Daily Tech Digest by Kannan Subbiah

Daily Tech Digest - November 08, 2025

Quote for the day:

"Always remember, your focus determines your reality." -- George Lucas

We can’t ignore cloud governance anymore

Many organizations are still treating cloud governance as an afterthought. Instead, enterprises pour resources into migration and adoption at the expense of creating a governance framework meant to manage risks proactively. This oversight leads to the type of major outages and service disruptions we’ve seen recently, which cost companies millions of dollars and erode brand trust. Events like these aren’t inevitable. With proper governance structures in place, much of the fallout can be mitigated or avoided altogether. ... Risks that were irrelevant five years ago, such as cloud-native application security or hybrid cloud architecture vulnerabilities, are now front and center. Enterprises must rethink their approach to risk in the cloud, from redefining acceptable levels of exposure to embedding automated tools that dynamically address vulnerabilities before they evolve into crises. In the book, we cover strategies for incorporating dynamic risk management tools, compliance structures, and a culture of accountability throughout an enterprise’s operations. ... The majority of enterprises are rolling the dice. The belief that cloud computing inherently eliminates risks is a dangerous misconception; without guardrails and policies to control how the cloud operates within an organization, risks can grow unchecked. Enterprises are unknowingly declining millions of dollars in potential savings simply because they don’t invest in governance.

The Art of Lean Governance: The Cybernetics of Data Quality

Without this cybernetic interplay, data governance devolves into static policy documents rather than a living, self-correcting mechanism. For risk officers and auditors, this distinction defines whether data risk is truly controlled or merely reported. The systems that thrive will be those that can self-correct faster than they degrade. ... Traditional data risk management has focused on frameworks, thresholds, and remediation logs. The cybernetic view goes further: it treats risk as system entropy — the measure of disorder introduced when feedback loops are weak or delayed. Consider financial reconciliation. When the flow of transactional data between ledgers, systems, and reports is disrupted, discrepancies emerge. If the feedback mechanism (the reconciliation engine) is not fast or intelligent enough, the delay amplifies uncertainty across dependent systems, and risk compounds through interconnection. Thus, data risk management is a function of response latency and feedback precision. Modern systems must evolve toward autonomous reconciliation, utilizing pattern recognition and AI-assisted anomaly detection to maintain equilibrium in near real-time. This is cybernetic risk control — adaptive, responsive, and context-aware. ... Cybernetics thrives on understanding the flow of energy, signals, and cause and effect. Data lineage is the cybernetic map of that flow. It illustrates how data is transformed, where it originates, and how it propagates through systems.

Role Reversals: How AI Trains Humans

In some cases, LLMs can shape how people think about topics such as culture, morality, and ethics. At some point, these complex feedback loops blur the line between human and machine thinking—including who is teaching whom. “Research shows that it’s possible to influence the vocabulary of large populations—potentially on a global scale. This shift in language can, in turn, reshape thinking, culture, and public discourse,” said Hiromu Yakura ... In fact, human behavior changes significantly when people use AI, according to a study from a research group at Washington University in St. Louis, MO. Using the behavioral economic bargaining tool Ultimatum Game, they found that study participants who thought their actions would help train an AI system were more likely to reject an “unfair” payout—even when it came at a personal cost. The reason? They wanted to teach AI what’s fair. ... AI-generated language can also help spread bias, misinformation, and narrow the way people think—including by design. Today, social media algorithms amplify and bury content to dial up user engagement. In the future, governments, political strategists, and others could tap AI-generated language to sway—and perhaps manipulate—public opinion. AI researchers like Treiman, already uneasy about how little is known about the inner workings of most algorithms, are raising red flags. Secrecy, she argued, leaves the public in the dark about systems that increasingly shape daily life.

How Data Is Reshaping Science – Part 1: From Observation to Simulation

With so much data and powerful AI models at their fingertips, researchers are doing more and more of their work inside machines. Across many fields, experiments that once started in a lab now begin on a screen. AI and simulation have flipped the order of discovery. In many cases, the lab has become the final step, not the first. You can see this happening in almost every area of science. Instead of testing one idea at a time, researchers now run thousands of simulations to figure out which ones are worth trying in real life. Whether they’re working with new materials, brain models, or climate systems, the pattern is clear: computation has become the proving ground for discovery. ... Scientists aren’t just testing hypotheses or peering into microscopes anymore. More and more, they’re managing systems — trying to stop models from drifting, tracking what changed and when, making sure what comes out actually means something. They’ve gone from running experiments to building the environment where those experiments even happen. And whether they’re at DeepMind, Livermore, NOAA, or just some research team spinning up models, it’s the same kind of work. They’re checking whether the data is usable, figuring out who touched it last, wondering if the labels are even accurate. AI can do a lot, but it doesn’t know when it’s wrong. It just keeps going. That’s why this still depends on the human in the loop.

ID verification laws are fueling the next wave of breaches

The cybersecurity community has long lived by a simple principle: Don't collect more data than you can protect. But ID laws and other legal mandates now force many organizations to store massive amounts of sensitive data, putting them in the precarious situation of dealing with information they don’t necessarily want but have to safeguard. ... ge verification laws are proliferating worldwide. These laws typically mandate age verification through government-issued documents, such as driver's licenses, passports or national ID cards. Failure to verify IDs can result in millions of dollars in fines. The intention is sensible: protecting minors from inappropriate online content. But for the organizations that have to collect ID data, the laws can lead to a security nightmare. Organizations now have to collect and store volumes of the most sensitive personally identifiable information possible regardless of whether they have the infrastructure to adequately protect it — or even want to collect it. ... When backup, endpoint protection, disaster recovery and security monitoring operate through a single agent with one management console, there are no handoff points where data might be exposed and no integration vulnerabilities to exploit, and there is no confusion about which tool protects what. Native integration delivers practical benefits beyond security. MSPs can reduce the administrative burden of managing multiple vendor relationships, licenses and support contracts.

Is enterprise agentic AI adoption matching the hype?

“The expectations around AI and agents are huge. And vendors are making statements that all you need to solve your enterprise problems is to unleash an army of agents,” van der Putten tells ITPro. “But if not properly controlled and governed, this army is more likely to go and wreak havoc than bring peace and prosperity in the enterprise. And enterprises know this.” According to van der Putten, today’s AI agents are unable to take the real-world complexity into account, which the majority of enterprises need to deal with. And the thing that makes them appealing — their apparent autonomy — is also their biggest weakness. “Enterprises want to innovate, but they are held back by legacy,” van der Putten explains. ... "The sticking point isn’t the technology – it’s trust. Agents can already reconcile accounts, flag anomalies, even anticipate compliance risks, but adoption will only scale once businesses have confidence in how they operate, explain their reasoning, and can be audited.” Nowhere is the issue of trust more apparent than in the world of commerce, where AI agents are being used as assistants and autonomous actors, capable of initiating and completing purchases independently of the shopper. ... Although agentic commerce promises to streamline the path to purchase for businesses, Sheikrojan says that it’s a path paved with “blind spots”. This is because when an AI agent takes over the transaction many of today’s retail processes, rooted in context and behavioral signals such as fraud prevention, disappear.

Power, not GPUs, will decide who wins AI

AI workloads scale differently from traditional IT. Where once we worried about server density in kilowatts per rack, we’re now talking about megawatts. That kind of thermal and electrical load exposes the inadequacies of legacy architectures built for virtualisation, not for vector processing or massive parallel training. As Stephen Worn put it, “AI isn’t just another workload; it’s a demanding tenant.” It’s a tenant with unpredictable consumption, heat spikes, and sub-millisecond tolerance for power fluctuation. And it’s not just moving in – it’s taking over. ... Downtime in AI is more than an outage; it’s a lost training cycle, corrupted model, or missed opportunity. Resilience in this context isn’t just about redundancy; it’s about reaction time. We need systems that operate on the same timelines as the workloads they protect. ... In a sense, the infrastructure must become intelligent; just like the workloads it supports. Data centres are evolving into living ecosystems, where compute behavior and physical response are tightly intertwined. ... So what does this all point to? Here’s a realistic, aspirational view of what AI-ready infrastructure could look like by the end of the decade: Hybrid Power Architectures: Combining traditional grid feeds, on-site renewables, and modular battery systems; Resilience by Design: Low-toxicity chemistries, automated failover, and microsecond response baked into every rack; AI-Managed AI Infrastructure: Neural networks monitoring and adjusting the environments they run in.

The Ultimate Betrayal: When Cyber Negotiators Became the Attackers

The allegations outline an audacious and calculated scheme that exploits the foundational trust between a victim and its incident response team. The indictment claims the defendants utilized the notorious BlackCat (ALPHV) ransomware variant to compromise targeted organizations. The irony, as noted by CNN, is that the accused were professionals whose entire business model was predicated on helping victims recover from these exact kinds of intrusions. The DOJ effectively accuses the U.S. ransomware negotiators of "launching their own ransomware attacks," according to TechCrunch. ... "'Zero Trust' is not just a security framework for your network; it must now be seen as a security framework that includes not just your network, but all the people and devices that have any type of access to it," Leighton said. "As a former intelligence officer, I couldn't help but think of Edward Snowden and how he compromised NSA's networks." "This case just proves that we have to extend our personnel vetting processes beyond our own organizations," he added. "We need to be able to also vet the employees of our suppliers, as well as those whose job it is to remediate breaches of our networks. This is easier said than done, but CISOs are going to have to work with their corporate legal teams to rewrite supplier contracts so they can vet third-party remediation team personnel independently."

Infostealers: Addressing a rising threat to UK businesses

Multiple infostealers exist, but several have been more dominant during 2025, according to experts. Raccoon Stealer stands out as the most frequently encountered infostealer, accounting for the highest volume of incidents, according to Rozenski. Despite law enforcement disruption, LummaStealer remains “one of the most prolific infostealers,” says Addison. It operates under a MaaS model, making it “accessible to a wide range of threat actors,” he says. ... Predictably, AI is also set to super-charge infostealer attacks. Walter says SentinelOne is now tracking for a new AI-assisted infostealer it calls Predator AI. “The malware doesn’t just steal passwords and credentials. It integrates with ChatGPT to analyse huge amounts of stolen data to identify high-value accounts and business domains.” Predator AI is also able to organise the stolen data, enabling cybercriminals to “operate more efficiently” and “increase the speed and volume of attacks,” he says. “While this infostealer isn’t a game-changer yet, it shows where cybercriminals are investing their resources and what businesses should look out for next.“ ... At the same time, breaking single sign on journeys is “crucial” for critical applications, says Gee. He recommends requiring users to revalidate MFA when accessing critical applications, making sure admins are required to also do so.

EU lawmakers approve regulation to expand Europol’s capabilities in biometric data processing

European lawmakers have backed a proposal to give Europol a central role in coordinating the fight against smuggling networks and human trafficking and to strengthen the obligation among EU member states to share data, including biometrics. The support for the regulation comes amid criticism from rights groups and the EU data watchdog. ... The regulation also enables Europol to “effectively and efficiently process biometric data in order to better support Member States in cracking down on irregular migration.” “The effective use of biometric data is key to closing the gaps and blind spots that terrorists and other criminals seek to exploit by hiding behind false or multiple identities,” says the document. ... “The Europol Regulation unlawfully expands the EU’s digital surveillance infrastructure without appropriate safeguards,” says the report. “This is particularly important in the context of biometrics.” Facing pushback, the EU introduced significant changes to the proposal in May, allowing more flexibility for EU member states to decide whether to exchange data with Europol. The presidency of the Council and European Parliament negotiators reached a provisional agreement on the regulation in September. Europol’s legal framework already allows the agency to process biometric data for operational purposes and for preventing or combating crime.

Daily Tech Digest - November 07, 2025

Quote for the day:

"The best teachers are those who don't tell you how to get there but show the way." -- @Pilotspeaker

AI spending may slow down as ROI remains elusive

Some AI experts agree with Forrester that an AI market correction is on the way. Microsoft founder Bill Gates recently talked about the existence of an AI bubble, and industry observers have noted that some AI excitement is dimming. Many don’t see an AI bubble that will burst in the near future, but it’s deflating a bit. Still others don’t see much of a slowdown in the near term. ... Some organizations are not achieving the accuracy they need from AI tools, and others are not finding their data to be easily accessible or properly structured, says Sam Ferrise, CTO of IT consulting firm Trinetix. “Many organizations are realizing that their expectations for AI accuracy and performance don’t always align with the level of investment they’re willing — or able — to make,” he says. “The key is calibrating expectations relative to both the investment and the use case.” In other cases, enterprises deploying AI are running into privacy or security problems, he adds. “Many teams successfully prove a use case with clear ROI, only to realize later that they must harden the solution before it can safely move into production,” Ferrise says. “When that alignment isn’t there, it’s natural for organizations to pause or delay spending until they can justify the value.” The prospect of a bubble bursting may be an overly dramatic scenario, although not impossible, he adds. It’s been easy for organizations to overlook intangible costs such as training, compliance, and governance.

Why can’t enterprises get a handle on the cloud misconfiguration problem?

“Microsoft, Google, and Amazon have handed us a problem,” says Andrew Wilder, CSO at Vetcor, a national network of more than 900 veterinary hospitals. “By default, everything is insecure, and you have to put security on top of it. It would be much better if they just gave us out-of-the-box secure stuff. Would you buy a car that doesn’t have locks? They wouldn’t even sell that car.” This security gap is what allows third-party vendors to exist, he says. “You should be building products — and I’m talking to you, Google, Microsoft, and Amazon — that are secure by design, so you don’t have to get a third-party tool. They should be out of the box secure.” ... When administrators or users make changes to cloud configurations in the cloud management consoles, it’s difficult to track those changes and to revert them if something goes wrong. Plus, humans can easily make mistakes. The solution experts advise is to adopt the principle of “infrastructure as code” and use configuration management tools so that all changes are checked against policies, tracked and audited, and can easily be rolled back. ... Companies will often have monitoring for major cloud services, but shadow IT deployments are left in the dark. This is less a technology problem than a management one and can be addressed by better communications with business units and a more disciplined approach to deploying technology on an enterprise-wide level.

The Supply Chain Blind Spot: Protecting Data in Expanding IT Ecosystems

Data growth is no longer linear, it is exponential. The rise of AI, automation, and digital platforms has transformed how information is created, stored, and shared. In India, this acceleration is particularly visible. The country’s data centre industry has grown from 590 MW in 2019 to 1.4 GW in 2024, a 139% jump, and is projected to reach 3 GW by 2030, driven by cloud adoption, AI demand, and data localisation initiatives. This infrastructure boom, while positive, brings new operational realities. Most enterprises now operate across hybrid environments, combining on-premises, public cloud and SaaS-based data stores. Without unified oversight, these fragmented environments risk becoming silos. True resilience depends not just on protecting data but understanding where it lives, how it moves, and who controls it. ... Globally, enterprises are reframing resilience as a core business capability. This approach requires integrating resilience principles into decision-making: from procurement and architecture design to crisis response. Simulated attacks, failover testing and dependency audits are becoming part of daily operational culture, not annual exercises. For Indian organizations, this mindset shift is vital. RBI’s ICT risk management directives and the DPDP Act establish the baseline; the differentiator lies in how proactively organizations operationalize these expectations.

The power of low-tech in a high-tech world

Our high-tech society is impressive in the collective. But it robs individuals of skills. Most kids now can’t write cursive. And they can’t read it, either. They can’t read an analog clock or a paper map. The acceleration of technological innovation also accelerates the rate at which we lose skills. Videogames, smartphones, and dating apps — aided and abetted by the trauma of the COVID-19 lockdowns a few years ago — have left many young people alone without the skills to meet and connect with anyone, leading to a loneliness epidemic among the young. But losing old-fashioned skills and old-school tech knowledge is a choice we don’t have to make. ... Thousands of scientific reports all lead us to the same conclusion: Over-reliance on advanced technologies dulls critical thinking, weakens memory, reduces problem-solving skills, limits creativity, erodes attention spans, and fosters passive dependence on automated systems. ... What all these old-school approaches have in common is that they’re harder and take longer — and they leave you smarter and better connected. In other words, if you strategically cultivate the skills, habits, discipline and practice of older tech, you’ll be much more successful in your career and your life. And here’s one final point: The more high-tech our culture becomes, the more impactful old-school tech will be. So yes, by all means become brilliantly skilled at AI chatbot prompt engineering.

Why Leaders Cannot Outsource Communication

When communication is delegated to a proxy, that signal weakens. Employees notice the gap between what the leader says or doesn’t say, and what the organization does. This is why communication has an outsized impact on engagement. Gallup finds that 70% of the variance in employee engagement is explained by managers and leaders, not perks or policies. When leaders own the message, they create psychological safety: the sense that it’s safe to commit, speak up and take risks. When they don’t, that safety erodes. ... Delegating communication is tempting. Leaders are busy. They hire communications officers and agencies to manage the message. These roles are valuable, but they can’t substitute for the leader’s voice. A speechwriter can shape phrasing and a PR team can guide timing, but only the leader can deliver authenticity. As Murphy has written, “Leaders are accountable to employees: Candor about bad news as well as the good, and feedback that aligns with expectations.” Authenticity requires candor, even when the message is difficult. When communication comes from anyone else, it’s interpreted as institutional rather than personal. And people follow people, not institutions. ... The Operator Economy demands a new kind of scale, one built not on capital or code, but on human alignment. Communication is infrastructure. The CEO becomes the signal source around which all systems calibrate. When leaders “scale themselves” through clarity and consistency, they convert trust into throughput.

Breaking the Burnout Cycle: How Smart Automation and ASPM Can Restore Developer Joy

Smart automation can rescue developers from repetitive drudgery by using AI to handle routine tasks like test writing, bug fixing, and documentation. Modern application security posture management (ASPM) platforms exemplify this approach by providing contextualized risk assessments rather than overwhelming vulnerability dumps, helping security teams first understand which issues actually matter and then giving developers actionable info on the risk and how it should be fixed. These platforms excel at managing the volume and unpredictability of AI-generated code, turning what was once a blind spot into manageable, prioritized work. ... Technology alone isn't enough. Organizations must also prioritize developer growth by creating opportunities for experimentation, architectural decisions, and end-to-end project ownership while automation handles routine tasks. This means shifting from measuring output volume to focusing on meaningful metrics like code quality and developer satisfaction. AI represents an opportunity for developers to gain expertise in an emerging technology. ... The developer talent crisis is solvable. While AI has introduced new complexities to the software development and security landscape, it also presents unprecedented opportunities for organizations willing to rethink how they support their development teams.

The CIO’s Role In Data Democracy: Empowering Teams Without Losing Control

The modern CIO is at a point where they can choose between innovation and control. In the past, IT departments were thought of as people who took care of infrastructure and enforced strict regulations about who could access data. The CIO needs to reassess this way of doing things today. They shouldn’t prohibit access; instead, they should make it safe by building frameworks. The job has changed from saying “no” to making sure that when the company says “yes,” it does it smartly. The CIO is now both an architect and a guardian. They create systems that make data easy to get to, understand, and act on, all while keeping security and compliance in mind. ... The CIO is no longer a gatekeeper; they are instead a designer of trust. The goal is to make governance a part of systems such that it is seamless, automatic, and easy to use. This change lets companies keep an eye on things and stay in control without making decisions take longer. Unified data taxonomies are the first step in building this framework. This means that all departments use the same naming standards and definitions. When everyone uses the same “data language,” there is less confusion and more cooperation. ... Effective governance demands collaboration between IT, compliance, and business leaders. The CIO must champion cross-functional alignment where all parties share responsibility for data integrity and use.

What keeps phishing training from fading over time

Employees who want to be helpful or appear responsive can become easier targets than those reacting to fear or haste. For CISOs, this reinforces the need to teach users about manipulation through trust and cooperation, not just the warning signs of urgent or threatening messages. ... Dubniczky said maintaining employee engagement over time is a major challenge for most organizations. “In contrast with other research in the area, a key contribution of ours was a mandatory training after each failed phishing attack,” he explained. “This strikes a good balance between not needlessly bothering careful employees with monthly or quarterly trainings while making sure that the highest risk individuals are constantly trained.” He recommended that organizations vary their phishing simulations to keep users alert. “We’d recommend performing monthly penetration tests on smaller groups of people in diverse departments of the organization with a seemingly random pattern, and making re-training mandatory in case of successful attacks,” he said. “It’s also difficult to generalize on this, but this approach seems much more effective than periodic presentation-style trainings.” ... One of the most striking findings involves the timing of feedback. When employees clicked a phishing link and then received an immediate explanation and training prompt, they were far less likely to repeat the behavior. Around seven in ten employees who failed once did not do so again.

The new QA playbook: Leveraging AI to amplify expertise, not replace it

Many quality teams have been part of the AI journey from the very beginning, contributing from concept to implementation and helping evaluate large language models to ensure quality and reliability. However, many AI features are not developed by QA practitioners, so it is essential to evaluate them through a QA lens. First, ensure the system can produce what your teams actually use, whether that is step lists, BDD-style scenarios, or free text that fits your templates and automation. Next, map the full data journey. Know whether prompts or results are kept, how encryption and minimization are applied, and where any content is stored. Finally, require fine-grained controls so you can limit usage by environment, project, and role. Regulated teams require an audit trail and clear accountability, which means governance must keep pace with adoption, or speed will outpace safety. Once review-first habits are in place, build on them. True oversight requires more than simply checking AI outputs; it demands deeper knowledge and understanding than the AI itself to spot gaps, inaccuracies, or misleading information. That’s what separates a passive reviewer from an effective human in the loop. ... Real gains from AI will not come from automation alone but from people who know how to guide it with clarity, context, and care. The future of testing depends on professionals who can combine technical fluency with critical thinking, ethical judgment, and a sense of ownership over quality.

Your outage costs more than you think – so design with resilience in mind

Service providers are under strain to deliver the rapid speeds and constant network uptime that modern life demands, with areas like remote working, financial transactions, cloud access and streaming services expected to work seamlessly as part of the daily lives of many end users. For many enterprises, their business depends on this connectivity. Even a single hour of network disruption can cost an organisation more than $300,000, and the long-term damage to customer trust often exceeds any immediate financial loss. Despite this, many organisations still rely on outdated infrastructure that cannot support the requirements of today’s end users. Legacy environments struggle with explosive data growth, the soaring demands of AI, and the complexity of distributed, cloud-first applications. At the same time, power limitations, infrastructure strain and inconsistent service levels put businesses at risk of falling behind. The gap between what service providers and enterprises need, and what their infrastructure can deliver, is widening. ... For service providers, investing in robust colocation and high-performance networking is not just about upgrading infrastructure, but enabling customers and partners worldwide to thrive in today’s fast-paced digital landscape. By offering resilient and scalable connectivity, providers can differentiate their service offering, attract high-value enterprise clients, and create new revenue streams based on reliability and performance.

Daily Tech Digest - November 05, 2025

Quote for the day:

"Effective leaders know that resources are never the problem; it's always a matter of resourfulness." -- Tony Robbins

AI web browsers are cool, helpful, and utterly untrustworthy

AI browsers can and do interact with everything on a web page: summarizing content, reading emails, composing posts, looking at images, etc., etc. Every element on the page, whether you can see it or not, can hide an attack. A hacker can embed clipboard manipulations or other hacks that traditional browsers would never, not ever, execute automatically. ... AI browser agents can be tricked by hidden instructions embedded in websites via invisible text, images, scripts, or, believe it or not, bad grammar. Your eyes might glaze over at a long run-on sentence, but your AI web browser will read it all, including instructions for an attack hidden in plain sight within it. Such malicious commands are read and executed by the AI. This can lead to exposure of sensitive data, such as emails, authentication tokens, and login details, or triggering unwanted actions, including sending emails, posting to social media, or giving your computer a bad case of malware. ... Privacy is pretty much lost these days anyway, but with AI web browsers, we’ll have all the privacy of a goldfish in a bowl. Since AI browsers monitor our every last move, they process much more granular personal information than conventional browsers. Worrying about cookies and privacy is so 1990s. AI browsers track everything. This is then used to create highly detailed behavioral profiles. What? You didn’t know that AI browsers have built-in memory functions that retain your interactions, browser history, and content from other apps? How do you think they do what they do? Intuition? ESP?

AI can flag the risk, but only humans can close the loop

Companies embedding AI into vendor risk processes need governance structures that ensure transparency, accountability, and compliance. This includes maintaining an approved sources catalogue and requiring either the system or an analyst to validate findings and document the rationale behind them. Data minimization should be built into the design by defining what information is always in scope, such as sanctions or embargo lists, and what is contextually relevant, while excluding protected or sensitive attributes under GDPR and configuring AI to ignore them. Risk assessments should be tiered, calibrating the depth of checks to supplier criticality and geography to avoid unnecessary data collection for low-risk relationships while expanding scope for high-risk scenarios. Human accountability remains essential, with a named individual owning due diligence decisions while AI provides recommendations without replacing human judgment ... Regulators are likely to allow AI use if firms establish strong controls and demonstrate effective oversight, as required by frameworks like the EU AI Act. Responsibility remains with individuals or organizations; liability does not transfer to AI itself. While regulators may struggle to specify detailed technical rules, one clear shift is that “the data volume was too large to review” will no longer be an acceptable defense.

10 top devops practices no one is talking about

“A key, yet overlooked, devops practice is building true shared ownership, which means more than just putting teams in the same chat room,” says Chris Hendrich, associate CTO of AppMod at SADA. “It requires making production reliability and performance a primary success indicator for development, not solely an operational concern. This shared accountability is what builds the organizational competency of creating better, more resilient products.” ... “Baking an integrated code quality and code security approach into your devops workflow isn’t just good practice, it’s essential and a game-changer,” says Donald Fischer, VP at Sonar. “Tackling security alongside quality from day one isn’t merely about early bug detection; it’s about building fundamentally stronger, more trustworthy, and resilient software that is secure by design.” ... “Open source is a no-brainer for developers, but as the ecosystem grows, so do the risks of malware, unsafe AI models, license issues, outdated packages, poor performance, and missing features,” says Mitchell Johnson, CPDO of Sonatype. “Modern devops teams need visibility into what’s getting pulled in, not just to stay secure and compliant, but to make sure they’re building with high-quality components.” ... “Version-controlling database schemas and configurations across development, QA, and production is a quietly powerful devops practice,” says McMillan.

Cloud Identity Exposure Is 'a Critical Point of Failure'

Attackers keep targeting cloud-based identities to help them bypass endpoint and network defenses, says an August report from cybersecurity firm CrowdStrike. That report counts a 136% increase in cloud intrusions over the preceding 12 months, plus a 40% year-on-year increase in cloud intrusions tied to threat actors likely working for the Chinese government. "The cloud is a priority target for both criminals and nation-state threat actors," said Adam Meyers, head of counter adversary operations at CrowdStrike ... One challenge is that enough cloud identities justify elevated permissions, putting organizations at elevated risk when their credentials are exposed. Take security operations centers and incident response teams. In general, while "the principle of least privilege and minimal manual access" is a best practice, first responders often need immediate and "necessary access," says an August report from Darktrace. "Security teams need access to logs, snapshots and configuration data to understand how an attack unfolded, but giving blanket access opens the door to insider threats, misconfigurations and lateral movement." Rather than always allowing such access, experts recommend using tools that only provide it when needed, for example, through Amazon Web Services' Security Token Service. "Leveraging temporary credentials, such as AWS STS tokens, allows for just-in-time access during an investigation" that can be automatically revoked after, which "reduces the window of opportunity for potential attackers to exploit elevated permissions," Darktrace said.

How Software Development Teams Can Securely and Ethically Deploy AI Tools

Clearly, there is a danger that teams will trust AI too much, as these tools lack a command of the often nuanced context to recognize complex vulnerabilities. They may not fully grasp an application’s authentication or authorization framework, potentially leading to the omission of critical checks. If developers reach a state of complacency in their vigilance, the potential for such risks will only increase. ... Beyond security, team leaders and members must focus more on ethical and even legal considerations: Nearly one-half of software engineers are facing legal, compliance and ethical challenges in deploying AI, according the The AI Impact Report 2025 from LeadDev. The ethical/legal scenarios can take on a highly perplexing nature: A human engineer can read, learn from and write original code from an open-source library. But if an LLM does the same thing, it can be accused of engaging in derivative practices. What’s more, the current legal picture is a murky work in progress. Given the still-evolving judicial conclusions and guidelines, those using third-party AI tools need to ensure they are properly indemnified from potential copyright infringement liability, according to Ropes & Gray, a global law firm that advises clients on intellectual property and data matters. “Risk allocation in contracts concerning or contemplating AI models should be approached very carefully,” according to the firm.

How AI is Revolutionising RegTech and Compliance

Traditional approaches are failing, overwhelmed by increasing regulatory complexity and cross-border requirements. Enter RegTech: a technological revolution transforming how institutions manage regulatory obligations. Advanced artificial intelligence systems now predict compliance breaches weeks before they occur, while blockchain platforms create tamper-proof audit trails that streamline regulatory examinations. ... Natural language processing interprets complex regulatory documents automatically, updating compliance procedures within minutes of regulatory changes. Smart contracts execute compliance actions without human intervention, ensuring consistent adherence to evolving requirements. Leading institutions are achieving remarkable results. Barclays reduced regulatory document processing time from days to minutes using AI-powered analysis. JPMorgan's blockchain settlement system maintains compliance across multiple jurisdictions simultaneously. ... Regulatory-as-a-Service models are democratising access to sophisticated compliance capabilities. Smaller institutions can now access enterprise-grade RegTech through subscription services, reducing compliance costs by up to 50% whilst improving regulatory coverage. Challenges remain significant. Data privacy concerns intensify as compliance systems process vast quantities of sensitive information. Regulatory fragmentation across jurisdictions complicates platform development.

CEOs Go All-In on AI, But Talent Isn't Ready

Despite the enthusiasm for AI, workforce readiness is still a critical concern. Approximately 74% of Indian CEOs see AI talent readiness as a determinant of their company's future success, yet 34% admit to a widening skills gap. This talent gap is multifaceted; it's not only technical proficiency that's in short supply, but also expertise in blending data science with ethics, regulatory understanding and business acumen. About 26% struggle to find candidates who balance technical skill with collaboration capabilities. ... Regulatory uncertainty still weighs heavily on CEOs' minds, with nearly half of Indian CEOs awaiting clearer regulatory guidance before pushing bold innovation initiatives, compared to only 39% globally. This cautious stance underlines a pragmatic approach to integrating AI amid evolving governance landscapes. About 76% of Indian CEOs worry that slow AI regulation progress could hinder organizational success. Ethical concerns also loom large: 62% of Indian CEOs cite them as significant barriers, slightly higher than the 59% global average, underscoring the importance of embedding trust and governance frameworks alongside technological investments. "This is why culture and leadership are very important. The board of directors must have a degree of AI literacy. There must be psychological safety in the organization. Employees must feel safe and if there's clear governance, it means there is a proactive suggestion to use sanctioned AI that meets security requirements," John Barker

Powering financial services innovation: The critical role of colocation

As AI continues to evolve, its impact on financial services is becoming both broader and deeper – moving beyond high-level innovation into the operational core of the enterprise. Today’s financial institutions face a dual mandate: to accelerate AI adoption in pursuit of competitive advantage, and to do so within the constraints of an increasingly complex digital and regulatory environment. From risk modelling and fraud prevention to real-time analytics and customer personalization, AI is being embedded into mission-critical functions. Realising its full potential, however, isn't solely a matter of algorithms – it hinges on having a data-first strategy, with the right infrastructure and governance in place. ... With exponential data growth presenting challenges, customers gain access to a secure, compliant, resilient, and performant foundation. This foundation enables the implementation of new technologies and seamless orchestration of data flows. Our goal is to simplify data management complexity and serve as the single, trusted, global data center partner for our customers. As organizations optimize their AI strategies, many are exploring cloud repatriation – the process of moving certain workloads from the cloud back to on-premises or colocation environments. This strategic move can be crucial for AI success, as it allows for better control over sensitive data, reduced latency, and improved performance for demanding AI workloads.

Measuring, Reporting, and Improving: Making Resilience Tangible and Accountable

A continuity plan sitting on a shelf provides little assurance of resilience. What matters is whether organizations can demonstrate their strategies work, they are tested, and corrective actions are tracked. Measurement transforms resilience from an abstract concept into quantifiable performance. ... Metrics ensure resilience is not left to chance or anecdote. They provide boards and regulators with evidence of progress, reinforcing accountability at the executive and governance levels. A resilience strategy that cannot be measured cannot be trusted. ... The first step in strengthening measurement is to define resilience key performance indicators (KPIs) and key risk indicators (KRIs). These metrics should evaluate outcomes rather than simply tracking activities, ensuring performance reflects actual readiness. ... Measurement alone is not enough without transparency. Organizations must establish reporting practices that make resilience performance visible to boards, regulators, and, when appropriate, customers. Sharing outcomes openly not only demonstrates accountability but also builds trust and credibility. ... One challenge organizations often encounter when measuring resilience is metric overload. In the effort to capture every detail, leaders may track too many indicators, creating complexity that dilutes focus and makes it difficult to interpret results.

Bridging the Gap: Why DevOps Teams Are Quietly Becoming the Front Line of Security

For experienced DevOps practitioners, the idea of shifting security left isn't new. Static analysis in CI/CD pipelines, dependency scanning, and Infrastructure as Code (IaC) validation have become the norm. What's changed more recently is the pressure to respond to security events operationally, in addition to preventing them during builds. DevOps teams are adjusting in very real ways. Many are building security context into their logging practices, ensuring that logs are structured for debugging, and also for investigation and audit. Others are automating triage for security alerts using the same mindset they've applied to performance monitoring and deployment pipelines. Perhaps most importantly, DevOps teams are often the first to respond when something unusual shows up in system logs or access patterns. ... Security can be a shared responsibility across teams as long as boundaries and expectations are set. DevOps teams are defining their role in security more clearly by, for example, determining what gets logged, what counts as an anomaly, and who owns the investigation. They're also setting expectations around incident escalation, CVE response timeframes, and compliance requirements. When these lines are clear, security becomes an integrated part of the workflow instead of an extra burden. ... For many DevOps teams, security is part of the daily reality. It comes as a series of small, increasingly frequent interruptions.

Daily Tech Digest - November 04, 2025

Quote for the day:

"Listen with curiosity, speak with honesty act with integrity." -- Roy T Bennett

What does aligning security to the business really mean?

“Alignment to me means that information security supports the strategy of the organization,” says Sattler, who also serves as a board director with the governance association . ... “It’s not enough to say it; you actually have to do it,” she explains. “There is a contingent of cybersecurity that sees itself as an island, implementing defense in depth in every corner of the organization, adopting all these frameworks and standards, but there is diminishing returns in doing that. So instead of saying, ‘This is our cybersecurity discipline and we’re doing all these things because the benchmarks tell us to,’ have to align their efforts to their organization’s business model.” ... To align, she says, security leaders must “know the objectives the business has and use those to shape strategy, whether it’s cost containment, going into new markets, adopting cloud. The playbook starts from understanding the organizational priorities and then layering in what threat actors are doing in that industry and what could go wrong, what is the risk we can live with, and understanding and articulating the business impact of security incidents.” ... “When security is not aligned, security is reacting to changes rather than shaping changes,” says . “But when security isn’t chasing the business it’s because it’s at the table from the beginning and is saying, ‘Here’s how I can help the business grow and grow securely.’”

CISO Burnout – Epidemic, Endemic, or Simply Inevitable?

“Burnout and are different conditions, though they can coexist and share some symptoms,” says . “The constant hypervigilance required in our roles can mirror PTSD symptoms, and some cyber security professionals do experience what could be considered from constantly dealing with the aftermath of cyber-attacks.” Experiencing trauma can make you more susceptible to burnout, and burnout can exacerbate existing trauma responses. “Both conditions are serious and treatable, but they require different approaches,” she suggests. And both are further complicated by , a characteristic that is particularly prevalent in cybersecurity, and especially among CISOs. ... “From my experience working with senior cyber security leaders,” she continues, “burnout also affects their ability to lead their teams effectively. They become less empathetic, more prone to micromanaging, and, ironically, more likely to create the very conditions that lead to burnout in their staff. The strategic thinking that makes a great CISO (the ability to see the big picture, anticipate threats, and balance risk with business needs) gets clouded by exhaustion and cynicism. Perhaps most dangerously, burned-out CISOs often develop tunnel vision, focusing obsessively on certain threats while missing others entirely. When the person responsible for an organization’s entire security posture is running on empty, everyone is at risk.”

Uncovering the risks of unmanaged identities

often operate independently, making it difficult to track and monitor their activities without a centralized management system. These agents can adapt and change their behavior autonomously, which complicates efforts to predict and control their actions. While performing their duties, AI agents can even spin up other models and agents that have access to valuable data. ... Unmanaged identities significantly expand the attack surface, providing more entry points for attackers. They are prime targets for credential theft, which can lead to lateral movement within an organization’s network. Forgotten or over-permissioned accounts can facilitate privilege escalation, allowing attackers to gain unauthorized access to sensitive data. have been linked to unmanaged identities, underscoring the critical need for effective identity management. ... Inefficient access management due to unmanaged identities increases IT overhead and complexity. Unauthorized access or accidental deletions can disrupt business operations, leading to breaches, financial losses, and diminished customer trust. ... Unmanaged identities present a clear and present danger to organizations. They increase the risk of security breaches, compliance failures, and operational disruptions. It is imperative for organizations to prioritize identity discovery and management as a core security practice.

Empowering Teams: Decentralizing Architectural Decision-Making

Decisions form the core of software architecture, and practicing software architecture means working with decisions. Software development itself represents a constant stream of decisions. In a decentralized decision-making process, everyone contributes to architectural decisions, from developers to architects. For this approach, identifying whether a decision is architecturally significant and will impact the system now or in the future matters more than who made the decision or how long it took. Recording architectural decisions captures the why behind every what, creating valuable context for future learning and shared understanding. ... Timing for seeking feedback or advice depends on the nature of the decision. For impactful decisions affecting multiple system parts, or when lacking business or technical knowledge, seeking advice during the decision-making process yields better results. ADRs are immutable documents; once marked as adopted, they cannot be changed. If a decision needs revision, the previous ADR is superseded and a new one created. ... From the program leadership perspective, watching teams make independent decisions felt like being the first test driver in a Tesla using autopilot and hoping to avoid crashing. Staying out of decisions required conscious effort to avoid undermining the advice process and resorting back to make the decisions for the team.

The Fractured Cloud: How CIOs Can Navigate Geopolitical and Regulatory Complexity

Initially, cloud environments were largely interchangeable from a governance, compliance, and security perspective. It didn't really matter exactly which cloud data center hosted an organization's workloads, or which jurisdiction the data center was located in. IT leaders had the luxury of choosing cloud platforms and regions based primarily on factors such as pricing and latency, without having to consider geopolitics or the global regulatory environment. Fast forward to the present, however, and planning a cloud architecture -- let alone evolving an existing cloud strategy in response to changing needs -- has become much more complex. ... During the past decade or so, a host of regulations have emerged that apply to specific jurisdictions, including the and California Public Records Act (CPRA). Regulations dealing with AI, which are just now coming online, are likely to add even more diversity as different states or countries introduce varying laws. ... A related issue is the increasing pressure organizations face surrounding , which refers to the practice of keeping data within a certain country or jurisdiction. Regulations require this in some cases. Even if they don't, businesses may voluntarily choose to ensure data localization for the purposes of improving workload performance, or to assure customers that their data never leaves their home region.

Let's Get Physical: A New Convergence for Electrical Grid Security

Power plants and transmission/distribution system operators () have long focused on maintaining uptime and enhancing the resilience of their services; keeping the lights on is always the goal. That's especially true as the past few years have seen the rise of OT/OT convergence, wherein formerly siloed equipment that runs physical processes for critical infrastructure (operational technology, or OT) has been hooked up to the IT network and the Internet in some cases, exposing it to more cyberthreats. Now, another type of convergence been forcing a new conversation. ... In this new world, both industry regulators and analysts, like those at Black & Veatch, are arguing the same point: that where once keeping the lights on might have just meant maintaining equipment and avoiding fallen trees, today's grid operators need a robust, integrated physical and cybersecurity strategy to maintain continuous service. ... an IT operation might primarily concern itself with firewalls, or network monitoring; but "in many cases, cyberattacks can often involve physical access to sites, whether by malicious insiders or unwitting employees and contractors. Understanding who is present on-site, when and why, is critical to investigating and mitigating attacks on operations," Bramson explains.

Was data mesh just a fad?

Data mesh architecture promised to solve these problems. A polar opposite approach from a , a data mesh gives the source team ownership of the data and the responsibility to distribute the dataset. Other teams access the data from the source system directly, rather than from a centralized data lake. The data mesh was designed to be everything that the data lake system wasn’t. ... But the excitement around data mesh didn’t last. Many users became frustrated. Beneath the surface, almost every bottleneck between data providers and data consumers became an implementation challenge. The thing is, the data mesh approach isn’t a once-and-done change, but a long-term commitment to prepare a data schema in a certain way. Although every source team owns their dataset, they must maintain a schema that allows downstream systems to read the data, rather than replicating it. ... No, data mesh is not a fad, nor is it the next big thing that will solve all of your data challenges. But data mesh can dramatically reduce data management overhead, and at the same time improve data quality, for many companies. In essence, data mesh is a shift in mindset, one that completely changes the way you view data. Teams must envision data as a product, continuously showing commitment for the source team to own the data set and discouraging duplication.

8 ways to make responsible AI part of your company's DNA

" is a team sport," the report's authors explain. "Clear roles and tight hand-offs are now essential to scale safely and confidently as AI adoption accelerates." To leverage the advantages of responsible AI, recommends rolling out AI applications within an operating structure with three "lines of defense." First line: Builds and operates responsibly. Second line: Reviews and governs. Third line: Assures and audits. ... "For tech leaders and managers, making sure AI is responsible starts with how it's built," Rohan Sen, principal for cyber, data, and tech risk with PwC US. "To build trust and scale AI safely, focus on embedding responsible AI into every stage of the AI development lifecycle, and involve key functions like cyber, data governance, privacy, and regulatory compliance," said Sen. ... "Start with a value statement around ethical use," said Logan. "From here, prioritize periodic audits and consider a steering committee that spans privacy, security, legal, IT, and procurement. Ongoing transparency and open communication are paramount so users know what's approved, what's pending, and what's prohibited. Additionally, investing in training can help reinforce compliance and ethical usage." ... Make it a priority to "continually discuss how to responsibly use AI to increase value for clients while ensuring that both data security and IP concerns are addressed," said Tony Morgan, senior engineer at Priority Designs.

Context Engineering: The Next Frontier in AI-Driven DevOps

Context Engineering represents a significant evolution from the early days of , which focused on crafting the perfect, isolated instruction for an AI model. Context engineering, in contrast, is about orchestrating the entire information ecosystem around the AI. It’s the difference between giving someone a map (prompt engineering) and providing them with a real-time GPS that has traffic updates, road closures, and understands your personal driving preferences. ... The core components of context engineering in a DevOps environment include: Dynamic Information Assembly: Aggregating data from a multitude of DevOps tools, including monitoring platforms, , and infrastructure as code (IaC) repositories. Multi-Source Integration: Connecting to APIs, databases, and internal documentation to create a comprehensive view of the entire system. Temporal Awareness: Understanding the history of changes, incidents, and performance to identify patterns and predict future outcomes. ... In a traditional setup, the CI/CD pipeline would run a standard set of tests. But with context engineering, a context-aware AI agent analyzes the change. It recognizes the high-risk nature of the code, cross-references it with a recent security audit that flagged a related library, and automatically triggers an extended security testing suite. It also notifies the security team for a priority review. This is a far cry from the old days of one-size-fits-all pipelines.

Drowning in Data? Here’s Why You Need to Ditch the Rowboat for an Aircraft Carrier

In an effort to stay afloat, many enterprises are trying to patch their systems with incremental upgrades. They add more cloud instances. They layer on external tools. They spin up new teams to manage increasingly fragmented stacks. But scaling up a fragile system doesn’t make it strong. It just makes the cracks bigger. ... The deeper issue is this: the dominant architecture most enterprises still rely on was designed over a decade ago. It served a world where workloads operated in gigabytes or single-digit terabytes. Today, companies are navigating hundreds of petabytes, yet many are still using infrastructure built for a far smaller scale. It’s no wonder the systems are buckling under the weight. ... As organizations reevaluate their data architectures, several priorities are coming into sharper focus: Reducing fragmentation by moving toward more unified environments, where systems work in concert rather than in silos. Improving performance and cost-efficiency not just through hardware, but through smarter architecture and workload optimization. Lowering latency for high-demand workloads like , AI, and real-time analytics, where speed directly impacts decision-making. Managing the energy consumption bottleneck in ways that align with both financial and sustainability goals. Ultimately, this shift is about enabling teams to go from playing defense (maintaining systems and containing cost) to playing offense with faster, more actionable insights.

Daily Tech Digest - November 03, 2025

Quote for the day:

"With the new day comes new strength and new thoughts." -- Eleanor Roosevelt

Smaller, Smarter, Faster: AI Will Scale Differently in 2026

"Technology leaders face a pivotal year in 2026, where disruption, innovation and risk are expanding at unprecedented speed," said Gene Alvarez, distinguished vice president analyst at . "The top strategic technology trends identified for 2026 are tightly interwoven and reflect the realities of an AI-powered, hyperconnected world where organizations must drive responsible innovation, operational excellence and digital trust." The centerpiece of that thesis is the pivot from large, general-purpose to domain-specific language models, or , and , , designed to execute and audit business workflows. DSLMs promise higher accuracy, lower downstream compliance risk and cheaper inference costs; MAS promise orchestration and scale. ... The back half of is a sober reminder of the price of admission. First is . This is the C-suite-level trend of yanking critical data and apps out of global public clouds and moving them to local or "sovereign" clouds. Driven by regulations like and fears over the , this market is exploding. Second, the security model is flipping. Gartner's predicts a massive shift, forecasting that 50% of IT security spending will move from "detection and response" to "proactive protection" by 2030, up from less than 5% in 2024.

Today’s security leaders must adopt an asymmetric mindset

We’ve built an unbalanced view of threats. We pour resources into the risks we know how to manage — firewalls, access control, guard contracts — while neglecting the ones that move fastest and cut deepest: hybrid, cross-domain, and narrative-driven threats. Consider the . State-linked actors compromised multiple U.S. telecom networks for nearly a year, breaching routers, core systems, and even . What began as a cyber incident rippled across national security. Or, the hybrid criminal case in which a fake recruiter on lured a corporate employee into downloading malware while coordinating physical intimidation. Digital, physical, and psychological tactics in one operation. ... Asymmetric actors win by exploiting tempo, surprise, and blind spots. As the former U.S. Army Asymmetric Warfare Group explained, its mission was to “identify critical asymmetric threats… through global first-hand observations,” enabling rapid adaptation in a shifting threat environment. That’s the same level of insight security leaders should demand whether from small teams or entire corporations. They don’t respect our categories. They will hit us digitally, physically, and reputationally in whatever sequence maximizes confusion and slows our response. They’ll use low-cost tools to cause high-cost damage: small moves, outsized effects.

Employees keep finding new ways around company access controls

AI, SaaS, and personal devices are changing how people get work done, but the tools that protect company systems have not kept up, according to . Tools like , , and no longer align with how employees and AI agents access data. The result is what researchers call the “,” a growing distance between what organizations think they can control and how employees and AI systems access company data. The survey tracks four areas where this gap is widening: AI governance, SaaS and , credentials, and endpoint security. Each shows the same pattern of rapid adoption and limited oversight. ... Organizations now rely on hundreds of cloud apps, most outside IT’s visibility. Over half of employees admit they have downloaded work tools without permission, often because approved options are slower or lack needed features. This behavior drives . 70% of security professionals say SSO tools are not a complete solution for securing identities. On average, only about two-thirds of enterprise apps sit behind SSO, leaving a large portion unmanaged. Offboarding gaps make the problem worse. 38% of employees say they have accessed a former employer’s account or data after leaving the company. ... remains the default control for company hardware, but security leaders see its limits. MDM tools do not adequately safeguard managed devices or ensure compliance.

Securing APIs at Scale: Threats, Testing, and Governance

must be approached as a fundamental element of the design and development process, rather than an afterthought or add-on. Many organizations fall short in this regard, assuming that security measures can be patched onto an existing system by deploying security devices like () at the perimeter. In reality, secure APIs begin with the first line of code, integrating security controls throughout the design lifecycle. Even minor security gaps can result in significant economic losses, legal repercussions, and long-term brand damage. Designing APIs with inadequate security practices introduces risks that compound over time, often becoming a time bomb for organizations. ... APIs are attractive targets for attackers because they expose business logic, data flows, and authentication mechanisms. According to , 94% of organizations experienced an API-related security incident in the past year. The threats facing APIs are constantly evolving, becoming more sophisticated and targeted. ... Given the complexity and scale of API ecosystems, a proactive and comprehensive testing strategy is crucial. Relying solely on manual testing is no longer sufficient; automation is key. ... Technical controls are vital, but without a strong governance framework, API security efforts can quickly unravel. Without governance, APIs become a “wild west” of inconsistent standards, duplicated efforts, and accidental exposure.

The Agentic evolution, How Autonomous AI is Re-Architecting the Enterprise

The rise of is leading to a new kind of enterprise that functions more like a living system. In this model, AI agents and humans work together as collaborators. The agents handle ongoing operations and optimize outcomes, while humans provide strategy, creativity, and oversight. Organizations that can successfully combine human intelligence with machine autonomy will lead the next era of business transformation. They will move faster, adapt quicker, and make better use of their data and resources. The Agentic Leap is not only about new technology; it represents a deeper change in how enterprises think and operate. It marks the beginning of organizations that are not only supported by AI but are actively driven and shaped by it. This traditional hierarchy of command is gradually evolving into a network of intelligent collaboration, where humans and AI systems continuously exchange information, refine strategies, and act with shared intent. In this model, humans and AI agents function as true partners. Agents operate as intelligent executors and problem-solvers, constantly monitoring data flows, identifying opportunities, and adapting operations in real time. They can handle repetitive, data-intensive tasks, freeing humans to focus on higher-order functions such as strategic planning, creative innovation, and ethical oversight. Humans, in turn, provide contextual understanding, emotional intelligence, and long-term vision qualities that anchor AI-driven actions in purpose and responsibility.

6 essential rules for unleashing AI on your software development process - and the No. 1 risk

"AI is not something you can pull out of your toolbox and expect magical things to happen," cautioned Andrew Kum-Seun, research director at Info-Tech Research Group. "At least, not right now. IT managers must be prepared to address the human, workflow, and technical implications that naturally come with AI while being honest about what AI can do today for their organization." In other words, get your AI implementation in order before you attempt to apply it to getting your software development in order. ... As is meant to maintain humanity in software development, AI needs to support this vision. This must be a core component of AI-driven Agile development as well. "If leaders are unable to bridge their intent for AI with the team's concerns, they will likely see improper use of AI and, perhaps, deliberate sabotage in its implementation," said Kum-Seun. Another important step is to "keep all AI explainable by ensuring the use of AI tools that clearly cite where their suggestions come from -- no black-box code that cannot be simply verified," said Sopuch. "Human oversight is a required step. AI can write and refactor code, but humans absolutely must approve merges, product pushes, or any exceptions. Everything in the process must be logged, including prompts, outputs, and approvals so that an audit can easily take place on demand."

The AWS outage post-mortem is more revealing in what it doesn’t say

When AWS suffered a series of cascading failures that crashed its systems for hours in late October, the industry was once again reminded of its extreme dependence on major . The incident also shed an uncomfortable light on how fragile these massive environments have become. In ’s detailed post-mortem report, the cloud giant detailed a vast array of delicate systems that keeps global operations functioning — at least, most of the time. ... “The outage exposed how deeply interdependent and fragile our systems have become. It doesn’t provide any confidence that it won’t happen again. ‘Improved safeguards’ and ‘better change management’ sound like procedural fixes, but they’re not proof of architectural resilience. If AWS wants to win back enterprise confidence, it needs to show hard evidence that one regional incident can’t cascade across its global network again. Right now, customers still carry most of that risk themselves.” ... Ellis agreed with others that AWS didn’t detail why this cascading failure happened on that day, which makes it difficult for enterprise IT executives to have high confidence that something similar won’t happen in a month. “They talked about what things failed and not what caused the failure. Typically, failures like this are caused by a change in the environment. Someone wrote a script and it changed something or they hit a threshold. It could have been as simple as a disk failure in one of the nodes. I tend to think it’s a scaling problem.”

Five Real-World Ways AI Can Boost Your Bank’s Operations

Use of artificial intelligence decisioning has already had time to prove itself, and the results have been strong, according to Daryl Jones, senior director. The fit varies from one institution to another, "but the lift, overall, has been unquestionable," said Jones. He said institutions using AI in lending decisions have generally seen healthy increases in approvals, with solid results. One caveat is that as aspects of loan decisions transition to AI, institutions have to be careful how human lenders influence the software development process. ... Technology has long been a mainstay for antifraud, according to John Meyer, managing director. "We’ve had machine learning algorithms since the 1990s," said Meyer, but today’s antifraud applications of AI go a step beyond. He explained that the old technology could evaluate a few data points "on day two," once the damage was already done. By contrast, AI-based techniques can screen and surface instances truly needing human evaluation, according to Meyer. Such applications include verifying that paper checks are genuine. Meyer noted that check fraud remains a significant issue for the banking industry in spite of the rise of digital transactions. ... Even in a modern banking office, documents can be a rat’s nest. "We had a client on the West Coast that wanted to centralize all of its operational documents," said Clio Silman, managing director.

Context engineering: Improving AI by moving beyond the prompt

It isn’t a new practice for developers of AI models to ingest various sources of information to train their tools to provide the best outputs, notes Neeraj Abhyankar, vice president of data and AI at , a digital product engineering firm. He defines the recently coined term as a strategic capability that shapes how AI systems interact with the broader enterprise. ... Context engineering will be critical for autonomous agents trusted to perform complex tasks on an organization’s behalf without errors, he adds. ... Context engineering is an “architectural shift” in how AI systems are built, adds Louis Landry, CTO at data analytics firm . “Early generative AI was stateless, handling isolated interactions where prompt engineering was sufficient,” he says. “However, autonomous agents are fundamentally different. They persist across multiple interactions, make sequential decisions, and operate with varying levels of human oversight.” He suggests that AI users are moving away from the approach of, “How do I ask this AI a question?” to “How do I build systems that continuously supply agents with the right operational context?” “The shift is toward context-aware agent architectures, especially as we move from simple task-based agents to autonomous agentic systems that make decisions, chain together complex workflows, and operate independently,” Landry adds.

India’s Search for Digital Sovereignty

states are seeking to impose varying degrees of control over the internet. Often, these manifest as restrictions on information flows, which have consequences for civil liberties such as speech, expression, dissent, and the exchange of ideas in society. And, in a time when both geopolitical and domestic actors, state and non-state alike, cynically exploit open societies to exacerbate polarization and dehumanization, calls for greater control might seem appealing. However, it is vital that attempts to curb the concentration of power and resources of one set of actors do not merely transfer those same powers to another set. On the contrary, the goal should be to dissipate dominance, in general. ... It is not that alternative pathways to reduce concentration do not exist. Free and open source software, though not without its own challenges, is an approach that many can choose. Kailash Nadh, one of the founders of the United Foundation, has argued that for India to achieve technological self-determination, it needed to “publicly acknowledge” FOSS, and invest “time, effort and resources into” it. In late August, perhaps in a nod to the , positioned itself as a “Strategic Asset for Governments and Enterprises Focused on Digital Sovereignty and Privacy.” When it comes to information distribution and consumption, decentralized social networks and ideas such as “” have existed for several years, but have yet to gain traction in India’s policy discourse.