Daily Tech Digest by Kannan Subbiah

Daily Tech Digest - October 04, 2025

Quote for the day:

“What seems to us as bitter trials are often blessings in disguise.” -- Oscar Wilde

Autonomous Agents – Redefining Trust and Governance in AI-Driven Software

Agents are no longer confined to code generation. They automate tasks across the full lifecycle: from coding and testing to packaging, deploying, and monitoring. This shift reflects a move from static pipelines to dynamic orchestration. A new developer persona is emerging: the Agentic Engineer. These professionals are not traditional coders or ML practitioners. They are system designers: strategic architects of intelligent delivery systems, fluent in feedback loops, agent behavior, and orchestration across environments. ... To scale agentic AI safely, enterprises must build more than pipelines – they must build platforms of accountability. This requires a System of Record for AI Agents: a unified, persistent layer that treats agents as first-class citizens in the software supply chain. This system must also serve as the foundation for regulatory compliance. As AI regulations evolve globally – covering everything from automated decision-making to data residency and sovereignty – enterprises must ensure that every agent action, dataset, and interaction complies with relevant laws. A well-architected System of Record doesn’t just track activity; it injects governance and compliance into the core of agent workflows, ensuring that AI operates within legal and ethical boundaries from the start.

New AI training method creates powerful software agents with just 78 examples

The problem is that current training frameworks assume that higher agentic intelligence requires a lot of data, as has been shown in the classic scaling laws of language modeling. The researchers argue that this approach leads to increasingly complex training pipelines and substantial resource requirements. Moreover, in many areas, data is not abundant, hard to obtain, and very expensive to curate. However, research in other domains suggests that you don’t necessarily require more data to achieve training objectives in LLM training. ... The LIMI framework demonstrates that sophisticated agentic intelligence can emerge from minimal but strategically curated demonstrations of autonomous behavior. Key to the framework is a pipeline for collecting high-quality demonstrations of agentic tasks. Each demonstration consists of two parts: a query and a trajectory. A query is a natural language request from a user, such as a software development requirement or a scientific research goal. ... “This discovery fundamentally reshapes how we develop autonomous AI systems, suggesting that mastering agency requires understanding its essence, not scaling training data,” the researchers write. “As industries transition from thinking AI to working AI, LIMI provides a paradigm for sustainable cultivation of truly agentic intelligence.”

CISOs advised to rethink vulnerability management as exploits sharply rise

The widening gap between exposure and response makes it impractical for security teams to rely on traditional approaches. The countermeasure is not “patch everything faster,” but “patch smarter” by taking advantage of security intelligence, according to Lefkowitz. Enterprises should evolve beyond reactive patch cycles and embrace risk-based, intelligence-led vulnerability remediation. “That means prioritizing vulnerabilities that are remotely exploitable, actively exploited in the wild, or tied to active adversary campaigns while factoring in business context and likely attacker behaviors,” Lefkowitz says. ... Yüceel adds: “A risk-based approach helps organizations focus on the threats that will most likely affect their infrastructure and operations. This means organizations should prioritize vulnerabilities that can be considered exploitable, while de-prioritizing vulnerabilities that can be effectively mitigated or defended against, even if their CVSS score is rated critical.” ... “Smart organizations are layering CVE data with real-time threat intelligence to create more nuanced and actionable security strategies,” Rana says. Instead of abandoning these trusted sources, effective teams are getting better at using them as part of a broader intelligence picture that helps them stay ahead of the threats that actually matter to their specific environment.

Modernizing Security and Resilience for AI Threats

For IT leaders, there may be concerns about the complexity and the risks of downtime and data loss. Operational leaders typically think of the impacts it will have on staffing demands and disruptions to business continuity. And it’s easy for security and compliance leaders to be worried about meeting regulatory standards without exposing the company’s data to new attacks. Most importantly, executive leadership can tend to be hesitant due to concerns around the total investment costs and disruption to innovation and revenue growth. While each leader may have their valid concerns, the risk of inaction is much greater. ... Fortunately, modernization doesn’t mean you need to take on a massive overhaul of your organization’s operations. Modernizing in place is an alternative solution that can be a sustainable, incremental strategy that improves stability, security, and performance without putting mission-critical systems at risk. When leaders can align on business continuity needs and concerns, they can develop low-risk approaches that still move operations forward while achieving long-term organizational goals. ... A modernization journey can take many forms. From updates to your on-prem system or migrating to a hybrid-cloud environment, modernization is a strategic initiative that can improve and bolster your company’s strength against potential data breaches.

Navigating AI Frontier — Role of Quality Engineering in GenAI

In the GenAI era, the role of Quality Engineering (QE) is under the spotlight like never before. Some whisper that QE may soon be obsolete after all, if developer agents can code autonomously, why not let GenAI-powered QE agents generate test cases from user stories, synthesize test data, and automate regression suites with near-perfect precision? Playwright and its peers are already showing glimpses of this future. In corporate corridors, by the water coolers, and in smoke breaks, the question lingers: Are we witnessing the sunset of QE as a discipline? The reality, however, is far more nuanced. QE is not disappearing it is being reshaped, redefined, and elevated to meet the demands of an AI-driven world. ... if test scripts pose one challenge, test data is an even trickier frontier. For testers, data that mirrors production is a blessing; data that strays too far is a nightmare. Left to itself, a large language model will naturally try to generate test data that looks very close to production. That may be convenient, but here’s the real question: can it stand up to compliance scrutiny? ... What we’ve explored so far only scratches the surface of why LLMs cannot and should not be seen as replacements for Quality Engineering. Yes, they can accelerate certain tasks, but they also expose blind spots, compliance risks, and the limits of context-free automation.

Are Unified Networks Key to Cyber Resilience?

Fragmentation usually stems from a mix of issues. It can start with well-meaning decisions to buy tools for specific problems. Over time, this creates siloed data, consoles and teams, and it can take a lot of additional work to manage all the information coming from different sources. Ironically, instead of improving security, it can introduce new risks. Another factor is the misalignment of business processes as needs change. As business needs evolve and grow, the pressure to address specific requirements can drive IT and security processes in different directions. And finally, there is shadow IT, where employees attach new devices and applications to the network that haven’t been approved. If IT and security teams can’t keep pace with business initiatives, other teams across the organisation may seek to find their own solutions, sometimes bypassing official processes and adding to fragmentation. ... The bigger issue is that security teams risk becoming the ‘department of no’ instead of business enablers. A unified approach can help address this. By consolidating networking, security and observability into one unified platform, organisations have a single source of truth for managing network security. They can even automate reporting in some platforms, eliminating hours of manual work. With a single view of the entire network instead of putting together puzzle pieces from various applications, security teams see the big picture instantly, allowing them to prioritise what matters, respond faster and avoid burnout.

How CIOs Balance Emerging Technology and Technical Debt

"Technical debt isn't just an IT problem -- it's an innovation roadblock." Briggs pointed to Deloitte data showing 70% of technology leaders cite technical debt as their number one productivity drain. His advice? Take inventory before you innovate. "Know what's working versus what's just barely hanging on, because adding AI to broken processes doesn't fix them, it just breaks them faster," he said. ... "Everything kind of boils down to how the organizations are structured, how your teams are structured, what the goals are per team and what you're delivering," Caiafa said. At SS&C, some teams focus solely on maintaining legacy systems, while others support the integration of newer technologies. But, Caliafa said, the dual structure doesn't eliminate the challenge: Technical debt still accumulates as newer technologies are adopted. He advised CIOs to stay disciplined about prioritizing value. At SS&C, the approach is straightforward: "If it's not going to help us or make a material impact on what we're doing day to day, then it's not going to be an area of focus," he said. ... "Technical debt isn't just legacy code -- it's the accumulation of decisions made without long-term clarity," he said. Profico urged CIOs to embed architectural thinking into every IT initiative, align with business strategy and adopt of new technologies in an incremental manner -- while avoiding "the urge to over-index on shiny tools."

For Banks and Credit Unions, AI Can Be Risky. But What’s Riskier? Falling Behind.

"Over the past 18 months, I have not encountered a single financial services organization that said ‘we don’t need to do anything'" when it comes to AI, said Ray Barata, Director of CX Strategy at TTEC Digital, a global customer experience technology and services company. That said, though many banks and credit unions are highly motivated, and some may have the beginnings of a strategy in mind, they are frozen in place. Conditioned by decades of "garbage-in-garbage-out" data-integration horror stories, these institutions’ leaders have come to believe they must wait until their data architectures are deemed "ready" — a state that never arrives. Meanwhile, compliance and security concerns add more friction. And doubts over return on investment complete the picture. ... Barata emphasized the critical role "sandboxing" plays in the low-risk / high-impact approach — setting up a controlled test environment that mirrors the real conditions operating within the institution, but walled off from its operating environment. This enables experimentation within guardrails. Referring to TTEC Digital’s Sandcastle CX approach, he described this as "building an entire ecosystem in which we can measure performance of individual platform components and data sets" — so that sensitive information stays protected while teams trial AI safely and prove value before scaling.

What is vector search and when should you use it?

Vector search uses specialized language models (not the large LLMs such as ChatGPT, but targeted embedding models) to convert text into numerical representations, known as vectors, which capture the meaning of the text. This enables search engines to make connections between different terminologies. If you search for “car,” the system can also find documents that mention “vehicle” or “motor vehicle,” even if those exact terms do not appear. ... If semantic meaning is crucial, vector search can be a good solution. This is the case when users search for the same information using different words, or when a better search query can lead to increased revenue. A large e-commerce platform could potentially achieve 1 or 2 percent more revenue by applying vector search. The application of vector search is therefore immediately measurable. ... Vector search does add extra complexity. Documents or texts must be divided into chunks, then run through embedding models, and finally indexed efficiently. Elastic uses HNSW (Hierarchical Navigable Small World) indexing for this. To keep things from getting too complex, Elastic has chosen to integrate it into its existing search solution. It is an additional data type that can be stored in a column alongside existing data. This also makes hybrid search much easier. However, this is not so simple with every vector search provider.

Digital friction is where most AI initiatives fail

While the link between digital maturity and AI outcomes plays out across the enterprise, it is clearest in employee-facing use cases. Many AI tools being introduced into the workplace are designed to assist with routine tasks, surface relevant knowledge, or to summarise documents and automate repetitive workflows. ... With DEX maturity, organisations begin to change how they understand and deliver technology. Early efforts often focus narrowly on devices or support tickets. More mature organisations shift their focus toward employees, designing services around user personas, mapping full task journeys across tools and monitoring how those journeys perform in real time. Telemetry moves beyond technical diagnostics, becoming a strategic input for decision-making, investment planning and continuous improvement. Experience data becomes a foundation for IT operations and transformation. ... Where maturity is lacking, AI tends to be misapplied. Automation is aimed at the wrong processes. Recommendations appear in the wrong context. Systems respond to incomplete or misleading signals. The result is friction, not transformation. Organisations that have meaningful visibility into how work actually happens, and where it slows down, can identify where AI would make a measurable difference.
What it means for you

Daily Tech Digest - October 03, 2025

Quote for the day:

"Success is the progressive realization of a worthy goal or ideal." -- Earl Nightingale

AI And The End Of Progress? Why Innovation May Be More Fragile Than We Think

“If progress was inevitable, the first industrial revolution would have happened a lot earlier,” he explained in our recent conversation. “And if progress was inevitable, most countries around the world would be rich and prosperous today.” Many societies have seen periods of intense innovation followed by stagnation or collapse. Ancient cities such as Ephesus once thrived and then disappeared. The Soviet Union industrialized rapidly but failed to keep up when the computer era began. ... Artificial intelligence sits squarely at the center of this fragile transition. Early breakthroughs, from transformers to generative AI, came from open experimentation in universities and small labs. ... Many organizations are using AI primarily for process automation and cost-cutting. Frey believes this will not deliver transformative growth. “If AI means we do email and spreadsheets a bit more efficiently and ease the way we book travel, the transformation is not going to be on par with electricity or the internal combustion engine,” he said. True prosperity comes from creating new industries and doing previously inconceivable things. ... “If you want to thrive as a business in the AI revolution, you need to give people at low levels of the organization more decision-making autonomy to actually implement the improvements they are finding for themselves,” he said.

Why every manager should have trauma literacy

Trauma literacy is the ability to recognize that unhealed past experiences show up in daily behavior and to respond in ways that foster safety and resilience. You don’t need to know someone’s history to be mindful of trauma’s effects. You just need to assume that trauma exists, and that it may be shaping how people show up at work. ... Managers are trained in financial strategy, forecasting, and performance management. But few are trained to recognize the external manifestations of what I felt back in that tech office: the racing heart, the sense of dread, and the silent withdrawal. Most workers are taught to push harder instead of pausing to hold space for emotions. Emotions are messy, and it often feels safer to stick with technical tasks and leave feelings unaddressed. ... Once someone shares something vulnerable, don’t rush to fix it or dismiss it. Just reflect it back: “Thanks for sharing that, I hear you,” or “That makes a lot of sense.” From there, you might ask, “Is there anything you need from me today?” or “Would it help to adjust your workload this week?” ... Trauma literacy isn’t a one-off conversation; it’s a culture. Build in rituals for reflection, adjust workloads proactively, and allocate time and resources toward psychological safety. When resilience is designed into structures, managers don’t have to rely on intuition alone.

Botnets are getting smarter and more dangerous

They don’t stop at automation. Natural language processing can be used to generate convincing phishing emails at scale. Reinforcement learning lets malware adjust strategies based on firewall responses. Image recognition can help bots evade visual CAPTCHAs. These capabilities give attackers a terrifying new playbook, one that relies less on scale and more on sophistication. What makes this trend especially insidious is that botnets can now be smaller and stealthier than ever. Instead of infecting millions of devices to overwhelm a system, an AI-driven botnet might only need a few thousand nodes to carry out highly targeted, surgical operations. That makes detection harder, attribution fuzzier and mitigation more complex. ... A compromised software development kit or node package manager can serve as a delivery mechanism for an AI-powered botnet, enabling it to infiltrate thousands of businesses in a single attack. From there, the botnet doesn’t just wait for instructions; it scouts, learns and adapts. IOT devices remain another massive vulnerability. ... The regulatory angle is becoming more critical as well. As botnet sophistication grows, governments and commercial organizations are being forced to reconsider their cybercrime frameworks. The blurred line between AI research and weaponization is becoming a legal gray zone. Will training a model to bypass CAPTCHA become criminalized? What about selling an AI model that can autonomously scan for zero-day exploits?

From Spend to Strategy: A CISO's View

Company executives view cybersecurity as a core business risk, but CISOs must communicate risk in a similar capacity to other risk functions through heat maps. These heat maps communicate the likelihood of a security incident impacting what matters most to the business - which includes key business capabilities, critical systems and services, and core locations or facilities - and the materiality of such an impact. Using these heat maps, CISOs can and should show the progress made in terms of reducing incident likelihood and impact, the progress expected to be made over the coming reporting period, and gaps that require additional funding to reduce corresponding risks to an acceptable level. From a security spend perspective, this means explaining to leadership how the function will deliver better business outcomes, not only with more budget but also with reallocated funding that can help create better ROI. CISOs must be prepared to answer inbound questions, such as: Haven't we already invested in this? What are you able to deliver with 20% more budget for these new capabilities that you weren't able to deliver before? Staying away from highly technical metrics like vulnerability counts with no direct correlation to business risk must be avoided at all costs. It's about helping executives understand the progress being made and soon to be made, along with gaps tied to reducing risk related to what the business cares about most.

The Future of Data Center Security: What Businesses Must Know

Unlike in the past, when cyberattacks mainly targeted networks, today’s hackers combine online attacks with physical sabotage in what is known as the “dual-attack model.” For example, while a cybercriminal tries to breach a network firewall, another may attempt to disable equipment physically inside the data center building. This coordinated attack can cause far-reaching damage. ... Alongside security, power management is a top priority. Indian data centers face rising energy demands. Reports show rack power consumption is climbing steadily, especially for AI workloads. Mumbai and Hyderabad, leading India’s AI data center growth, are investing in advanced cooling technologies and reliable backup energy systems to ensure smooth operations and prevent downtime. Failures in cooling or power systems can cause major outages that result in millions in losses. ... Cybersecurity experts also warn that more attacks today are concealed within encrypted network traffic, bypassing traditional firewalls. To counter this, Indian data centers are adopting tools that decrypt, inspect, and then re-encrypt data communications in real time. ... Indian companies must act decisively to implement next-generation security measures. Those that do will benefit from uninterrupted operations, stronger compliance, and gain a competitive edge in an increasingly digital economy.

4 ways to use time to level up your security monitoring

Most security events start small. You notice a few unusual logins, a traffic spike or abnormal activities in a certain system. Where raw log pipelines add parsing or enrichment delays before data is ready for analysis, time series arrives consistently structured and ready for immediate querying. This makes it easier to establish behavioral baselines and even apply statistical models like rolling averages and standard deviations to detect anomalies quickly. ... Detection is only half the battle. Time series systems handle low-latency ingest, allowing alerts and triggers to be fired in real-time as new data points arrive. When a device needs to be quarantined, access tokens revoked or an attacker’s behavior spun up into a forensics workflow to prevent lateral movement, it can do so in real-time. Because most SaaS log platforms batch and index events before they are fully queryable, SIEM-driven responses can lag by minutes, depending on configuration and data volume. Time series systems process data points in real-time, reducing that lag. ... SIEMs remain indispensable, and logs are foundational for investigations and compliance. High-precision time series, continuously ingested and analyzed, enables faster detection, longer retention and real-time response. All without the cost and performance tradeoffs of relying on logs alone.

The Leadership Style That’s Winning in the AI Era

Technology can generate ideas and reinforce existing thinking, but it cannot replace authentic human connection. Quiet leaders understand this instinctively: They build credibility through genuine relationships, not algorithms. These leaders share a common set of principles and practices that guide how they work and show up for their teams ... Respect grows when leaders admit their limitations, take responsibility for mistakes and remain grounded. Employees appreciate leaders who share when they don’t have all the answers and ask others to contribute to solutions. This kind of openness increases their credibility and influence. ... The best leaders treat all conversations as learning opportunities. A curious leader doesn’t jump to conclusions or cut discussions short. They ask thoughtful questions and listen actively, signaling to their teams that their input matters. This kind of curiosity encourages innovation and creates space for better ideas to surface. ... Rather than seeking credit, quiet leaders focus on building organizations that thrive beyond any one individual. They delegate, ensuring that their team can take real ownership of projects and celebrate success together. ... Leaders who engage in the day-to-day work of the business gain credibility and insight. Whether it’s walking the production floor or sitting on customer service calls, this engagement deepens the understanding of the business, the customer experience and the challenges team members face.

How autonomous businesses succeed by engaging with the world

Autonomous machines are designed from the outside in, while conventional machines are designed from the inside out. We are witnessing a fundamental shift in how successful systems are designed, and agentic AI sits at the heart of this revolution. Today, businesses are being designed more and more to resemble machines. ... For companies becoming autonomous machines, this outside-in orientation has profound implications for how they think about customers, markets, and value creation. Traditional companies are often internally focused. They design products based on their capabilities, organize around their processes, and optimize for efficiency. Customers are external entities who hopefully will want what the company produces. The company's internal logic, its org chart, processes, and systems become the center of attention, with customers orbiting around these internal priorities. ... Autonomous companies must be world-oriented rather than center-oriented. Customers represent the primary external environment they need to understand and respond to, but they're not a center to be served; they're part of a dynamic world to be engaged with. Just as a Tesla can't function without sophisticated environmental sensing, an autonomous company can't function without a deep, real-time understanding of customer needs, behaviors, and changing requirements.

Indian factories and automation: The ‘everything bagel’ is here

True competitiveness in manufacturing now hinges on integrating automation right from the design stage and not just on the assembly floor, indicates Krishnamoorthy. “By connecting CAD environments with robots friendly jigs, manufacturers can reduce programming times by 30 per cent, speeding up product launches and boosting agility in responding to market demands.” You can now walk around a plant inside your computer- thanks to the power of modelling technology. ... As attractive and revolutionary this advent of automation is, some holes still remain to be looked into. Like labor replacement, robot taxes, turbulence in brownfield facilities and accidents due to automation changing so much in the factories. Dai avers that automation may displace low-skill jobs but will address labor shortages. As to Robot taxes, they will become a norm in the long term amid the rise of robotics to balance innovation and social disruption. “Robotics governance is becoming increasingly critical to ensure security, privacy, ethics, and regulatory compliance.” He feels. ... “The future of robotics in manufacturing is about more than efficiency gains—it is about reshaping industrial culture, building resilience, and redefining global competitiveness. India, with its rapid adoption and supportive ecosystem, is not just catching up but positioning itself as a potential leader in this next era of intelligent manufacturing.” Captures Krishnamoorthy.

Old-school engineering lessons for AI app developers

Models keep getting smarter; apps keep breaking in the same places. The gap between demo and durable product remains the place where most engineering happens. How are development teams breaking the impasse? By getting back to basics. ... When data agents fail, they often fail silently—giving confident-sounding answers that are wrong, and it can be hard to figure out what caused the failure.” He emphasizes systematic evaluation and observability for each step an agent takes, not just end-to-end accuracy. ... The teams that win treat knowledge as a product. They build structured corpora, sometimes using agents to lift entities and relations into a lightweight graph. They grade their RAG systems like a search engine: on freshness, coverage, and hit rate against a golden set of questions. ... As Valdarrama quips, “Letting AI write all of my code is like paying a sommelier to drink all of my wine.” In other words, use the machine to accelerate code you’d be willing to own; don’t outsource judgment. In practice, this means developers must tighten the loop between AI-suggested diffs and their CI and enforce tests on any AI-generated changes, blocking merges on red builds ... And then there’s security, which in the age of generative AI has taken on a surreal new dimension. The same guardrails we put on AI-generated code must be applied to user input, because every prompt should be treated as potentially hostile.

Daily Tech Digest - October 02, 2025

Quote for the day:

"Success is the progressive realization of predetermined, worthwhile, personal goals." -- Paul J. Meyer

AI cost overruns are adding up — with major implications for CIOs

Many organizations appear to be “flying blind” while deploying AI, adds John Pettit, CTO at Google Workspace professional services firm Promevo. If a CIO-led AI project misses budget by a huge margin, it reflects on the CIO’s credibility, he adds. “Trust is your most important currency when leading projects and organizations,” he says. “If your AI initiative costs 50% more than forecast, the CFO and board will hesitate before approving the next one.” ... Beyond creating distrust in IT leadership, missed cost estimates also hurt the company’s bottom line, notes Farai Alleyne, SVP of IT operations at accounts payable software vendor Billtrust. “It is not just an IT spending issue, but it could materialize into an overall business financials issue,” he says. ... enterprise leaders often assume AI coding assistants or no-code/low-code tools can take care of most of the software development needed to roll out a new AI tool. These tools can be used to create small prototypes, but for enterprise-grade integrations or multi-agent systems, the complexity creates additional costs, he says. ... In addition, organizations often underestimate the cost of operating an AI project, he says. Token usage for vectorization and LLM calls can cost tens of thousands of dollars per month, but hosting your own models isn’t cheap, either, with on-premises infrastructure costs potentially running into the thousands of dollars per month.

AI-Powered Digital Transformation: A C-Suite Blueprint For The Future Of Business

At its core, digital transformation is a strategic endeavor, not a technological one. To succeed, it should be at the forefront of the organizational strategy. This means moving beyond simply automating existing processes and instead asking how AI enables new ways of creating value. The shift is from operational efficiency to business model innovation. ... True digital leaders possess a visionary mindset and the critical competencies to guide their teams through change. They must be more than tech-savvy; they must be emotionally intelligent and capable of inspiring trust. This demands an intentional effort to develop leaders who can bridge the gap between deep business acumen and digital fluency. ... With the strategic, cultural and data foundations in place, organizations can focus on building a scalable and secure digital infrastructure. This may involve adopting cloud computing to provide flexible resources needed for big data processing and AI model deployment. It can also mean investing in a range of complementary technologies that, when integrated, create a cohesive and intelligent ecosystem. ... Digital transformation is a complex, continuous journey, not a single destination. This framework provides a blueprint, but its success requires leadership. The challenge is not technological; it's a test of leadership, culture and strategic foresight.

Why Automation Fails Without the Right QA Mindset

Automation alone doesn’t guarantee quality — it is only as effective as the tests it is scripted to run. If the requirements are misunderstood, automated tests may pass while critical issues remain undetected. I have seen failures where teams relied solely on automation without involving proper QA practices, leading to tests that validated incorrect behavior. Automation frequently fails to detect new or unexpected issues introduced by system upgrades. It often misses critical problems such as faulty data mapping, incomplete user interface (UI) testing and gaps in test coverage due to outdated scripts. Lack of adaptability is another common obstacle that I’ve repeatedly seen undermine automation testing efforts. When UI elements are tightly coupled, even minor changes can disrupt test cases. With the right QA mindset, this challenge is anticipated — promoting modular, maintainable automation strategies capable of adapting to frequent UI and logic changes. Automation lacks the critical analysis required to validate business logic and perform true end-to-end testing. From my experience, the human QA mindset proved essential during the testing of a mortgage loan calculation system. While automation handled standard calculations and data validation, it could not assess whether the logic aligned with real-world lending rules.

Stop Feeding AI Junk: A Systematic Approach to Unstructured Data Ingestion

Worse, bad data reduces accuracy. Poor quality data not only adds noise, but it also leads to incorrect outputs that can erode trust in AI systems. The result is a double penalty: wasted money and poor performance. Enterprises must therefore treat data ingestion as a discipline in its own right, especially for unstructured data. Many current ingestion methods are blunt instruments. They connect to a data source and pull in everything, or they rely on copy-and-sync pipelines that treat all data as equal. These methods may be convenient, but they lack the intelligence to separate useful information from irrelevant clutter. Such approaches create bloated AI pipelines that are expensive to maintain and impossible to fine-tune. ... Once data is classified, the next step is to curate it. Not all data is equal. Some information may be outdated, irrelevant, or contradictory. Curating data means deliberately filtering for quality and relevance before ingestion. This ensures that only useful content is fed to AI systems, saving compute cycles and improving accuracy. This also ensures that RAG and LLM solutions can utilize their context windows on tokens for relevant data and not get cluttered up with irrelevant junk. ... Generic ingestion pipelines often lump all data into a central bucket. A better approach is to segment data based on specific AI use cases.

Five critical API security flaws developers must avoid

Developers might assume that if an API endpoint isn’t publicly advertised, it’s inherently secure, a dangerous myth known as “security by obscurity.” This mistake manifests in a few critical ways: developers may use easily guessable API keys or leave critical endpoints entirely unprotected, allowing anyone to access them without proving their identity. ... You must treat all incoming data as untrusted, meaning all input must be validated on the server-side. Your developers should implement comprehensive server-side checks for data types, formats, lengths, and expected values. Instead of trying to block everything that is bad, it is more secure to define precisely what is allowed. Finally, before displaying or using any data that comes back from the API, ensure it is properly sanitized and escaped to prevent injection attacks from reaching end-users. ... Your teams must adhere to the “only what’s necessary” principle by designing API responses to return only the absolute minimum data required by the consuming application. For production environments, configure systems to suppress detailed error messages and stack traces, replacing them with generic errors while logging the specifics internally for your team. ... Your security strategy must incorporate rate limiting to apply strict controls on the number of requests a client can make within a given timeframe, whether tracked by IP address, authenticated user, or API key.

Disaster recovery and business continuity: How to create an effective plan

If your disaster recovery and business continuity plan has been gathering dust on the shelf, it’s time for a full rebuild from the ground up. Key components include strategies such as minimum viable business (MVB); emerging technologies such as AI and generative AI; and tactical processes and approaches such as integrated threat hunting, automated data discovery and classification, continuous backups, immutable data, and gamified tabletop testing exercises. Backup-as-a-service (BaaS) and disaster recovery-as-a-service (DRaaS) are also becoming more popular, as enterprises look to take advantage of the scalability, cloud storage options, and ease-of-use associated with the “as-a-service” model. ... Accenture’s Whelan says that rather than try to restore the entire business in the event of a disaster, a better approach might be to create a skeletal replica of the business, an MVB, that can be spun up immediately to keep mission-critical processes going while traditional backup and recovery efforts are under way. ... The two additional elements are: one offline, immutable, or air-gapped backup that will enable organizations to get back on their feet in the event of a ransomware attack, and a goal of zero errors. Immutable data is “the gold standard,” Whelan says, but there are complexities associated with proper implementation.

Building Intelligence into the Database Layer

At the core of this evolution is the simple architectural idea of the database as an active intelligence engine. Rather than simply recording and serving historical data, an intelligent database interprets incoming signals, transforms them in real-time, and triggers meaningful actions directly from within the database layer. From a developer’s perspective, it still looks like a database, but under the hood, it’s something more: a programmable, event-driven system designed to act on high-velocity data streams with intense precision in real-time. ... Built-in processing engines unlock features like anomaly detection, forecasting, downsampling, and alerting in true real-time. These embedded engines enable real-time computation directly inside the database. Instead of moving data to external systems for analysis or automation, developers can run logic where the data already lives. ... Active intelligence doesn’t just enable faster reactions; it opens the door to proactive strategies. By continuously analyzing streaming data and comparing it to historical trends, systems can anticipate issues before they escalate. For example, gradual changes in sensor behavior can signal the early stages of a failure, giving teams time to intervene. ... Developers need more than just storage and query, they need tools that think. Embedding intelligence into the database layer represents a shift toward active infrastructure: systems that monitor, analyze, and respond at the edge, in the cloud, and across distributed environments.

AI Cybersecurity Arms Race: Are Companies Ready?

Security operations centers were already overwhelmed before AI became mainstream. Human analysts, drowning in alerts, can’t possibly match the velocity of machine-generated threats. Detection tools, built on static signatures and rules, simply can’t keep up with attacks that mutate continuously. The vendor landscape isn’t much more reassuring. Every security company now claims its product is “AI-powered,” but too many of these features are black boxes, immature, or little more than marketing gloss. ... That doesn’t mean defenders are standing still. AI is beginning to reshape cybersecurity on the defensive side, too, and the potential is enormous. Anomaly detection, fueled by machine learning, is allowing organizations to spot unusual behavior across networks, endpoints, and cloud environments far faster than humans ever could. In security operations centers, agentic AI assistants are beginning to triage alerts, summarize incidents, and even kick off automated remediation workflows. ... The AI arms race isn’t something the CISO can handle alone; it belongs squarely in the boardroom. The challenge isn’t just technical — it’s strategic. Budgets must be allocated in ways that balance proven defenses with emerging AI tools that may not be perfect but are rapidly becoming necessary. Security teams must be retrained and upskilled to govern, tune, and trust AI systems. Policies need to evolve to address new risks such as AI model poisoning or unintended bias.

Agentic AI needs stronger digital certificates

The consensus among practitioners is that existing technologies can handle agentic AI – if, that is, organisations apply them correctly from the start. “Agentic AI fits into well-understood security best practices and paradigms, like zero trust,” Wetmore emphasises. “We have the technology available to us – the protocols and interfaces and infrastructure – to do this well, to automate provisioning of strong identities, to enforce policy, to validate least privilege access.” The key is approaching AI agents with security-by-design principles rather than bolting on protection as an afterthought. Sebastian Weir, executive partner and AI Practice Leader at IBM UK&I, sees this shift happening in his client conversations. ... Perhaps the most critical insight from security practitioners is that managing agentic AI isn’t primarily about new technology – it’s about governance and orchestration. The same platforms and protocols that enable modern DevOps and microservices can support AI agents, but only with proper oversight. “Your ability to scale is about how you create repeatable, controllable patterns in delivery,” Weir explains. “That’s where capabilities like orchestration frameworks come in – to create that common plane of provisioning agents anywhere in any platform and then governance layers to provide auditability and control.”

Learning from the Inevitable

Currently, too many organizations follow a “nuke and pave” approach to IR, opting to just reimage computers because they don’t have the people to properly extract the wisdom from an incident. In the short term, this is faster and cheaper but has a detrimental impact on protecting against future threats. When you refuse to learn from past mistakes, you are more prone to repeating them. Conversely, organizations may turn to outsourcing. Experts in managed security services and IR have realized consulting gives them a broader reach and impact over the problem — but none of these are long-term solutions. This kind of short-sighted IR creates a false sense of security. Organizations are solving the problem for the time being, but what about the future? Data breaches are going to happen, and reliance on reactive problem-solving creates a flimsy IR program that leaves an organization vulnerable to threats. ... Knowledge-sharing is the best way to go about this. Sharing key learnings from previous attacks is how these teams can grow and prevent future disasters. The problem is that while plenty of engineers agree they learn the most when something “breaks” and that incidents are a treasure trove of knowledge for security teams, these conversations are often restricted to need-to-know channels. Openness about incidents is the only way to really teach teams how to address them.

Daily Tech Digest - September 30, 2025

Quote for the day:

"There is only one success – to be able to spend your life in your own way." -- Christopher Morley

Smoothing out AI’s rough edges

When data agents fail, they often fail silently—giving confident-sounding answers that are wrong, and it can be hard to figure out what caused the failure.” He emphasizes systematic evaluation and observability for each step an agent takes, not just end-to-end accuracy. We may like the term “vibe coding,“ but smart developers are forcing the rigor of unit tests, traces, and health checks for agent plans, tools, and memory. ... The teams that win treat knowledge as a product. They build structured corpora, sometimes using agents to lift entities and relations into a lightweight graph. They grade their RAG systems like a search engine: on freshness, coverage, and hit rate against a golden set of questions. Chunking isn’t just a library default; it’s an interface that needs to be designed with named hierarchies, titles, and stable IDs. ... It’s not without complications, though, and there’s a risk of too much delegation. As Valdarrama quips, “letting AI write all of my code is like paying a sommelier to drink all of my wine.” In other words, use the machine to accelerate code you’d be willing to own; don’t outsource judgment. In practice, this means developers must tighten the loop between AI-suggested diffs and their CI and enforce tests on any AI-generated changes, blocking merges on red builds ... We‘re not just talking about traditional vulnerabilities.

The EU AI Act: From the experts themselves

For businesses deploying AI systems, the cost of non-compliance is steep: penalties of up to €35 million or 7% of global turnover are on the table. But some experts believe the real challenge lies in how this framework interacts with competing global approaches. As Darren Thomson, field CTO EMEAI at Commvault, points out, “The EU AI Act is a comprehensive, legally binding framework that clearly prioritises regulation of AI, transparency, and prevention of harm.” ... “The EU AI Act has a clear common purpose to reduce the risk to end users. By prohibiting a range of high-risk applications of AI techniques, the risk of unethical surveillance and other means of misuse is certainly mitigated.” The requirement for impact assessments on high-risk systems isn’t a tick-box exercise and under the Act, organisations deploying high-impact AI systems must carry out rigorous risk assessments before those systems can reach end users. ... Businesses building or deploying AI systems in the EU can’t afford to ignore the AI Act. Understanding risk level and assessing whether your use of AI falls into a high-risk category is a crucial first step to compliance. Companies must also prepare for scrutiny, this is best done by documenting AI systems, auditing them regularly, and staying prepared to conduct impact assessments.

Stop drifting through AI transformation: The design principles that actually work

If drift is our danger, then design must be our answer. But design cannot begin with blueprints alone. Tempting as it is, we cannot jump to solutions. ... The principles need to address fundamental issues to ensure that intelligent systems are designed and implemented to protect human value and values. Doing so, we must address several questions. How do we preserve human worth? How do we maintain diverse perspectives? How do we ensure accountability? How do we keep humans in control? ... The first and possibly most critical of these is that human dignity must be celebrated and not sacrificed for efficiency. There is a strong temptation to use AI to view people as overhead, processes as bottlenecks, and care as inefficiency. ... The second compass is pluralism over uniformity. Intelligent systems already threaten to divide us into private realities, each fed by personalized algorithms, while at the same time nudging us toward uniformity by narrowing what counts as knowledge. Either path is perilous. ... Thirdly, we must insist on transparency in AI as a condition of trust. Hidden systems corrode confidence. Even now, algorithms make choices that affect credit, hiring, parole and healthcare with little visibility into how those judgments are reached. As machine cognition seeps into every facet of life, opacity will only deepen the gulf between those who wield the systems and those who live with their consequences.

With AI Agents, 'Memory' Raises Policy and Privacy Questions

If deciding what an agent remembers is one problem, deciding how much authority you have over those memories is another. Here, three issues stand out: portability, accuracy, and retention. Each raises a different set of policy challenges, all tied to a deeper question: do you own your digital memories, or merely rent them? Imagine trying to leave your job but discovering your executive assistant is contractually barred from joining you. That’s the risk if memories cannot move with you from one AI platform to another. A simple copy-and-paste transfer would seem like common sense, but companies may resist: they can argue that the insights their systems have drawn from your data are proprietary, or that moving memories introduces security concerns. The reality is that restricting portability creates enormous “switching costs.” If moving to a rival agent means starting from scratch, users will be effectively locked in — a dynamic antitrust lawyers would recognize as a modern twist on classic market power. The fight over portability is therefore not only about convenience, but also about competition. A second issue is whether you can edit what your agent knows about you. Some changes may feel trivial: swapping your listed hometown, adjusting a phone number, maybe even knocking a few years off your official age. But once agents become conduits to doctors, insurers, banks, or government services, accuracy takes on legal weight.

The Under-Appreciated Sustainability Benefits of Colocation Data Centers

On balance, colocation data centers don’t always come out ahead on the sustainability front. Not all colocation facilities offer more efficient cooling and water management solutions. Some are just as inefficient in these areas as the typical private data center. Nor is there a guarantee that all colocation facilities will provide access to renewable energy, certainly not on a continuous basis. For this reason, businesses that can afford to invest in sustainability-friendly solutions inside their own data centers may find this a better approach than using colocation to improve sustainability. It’s important as well to consider the total cost. ... It’s worth noting as well that public cloud data centers are also usually more sustainable than private data centers. This is due mainly to the massive economies of scale of these facilities (they’re called “hyperscale data centers” for a reason), combined with the high utilization rates they achieve by renting IT infrastructure to tens of thousands of different customers using an IaaS model. That said, for companies focused on sustainability, there are reasons to prefer colocation facilities over the public cloud. Beyond the perhaps obvious fact that colocation offers much more control (because it allows businesses to deploy and manage their own servers, rather than renting servers from a public cloud), it’s also easier to track efficiency metrics inside a colocation facility.

Cyber risk quantification helps CISOs secure executive support

We often see with customers this frequent mistake: investing in security tools just for compliance, but not configuring or using them properly. This can give a false sense of security. Testing means making sure tools are not only in place but also set up and maintained to protect your business. Our best advice is to focus on investing in experienced professionals rather than relying solely on tools. While technology, including AI, continues to evolve, it cannot yet replace the expertise and judgment of seasoned cybersecurity engineers. Skilled people remain the foundation of a strong and resilient cybersecurity strategy. ... By translating cyber risks into financial terms, CISOs can help the board understand the impact. Instead of using broad categories like low, medium, or high, it’s more persuasive to show the potential financial exposures. When risks are presented in financial terms, CISOs can demonstrate how specific projects or investments make a difference. For instance, showing that a $100,000 investment in cybersecurity could lower ransomware risk exposure from $5 million to $1 million creates a compelling return on investment. This approach makes budget approval much more likely. With Cyber Risk Quantification, we can also benchmark a company with their peers on the market, which is also an argument toward the board and other executives.

Making your code base better will make your code coverage worse

You do zero financial assessment of what happens if one particular feature fails. You are treating every file as if they have equal value and each one must meet 80% percent code coverage. The file that encrypts user data? 80% code coverage required. The file that allows a user to upload their profile image? 80% code coverage required. ... There’s a lot of sub-optimal code out there. Your automated tests can only be as good as the code that it is used to validate. Your whole test strategy is only worth as much as the features that they validate. Adding a code coverage tool to a sub-optimal code base with the hopes that it will magically improve the quality of your application will not work. It’s also likely to make it a lot harder for your development team to make it better. ... As a code base evolves, opportunities present themselves to make improvements. One of the most common practices is to consolidate repeated code. Your code base might have one or more blocks of code that gets copied and pasted elsewhere. Having identical code in multiple places is generally regarded as bad practice, it makes sense to move that repeatedly used block into a single location. That shared code might still be in the same file or moved into a separate one. This is the principle of Don’t Repeat Yourself (DRY), as opposed to Write Every Time (WET) code. Making your code DRYer is generally accepted as a good thing. Yet this comes at the cost of declining code coverage. Here are some hypothetical numbers.

Build Smart, Test Often: A Developer's Guide to AI Readiness

AI innovation is uncertain. New models, protocols and approaches to AI continue to emerge, making it difficult for organizations to adapt and keep pace. While jumping in blindly risks failure, waiting too long risks losing a competitive edge. ... Another hazard: Governance gaps create hidden risks. Without clear access controls and monitoring, AI systems can expose sensitive data or violate compliance requirements. That's why 79% of CIOs say they need strict governance in place to succeed with AI. However, as AI architectures grow more complex, they become harder to govern, limiting control and increasing enterprise risk. ... Many organizations silo experimentation and data control as if they are unrelated, but in reality, they reinforce each other. With data fragmentization, experiments can produce misleading results. Without a safe environment for experimentation, teams hesitate to deploy AI projects, even when they have the technical ability. ... The path to AI success is all about building the right foundation that enables both confident experimentation and rapid scaling. This starts with simplifying data architectures. Indeed, all surveyed enterprises are consolidating their AI tech stacks because fragmented systems create barriers to effective AI deployment. Teams with these data practices move faster because they can iterate without fear of catastrophic failures.

AI Quantisation: Reducing the cost of AI computation across the board

According to McKinsey’s research on AI empowerment organisations can achieve their complete AI value only when functional teams access powerful yet practical tools and models. Quantisation functions as a key method to connect the available solutions to practical applications. ... Quantisation has established itself as a powerful solution to tackle this problem. The process of quantisation simplifies AI model calculations by decreasing their numerical precision. Most models rely on 32-bit floating point numbers for accuracy, yet they rarely need such high precision for effective performance. Quantisation achieves memory reduction and computational load reduction by converting numbers into 8-bit or 4-bit formats. ... Quantisation-Aware Training involves adding precision limitations to the model’s training process. The training method produces models that maintain stable performance while being highly optimised , which makes it suitable for healthcare and automotive industries that require strict accuracy standards. Generalised Post-Training Quantisation or GPTQ has gained special importance when working with large language models. Through GPTQ methods, organisations can reduce their models to extremely low precision levels without compromising their advanced text understanding and generation capabilities.

How AI-driven automation is the key to unlocking your operational resilience

From IT outages to global crises, modern organizations increasingly require rapid, reliable response and recovery capabilities to keep their digital operations running and their people safe. To a great degree, ever-higher expectations for operational resilience must be met by significant advances in automation -- which leading solution providers are making possible by AI and machine learning. ... The real key? Automation. Sean stressed that true resilience comes from automating IT incident responses alongside business continuity plans. Without integration and automation, manual processes are the enemy of efficiency and cost-effectiveness. This raised the natural question: If automation is the end (the "what"), what are the means (the "how")? ... Sean explained how advanced technologies like AI and machine learning are essential engines driving this automation. xMatters offers native process automation in a single platform, handling everything from issue detection to resolution. ... With AI agents on the horizon, Sean painted a future where incident commanders oversee rather than micromanage, as bots handle troubleshooting, communication, and mitigation. This is the next evolution in making resilience a superpower for complex IT environments, complete with no-code flow designers and AIOps for proactive threat hunting.

Daily Tech Digest - September 29, 2025

Quote for the day:

"Remember that stress doesn't come from what is going on in your life. It comes from your thoughts on what is going on in your life." -- Andrew Bernstein

Agentic AI in IT security: Where expectations meet reality

The first decision regarding AI agents is whether to layer them onto existing platforms or to implement standalone frameworks. The add-on model treats agents as extensions to security information and event management (SIEM), security orchestration, automation and response (SOAR), or other security tools, providing quick wins with minimal disruption. Standalone frameworks, by contrast, act as independent orchestration layers, offering more flexibility but also requiring heavier governance, integration, and change management. ... Agentic AI adoption rarely happens overnight. As Checkpoint’s Weigman puts it, “Most security teams aren’t swapping out their whole SOC for some shiny new AI system, and one can understand that: It’s expensive, and it demands time and human effort, which at the end of the day could appear be too disruptive and costly.” Instead, leaders look for ways to incrementally layer new capabilities without jeopardizing ongoing operations, which makes pilots a common first step. ... “An agent designed to carry out a sequence of actions in response to a threat could inadvertently create new risks if misused or deployed inappropriately,” says Goje. “For instance, there’s potential for unregulated scripts or newly discovered vulnerabilities.” ... “Pricing remains a friction point,” says Fifthelement.ai’s Garini. “Vendors are playing with usage-based models, but organizations are finding value when they tie spend to analyst hours saved rather than raw compute or API calls.”

Anthropic, surveillance and the next frontier of AI privacy

Democratic legal systems are built on due process: Law enforcement must have grounds to investigate. Surveillance is meant to be targeted, not generalized. Allowing AI to conduct mass, speculative profiling would invert that principle, treating everyone as a potential suspect and granting AI the power to decide who deserves scrutiny. By saying “no” to this use case, Anthropic has drawn a red line. It is asserting that there are domains where the risk of harm to civil liberties outweighs the potential utility. ... How much should technology companies be able to control how their products are used, particularly once they are sold into government? Better yet, do they have a responsibility to ensure their products are used as intended? There is no easy answer. Enforcement of “terms of service” in highly sensitive contexts is notoriously difficult. A government agency may purchase access to an AI model and then apply it in ways that the provider cannot see or audit. ... The real challenge ahead is to establish publicly accountable frameworks that balance security needs with fundamental rights. Surveillance powered by AI will be more powerful, more scalable and more invisible than anything that came before. It has enormous potential when it comes to national security use cases. Yet without clear limits, it threatens to normalize perpetual, automated suspicion.

How attackers poison AI tools and defenses

AI systems that act with a high degree of autonomy carry another risk: impersonating users or trusting impostors. One tactic is known as a “Confused Deputy” attack. Here, an AI agent with high privileges performs a task on behalf of a low-privileged attacker. Another involves spoofed API access, where attackers trick integrations with services like Microsoft 365 or Gmail into leaking information or sending fraudulent emails. ... One crucial step is to make filters aware of how LLMs generate content, so they can flag anomalies in tone, behavior or intent that might slip past older systems. Another is to validate what AI systems remember over time. Without that check, poisoned data can linger in memory and influence future decisions. Isolation also matters. AI assistants should run in contained environments where unverified actions are blocked before they can cause damage. Identity management needs to follow the principle of least privilege, giving AI integrations only the access they require. Finally, treat every instruction with skepticism. Even routine requests must be verified before execution if zero-trust principles are to hold. ... The next wave of threats will involve agentic AI-powered systems that reason, plan and act on their own. While these tools can deliver tremendous productivity gains to users, their autonomy makes them attractive targets. If attackers succeed in steering an agent, the system could make decisions, launch actions or move data undetected.

‘AI and ML the main focus in tech right now’

AI and machine learning are undoubtedly the main focuses in technology right now, with mentions everywhere. A great way to upskill in this area is by attending talks and seminars, which are frequently held and provide valuable insights into how these technologies are being applied in the industry. These events also help you stay up to date on the latest developments. If you have a strong interest in the field, taking an online course, even a free one, can be a great way to grasp the fundamentals, learn the terminology, and understand how to effectively apply these technologies in your current role. Cloud technology is another area that’s here to stay. It’s widely adopted and incredibly versatile. Cloud certifications are highly accessible, with plenty of resources available to help you prepare for the exams and follow the learning paths they offer. ... Being a people person is incredibly beneficial in this field. A significant part of the job involves communication – whether it’s sharing ideas or networking with coworkers in your area. Building these connections can greatly enhance your ability to perform and succeed in your role. Problem-solving is another key aspect of software engineering, and it’s something I’ve always enjoyed. While it can be particularly challenging at times, the sense of accomplishment and reward when your efforts pay off is unmatched.

Better Data Beats Better Models: The Case for Data Quality in ML

Data quality is a broad and abstract concept, but it becomes more measurable when we break it down into different dimensions. Accuracy is the most important and obvious one: If the input data is wrong (e.g., mislabeled transactions in fraud detection models), the model will simply learn incorrect patterns. Completeness is equally important. Without a high degree of coverage for important features, the model will lack context and produce weaker predictions. For example, a recommender system missing key user attributes will fail to provide personalized recommendations. Freshness plays a subtle but powerful role in data quality. Outdated data appears correct, but does not reflect real-world conditions. ... Detecting data quality issues is not just about a single check but rather about continuous monitoring. Statistical distribution checks are the first line of defense, helping detect anomalies or sudden shifts that can indicate broken data pipelines. ... Ignoring data quality can often turn out to be very expensive. Teams spend large amounts of compute to retrain models on flawed data, to observe little to no business impact. Launch timelines get pushed back since teams spend weeks debugging data issues, a time that could have been spent otherwise on feature development. In industries that are regulated, like finance and healthcare, poor data quality can cause compliance violations and increased legal expenses.

DORA 2025: Faster, But Are We Any Better?

The newest DORA report — the “State of AI-Assisted Software Development” — lands at a time when AI is eating everything from code generation to documentation to operations. And just like those early DORA reports reframed speed versus stability, this one is reframing what AI is actually doing to our software delivery pipelines. Spoiler alert: It’s not as simple as “AI makes everything better.” ... Now here’s the counterintuitive part. For the first time, DORA shows AI adoption is linked to higher throughput. That’s right — teams using AI are moving work through the system faster than those who aren’t. But before you pop the champagne, look at the other half of the finding: Instability is still higher in AI-heavy teams. Faster, yes. Safer? Not so much. If you’ve been around the block, this won’t shock you. We saw the same thing in the early days of automation — speed without discipline just meant you hit the wall quicker. ... Another gem buried in the report is the role of value stream management. AI tends to deliver “local optimizations” — an engineer codes faster, a test suite runs quicker — but without VSM, those wins don’t always roll up into business outcomes. With VSM in place, AI-driven productivity gains translate into measurable improvements at the team and product level. That, to me, is vintage DORA. Remember when they proved that culture — psychological safety, autonomy, collaboration — wasn’t just a warm fuzzy HR concept but directly correlated with elite performance? Same here. VSM turns AI from a toy into a force multiplier.

The 5 Technology Trends For 2026 Everyone Must Prepare For Now

In recent years, we've seen industry, governments, education and everyday folk scrambling to adapt to the disruptive impact of AI. But by 2026, we're starting to get answers to some of the big questions around its effect on jobs, business and day-to-day life. Now, the focus shifts from simply reacting to reinventing and reshaping in order to find our place in this brave, different and sometimes frightening new world. ... In tech, agents were undoubtedly the hot buzzword of 2025, representing a meaningful evolution over previous AI applications like chatbots and generative AI. Rather than simply answering questions and generating content, agents take action on our behalf, and in 2026, this will become an increasingly frequent and normal occurrence in everyday life. From automating business decision-making to managing and coordinating hectic family schedules, AI agents will handle the “busy work” involved in planning and problem-solving, freeing us up to focus on the big picture or simply slowing down and enjoying life. ... Quantum computing harnesses the strange and seemingly counterintuitive behavior of particles at the sub-atomic level to accomplish many complex computing tasks millions of times faster than "classic" computers. For the last decade, there's been excitement and hype over their performance in labs and research environments, but in 2026, we are likely to see further adoption in the real world.

GreenOps and FinOps: Strategic Convergence in the Cloud Transformation Journey

FinOps, short for “Financial Operations,” is a cultural practice designed to bring financial accountability to the cloud. It blends engineering, finance, and business teams to manage cloud costs collaboratively and transparently. The goal is clear: maximize business value from the cloud by making spending decisions grounded in data and aligned with business objectives. ... GreenOps, on the other hand, is all about sustainability in cloud operations. It’s a discipline that encourages organizations to monitor, manage, and minimize the environmental footprint of their cloud usage. GreenOps revolves around using renewable energy-powered cloud resources, recycling or reusing digital assets, optimizing workloads, and selecting eco-friendly services, all with the aim of reducing carbon emissions and supporting broader sustainability goals. ... In practical terms, GreenOps activities such as deleting unused storage volumes, rightsizing virtual machines, and consolidating workloads not only shrink the carbon footprint but also slash monthly cloud bills. Thus, sustainability efforts act as “passive” cost optimizers—delivering FinOps benefits without explicit financial tracking. ... FinOps and GreenOps aren’t one-off projects but ongoing practices. Regular reviews, “cost and sustainability audits,” and optimization sprints keep teams focused.

Rethinking AI’s Role in Mental Health with GPT-5

GPT-5 has surfaced critical questions in the AI mental health community: What happens when people treat a general purpose chatbot as a source of care? How should companies be held accountable for the emotional effects of design decisions? What responsibilities do we bear, as a health care ecosystem, in ensuring these tools are developed with clinical guardrails in place? ... OpenAI has since taken steps to restore user confidence by making its personality “warmer and friendlier,” and encouraging breaks during extended sessions. However, it doesn’t change the fact that ChatGPT was built for engagement, not clinical safety. The interface may feel approachable, especially appealing to those looking to process feelings around high-stigma topics – from intrusive thoughts to identity struggles – but without thoughtful design, that comfort can quickly become a trap. ... Designing for engagement alone won’t get us there, and we must design for outcomes rooted in long-term wellbeing. At the same time, we should broaden our scope to include AI systems that shape the care experience, such as reducing the administrative burden on clinicians by streamlining billing, reimbursement, and other time-intensive tasks that contribute to burnout. Achieving this requires a more collaborative infrastructure to help shape what that looks like, and co-create technology with shared expertise from all corners of the industry including AI ethicists, clinicians, engineers, researchers, policymakers and users themselves.

Cybersecurity skills shortage: can upskilling close the talent gap?

According to reports, the global cybersecurity workforce gap exceeded 4 million professionals in 2023, with India alone requiring more than 500,000 skilled experts to meet current demand. This shortage is not merely a hiring challenge; it is a business risk. ... The traditional answer to talent shortages has been to hire more people. But in cybersecurity, where demand far outstrips supply, hiring alone cannot solve the problem. Upskilling training existing employees to meet evolving requirements offers a sustainable solution. Upskilling is not about starting from scratch. It leverages existing talent pools, such as IT administrators, network engineers, or even software developers, and equips them with cybersecurity expertise. ... While technology plays a central role in cybersecurity, the human factor remains the ultimate line of defense. Many high-profile breaches stem not from technical weaknesses but from human errors such as phishing clicks or misconfigured systems. Upskilling programs must therefore go beyond technical mastery to also emphasise behavioral awareness, ethical responsibility, and decision-making under pressure. ... The cybersecurity talent gap is unlikely to vanish overnight. However, the organisations that will thrive are those that view the challenge not as a bottleneck but as an opportunity to reimagine workforce development. Upskilling is the most pragmatic path forward, enabling companies to build resilience, retain talent, and remain competitive in an era of escalating cyber risks.