Showing posts with label IoT. Show all posts
Showing posts with label IoT. Show all posts

Daily Tech Digest - July 31, 2025


Quote for the day:

"Listening to the inner voice & trusting the inner voice is one of the most important lessons of leadership." -- Warren Bennis


AppGen: A Software Development Revolution That Won't Happen

There's no denying that AI dramatically changes the way coders work. Generative AI tools can substantially speed up the process of writing code. Agentic AI can help automate aspects of the SDLC, like integrating and deploying code. ... Even when AI generates and manages code, an understanding of concepts like the differences between programming languages or how to mitigate software security risks is likely to spell the difference between the ability to create apps that actually work well and those that are disasters from a performance, security, and maintainability standpoint. ... NoOps — short for "no IT operations" — theoretically heralded a world in which IT automation solutions were becoming so advanced that there would soon no longer be a need for traditional IT operations at all. Incidentally, NoOps, like AppGen, was first promoted by a Forrester analyst. He predicted that, "using cloud infrastructure-as-a-service and platform-as-a-service to get the resources they need when they need them," developers would be able to automate infrastructure provisioning and management so completely that traditional IT operations would disappear. That never happened, of course. Automation technology has certainly streamlined IT operations and infrastructure management in many ways. But it has hardly rendered IT operations teams unnecessary.


Middle managers aren’t OK — and Gen Z isn’t the problem: CPO Vikrant Kaushal

One of the most common pain points? Mismatched expectations. “Gen Z wants transparency—they want to know the 'why' behind decisions,” Kaushal explains. That means decisions around promotions, performance feedback, or even task allocation need to come with context. At the same time, Gen Z thrives on real-time feedback. What might seem like an eager question to them can feel like pushback to a manager conditioned by hierarchies. Add in Gen Z’s openness about mental health and wellbeing, and many managers find themselves ill-equipped for conversations they’ve never been trained to have. ... There is a growing cultural narrative that managers must be mentors, coaches, culture carriers, and counsellors—all while delivering on business targets. Kaushal doesn’t buy it. “We’re burning people out by expecting them to be everything to everyone,” he says. Instead, he proposes a model of shared leadership, where different aspects of people development are distributed across roles. “Your direct manager might help you with your day-to-day work, while a mentor supports your career development. HR might handle cultural integration,” Kaushal explains. ... When asked whether companies should focus on redesigning manager roles or reshaping Gen Z onboarding, Kaushal is clear: “Redesign manager roles.”


New AI model offers faster, greener way for vulnerability detection

Unlike LLMs, which can require billions of parameters and heavy computational power, White-Basilisk is compact, with just 200 million parameters. Yet it outperforms models more than 30 times its size on multiple public benchmarks for vulnerability detection. This challenges the idea that bigger models are always better, at least for specialized security tasks. White-Basilisk’s design focuses on long-range code analysis. Real-world vulnerabilities often span multiple files or functions. Many existing models struggle with this because they are limited by how much context they can process at once. In contrast, White-Basilisk can analyze sequences up to 128,000 tokens long. That is enough to assess entire codebases in a single pass. ... White-Basilisk is also energy-efficient. Because of its small size and streamlined design, it can be trained and run using far less energy than larger models. The research team estimates that training produced just 85.5 kilograms of CO₂. That is roughly the same as driving a gas-powered car a few hundred miles. Some large models emit several tons of CO₂ during training. This efficiency also applies at runtime. White-Basilisk can analyze full-length codebases on a single high-end GPU without needing distributed infrastructure. That could make it more practical for small security teams, researchers, and companies without large cloud budgets.


Building Adaptive Data Centers: Breaking Free from IT Obsolescence

The core advantage of adaptive modular infrastructure lies in its ability to deliver unprecedented speed-to-market. By manufacturing repeatable, standardized modules at dedicated fabrication facilities, construction teams can bypass many of the delays associated with traditional onsite assembly. Modules are produced concurrently with the construction of the base building. Once the base reaches a sufficient stage of completion, these prefabricated modules are quickly integrated to create a fully operational, rack-ready data center environment. This “plug-and-play” model eliminates many of the uncertainties in traditional construction, significantly reducing project timelines and enabling customers to rapidly scale their computing resources. Flexibility is another defining characteristic of adaptive modular infrastructure. The modular design approach is inherently versatile, allowing for design customization or standardization across multiple buildings or campuses. It also offers a scalable and adaptable foundation for any deployment scenario – from scaling existing cloud environments and integrating GPU/AI generation and reasoning systems to implementing geographically diverse and business-adjacent agentic AI – ensuring customers achieve maximum return on their capital investment.


‘Subliminal learning’: Anthropic uncovers how AI fine-tuning secretly teaches bad habits

Distillation is a common technique in AI application development. It involves training a smaller “student” model to mimic the outputs of a larger, more capable “teacher” model. This process is often used to create specialized models that are smaller, cheaper and faster for specific applications. However, the Anthropic study reveals a surprising property of this process. The researchers found that teacher models can transmit behavioral traits to the students, even when the generated data is completely unrelated to those traits. ... Subliminal learning occurred when the student model acquired the teacher’s trait, despite the training data being semantically unrelated to it. The effect was consistent across different traits, including benign animal preferences and dangerous misalignment. It also held true for various data types, including numbers, code and CoT reasoning, which are more realistic data formats for enterprise applications. Remarkably, the trait transmission persisted even with rigorous filtering designed to remove any trace of it from the training data. In one experiment, they prompted a model that “loves owls” to generate a dataset consisting only of number sequences. When a new student model was trained on this numerical data, it also developed a preference for owls. 


How to Build Your Analytics Stack to Enable Executive Data Storytelling

Data scientists and analysts often focus on building the most advanced models. However, they often overlook the importance of positioning their work to enable executive decisions. As a result, executives frequently find it challenging to gain useful insights from the overwhelming volume of data and metrics. Despite the technical depth of modern analytics, decision paralysis persists, and insights often fall short of translating into tangible actions. At its core, this challenge reflects an insight-to-impact disconnect in today’s business analytics environment. Many teams mistakenly assume that model complexity and output sophistication will inherently lead to business impact. ... Many models are built to optimize a singular objective, such as maximizing revenue or minimizing cost, while overlooking constraints that are difficult to quantify but critical to decision-making. ... Executive confidence in analytics is heavily influenced by the ability to understand, or at least contextualize, model outputs. Where possible, break down models into clear, explainable steps that trace the journey from input data to recommendation. In cases where black-box AI models are used, such as random forests or neural networks, support recommendations with backup hypotheses, sensitivity analyses, or secondary datasets to triangulate your findings and reinforce credibility.


GDPR’s 7th anniversary: in the AI age, privacy legislation is still relevant

In the years since GDPR’s implementation, the shift from reactive compliance to proactive data governance has been noticeable. Data protection has evolved from a legal formality into a strategic imperative — a topic discussed not just in legal departments but in boardrooms. High-profile fines against tech giants have reinforced the idea that data privacy isn’t optional, and compliance isn’t just a checkbox. That progress should be acknowledged — and even celebrated — but we also need to be honest about where gaps remain. Too often GDPR is still treated as a one-off exercise or a hurdle to clear, rather than a continuous, embedded business process. This short-sighted view not only exposes organisations to compliance risks but causes them to miss the real opportunity: regulation as an enabler. ... As organisations embed AI deeper into their operations, it’s time to ask the tough questions around what kind of data we’re feeding into AI, who has access to AI outputs, and if there’s a breach – what processes we have in place to respond quickly and meet GDPR’s reporting timelines. Despite the urgency, there’s still a glaring gap of organisations that don’t have a formal AI policy in place, which exposes organisations to privacy and compliance risks that could have serious consequences. Especially when data loss prevention is a top priority for businesses.


CISOs, Boards, CIOs: Not dancing Tango. But Boxing.

CISOs overestimate alignment on core responsibilities like budgeting and strategic cybersecurity goals, while boards demand clearer ties to business outcomes. Another area of tension is around compliance and risk. Boards tend to view regulatory compliance as a critical metric for CISO performance, whereas most security leaders view it as low impact compared to security posture and risk mitigation. ... security is increasingly viewed as a driver of digital trust, operational resilience, and shareholder value. Boards are expecting CISOs to play a key role in revenue protection and risk-informed innovation, especially in sectors like financial services, where cyber risk directly impacts customer confidence and market reputation. In India’s fast-growing digital economy, this shift empowers security leaders to influence not just infrastructure decisions, but the strategic direction of how businesses build, scale, and protect their digital assets. Direct CEO engagement is making cybersecurity more central to business strategy, investment, and growth. ... When it comes to these complex cybersecurity subjects, the alignment between CXOs and CISOs is uneven and still maturing. Our findings show that while 53 per cent of CISOs believe AI gives attackers an advantage (down from 70 per cent in 2023), boards are yet to fully grasp the urgency. 


Order Out of Chaos – Using Chaos Theory Encryption to Protect OT and IoT

It turns out, however, that chaos is not ultimately and entirely unpredictable because of a property known as synchronization. Synchronization in chaos is complex, but ultimately it means that despite their inherent unpredictability two outcomes can become coordinated under certain conditions. In effect, chaos outcomes are unpredictable but bounded by the rules of synchronization. Chaos synchronization has conceptual overlaps with Carl Jung’s work, Synchronicity: An Acausal Connecting Principle. Jung applied this principle to ‘coincidences’, suggesting some force transcends chance under certain conditions. In chaos theory, synchronization aligns outcomes under certain conditions. ... There are three important effects: data goes in and random chaotic noise comes out; the feed is direct RTL; there is no separate encryption key required. The unpredictable (and therefore effectively, if not quite scientifically) unbreakable chaotic noise is transmitted over the public network to its destination. All of this is done at the hardware – so, without physical access to the device, there is no opportunity for adversarial interference. Decryption involves a destination receiver running the encrypted message through the same parameters and initial conditions, and using the chaos synchronization property to extract the original message. 


5 ways to ensure your team gets the credit it deserves, according to business leaders

Chris Kronenthal, president and CTO at FreedomPay, said giving credit to the right people means business leaders must create an environment where they can judge employee contributions qualitatively and quantitatively. "We'll have high performers and people who aren't doing so well," he said. "It's important to force your managers to review everyone objectively. And if they can't, you're doing the entire team a disservice because people won't understand what constitutes success." ... "Anyone shying away from measurement is not set up for success," he said. "A good performer should want to be measured because they're comfortable with how hard they're working." He said quantitative measures can be used to prompt qualitative debates about whether, for example, underperformers need more training. ... Stephen Mason, advanced digital technologies manager for global industrial operations at Jaguar Land Rover, said he relies on his talented IT professionals to support the business strategy he puts in place. "I understand the vision that the technology can help deliver," he said. "So there isn't any focus on 'I' or 'me.' Every session is focused on getting the team together and giving the right people the platform to talk effectively." Mason told ZDNET that successful managers lean on experts and allow them to excel.

Daily Tech Digest - July 21, 2025


Quote for the day:

"Absolute identity with one's cause is the first and great condition of successful leadership." -- Woodrow Wilson


Is AI here to take or redefine your cybersecurity role?

Unlike Thibodeaux, Watson believes the level-one SOC analyst role “is going to be eradicated” by AI eventually. But he agrees with Thibodeaux that AI will move the table stakes forward on the skills needed to land a starter job in cyber. “The thing that will be cannibalized first is the sort of entry-level basic repeatable tasks, the things that people traditionally might have cut their teeth on in order to sort of progress to the next level. Therefore, the skill requirement to get a role in cybersecurity will be higher than what it has been traditionally,” says Watson. To help cyber professionals attain AI skills, CompTIA is developing a new certification program called SecAI. The course will target cyber people who already have three to four years of experience in a core cybersecurity job. The curriculum will include practical AI skills to proactively combat emerging cyber threats, integrating AI into security operations, defending against AI-driven attacks, and compliance for AI ethics and governance standards. ... As artificial intelligence takes over a rising number of technical cybersecurity tasks, Watson says one of the best ways security workers can boost their employment value is by sharpening their human skills like business literacy and communication: “The role is shifting to be one of partnering and advising because a lot of the technology is doing the monitoring, triaging, quarantining and so on.”


5 tips for building foundation models for AI

"We have to be mindful that, when it comes to training these models, we're doing it purposefully, because you can waste a lot of cycles on the exercise of learning," he said. "The execution of these models takes far less energy and resources than the actual training." OS usually feeds training data to its models in chunks. "Building up the label data takes quite a lot of time," he said. "You have to curate data across the country with a wide variety of classes that you're trying to learn from, so a different mix between urban and rural, and more." The organisation first builds a small model that uses several hundred examples. This approach helps to constrain costs and ensures OS is headed in the right direction. "Then we slowly build up that labelled set," Jethwa said. "I think we're now into the hundreds of thousands of labelled examples. Typically, these models are trained with millions of labelled datasets." While the organization's models are smaller, the results are impressive. "We're already outperforming the existing models that are out there from the large providers because those models are trained on a wider variety of images," he said. "The models might solve a wider variety of problems, but, for our specific domain, we outperform those models, even at a smaller scale."


Reduce, re-use, be frugal with AI and data

By being more selective with the data included in language models, businesses can better control their carbon emissions, limiting energy to be spent on the most important resources. In healthcare, for example, separating the most up-to-date medical information and guidance from the rest of the information on that topic will mean safer, more reliable and faster responses to patient treatment. ... Frugal AI means adopting an intelligent approach to data that focuses on using the most valuable information only. When businesses have a greater understanding of their data, how to label it, identify it and which teams are responsible for its deletion, then the storage of single use data can be significantly reduced. Only then can frugal AI systems be put in place, allowing businesses to adopt a resource aware and efficient approach to both their data consumption and AI usage. It’s important to stress here though that frugal AI doesn’t mean that the end results are lesser or of a reduced impact of technology, it means that the data that goes into AI is concentrated, smaller but just as impactful. Think of it like making a drink with extra concentrated squash. Frugal AI is that extra concentrate squash that puts data efficiency, consideration and strategy at the centre of an organisation’s AI ambitions.


Cyber turbulence ahead as airlines strap in for a security crisis

Although organizations have acknowledged the need to boost spending, progress remains to be made and new measures adopted. Legacy OT systems, which often lack security features such as automated patching and built-in encryption, should be addressed as a top priority. Although upgrading these systems can be costly, it is essential to prevent further disruptions and vulnerabilities. Mapping the aviation supply chain helps identify all key partners, which is important for conducting security audits and enforcing contractual cybersecurity requirements. This should be reinforced with multi-layered perimeter defenses, including encryption, firewalls, and intrusion detection systems, alongside zero-trust network segmentation to minimize the risk of attackers moving laterally within networks. Companies should implement real-time threat monitoring and response by deploying intrusion detection systems, centralizing analysis with SIEM, and maintaining a regularly tested incident response plan to identify, contain, and mitigate cyberattacks. ... One of the most important steps is to train all staff, including pilots and ground crews, to recognize scams. Since recent security breaches have mostly relied on social engineering tactics, this type of training is essential. A single phone call or a convincing email can be enough to trigger a data breach. 


What Does It Mean to Be Data-Driven?

A data-driven organization understands the value of its data and the best ways to capitalize on that value. Its data assets are aligned with its goals and the processes in place to achieve those goals. Protecting the company’s data assets requires incorporating governance practices to ensure managers and employees abide by privacy, security, and integrity guidelines. In addition to proper data governance, the challenges to implementing a data-driven infrastructure for business processes are data quality and integrity, data integration, talent acquisition, and change management. ... To ensure the success of their increasingly critical data initiatives, organizations look to the characteristics that led to effective adoption of data-driven programs at other companies. Management services firm KPMG identifies four key characteristics of successful data-driven initiatives: leadership involvement, investments in digital literacy, seamless access to data assets, and promotion and monitoring. ... While data-as-a-service (DaaS) emphasizes the sale of external data, data as a product (DaaP) considers all of a company’s data and the mechanisms in place for moving and storing the data as a product that internal operations rely on. The data team becomes a “vendor” serving “customers” throughout the organization.


AI Needs a Firewall and Cloud Needs a Rethink

Hyperscalers dominate most of enterprise IT today, and few are willing to challenge the status quo of cloud economics, artificial intelligence infrastructure and cybersecurity architectures. But Tom Leighton, co-founder and CEO of Akamai, does just that. He argues that the cloud has become bloated, expensive and overly centralized. The internet needs a new kind of infrastructure that is distributed, secure by design and optimized for performance at the edge, Leighton told Information Security Media Group. From edge-native AI inference and API security to the world's first firewall for artificial intelligence, Akamai is no longer just delivering content - it's redesigning the future. ... Among the most notable developments Leighton discussed was a new product category: an AI firewall. "People are training models on sensitive data and then exposing them to the public. That creates a new attack surface," Leighton said. "AI hallucinates. You never know what it's going to do. And the bad guys have figured out how to trick models into leaking data or doing bad things." Akamai's AI firewall monitors prompts and responses to prevent malicious prompts from manipulating the model and to avoid leaking sensitive data. "It can be implemented on-premises, in the cloud or within Akamai's platform, providing flexibility based on customer preference. 


Human and machine: Rediscovering our humanity in the age of AI

In an era defined by the rapid advancement of AI, machines are increasingly capable of tasks once considered uniquely human. ... Ethical decision-making, relationship building and empathy have been identified as the most valuable, both in our present reality and in the AI-driven future. ... As we navigate this era of AI, we must remember that technology is a tool, not a replacement for humanity. By embracing our capacity for creativity, connection and empathy, we can ensure that AI serves to enhance our humanity, not diminish it. This means accepting that preserving our humanness sometimes requires assistance. It means investing in education and training that fosters critical thinking, problem-solving and emotional intelligence. It means creating workplaces that value human connection and collaboration, where employees feel supported and empowered to bring their whole selves to work. And it means fostering a culture that celebrates creativity, innovation and the pursuit of knowledge. At a time when seven out of every ten companies are already using AI in at least one business function, let us embrace the challenge of this new era with both optimism and intentionality. Let us use AI to build a better future for ourselves and for generations to come – a future where technology serves humanity, and where every individual has the opportunity to thrive.


‘Interoperable but not identical’: applying ID standards across diverse communities

Exchanging knowledge and experiences with identity systems to improve future ID projects is central to the concept of ID4Africa’s mission. At this year’s ID4Africa AGM in Addis Ababa, Ethiopia, a tension was more evident than ever before between the quest for transferable insights and replicable successes and the uniqueness of each African nation. Thales Cybersecurity and Digital Identity Field Marketing Director for the Middle East and Africa Jean Lindner wrote in an emailed response to questions from Biometric Update following the event that the mix of attendees reflected that “every African country has its own diverse history or development maturity and therefore unique legacy identity systems, with different constraints. Let us recognize here there is no unique quick-fix to country-specific hurdles,” he says. The lessons of one country can only benefit another to the extent that common ground is identified. The development of the concept of digital public infrastructure has mapped out some common ground, but standards and collaborative organizations have a major role to play. Unfortunately, Stéphanie de Labriolle, executive director services at the Secure Identity Alliance says “the widespread lack of clarity around standards and what compliance truly entails” was striking at this year’s ID4Africa AGM.


The Race to Shut Hackers out of IoT Networks

Considered among the weakest links in enterprise networks, IoT devices are used across industries to perform critical tasks at a rapid rate. An estimated 57% of deployed units "are susceptible to medium- or high-severity attacks," according to research from security vendor Palo Alto Networks. IoT units are inherently vulnerable to security attacks, and enterprises are typically responsible for protecting against threats. Additionally, the IoT industry hasn't settled on standardized security, as time to market is sometimes a priority over standards. ... 3GPP developed RedCap to provide a viable option for enterprises seeking a higher-performance, feature-rich 5G alternative to traditional IoT connectivity options such as low-power WANs (LPWANs). LPWANs are traditionally used to transmit limited data over low-speed cellular links at a low cost. In contrast, RedCap offers moderate bandwidth and enhanced features for more demanding use cases, such as video surveillance cameras, industrial control systems in manufacturing and smart building infrastructure. ... From a security standpoint, RedCap inherits strong capabilities in 5G, such as authentication, encryption and integrity protection. It can also be supplemented at application and device levels for a multilayered security approach.


Architecting the MVP in the Age of AI

A key aspect of architecting an MVP is forming and testing hypotheses about how the system will meet its QARs. Understanding and prioritizing these QARs is not an easy task, especially for teams without a lot of architecture experience. AI can help when teams provide context by describing the QARs that the system must satisfy in a prompt and asking the LLM to suggest related requirements. The LLM may suggest additional QARs that the team may have overlooked. For example, if performance, security, and usability are the top 3 QARs that a team is considering, an LLM may suggest looking at scalability and resilience as well. This can be especially helpful for people who are new to software architecture. ... Sometimes validating the AI’s results may require more skills than would be required to create the solution from scratch, just as is sometimes the case when seeing someone else’s code and realizing that it’s better than what you would have developed on your own. This can be an effective way to improve developers’ skills, provided that the code is good. AI can also help you find and fix bugs in your code that you may miss. Beyond simple code inspection, experimentation provides a means of validating the results produced by AI. In fact, experimentation is the only real way to validate it, as some researchers have discovered.

Daily Tech Digest - July 15, 2025


Quote for the day:

“Rarely have I seen a situation where doing less than the other guy is a good strategy.” -- Jimmy Spithill


CyberArk: Rise in Machine Identities Poses New Risks

The CyberArk report outlines the substantial business consequences of failing to protect machine identities, leaving organizations vulnerable to costly outages and breaches. Seventy-two percent of organizations experienced at least one certificate-related outage over the past year - a sharp increase compared to prior years. Additionally, 50% reported security incidents or breaches stemming from compromised machine identities. Companies that have experienced non-human identity security breaches include xAI, Uber, Schneider Electric, Cloudflare and BeyondTrust, among others. "Machine identities of all kinds will continue to skyrocket over the next year, bringing not only greater complexity but also increased risks," said Kurt Sand, general manager of machine identity security at CyberArk. "Cybercriminals are increasingly targeting machine identities - from API keys to code-signing certificates - to exploit vulnerabilities, compromise systems and disrupt critical infrastructure, leaving even the most advanced businesses dangerously exposed." ... Fifty percent of security leaders reported security incidents or breaches linked to compromised machine identities in the previous year. These incidents led to delays in application launches for 51% companies, customer-impacting outages for 44% and unauthorized access to sensitive systems for 43%.


What Can Businesses Do About Ethical Dilemmas Posed by AI?

Digital discrimination is a product of bias incorporated into the AI algorithms and deployed at various levels of development and deployment. The biases mainly result from the data used to train the large language models (LLMs). If the data reflects previous iniquities or underrepresents certain social groups, the algorithm has the potential to learn and perpetuate those iniquities. Biases may occasionally culminate in contextual abuse when an algorithm is used beyond the environment or audience for which it was intended or trained. Such a mismatch may result in poor predictions, misclassifications, or unfair treatment of particular groups. Lack of monitoring and transparency merely adds to the problem. In the absence of oversight, biased results are not discovered. ... Human-in-the-loop systems allow intervention in real time whenever AI acts unjustly or unexpectedly, thus minimizing potential harm and reinforcing trust. Human judgment makes choices more inclusive and socially sensitive by including cultural, emotional, or situational elements, which AI lacks. When humans remain in the loop of decision-making, accountability is shared and traceable. This removes ethical blind spots and holds users accountable for consequences.


Beyond the hype: AI disruption in India’s legal practice

The competitive dynamics are stark. When AI can complete a ten-hour task in two hours, firms face a pricing paradox: how to maintain profitability while passing efficiency gains to the clients? Traditional hourly billing models become unsustainable when the underlying time economics change dramatically. ... Effective AI integration hinges on a strong technological foundation, encompassing secure data architecture, advanced cybersecurity measures and a seamless and hassle-free interoperability between systems and already existing platforms. SAM’s centralised Harvey AI approach and CAM’s multi-tool strategy both imply significant investment in these backend capabilities. ... Merely automating existing workflows fails to leverage AI’s transformative potential. To unlock AI’s full transformative value, firms must rethink their legal processes – streamlining tasks, reallocating human resources to higher order functions and embedding AI at the core of decision-making processes and document production cycles. ... AI enables alternative service models that go beyond the billable hour. Firms that rethink on how they can price say, by offering subscription-based or outcome-driven services, and position themselves as strategic partners rather than task executors, will be best positioned to capture long-term client value in an AI-first legal economy.


‘Chronodebt’: The lose/lose situation few CIOs can escape

One needn’t be an expert in the field of technical architecture to know that basing a capability as essential as air traffic control on such obviously obsolete technology is a bad idea. Someone should lose their job over this. And yet, nobody has lost their job over this, nor should they have. That’s because the root cause of the FAA’s woes — poor chronodebt management, in case you haven’t been paying attention — is a discipline that’s rarely tracked by reliable metrics and almost-as-rarely budgeted for. Metrics first: While the discipline of IT project estimation is far from reliable, it’s good enough to be useful in estimating chronodebt’s remediation costs — in the FAA’s case what it would have to spend to fix or replace its integrations and the integration platforms on which those integrations rely. That’s good enough, with no need for precision. Those running the FAA for all these years could, that is, estimate the cost of replacing the programs used to export and update its repositories, and replacing the 3 ½” diskettes and paper strips on which they rely. But, telling you what you already know, good business decisions are based not just on estimated costs, but on benefits netted against those costs. The problem with chronodebt is that there are no clear and obvious ways to quantify the benefits to be had by reducing it.


Can System Initiative fix devops?

System Initiative turns traditional devops on its head. It translates what would normally be infrastructure configuration code into data, creating digital twins that model the infrastructure. Actions like restarting servers or running complex deployments are expressed as functions, then chained together in a dynamic, graphical UI. A living diagram of your infrastructure refreshes with your changes. Digital twins allow the system to automatically infer workflows and changes of state. “We’re modeling the world as it is,” says Jacob. For example, when you connect a Docker container to a new Amazon Elastic Container Service instance, System Initiative recognizes the relationship and updates the model accordingly. Developers can turn workflows — like deploying a container on AWS — into reusable models with just a few clicks, improving speed. The GUI-driven platform auto-generates API calls to cloud infrastructure under the hood. ... An abstraction like System Initiative could embrace this flexibility while bringing uniformity to how infrastructure is modeled and operated across clouds. The multicloud implications are especially intriguing, given the rise in adoption of multiple clouds and the scarcity of strong cross-cloud management tools. A visual model of the environment makes it easier for devops teams to collaborate based on a shared understanding, says Jacob — removing bottlenecks, speeding feedback loops, and accelerating time to value.


An exodus evolves: The new digital infrastructure market

Regulatory pressures have crystallised around concerns over reliance on a small number of US-based cloud providers. With some hyperscalers openly admitting that they cannot guarantee data stays within a jurisdiction during transfer, other types of infrastructure make it easier to maintain compliance with UK and EU regulations. This is a clear strategy to avoid future financial and reputational damage. ... 2025 is a pivotal year for digital infrastructure. Public cloud will remain an essential part of the IT landscape. But the future of data strategy lies in making informed, strategic decisions, leveraging the right mix of infrastructure solutions for specific workloads and business needs. As part of our research, we assessed the shape of this hybrid market. ... With one eye to the future, UK-based cloud providers must be positioned as a strategic advantage, offering benefits such as data sovereignty, regulatory compliance, and reduced latency. Businesses will need to situate themselves ever more precisely on the spectrum of digital infrastructure. Their location will reflect how they embrace a hybrid model that balances public cloud, private cloud, colocation and on-premise options. This approach will not only optimise performance and costs but also provide long-term resilience in an evolving digital economy.


How Trump's Cyber Cuts Dismantle Federal Information Sharing

"The budget cuts, personnel reductions and other policy changes have decreased the volume and frequency of CISA's information sharing activities in both formal and informal channels," Daniel told ISMG. While sector-specific ISACs still share information, threat sharing efforts tied to federal funding - such as the Multi-State ISAC, which supports state and local governments - "have been negatively affected," he said . One former CISA staffer who recently accepted the administration's deferred resignation offer told ISMG the agency's information-sharing efforts "were among the first to take a hit" from the administration's cuts, with many feeling pressured into silence. ... Analysts have also warned that cuts to cyber staff across federal agencies and risks to initiatives including the National Vulnerability Database and Common Vulnerabilities and Exposures program could harm cybersecurity far beyond U.S. borders. The CVE program is dealing with backlogs and a recent threat to shut down funding over a federal contracting issue. Failure of the CVE Program "would have wide impacts on vulnerability management efficiency and effectiveness globally," said John Banghart, senior director for cybersecurity services at Venable and a key architect of the Obama administration's cybersecurity policy as a former director for federal cybersecurity for the National Security Council.


Securing vehicles as they become platforms for code and data

Recently security researchers have demonstrated real-world attacks against connected cars, such as wireless brake manipulation on heavy trucks by spoofing J-bus diagnostic packets. Another very recent example is successful attacks against autonomous car LIDAR systems. While the distribution of EV and advanced cars becomes more pervasive across our society, we expect these types of attacks and methods to continue to grow in complexity. Which makes a continuous, real-time approach to securing the entire ecosystem (from charger, to car, to driver) even more so important. ... Over-the-air (OTA) update hijacking is very real and often enabled by poor security design, such as lack of encryption, improper authentication between the car and backend, and lack of integrity or checksum validation. Attack vectors that the traditional computer industry has dealt with for years are now becoming a harsh reality in the automotive sector. Luckily, many of the same approaches used to mitigate these risks in IT can also apply here ... When we look at just the automobile, we have a variety of connected systems which typically all come from different manufacturers (Android Automotive, or QNX as examples) which increases the potential for supply chain abuse. We also have devices which the driver introduces which interacts with the car’s APIs creating new entry points for attackers.


Strategizing with AI: How leaders can upgrade strategic planning with multi-agent platforms

Building resiliency and optionality into a strategic plan challenges humans’ cognitive (and financial) bandwidth. The seemingly endless array of future scenarios, coupled with our own human biases, conspires to anchor our understanding of the future in what we’ve seen in the past. Generative AI (GenAI) can help overcome this common organizational tendency for entrenched thinking, and mitigate the challenges of being human, while exploiting LLMs’ creativity as well as their ability to mirror human behavioral patterns. ... In fact, our argument reflects our own experience using a multi-agent LLM simulation platform built by the BCG Henderson Institute. We’ve used this platform to mirror actual war games and scenario planning sessions we’ve led with clients in the past. As we’ve seen firsthand, what makes an LLM multi-agent simulation so powerful is the possibility of exploiting two unique features of GenAI—its anthropomorphism, or ability to mimic human behavior, and its stochasticity, or creativity. LLMs can role-play in remarkably human-like fashion: Research by Stanford and Google published earlier this year suggests that LLMs are able to simulate individual personalities closely enough to respond to certain types of surveys with 85% accuracy as the individuals themselves.


The Network Challenges of IoT Integration

IoT interoperability and compatible security protocols are a particular challenge. Although NIST and ISO, among other organizations, have issued IoT standards, smaller IoT manufacturers don't always have the resources to follow their guidance. This becomes a network problem because companies have to retool these IoT devices before they can be used on their enterprise networks. Moreover, because many IoT gadgets are delivered with default security settings that are easy to undo, each device has to be hand-configured to ensure it meets company security standards. To avoid potential interoperability pitfalls, network staff should evaluate prospective technology before anything is purchased. ... First, to achieve high QoS, every data pipeline on the network must be analyzed -- as well as every single system, application and network device. Once assessed, each component must be hand-calibrated to run at the highest performance levels possible. This is a detailed and specialized job. Most network staff don't have trained QoS technicians on board, so they must go externally for help. Second, which areas of the business get maximum QoS, and which don't? A medical clinic, for example, requires high QoS to support a telehealth application where doctors and patients communicate. 

Daily Tech Digest - June 18, 2025


Quote for the day:

"Build your own dreams, or someone else will hire you to build theirs." -- Farrah Gray



Agentic AI adoption in application security sees cautious growth

The study highlights a considerable proportion of the market preparing for broader adoption, with nearly 50% of respondents planning to integrate agentic AI tools within the next year. The incremental approach taken by organisations reflects a degree of caution, particularly around the concept of granting AI systems the autonomy to make decisions independently.  ... The survey results illustrate the impact agentic AI could have on software development pipelines. Thirty percent of respondents believe integrating agentic AI into continuous integration and continuous deployment (CI/CD) pipelines would significantly enhance the process. The increased speed and frequency of code deployment-termed "vibe coding" in industry parlance-has led to faster development cycles. This acceleration does not necessarily alter the ratio of application security personnel to developers, but it can create the impression of a widening gap, with security teams struggling to keep up. ... Key findings from the survey reveal varied perceptions on the utility of agentic AI for security teams. Forty-four percent of those surveyed believe agentic AI's greatest benefit lies in supporting the identification, prioritisation, and remediation of vulnerabilities. 


Why Conventional Disaster Recovery Won’t Save You from Ransomware

Cyber incident recovery planning means taking measures that mitigate the unique challenges of ransomware recovery, such as: Immutable, offsite backups. These backups are stored offsite to minimise the risk that threat actors will be able to destroy backup data. While clean-room recovery environments serve as a secondary environment where workloads can be spun back up following a ransomware attack. This makes it possible to keep the original environment intact for forensics purposes while still performing rapid recovery. Finally, to avoid replicating the malware that led to the ransomware breach, cyber incident recovery must include a process for finding and extricating malware from backups prior to recovery. The unpredictable nature of ransomware attacks means that cyber incident recovery operations must be flexible enough to enable a nimble reaction to unexpected circumstances, like redeploying individual applications instead of simply replicating an entire server image if the server was compromised but the apps were not. ... Maintaining these capabilities can be challenging, even for organisations with extensive IT resources. In addition to the operational complexity of having to manage a secondary, clean-room recovery site and formulate intricate ransomware recovery plans, it’s costly to acquire and maintain the infrastructure necessary to ensure successful recovery.


Cybersecurity takes a big hit in new Trump executive order

Specific orders Trump dropped or relaxed included ones mandating (1) federal agencies and contractors adopt products with quantum-safe encryption as they become available in the marketplace, (2) a stringent Secure Software Development Framework (SSDF) for software and services used by federal agencies and contractors, (3) the adoption of phishing-resistant regimens such as the WebAuthn standard for logging into networks used by contractors and agencies, (4) the implementation new tools for securing Internet routing through the Border Gateway Protocol, and (5) the encouragement of digital forms of identity. ... Critics said the change will allow government contractors to skirt directives that would require them to proactively fix the types of security vulnerabilities that enabled the SolarWinds compromise. "That will allow folks to checkbox their way through 'we copied the implementation' without actually following the spirit of the security controls in SP 800-218," Jake Williams, a former hacker for the National Security Agency who is now VP of research and development for cybersecurity firm Hunter Strategy, said in an interview. "Very few organizations actually comply with the provisions in SP 800-218 because they put some onerous security requirements on development environments, which are usually [like the] Wild West."


Mitigating AI Threats: Bridging the Gap Between AI and Legacy Security

AI systems, particularly those with adaptive or agentic capabilities, evolve dynamically, unlike static legacy tools built for deterministic environments. This inconsistency renders systems vulnerable to AI-focused attacks, such as data poisoning, prompt injection, model theft, and agentic subversion—attacks that often evade traditional defenses. Legacy tools struggle to detect these attacks because they don’t followpredictable patterns, requiring more adaptive, AI-specific security solutions. Human flaws and behavior only worsen these weaknesses; insider attacks, social engineering, and insecure interactions with AI systems leave organizations vulnerable to exploitation. ... AI security frameworks like NIST’s AI Risk Management Framework incorporate human risk management to ensure that AI security practices align with organizational policies. Also modeled on the fundamental C.I.A. triad, the “manage” phase specifically includes employee training to uphold AI security principles across teams. For effective use of these frameworks, cross-departmental coordination is required. There needs to be collaboration among security staff, data scientists, and human resource practitioners to formulate plans that ensure AI systems are protected while encouraging their responsible and ethical use.


Modernizing your approach to governance, risk and compliance

Historically, companies treated GRC as an obligation to meet–and if legacy solutions were effective enough in meeting GRC requirements, organizations struggled to make a case for modernization. A better way to think about GRC is a means of maximizing the value for your company by tying out those efforts to unlock revenue and increased customer trust, and not simply by reducing risks, passing audits, and staying compliant. GRC modernization can open the door to a host of other benefits, such as increased velocity of operations and an enhanced team member (both GRC team members and internal control / risk owners alike) experience. For instance, for businesses that need to demonstrate compliance to customers as part of third-party or vendor risk management initiatives, the ability to collect evidence and share it with clients faster isn’t just a step toward risk mitigation. These efforts also help close more deals and speed up deal cycle time and velocity. When you view GRC as an enabler of business value rather than a mere obligation, the value of GRC modernization comes into much clearer focus. This vision is what businesses should embrace as they seek to move away from legacy GRC strategies that don’t waste time and resources, but fundamentally reduce their ability to stay competitive.


What is Cyberespionage? A Detailed Overview

Cyber espionage involves the unauthorized access to confidential information, typically to gain strategic, political, or financial advantage. This form of espionage is rooted in the digital world and is often carried out by state-sponsored actors or independent hackers. These attackers infiltrate computer systems, networks, or devices to steal sensitive data. Unlike cyber attacks, which primarily target financial gain, cyber espionage is focused on intelligence gathering, often targeting government agencies, military entities, corporations, and research institutions. ... One of the primary goals of cyber espionage is to illegally access trade secrets, patents, blueprints, and proprietary technologies. Attackers—often backed by foreign companies or governments—aim to acquire innovations without investing in research and development. Such breaches can severely damage a competitor’s advantage, leading to billions in lost revenue and undermining future innovation. ... Governments and other organizations often use cyber espionage to gather intelligence on rival nations or political opponents. Cyber spies may breach government networks or intercept communications to secretly access sensitive details about diplomatic negotiations, policy plans, or internal strategies, ultimately gaining a strategic edge in political affairs.


European Commission Urged to Revoke UK Data Adequacy Decision Due to Privacy Concerns

The items in question include sweeping new exemptions that allow law enforcement and government agencies to access personal data, loosening of regulations governing automated decision-making, weakening restrictions on data transfers to “third countries” that are otherwise considered inadequate by the EU, and increasing the possible ways in which the UK government would have power to interfere with the regular work of the UK Data Protection Authority. EDRi also cites the UK Border Security, Asylum and Immigration Bill as a threat to data adequacy, which has passed the House of Commons and is currently before the House of Lords. The bill’s terms would broaden intelligence agency access to customs and border control data, and exempt law enforcement agencies from UK GDPR terms. It also cites the UK’s Public Authorities (Fraud, Error and Recovery) Bill, currently scheduled to go before the House of Lords for review, which would allow UK ministers to order that bank account information be made available without demonstrating suspicion of wrongdoing. The civil society group also indicates that the UK ICO would likely become less independent under the terms of the UK Data Bill, which would give the UK government expanded ability to hire, dismiss and adjust the compensation of all of its board members.


NIST flags rising cybersecurity challenges as IT and OT systems increasingly converge through IoT integration

Connectivity can introduce significant challenges for organizations attempting to apply cybersecurity controls to OT and certain IoT products. OT equipment may use modern networking technologies like Ethernet or Wi-Fi, but is often not designed to connect to the internet. In many cases, OT and IoT systems prioritize trustworthiness aspects such as safety, resiliency, availability, and cybersecurity differently than traditional IT equipment, which can complicate control implementation. While IoT devices can sometimes replace OT equipment, they often introduce different or significantly expanded functionality that organizations must carefully evaluate before moving forward with replacement. Organizations should consider how other aspects of trustworthiness, such as safety, privacy, and resiliency, factor into their approach to cybersecurity. It is also important to address how they will manage the differences in expected service life between IT, OT, and IoT systems and their components. The agency identified that federal agencies are actively deploying IoT technologies to enhance connectivity, security, environmental monitoring, transportation, healthcare, and industrial automation.


How Organizations Can Cross the Operational Chasm

A fundamental shift in operational capability is reshaping the competitive landscape, creating a clear distinction between market leaders and laggards. This growing divide isn’t merely about technological adoption — it represents a strategic inflection point that directly affects market position, customer retention and shareholder value. ... The message is clear: Organizations must bridge this divide to remain competitive. Crossing this chasm requires more than incremental improvements. It demands a fundamental transformation in operational approach, embracing AI and automation to build the resilience necessary for today’s digital landscape. ... Digital operations resiliency is a proactive approach to safeguarding critical business services by reducing downtime and ensuring seamless customer experiences. It focuses on minimizing operational disruptions, protecting brand reputation and mitigating business risk through standardized incident management, automation and compliance with service-level agreements (SLAs). Real-time issue resolution, efficient workflows and continuous improvement are put into place to ensure operational efficiency at scale, helping to provide uninterrupted service delivery. 


7 trends shaping digital transformation in 2025 - and AI looms large

Poor integration is the common theme behind all these challenges. If agents are unable to access the data and capabilities they need to understand user queries, find a solution, and resolve these issues for them, their impact is severely limited. As many as 95% of IT leaders claim integration issues are a key factor that impedes AI adoption. ... The surge in demand for AI capabilities will exacerbate the problem of API and agent sprawl, which occurs when different teams and departments build integrations and automations without any centralized management or coordination. Already, an estimated quarter of APIs are ungoverned. Three-fifths of IT and security practitioners said their organizations had at least one data breach due to API exploitation, according to a 2023 study from the Ponemon Institute and Traceable. ... Robotic process automation (RPA) is already helping organizations enhance efficiency, cut operational costs, and reduce manual toil by up to two hours for each employee every week in the IT department alone. These benefits have driven a growing interest in RPA. In fact, we could see near-universal adoption of the technology by 2028, according to Deloitte. In 2025, organizations will evolve their use of RPA technology to reduce the need for humans at every stage of the operational process. 

Daily Tech Digest - April 29, 2025


Quote for the day:

"Don't let yesterday take up too much of today." -- Will Rogers



AI and Analytics in 2025 — 6 Trends Driving the Future

As AI becomes deeply embedded in enterprise operations and agentic capabilities are unlocked, concerns around data privacy, security and governance will take center stage. With emerging technologies evolving at speed, a mindset of continuous adaptation will be required to ensure requisite data privacy, combat cyber risks and successfully achieve digital resilience. As organizations expand their global footprint, understanding the implications of evolving AI regulations across regions will be crucial. While unifying data is essential for maximizing value, ensuring compliance with diverse regulatory frameworks is mandatory. A nuanced approach to regional regulations will be key for organizations navigating this dynamic landscape. ... As the technology landscape evolves, continuous learning becomes essential. Professionals must stay updated on the latest technologies while letting go of outdated practices. Tech talent responsible for building AI systems must be upskilled in evolving AI technologies. At the same time, employees across the organization need training to collaborate effectively with AI, ensuring seamless integration and success. Whether through internal upskilling or embarking on skills-focused partnerships, investment in talent management will prove crucial to winning the tech-talent gold rush and thriving in 2025 and beyond.


Generative AI is not replacing jobs or hurting wages at all, say economists

The researchers looked at the extent to which company investment in AI has contributed to worker adoption of AI tools, and also how chatbot adoption affected workplace processes. While firm-led investment in AI boosted the adoption of AI tools — saving time for 64 to 90 percent of users across the studied occupations — chatbots had a mixed impact on work quality and satisfaction. The economists found for example that "AI chatbots have created new job tasks for 8.4 percent of workers, including some who do not use the tools themselves." In other words, AI is creating new work that cancels out some potential time savings from using AI in the first place. "One very stark example that it's close to home for me is there are a lot of teachers who now say they spend time trying to detect whether their students are using ChatGPT to cheat on their homework," explained Humlum. He also observed that a lot of workers now say they're spending time reviewing the quality of AI output or writing prompts. Humlum argues that can be spun negatively, as a subtraction from potential productivity gains, or more positively, in the sense that automation tools historically have tended to generate more demand for workers in other tasks. "These new job tasks create new demand for workers, which may boost their wages, if these are more high value added tasks," he said.


Advancing Digital Systems for Inclusive Public Services

Uganda adopted the modular open-source identity platform, MOSIP, two years ago. A small team of 12, with limited technical expertise, began adapting the MOSIP platform to align with Uganda's Registration of Persons Act, gradually building internal capacity. By the time the system integrator was brought in, Uganda incorporated digital public good, DPG, into its legal framework, providing the integrator with a foundation to build upon. This early customization helped shape the legal and technical framework needed to scale the platform. But improvements are needed, particularly in the documentation of the DPG. "Standardization, information security and inclusion were central to our work with MOSIP," Kisembo said. "Consent became a critical focus and is now embedded across the platform, raising awareness about privacy and data protection." ... Nigeria, with a population of approximately 250 million, is taking steps to coordinate its previously fragmented digital systems through a national DPI framework. The country deployed multiple digital solutions over the last 10 to 15 years, which were often developed in silos by different ministries and private sector agencies. In 2023 and 2024, Nigeria developed a strategic framework to unify these systems and guide its DPI adoption. 


Eyes, ears, and now arms: IoT is alive

In just a few years, devices at home and work started including cameras to see and microphones to hear. Now, with new lines of vacuums and emerging humanoid robots, devices have appendages to manipulate the world around them. They’re not only able to collect information about their environment but can touch, “feel”, and move it. ... But, knowing the history of smart devices getting hacked, there’s cause for concern. From compromised baby monitors to open video doorbell feeds, bad actors have exploited default passwords and unencrypted communications for years. And now, beyond seeing and hearing, we’re on the verge of letting devices roam around our homes and offices with literal arms. What’s stopping a hacked robot vacuum from tampering with security systems? Or your humanoid helper from opening the front door? ... If developers want robots to become a reality, they need to create confidence in these systems immediately. This means following best practice cybersecurity by enabling peer-to-peer connectivity, outlawing generic credentials, and supporting software throughout the device lifecycle. Likewise, users can more safely participate in the robot revolution by segmenting their home networks, implementing multi-factor authentication, and regularly reviewing device permissions.


How to Launch a Freelance Software Development Career

Finding freelance work can be challenging in many fields, but it tends to be especially difficult for software developers. One reason is that many software development projects do not lend themselves well to a freelancing model because they require a lot of ongoing communication and maintenance. This means that, to freelance successfully as a developer, you'll need to seek out gigs that are sufficiently well-defined and finite in scope that you can complete within a predictable period of time. ... Specifically, you need to envision yourself also as a project manager, a finance director, and an accountant. When you can do these things, it becomes easier not just to freelance profitably, but also to convince prospective clients that you know what you're doing and that they can trust you to complete projects with quality and on time. ... While creating a portfolio may seem obvious enough, one pitfall that new freelancers sometimes run into is being unable to share work due to nondisclosure agreements they sign with clients. When negotiating contracts, avoid this risk by ensuring that you'll retain the right to share any key aspects of a project for the purpose of promoting your own services. Even if clients won't agree to letting you share source code, they'll often at least allow you to show off the end product and discuss at a high level how you approached and completed a project.


Digital twins critical for digital transformation to fly in aerospace

Among the key conclusions were that there was a critical need to examine the standards that currently support the development of digital twins, identify gaps in the governance landscape, and establish expectations for the future. ... The net result will be that stakeholder needs and objectives become more achievable, resulting in affordable solutions that shorten test, demonstration, certification and verification, thereby decreasing lifecycle cost while increasing product performance and availability. Yet the DTC cautioned that cyber security considerations within a digital twin and across its external interfaces must be customisable to suit the environment and risk tolerance of digital twin owners. ... First, the DTC said that evidence suggests a necessity to examine the standards that currently support digital twins, identify gaps in the governance landscape, and set expectations for future standard development. In addition, the research team identified that standardisation challenges exist when developing, integrating and maintaining digital twins during design, production and sustainment. There was also a critical need to identify and manage requirements that support interoperability between digital twins throughout the lifecycle. This recommendation also applied to the more complex SoS Digital Twins development initiatives. Digital twin model calibration needs to be an automated process and should be applicable to dynamically varying model parameters.


Quality begins with planning: Building software with the right mindset

Too often, quality is seen as the responsibility of QA engineers. Developers write the code, QA tests it, and ops teams deploy it. But in high-performing teams, that model no longer works. Quality isn’t one team’s job; it’s everyone’s job. Architects defining system components, developers writing code, product managers defining features, and release managers planning deployments all contribute to delivering a reliable product. When quality is owned by the entire team, testing becomes a collaborative effort. Developers write testable code and contribute to test plans. Product managers clarify edge cases during requirements gathering. Ops engineers prepare for rollback scenarios. This collective approach ensures that no aspect of quality is left to chance. ... One of the biggest causes of software failure isn’t building the wrong way, it’s building the wrong thing. You can write perfectly clean, well-tested code that works exactly as intended and still fail your users if the feature doesn’t solve the right problem. That’s why testing must start with validating the requirements themselves. Do they align with business goals? Are they technically feasible? Have we considered the downstream impact on other systems or components? Have we defined what success looks like?


What Makes You a Unicorn in Your Industry? Start by Mastering These 4 Pillars

First, you have to have the capacity, the skill, to excel in that area. Additionally, you have to learn how to leverage that standout aspect to make it work for you in the marketplace - incorporating it into your branding, spotlighting it in your messaging, maybe even including it in your name. Concise as the notion is, there's actually a lot of breadth and flexibility in it, for when it comes to selecting what you want to do better than anyone else is doing it, your choices are boundless. ... Consumers have gotten quite savvy at sniffing out false sincerity, so when they come across the real thing, they're much more prone to give you their business. Basically, when your client base believes you prioritize your vision, your team and creating an incredible product or service over financial gain, they want to work with you. ... Building and maintaining a remarkable "company culture" can just be a buzzword to you, or you can bring it to life. I can't think of any single factor that makes my company more valuable to my clients than the value I place on my people and the experience I endeavor to provide them by working for me. When my staff feels openly recognized, wholly supported and vitally important to achieving our shared outcomes, we're truly unstoppable. So keep in mind that your unicorn focus can be internal, not necessarily client-facing.



Conquering the costs and complexity of cloud, Kubernetes, and AI

While IT leaders clearly see the value in platform teams—nine in 10 organizations have a defined platform engineering team—there’s a clear disconnect between recognizing their importance and enabling their success. This gap signals major stumbling blocks ahead that risk derailing platform team initiatives if not addressed early and strategically. For example, platform teams find themselves burdened by constant manual monitoring, limited visibility into expenses, and a lack of standardization across environments. These challenges are only amplified by the introduction of new and complex AI projects. ... Platform teams that manually juggle cost monitoring across cloud, Kubernetes, and AI initiatives find themselves stretched thin and trapped in a tactical loop of managing complex multi-cluster Kubernetes environments. This prevents them from driving strategic initiatives that could actually transform their organizations’ capabilities. These challenges reflect the overall complexity of modern cloud, Kubernetes, and AI environments. While platform teams are chartered with providing infrastructure and tools necessary to empower efficient development, many resort to short-term patchwork solutions without a cohesive strategy. 


Reporting lines: Could separating from IT help CISOs?

CFOs may be primarily concerned with the financial performance of the business, but they also play a key role in managing organizational risk. This is where CISOs can learn the tradecraft in translating technical measures into business risk management. ... “A CFO comes through the finance ranks without a lot of exposure to IT and I can see how they’re incentivized to hit targets and forecasts, rather than thinking: if I spend another two million on cyber risk mitigation, I may save 20 million in three years’ time because an incident was prevented,” says Schat. Budgeting and forecasting cycles can be a mystery to CISOs, who may engage with the CFO infrequently, and interactions are mostly transactional around budget sign-off on cybersecurity initiatives, according to Gartner. ... It’s not uncommon for CISOs to find security seen as a barrier, where the benefits aren’t always obvious, and are actually at odds with the metrics that drive the CIO. “Security might slow down a project, introduce a layer of complexity that we need from a security perspective, but it doesn’t obviously help the customer,” says Bennett. Reporting to CFOs can relieve potential conflicts of interest. It can allow CISOs to broaden their involvement across all areas of the organization, beyond input in technology, because security and managing risk is a whole-of-business mission.