the Resilience Risk Operations Center (ROC) is a proactive intelligence hub. Think of it as a fusion center in which cyber, business and financial risk come together to form one clear picture. While the idea of a ROC isn’t entirely new — versions of it have existed across government and private sectors — the latest iterations emphasize collaboration between technical and financial teams to anticipate, rather than react to, threats. ... Of course, building the ROC wasn’t all smooth sailing. Just like military adversaries, cyber criminals are constantly evolving and improving. Scarier yet, just a single keystroke by a criminal actor can set off a chain reaction of significant disruptions. That makes trying to anticipate their next move feel like playing chess against an opponent who is changing the rules mid-game. There was also the challenge of breaking down the existing silos between cyber, risk and financial teams. ... The ROC concept represents the first real step in that journey towards . It’s not as a single product or platform, but as a strategic shift toward integrated, financially informed cyber defense.

Data Migration in Software Modernization: Balancing Automation and Developers’ Expertise

The process of is often far more labor-intensive than expected. We've only described a few basic features, and even implementing this little set requires splitting a single legacy table into three normalized tables. In real-world scenarios, the number of such transformations is often significantly higher. Additionally, consider the volume of data handled by applications that have been on the market for decades. Migrating such data structures is a major task. The amount of custom logic a developer must implement to ensure data integrity and correct representation can be substantial. ... Automated data migration tools can help developers migrate to a different database management system or to a new version of the DBMS in use, applying the required data manipulations to ensure accurate representation. Also, they can copy the id, email, and nickname fields with little trouble. Possibly, there will be no issues with replicating the old users table into a staging environment. Automated data migration tools can’t successfully perform the tasks required for the use case we described earlier. For instance, infer gender from names (e.g., determine "Sarah" is female, "John" is male), or populate the interests table dynamically from user-provided values. Also, there could be issues with deduplicating shared interests across users (e.g., don’t insert "kitchen gadgets" twice) or creating the correct many-to-many relationships in user_interests.

The Quiet Rise of AI’s Real Enablers

“Models need so much more data and in multiple formats,” shared George Westerman, Senior Lecturer and Principal Research Scientist, MIT Sloan School of Management. “Where it used to be making sense of structured data, which was relatively straightforward, now it’s: ‘What do we do with all this unstructured data? How do we tag it? How do we organize it? How do we store it?’ That’s a bigger challenge.” ... As engineers get pulled deeper into AI work, their visibility is rising. So is their influence on critical decisions. The report reveals that data engineers are now helping shape tooling choices, infrastructure plans, and even high-level business strategy. Two-thirds of the leaders say their engineers are involved in selecting vendors and tools. More than half say they help evaluate AI use cases and guide how different business units apply AI models. That represents a shift from execution to influence. These engineers are no longer just implementing someone else’s ideas. They are helping define the roadmap. It also signals something bigger. AI success is not just about algorithms. It is about coordination. ... So the role and visibility of data engineers are clearly changing. But are we seeing real gains in productivity? The report suggests yes. More than 70 percent of tech leaders said AI tools are already making their teams more productive. The workload might be heavier, but it’s also more focused. Engineers are spending less time fixing brittle pipelines and more time shaping long-term infrastructure.

The silent killer of CPG digital transformation: Data & knowledge decay

Data without standards is chaos. R&D might record sugar levels as “Brix,” QA uses “Bx,” and marketing reduces it to “sweetness score.” When departments speak different data languages, integration becomes impossible. ... When each function hoards its own version of the truth, leadership decisions are built on fragments. At one CPG I observed, R&D reported a product as cost-neutral to reformulate, while supply chain flagged a 12% increase. Both were “right” based on their datasets — but the company had no harmonized golden record. ... Senior formulators and engineers often retire or are poached, taking decades of know-how with them. warns that unmanaged knowledge loss directly threatens innovation capacity and recommends systematic capture methods. I’ve seen this play out: a CPG lost its lead emulsification expert to a competitor. Within six months, their innovation pipeline slowed dramatically, while their competitor accelerated. The knowledge wasn’t just valuable — it was strategic. ... Intuition still drives most big CPG decisions. While human judgment is critical, relying on gut feel alone is dangerous in the age of AI-powered formulation and predictive analytics. ... Define enterprise-wide data standards: Create master schemas for formulations, processes and claims. Mandate structured inputs. Henkel’s success demonstrates that without shared standards, even the best tools underperform.

From Chef to CISO: An Empathy-First Approach to Cybersecurity Leadership

Rather than focusing solely on technical credentials or a formal cybersecurity education, prioritizes curiosity and hunger for learning as the most critical qualities in potential hires. His approach emphasizes empathy as a cornerstone of security culture, encouraging his team to view security incidents not as failures to be punished, but as opportunities to coach and educate colleagues. ... We're very technically savvy and it's you have a weak moment or you get distracted because you're a busy person. Just coming at it and approaching it with a very thoughtful culture-oriented response is very important for me. Probably the top characteristic of my team. I'm super fortunate. And that I have people from ages, from end to end, backgrounds from end to end that are all part of the team. But one of those core principles that they all follow with is empathy and trying to grow culture because culture scales. ... anyone who's looking at adopting new technologies in the cybersecurity world is firstly understand that the attackers have access to just about everything that you have. So, they're going to come fast and they're going to come hard at you and its they can make a lot more mistakes than you have. So, you have to focus and ensure that you're getting right every day what they can have the opportunity to get wrong.

It takes an AWS outage to prioritize diversification

, caused by a data center malfunction in Northern Virginia, didn’t just disrupt its direct customers; it served as a stark reminder of how deeply our digital world relies on a select few cloud giants. A single system hiccup in one region reverberated worldwide, stopping critical services for millions of users. ... The AWS outage is part of a broader pattern of instability common to centralized systems. ... The AWS outage has reignited a longstanding argument for organizational diversification in the cloud sector. Diversification enhances resilience. It decentralizes an enterprise’s exposure to risks, ensuring that a single provider’s outage doesn’t completely paralyze operations. However, taking this step will require initiative—and courage—from IT leaders who’ve grown comfortable with the reliability and scale offered by dominant providers. This effort toward diversification isn’t just about using a (although a combined approach with multiple is an important aspect). Companies should also consider alternative platforms and solutions that add unique value to their IT portfolios. Sovereign clouds, specialized services from companies like , managed service providers, and offer viable options. Here’s why they’re worth exploring. ... The biggest challenge might be psychological rather than technical. Many companies have internalized the idea that the hyperscalers are the only real options for cloud infrastructure.

What brain privacy will look like in the age of neurotech

What has just introduced, what has now made native as part of its accessibility protocols, is to enable picking up your intentions through neural signals and sensors that AI decodes to allow you to navigate through all of that technology. So I think the first generation of most of these devices will be optional. That is, you can get the smart watch without the neural band, you can get the airpods without the in them. But just like you can't get an Apple watch now without getting an Apple watch with a heart rate sensor, second and third generation of these devices, I think your only option will be to get the devices that have the neural sensors in them. ... There's a couple of ways to think about hacking. One is getting access to what you're thinking and another one is changing what you're thinking. One of the now classic examples in the field is how researchers were able to, when somebody was using a neural headset to play a video game, embed prompts that the conscious mind wouldn't see to be able to figure out what the person's PIN code and address were for their bank account and mailing address. In much the same way that a person's mind could be probed for how they respond to Communist messaging, a person's mind could be probed to see recognition of a four digit code or some combination of numbers and letters to be able to try to get to a person's password without them even realizing that's what's happening.

Beyond Alerts and Algorithms: Redefining Cyber Resilience in the Age of AI-Driven Threats

In an average enterprise Security Operations Center (SOC), analysts face tens of thousands of alerts daily. Even the most advanced platforms struggle with false positives, forcing teams to spend the bulk of their time sifting through noise instead of investigating real threats. The result is a silent crisis: . Skilled analysts burn out, genuine threats slip through, and the mean time to respond (MTTR) increases dangerously. But the real issue isn’t just too many alerts — it’s the lack of context. Most tools operate in isolation. An endpoint alert means little without correlation to user behavior, network traffic, or threat intelligence. Without this contextual layer, detection lacks depth and intent remains invisible. ... Resilience, however, isn’t achieved once — it’s engineered continuously. Techniques like Continuous Automated Red Teaming (CART) and Breach & Attack Simulation (BAS) allow enterprises to test, validate, and evolve their defenses in real time. AI won’t replace human judgment — it enhances it. The SOC of the future will be machine-accelerated yet human-guided, capable of adapting dynamically to evolving threats. ... Today’s are more than security leaders — they’re business enablers. They sit at the intersection of risk, technology, and trust. Boards now expect them not just to protect data, but to safeguard reputation and ensure continuity.

Quantum Circuits brings dual-rail qubits to Nvidia’s CUDA-Q development platform

Quantum Circuits’ means that it combines two different quantum computing approaches — superconducting resonators with . The qubit itself is a photon, and there’s a superconducting circuit that controls the photon. “It matches the reliability benchmarks of ions and neutral atoms with the speed of the superconducting platform,” says Petrenko. There’s another bit of quantum magic built into the platform, he says — error awareness. “No other quantum computer tells you in real time if it encounters an error, but ours does,” he says. That means that there’s potential to correct errors before scaling up, rather than scaling up first and then trying to do error correction later. In the near-term, the high reliability and built-in error correction makes it an extremely powerful tool for developing new algorithms, says Petrenko. “You can start kind of opening up a new door and tackling new problems. We’ve leveraged that already for showing new things for machine learning.” It’s a different approach to what other quantum computer makers are taking, confirms . According to Sanders, this dual-rail method combines the best of both types of qubits, lengthening coherence time, plus integrating error correction. Right now, Seeker is only available via Quantum Circuits’ own cloud platform and only has eight qubits.