Binance has confirmed a security breach thought to be the largest crypto heist in history, with more than $6.3 billion (£4.7 billion) stolen by hackers.

In a statement, the crypto exchange firm revealed around half of affected assets have been frozen in response to the incident. A significant portion still remains in the hands of cyber criminals, however, and Binance has pledged to “cover all losses”.

Initial findings from blockchain analytics firm TRM suggests Ethereum accounts for roughly $3.79 billion of the total stolen, with Bitcoin accounting for $1.47 billion.

At $6.3 billion, this makes the Binance hack the single largest cryptocurrency theft in history.

Research from Elliptic noted that this “dwarfs” the $1.46 billion stolen from Bybit during a February 2025 attack, which itself was more than twice that of any previous incident.

Who’s behind the Binance hack?

Cybersecurity researchers have attributed the attack to the TraderTraitor group, a North Korean state-sponsored hacker unit associated with the infamous Lazarus Group.

Rafe Pilling, senior director of threat research at Sophos, said the attack bears all the hallmarks of the TraderTraitor group. Sophos’ Counter-Threat Unit has been tracking the group since 2009 under the name NICKEL ALLEY.

“This incident is still in the initial ‘fog of war’ phase, and Binance will need to take time to fully investigate how this attack happened,” he said.

“Initial reports do align with the playbook of the group known as TraderTraitor, a North Korean state-sponsored cluster associated with previous cryptocurrency thefts,” he said.

TraderTraitor is believed to have been behind the aforementioned attack on Bybit last year. In an advisory shortly after the incident, the FBI attributed the attack to the group.

North Korean hacker groups have frequently targeted cryptocurrency exchanges in recent years, with the Lazarus Group in particular having successfully breached a series of firms.

The aim here is to enable the North Korean regime to circumvent economic sanctions and provide it with a steady flow of cash. It’s a tactic highlighted by security experts as far back as 2017, and one that has clearly proved successful given the steady volume of attacks since then.

How was Binance hacked?

Reports on how TraderTraitor gained access to Binance systems are murky right now, especially given the crypto exchange has changed its tune over the last 24 hours.

Initially, it was believed that the incident stemmed from a single compromised developer workstation – a finding detailed by Binance co-CEO Richard Teng in a post on LinkedIn.

“Our initial investigation suggests this security incident may have started with a compromised DevOps engineer's laptop. That gave an attacker access to a service container, where they submitted unauthorized withdrawal transactions,” he wrote.

“To be clear: the attacker did not simply use one engineer's permissions, and this was not a single ‘one-click’ action. It involved a more complex attack process. Our investigation has not attributed responsibility to any individual.”

According to Pilling, this tracks with previous attacks by the TraderTraitor group, who typically aim to compromise employee devices – particularly those used by developers and engineers with deep access to mission-critical systems.

This enables the threat group to “conduct reconnaissance and develop the technical attack,” he explained. “Then, in a relatively short space of time, they launch the attack using rapid, coordinated transactions to steal cryptocurrency from the victim organization.”

While there is a clear link between the group’s techniques and the initial statement from Binance, the company has since revealed a subsequent probe uncovered “additional points of breach”.

The crypto exchange is yet to provide any additional details on the attack.

“This was a complex attack, and we are doing all we can in coordination with law enforcement to resolve it. We are still gathering the facts, and will share more directly as we have them,” the company said in a post on X.

“Staggering in both its scale and potential consequences”

Cybersecurity experts across the globe have weighed in on the Binance hack over the last 24 hours, conveying shock at the scale of the incident.

Jamie Akhtar, CEO and co-founder of CyberSmart, described the incident as “staggering in both its scale and potential consequences”.

“Initial investigations suggest the attack may have begun with a compromised employee laptop, although further points of compromise have since been identified,” he said.

“The fact that cybercriminals were reportedly able to move billions in digital assets in a matter of minutes demonstrates just how devastating a successful attack can be.”

Chris Dimitriadis, chief global strategy officer at ISACA, said incidents such as these “affects trust in cryptocurrency as a whole”. Dimitriadis warned that the incident may prompt further attacks as threat groups look to capitalize on confusion among customers.

“High-profile incidents like this are often exploited by hackers on other platforms to trick users into taking immediate action that could compromise their crypto assets,” he said.

FOLLOW US ON SOCIAL MEDIA

Lakeside Software has announced the appointment of Mark Benson as channel director for EMEA, as the digital employee experience (DEX) software specialist looks to expand its partner ecosystem.

Benson will work alongside global partner director David Whiting to extend the company’s reach beyond its existing partnerships with global systems integrators (GSIs) and major service providers.

A seasoned industry leader, Benson brings extensive experience in developing technology ecosystems and distribution-led partnerships.

Prior to joining Lakeside, he served as head of Arrow ECS’ modern datacentre alliances for EMEA and ANZ and has previously held the role of chief technology officer at Logicalis UK.

His career has also included spells at Roc Technologies, Nexthink, 1E, Liquidware, and RES Software.

Expanding channel opportunities

In his new role, Benson and Whiting will work to engage a wider range of partners as Lakeside expands its channel operations around its DEX platform SysTrack.

Designed to deliver insights and automated resolutions using high-resolution, first-party telemetry, the solution provides organizations with visibility into their IT environments to help identify and tackle issues while reducing operational costs.

In an announcement, Lakeside global partner director David Whiting said the firm wants to build relationships that “create meaningful opportunities” for both partners and customers.

“For global systems integrators and major service providers, that means understanding their existing services and identifying where SysTrack can strengthen and differentiate what they take to market,” he explained.

“We want SysTrack to become an integral part of those solutions, supported by the expertise and insight Lakeside brings to the partnership.”

A revamped partner program for 2027

Alongside Benson’s appointment, Lakeside also revealed it is in the process of revamping its channel partner program and portal. Set to roll out early next year, the firm said its new-look initiative will introduce clearer objectives and incentives, while directing investment and support towards partners developing their propositions around SysTrack.

As AI-capable PCs continue to gain prominence, Lakeside said its platform can help partners advise customers on potential hardware upgrades and investment priorities, while using diagnostics and automation to reduce IT service management costs.

Additionally, partners can also leverage SysTrack to monitor shadow AI use across customer organizations, including identifying which tools are being used, potential security and data risks, and assessing the value of tools such as Microsoft Copilot.

Commenting on the revamp, Benson said Lakeside’s aim is to help partners tailor their propositions around modern customer challenges, rather than simply adding further technology to their portfolios.

“That means identifying where SysTrack can deliver tangible value, whether that is helping customers plan their AI PC strategy, reduce IT support costs or gain greater visibility into how AI is being used across the organisation,” he said.

FOLLOW US ON SOCIAL MEDIA

Governments now face ransomware attacks more than once a day, according to research from Comparitech.

Research from the firm recorded a 47% increase from the second quarter of 2026 to the third quarter, with the number of attacks tracked rising from 90 to 132.

That works out to 1.4 attacks every day, with attacks also surging by 91% compared to the same period last year.

"It goes without saying that governments remain a focus for hackers because of the sheer amount of disruption these attacks can cause, both through system encryption and data theft," said Rebecca Moody, Head of Data Research at Comparitech.

"But what our Q3 report demonstrates is that, as ransomware attacks continue to increase in volume, it has never been more important for government entities to do what they can to mitigate these risks and have a worst-case-scenario plan in place."

The US was targeted with the most attacks, 41 of the total 132 recorded, an increase of 78%, followed by Germany – but ransomware hit governmental organizations across the world.

"No government entity, large or small, previously targeted or not, is immune," added Moody.

More ransomware disruption ahead

Some of the organizations affected faced severe downtime following attacks, according to Comparitech. The firm noted that the Angolan state telecommunications agency Unitel suffered three weeks of disruption after an attack.

The American city of Coweta took two weeks to restore services, while in Ayuntamiento de Collado Villalba, Spain, services were brought online after a week of 16-hour workdays.

Comparitech noted that the US county of Merrimack was able to avoid paying a ransom and dodged serious disruption "thanks to its regular backups."

"As part of their worst-case-scenario plan, government entities not only need to have a clear strategy in place for how they will deal with an attack (e.g. making sure there are regular backups in place to get systems back online as soon as possible), but they also need to assume that a data breach has occurred," Moody added.

High costs

The costs can also be high, the study warned. Beaver County Behaviour Health paid $175,000 to unknown hackers, with Comparitech saying the average ransom demand was more than half a million dollars.

Some authorities faced higher ransom demands. Anne Arundel County, for example, was hit with a demand for $2m, though such ransoms weren't paid. In that latter incident, attackers from Rhysida stole 2.6TB of data, some of it sensitive including medical information, social security numbers and payroll data.

As Comparitech noted in a blog post, it's the second ransomware incident to hit that US county in the last year and a half: "Official letters to those affected in the first attack from February 2025 have only just been sent in the last month."

Moody added that warnings to victims need to arrive in a timely manner to help avoid fraud.

"Hackers will have stolen data in the majority of cases, so issuing warnings to anyone involved promptly is essential to safeguarding this data," she said.

"Better to warn people straight away and retract this warning later on if data hasn't been stolen, than to avoid warning people until months after the attack when there's little they can do if their data has been floating around on the dark web for all that time."

FOLLOW US ON SOCIAL MEDIA

Alibaba Cloud is pushing ahead with its plans for European expansion, launching its first public cloud region in the Netherlands with two new data centers in Amsterdam.

The Chinese firm said the move will help it deliver more resilient, low-latency services, strengthen disaster recovery, and support customers who require their data to be processed and stored locally in the Netherlands and within Europe.

“The Netherlands is one of Europe’s most vibrant digital economies, and our first region here is a direct response to the strong demand we see from local businesses building and scaling with AI,” said Feifei Li, chief technology officer and president of international business at Alibaba Cloud Intelligence.

"By bringing our advanced AI and cloud capabilities to Amsterdam, we are giving customers the in-region infrastructure, performance and data residency they need to innovate faster, scale securely and operate with greater efficiency in the AI era."

The firm plans to offer a suite of cloud computing products spanning elastic computing, storage, containers, networking, big data, security, database, and cloud native services.

It also plans to bring a suite of agentic AI services to the region. These include ACS Agent Sandbox, which provides hardware-level security isolation while reducing the operational cost of AI agents.

Elsewhere, the firm is rolling out its Agent Security Center, an integrated defense platform for AI agents, and AI Security Guardrails 2.0, an upgraded security solution with end-to-end risk detection capabilities.

Agentic SOC, meanwhile, is an enterprise-grade, AI agent-driven security operations platform, while STAROps is an intelligent operations platform.

The company also launched the latest generation of Apsara Stack, a flexible hybrid cloud solution built on public cloud architecture for public sector and enterprise AI workloads.

This, the company said, will deliver more than 80 cloud and AI products, with round-the-clock service to customers worldwide.

Alibaba Cloud’s growing European footprint

The company already has some customers in the Netherlands, including software development company JetBrains, which is looking at integrating Qwen models to power Junie, JetBrains' AI coding assistant, across both cloud and local scenarios.

“AI development is moving quickly, and developers need the freedom to choose the tools and models that work best for them,” said Kirill Skrygan, CEO of JetBrains.

"Working with Alibaba Cloud gives us an opportunity to combine JetBrains’ expertise in software development and AI with Alibaba Cloud’s infrastructure and AI capabilities, giving developers more choice while keeping them in control of how they build with AI."

Alibaba Cloud now has 109 availability zones across 32 regions worldwide. The firm recently launched its first cloud regions in Türkiye and Finland alongside existing regions in Frankfurt, London, and Paris.

It's also increased its data center footprint in Malaysia, the United Arab Emirates, and Hong Kong. By 2032, the company said it's aiming for a total global data center capacity of more than 20GW.

FOLLOW US ON SOCIAL MEDIA

Data belonging to more than 40,000 employees at the Department of Homeland Security (DHS) has been leaked online in a move cyber experts have described as a “severe operational failure”.

A hacktivist group dubbed the ‘Department of Peace’ published the information on agents, which was then distributed online by transparency collective Distributed Denial of Secrets under a database codenamed ‘Icepick’.

As the database name suggests, a significant portion of employees exposed in the incident work for the Immigration and Customs Enforcement (ICE) and Customs and Border Protection agencies.

Leaked employee details include names, job titles, email addresses, and phone numbers, as well as information on agents working on surveillance operations, undercover work, and other various activities.

In a statement, the DHS said it is “aware of a potential breach and is actively working to address the situation swiftly and effectively”.

The federal department added that it will provide more information in due course and will “work to ensure all [agents] are properly protected”.

Dray Agha, senior manager for tactical response at cybersecurity firm Huntress, said the incident is “a severe operational failure that places the physical safety of undercover personnel at direct risk”.

“Exfiltrating this directory data gives hostile actors a complete map of sensitive departments and their internal reporting structures,” Agha commented.

Compromised identity behind DHS breach

The hacktivist group behind the attack claims it gained access to DHS systems through Identity and Access Management (IAM) platform Okta, using exposed user credentials.

A spokesperson for Okta told ITPro: "We are aware of this report. Okta is secure, and we have no evidence our data or systems were compromised."

Graeme Stewart, head of public sector at Check Point, said the incident is a “stark reminder that identity is now the front door for attackers”.

“If the reports are right and the attackers got in by abusing a single sign-on system, then one compromised login was enough to reach the personnel records of tens of thousands of people,” he said.

Stewart echoed Agha’s comments on the nature of information exposed in the breach, warning that this poses a real-world threat for agents working across a range of departments.

“The most worrying part is not the volume of data but its nature. Job titles and contact details for people working in surveillance and undercover roles create a real-world safety risk, not just a privacy one,” he added.

“Exposed data like this also tends to fuel follow-on phishing and impersonation campaigns for months afterwards.”

Government workers in the crosshairs

The DHS data leak comes just weeks after a similar incident involving the Federal Bureau of Investigation (FBI).

As ITPro reported in September, the ShinyHunters threat group claimed responsibility for a breach at the law enforcement agency, stealing information on thousands of agents.

Compromised data included agent names, badge numbers, and even home addresses.

In a similar vein to the DHS breach, exposed information also included highly sensitive data on investigations into foreign intelligence and drug cartel activities.

Security experts told ITPro at the time this data could have severe real-world consequences if it fell into the wrong hands.

FOLLOW US ON SOCIAL MEDIA

Just 3% of organizations have been able to achieve “desired cost savings” through productivity gains, according to new research from Gartner.

A survey conducted by the analyst firm highlighted a growing disconnect between board members and the on-the-ground reality of AI.

Despite the small number of firms who’ve recorded gains, three-quarters of board members still expect AI to deliver value in terms of productivity and costs.

Moreover, Gartner’s survey found that 85% are planning to spend even more in the coming year as they ramp up adoption rates.

CV Viverito, senior director analyst in the Gartner HR practice, said the survey identifies that while AI shows promise for enterprises, many are still failing to unlock tangible value.

“Ultimately, organizations will not generate cost savings from AI at this point,” he said. “The greater opportunity is to use AI to do things that weren’t possible before, such as shifting employee time into new capabilities, outcomes, and sources of growth.”

Using AI to unlock time savings – and thereby costs – for employees isn’t proving easy, however. A similar study from Gartner found that just 21% of the time freed up by the technology was redirected into more “innovative work”.

“There isn’t a struggle to create capacity; that’s happening already as organizations redesign work,” Viverito commented. “What organizations are struggling with is how to make that capacity usable and redirecting it to what is valuable.”

For organizations hoping to “make that capacity usable”, Gartner said those with several key traits and skillsets rank among those recording the most success.

These include those with high AI fluency, which helps them in “knowing when to trust technology, when to challenge it, and how to be accountable for the results”.

Leveraging “human connection” is another area in which workers are using AI to their advantage, the firm noted, particularly in areas such as stakeholders management, teamwork, and communication.

Mixed results with AI adoption

Gartner’s findings mark the latest in a string of studies highlighting lackluster returns from AI adoption in recent years. As ITPro reported in January this year, research from PwC showed widespread discontent among executives after heavy investment in the technology.

In the consultancy’s Global CEO Survey, just one-in-eight CEOs said that AI delivered both cost savings and revenue gains for their business. A third, meanwhile, reported gains in one or the other, but rarely both.

Crucially, more than half (56%) said they’d recorded no significant financial benefit at all. Optimism on this front was also lacking, the survey found. PwC noted that only 30% were confident about AI-related revenue growth across 2026.

A key factor behind growing discontent with AI lies in an inability to push projects from pilot to production, PwC noted. Enterprises have invested heavily in the early stages of the technology, but typically encounter difficulties when integrating the technology across the business.

Indeed, research from Accenture in April this year found that only one-in-ten UK firms had successfully deployed – or scaled – AI in core operations. The consultancy’s Generating Impact report also pointed to a “widening gap” between the basic use of the AI and its broader impact on organizational change.

Put simply, individual workers using the technology are seeing tangible benefits, such as increased productivity and time savings. Yet on a business-wide scale, these gains aren’t be translated into revenue.

Alignment is critical for success

Integration of AI across the business requires close collaboration and enterprise-wide alignment, Gartner noted. A July 2026 survey found that 78% of leaders have no clear alignment on “where AI creates value”.

Arj Bagga, VP analyst in Gartner’s HR practice, said this underlines the importance of a clear-cut strategy and expectations with the technology during the early adoption phase.

“Without a shared view of where AI matters the most for the organization, there is a disconnect in how to position the workforce, and ultimately, how to capture value from AI investments,” Bagga commented.

FOLLOW US ON SOCIAL MEDIA

A new malware campaign uses fake AI apps with names like "GPT-6 Astra", "GPT-5.6 Sol", and "Claude Opus" to infect victims and mine cryptocurrency.

The campaign uses fake GitHub projects to impersonate the applications, and doesn't need phishing emails, as the fake download pages rank prominently in search results - probably through the use of SEO poisoning.

In an advisory, researchers at Check Point said the campaign, dubbed Yoba, uses real OpenAI and Anthropic software, with each download including a genuine, signed ChatGPT or Claude installer. The package looks legitimate, but when the real app runs, the malware runs along with it.

Importantly, neither ChatGPT and Claude nor OpenAI and Anthropic have themselves been compromised. Instead, the attackers abuse legitimate signed binaries and the credibility associated with the brands.

“The AI boom is creating a new opportunity for cybercriminals: they can attack the trust surrounding AI without ever attacking the AI itself," said Eli Smadja, head of research at Check Point Research.

"Yoba shows how search results, recognised brands and even legitimately signed software can be combined to make malicious downloads appear credible."

Duping users

Check Point said Yoba uses several checks designed to complicate automated analysis before moving on to its second stage.

YobaDropper verifies that it was launched by the expected Setup.exe, introduces a lengthy delay if this check fails, applies regional language checks, and requires administrator privileges to continue.

Once these checks have been carried out, YobaDropper deploys YobaLoader alongside a legitimate Windows executable and creates a scheduled task that enables the legitimate executable to sideload YobaLoader after system startup.

It uses trusted internet services – such as Telegram, Google’s DNS-over-HTTPS service, and Catbox – to retrieve payloads, reducing its dependence on traditional command-and-control infrastructure and making malicious communications harder to distinguish from normal activity.

In this particular campaign, the final payload was XMRig 6.26.0, which is used to mine cryptocurrency. However, Smadja said the campaign “should not be viewed simply as cryptomining malware”.

“YobaLoader is a generic loader capable of delivering different Windows executable or PowerShell payloads, meaning the same infection chain could potentially be used to distribute other malware."

The hackers behind the campaign appear to have Russian origins, operating primarily in the UTC-4 time zone, and deliberately avoiding infecting computers set up for Russian and other CIS languages.

To avoid infection, organizations should verify AI software at the source, restrict unauthorized applications and administrator privileges and inspect downloads and application behaviour, Check Point said.

"As adoption accelerates, users and organisations need to verify AI software at its source and apply prevention-first controls to unauthorised applications and endpoint behaviour," said Smadja.

"In the AI era, knowing where your software came from may become just as important as knowing what it does."

FOLLOW US ON SOCIAL MEDIA

Amazon has joined the growing list of companies telling software engineers to stop tokenmaxxing just to look like you're using AI, and instead use the technology only when it actually makes sense.

That's the clear message from Amazon to its engineers via a memo the company chose to publish, telling staff: "if your work does not benefit from current AI tooling, that is a finding, not a failing."

The memo to staff follows reports earlier this year that suggested Amazon staff were using AI for unnecessary tasks in order to move up internal rankings on an AI adoption leaderboard.

The memo was sent in September to software development engineers (SDEs) and software development managers (SDMs).

Not every task needs AI

Terk Terkowitz, vice president and distinguished engineer at Worldwide Amazon Stores, said engineering leaders at the organization had created an "updated role guideline" after concluding that the key elements of software development hadn't really changed despite the impact of AI coding.

"Our most prolific engineers have demonstrated that neither the developer role nor their output is defined by the use of AI," Terkowitz said. "We're now in the era of the Renaissance Developer, blending AI tools with human judgment and domain expertise to build entirely new things."

The new attitude suggests a shift in thinking at the retail and tech giant, following a pattern of companies going all-in in AI only to take a step back — especially after facing big bills from "tokenmaxxing”.

This refers to a practice in which users ramp up their use of the technology, often regardless of whether it’s needed. Indeed, tokenmaxxing has been a recurring talking point across 2026 so far, with some companies rapidly accelerating their use of AI.

Uber, for example, was forced to introduce a cap on AI usage after chewing through its entire annual AI budget in just four months. As ITPro reported in late July, Accenture also followed suit, ordering staff to stop using the technology for basic tasks due to skyrocketing costs.

Elsewhere, Microsoft sent a similar memo to its engineers over the summer, telling them to seek value for customers and the business, as "tokenmaxxing is not what we are optimising for."

AI needs to add value

The memo still makes clear that AI is core to software engineering at Amazon, and a spokesperson told CNBC there was no cap on AI usage at the company.

"We are certain that whatever future best practices are, AI will be at the center of software engineering practice," the memo notes. "If you haven’t already, you should take the time to learn and apply AI into your daily work as soon as possible."

However, Amazon also admitted difficulties with its previous attempts to measure AI using "input metrics" like token usage or AI tool adoption, as well as throughput metrics like code changes or reviews.

"We are all aware of how deeply flawed these metrics are, primarily because they are disconnected from what matters," the memo added, admitting these metrics could be used as a target that would "drive negative outcomes".

These outcomes include high costs from tokenmaxxing and unnecessary complexity contrary to Amazon’s “invent and simplify” mantra.

That doesn't mean Amazon isn't considering metrics, however. Instead, the memo directed managers to consider the bottom tenth of teams when it comes to AI usage as well as the top, to understand why some aren't using the technology and why others are.

"Deploying AI in your organizations requires carefully balancing between exploring new and better ways to do things and investing in doubling down on the ones you already have," the memo said.

Amazon called on its engineers to tell the company when AI isn't useful. "An engineer who can explain where AI does not yet help their work is demonstrating the judgement we are asking for," the memo notes.

FOLLOW US ON SOCIAL MEDIA

Chancellor John Healey's Autumn Budget yesterday included a package of measures aimed at driving data center growth while keeping local communities on side.

Under the new Data Centre Covenant, developers will be expected to make 'credible' commitments for the grid capacity they request, support security of supply, and invest in clean power and net zero while offering benefits to local residents and businesses.

"This Covenant sets out a clear offer: government will support faster and more certain delivery of the data centers the country needs in return for responsible development that delivers lasting benefits for communities," the government said.

"Together, these measures will help keep more of the benefits of AI in Britain, supported by infrastructure that serves our long-term interests."

Data center developers will be expected to agree to a Local Benefit Plan that commits them to 'substantial' investment, developed with the local community and linked to the project’s size. This can be spent on local priorities like transport, parks, and town centers.

Firms will also be asked to minimize water and power use, and to harness waste heat for local homes, schools, hospitals, or businesses wherever practical.

"Developers should create good, well-paid jobs that last beyond construction. They should recruit locally where possible and invest in apprenticeships, colleges and universities,” Downing Street said in a statement.

“Where roles cannot currently be filled locally, they should invest in education and training to enable more local people to access these opportunities in the future."

Elsewhere, data centers should provide secure, resilient UK access to compute for critical services and national priorities, meeting current and future cyber resilience standards.

They should also work with suppliers to develop plans for foreseeable disruption, and take part in government exercises to test arrangements for prioritizing essential services.

Mixed industry reaction

Much of this is aspirational, rather than a set of hard-and-fast rules. Walter Kulvik, digital infrastructure partner at law firm Simmons & Simmons, said most developers are operating under similar principles already.

"Commentary around public support for data center developments has been an increasing issue for a number of years, and major data center developers have already put investment in local communities - both in terms of job creation and development of public infrastructure - into their development plans and budgets," he said.

"As such it is unclear whether the government’s proposal will make much of a difference for the bigger sites and developers."

For developers that can fulfil the criteria, the government will establish a new Ministerial Control Centre aimed at speeding up access to electricity connections.

This will use new powers in the Planning and Infrastructure Act to prioritize strategically important projects by reserving future capacity and reallocating capacity when other projects leave the connections queue.

It will also work to identify locations where capacity may be available before 2030 and enable access to temporary power to bridge the gap to grid connections.

Ash Gawthorp, CTO at Scale Factory, said that despite these measures, power constraints are likely to continue.

"The British data centre covenant acknowledges a real constraint. Faster grid connections and on-site generation might help projects move forward, but they will not make wider power infrastructure problems disappear," he said.

"A major AI data center project in Essex has already lost its anchor customer after grid delays pushed its expected connection into the 2030s. Keeping sensitive NHS and defence data in Britain will require dependable electricity infrastructure."

Kulvik noted that encouraging community investment by offering prioritized grid access or permits for on-site power generation could incentivize the building of larger-scale data centers, particularly where the community investment costs would be a marginal part of the overall cost.

Small-scale developments, though, could find it harder to balance the books.

Matthew Baynes, VP for secure power and data centers at Schneider Electric, said the chancellor’s announcement nonetheless represents a “significant opportunity for a new era of responsible data center development”.

“The opportunity now is for government, energy providers and the data centre industry to work together to turn this commitment into action,” he commented.

“By embracing innovative energy technologies and taking a more integrated approach to infrastructure planning, we can unlock the next wave of AI investment while ensuring data centre growth is sustainable, resilient and delivers lasting value to the communities it serves.”

FOLLOW US ON SOCIAL MEDIA

NCC Group has announced the appointment of Guy Ellis as its CEO following the company’s transition into a pure-play cybersecurity business.

He succeeds former CEO Mike Maddison with immediate effect, who is stepping down following four and a half years leading the business and delivering its transformation.

Ellis takes the role having served as the company’s chief financial officer (CFO) since 2023. During that time, he played a key role in strengthening NCC’s financial performance and commercial discipline, including delivering the successful divestment of software escrow business Escode.

Current group financial director Andy Beaver will become interim CFO to support the leadership transition, NCC said.

“Over the past four and a half years, Mike and the Executive team have transformed NCC into a focused and strategically positioned cybersecurity business,” said NCC Group chair Chris Stone.

“The successful disposal of Escode, the strengthening of our balance sheet and the substantial return of capital to shareholders have created a strong platform for future growth.”

According to Stone, Ellis was identified by the board as the right person to lead NCC through its next growth phase, following an internal and external process.

“Having helped shape and deliver our strategy, Guy brings a unique combination of operational, commercial and financial leadership experience, together with a deep understanding of our clients, people and markets,” he added.

As CEO, Ellis said he will focus on deepening the company’s client relationships, expanding its managed services capabilities, and scaling its cyber expertise.

“We are privileged to work with many of the world's leading organisations and there is a significant opportunity to build on those relationships,” he explained. “As AI continues to reshape the risk landscape, the need for trusted independent cyber expertise has never been greater.”

Building on increasing revenues

Alongside the appointment, NCC announced a trading update for the year ended 30 September 2026, with the company stating it expects full year revenue to be in line with market expectations and adjusted EBITDA to be ahead of forecasts.

The firm’s cyber business is anticipated to generate revenue of approximately £235 million, marking a 3.7% increase on the previous comparable period, while gross margin is forecast to hit a record 38.4%, up 1.8%. Adjusted EBITDA is expected to be £16.3 million – equating to around 6.9% of revenue.

Looking ahead, NCC said its cost and efficiency program is on track as it eyes further organic growth, while financial expectations for the year ahead remain unchanged.

“I want to thank all our colleagues for their commitment, hard work and focus throughout FY26,” Ellis added.

“Everyone at NCC is focused on the significant opportunity ahead of us as we target organic growth, recurring revenues and to drive profits through a continued margin expansion with a plan to get to mid teen EBITDA margins.”

NCC expects to publish its audited FY26 results on 10 December 2026, which it said will disclose a more in-depth update on its growth strategy.

FOLLOW US ON SOCIAL MEDIA

IT leaders are concerned that public key infrastructure (PKI) – one of the most widespread applications of cryptography today – will need to change significantly to support post-quantum cryptography (PQC).

Research from Sectico found that as organizations adapt to shorter SSL/TLS certificate lifespans and the operational demands they create, 78% of IT and security leaders believe that PKI will need to change too.

Organizations are making progress in assessing the systems that might be vulnerable to quantum attacks, up from 14% in 2025, the study found. Another 44% say their assessment is mostly complete.

Meanwhile, 83% have allocated budget to quantum-readiness initiatives over the next year. Of those, 93% expect PQC investment to increase over the next two to three years.

Post-quantum preparations accelerate

Last year, researchers said organizations were mostly preparing for shorter certificate lifespans and the future transition to PQC.

Now, though, both are becoming active operational priorities – priorities that mean a great deal of work across cryptographic discovery, automation, architecture, governance, and investment.

“Organizations have moved from asking whether they need to prepare for cryptographic change to confronting what that change actually requires,” said Nick France, CTO at Sectigo.

“PQC is not simply an algorithm swap, and shorter certificate lifespans are not simply a renewal problem. Both require organizations to rethink how they discover, manage, and adapt the cryptographic infrastructure they depend on, across both public and private PKI environments. That ability to execute continuously is what crypto agility looks like in practice.”

The report examines Merkle Tree Certificates (MTCs), a proposed certificate architecture under development by the Internet Engineering Task Force (IETF), as one example of the architectural thinking underway.

Yet even among those familiar with the proposed MTC architecture, only 40% believe they clearly understand the changes their systems, processes, and environments would require to support it.

Certificate lifespans are getting shorter, with the maximum validity period for publicly trusted SSL/TLS certificates having fallen from 398 to 200 days in March, and scheduled to drop to 100 days in March 2027 and 47 days in March 2029.

This is already presenting problems, the study noted. While 62% report a complete, up-to-date inventory of public SSL/TLS certificates, more than double the 28% reported in 2025 say they are ‘very prepared’ for monthly renewals – largely because they already have automated systems in place.

Nearly three-quarters (73%) said they plan to increase certificate-management automation because of shorter lifespans, and 61% said they'd experienced a certificate-related outage or incident in the past 12 months.

“We’ve entered a time where organizations can no longer manage cryptography as static infrastructure, yet at the same time, we need to make cryptography itself boring again. As algorithms, standards and requirements change, organizations need to be able to adapt without turning every cryptographic transition into a major operational event," said France.

"The next stage in crypto agility is about turning awareness into repeatable, testable, and scalable operations through an approach built around continuous cryptographic discovery, risk prioritization, migration planning and governed change.”

NIST publishes quantum timeline guidance

The research comes after the National Institute of Standards and Technology (NIST) released advice on the best approach and timelines for transitioning away from quantum-vulnerable algorithms to quantum-resistant standards.

"We lay out how certain encryption algorithms people are using today will get phased out,” said NIST mathematician Dustin Moody, who heads the PQC standardization project.

“It’s important to know how a given algorithm might be disallowed in federal systems after a certain date, for instance, or whether it will be allowed but at the user’s own risk. Factors like this can help an organization plan.”

FOLLOW US ON SOCIAL MEDIA

Tech industry stakeholders have voiced optimism in the wake of the UK government’s Autumn Budget.

Chancellor John Healey's inaugural budget includes a £600+ million package to support British AI development, security, and skills capabilities.

Julian David, CEO of techUK, described the funding pledge as a “strong” indication of the government’s focus on AI’s economic potential.

“It signals that government is focused on the right issues on both securing the benefits of AI for the whole of the UK whilst also tackling the biggest questions and challenges around safety, security and economic impact,” he said.

Speaking in the House of Commons, Healey said the government aims to “forge a British way to seize opportunities and guard against the risks” associated with the technology.

On the security front in particular, the government will allocate £165 million for a new National AI Biosecurity Initiative, along with £120 million for the AI Security Institute (AISI).

An additional £60 million, meanwhile, will go toward funding the National Cyber Shield. First announced by the National Cyber Security Centre (NCSC) in May this year, the Cyber Shield initiative will build a nationwide defensive network using AI agents.

Investment on this front will be mirrored by a new £70 million Nation Exposure and Real Time Vulnerability (NERV) Centre, the government revealed. This will help identify cyber-related weaknesses in critical infrastructure.

Alexandra Rose, Head of Global Affairs, Policy, & Partnerships at Sophos, said investment in AI security capabilities will be critical to the success of the UK industry moving forward.

“Strengthening national cyber resilience and continuing to make cybersecurity a strategic priority is always welcome,” Rose commented.

“As AI accelerates vulnerability discovery and cybercriminal activity, investments such as the proposed National Exposure and Real-Time Vulnerability (NERV) Centre offer an important opportunity to strengthen our collective defences.”

Piero Gallucci, Regional VP for UK&I, Veeam Software, echoed Rose’s comments, noting that the investment is a “welcomed” step in the right direction.

“As we scale AI, we must also secure it. And so it’s hugely encouraging to see the Chancellor’s extensive AI growth plan, particularly the £120 million investment in the AI Security Institute and the £60 million allocated to the National Cyber Shield development,” he said.

Sovereign AI in the spotlight

The Budget also confirmed additional funding for the Sovereign AI Fund in the form of a $60 million investment.

Sovereignty has become a recurring flashpoint for firms across the UK and Europe more widely in recent years amidst rising concerns about overreliance on foreign tech firms.

As ITPro reported ahead of the Budget, UKAI said the country risks “becoming a vassal state” due to reliance on overseas technology providers.

The trade body, which represents hundreds of British AI firms, called for heightened investment in sovereign AI and compute capabilities to bolster self-reliance.

According to Downing Street, increased support for the Sovereign AI Fund will “enhance its ability” to invest in UK AI companies and support scaling.

“This will include expanding into a new focus area of Physical and Industrial AI,” the government said in a statement.

Mark Boost, CEO at Civo, welcomed the investment, noting that support for home-grown firms must be a priority for the government.

“Much of today’s Budget is encouraging, with the government having set out genuine ambition for the country’s digital future. Whether that ambition reaches British companies is a different story,” he said.

“If public spending continues defaulting abroad, AI will be running on foreign providers' platforms, with all of the value produced flowing overseas. All of the government’s best-laid plans for its AI goals will go awry if its procurement bravery fails to match its rhetorical ambition.”

Elsewhere, an additional £60 million will support the Sovereign AI’s R&D Procurement Scheme, Healey announced.

Downing Street said this will help provide “innovative solutions to challenges across the health and care system” as well as in AI security and adoption.

Boost once again reiterated that the focus should be directed toward supporting home-grown companies.

“Schemes like the new £60 million R&D Procurement competition are designed to help UK AI hardware and software companies deploy solutions at scale across public services like the NHS,” he said.

“But the sad truth is that UK public cloud spending has defaulted to US hyperscalers for years. Expanding the Sovereign AI Fund with an additional £60 million in equity capacity will help ensure homegrown AI scales securely and sustainably.”

FOLLOW US ON SOCIAL MEDIA

The US Cybersecurity and Infrastructure Security Agency (CISA) has urged federal agencies to implement PHP (PHP Hypertext Preprocessor) patches after observing exploits in the wild.

CISA added the two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities (KEV) database on 26 October.

The agency has set a 29 October deadline for Federal Civilian Executive Branch (FCEB) agencies to implement patches, adding that it “encourages all organizations” to follow suit where possible.

“CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619,” CISA said in its advisory.

“These vulnerabilities, known as “php2shell,” allow for unauthenticated remote code execution in PHP. The vulnerabilities affect all PHP installations serving web requests, including Apache with mod_php (Note: PHP considers this highest risk), PHP-FPM, php-cgi, FrankenPHP and LiteSpeed.”

With the deadline fast approaching, federal agencies will be required to update to PHP versions 8.5.12, 8.4.27, 8.3.36 or 8.2.35.

PHP2Shell rocked the web

CISA’s advisory comes after the vulnerabilities sent the security industry, and indeed much of the web, into a frenzy last week.

PHP is a programming language used in web development and underpins up to 70% of websites globally.

On 20 October, maintainers of the language, The PHP Foundation, issued an advisory warning of an impending patch after the critical vulnerabilities were discovered by security researchers.

While the patch landed on Wednesday, the incident sparked widespread disruption and panic amidst reports that the vulnerabilities were being actively exploited.

As ITPro reported last week, Cloudflare CEO Matthew Prince said the company saw “thousands of attempts to exploit it” in the hours before it was publicly announced.

“Across the Cloudflare network we saw thousands of attempts to exploit it,” he wrote in a post on X. “That jumped to tens of thousands in the 45 minutes post-announcement, hundreds of thousands within 2 hours, and millions now.”

CISA recommendations

In its advisory, CISA outlined a series of actions that organizations can take to limit exposure, including:

• Identify and inventory systems running any version of PHP across your organization. PHP is often a component of other software, and its prevalence may not be directly observable.
• Apply the patch immediately, prioritizing internet-facing systems.
• Organizations that cannot update immediately, or that continue to use PHP 8.1 or earlier unsupported versions, should take PHP-based systems offline until they can be patched or updated.
• A web application firewall may provide some protection until systems are updated or patched.
• Review the official PHP security advisory for guidance on patching.
• Monitor for suspicious activity, including PHP worker processes launching shells or downloading tools.

Ramy Rahman, senior principal solutions engineer at ArmorCode, said that although federal agencies might face a tight deadline, it’s certainly possible to meet this “with the right resources”.

“The biggest challenge will be the versions of PHP they’re running, and the dependencies tied to them,” he said.

“Administrators should prioritize upgrading to the patched versions of PHP, including 8.5.12, 8.4.27, 8.3.36, or 8.2.35, depending on their release branch.

"The reality is that many organizations are likely running older, unsupported versions, which introduces the additional complexity of upgrading applications, addressing compatibility issues, or working with vendors to obtain supported fixes.”

For systems that cannot be patched immediately, Rahman said: “compensating controls need to be applied to reduce exposure”.

This includes disabling vulnerable functionalities, restricting access, and taking systems offline if they cannot be adequately protected. The latter of these was recommended by security agencies last week, including CERT-EU and the UK’s National Cyber Security Centre (NCSC).

FOLLOW US ON SOCIAL MEDIA

Organizations are sticking with Microsoft Azure largely due to the risk of financial penalties rather than merit, according to a new survey.

A poll conducted by the Coalition for Fair Software Licensing (CFSL) has concluded that Microsoft's software licensing practices are a widespread barrier to competition and choice.

More than three-quarters (83%) of software and cloud decision-makers said Microsoft's rules meaningfully limit which cloud providers they can realistically consider.

61% that shopped around said they chose Azure to avoid fees, not because it was the better product. Nearly all reported at least one concrete harm from Microsoft’s licensing practices, with 65% reporting three or more.

Notably, if cost wasn't a factor, eight-in-ten said they would migrate workloads away from Azure if Microsoft's licensing restrictions were lifted.

These concerns have led nearly two-thirds of organizations to keep a workload on their own servers, rather than migrating to the cloud, according to the CFSL.

Microsoft licensing practices raise the stakes with AI ambitions

According to the survey, 82% of respondents with AI projects said Microsoft licensing practices have affected which AI platform they can use. More than half (52%) said they’ve subsequently delayed, scaled back, or cancelled a project.

Meanwhile, licensing cost increases have led 56% to raise prices for their own customers, with 42% of all organizations passing on most or all of the increase. More than half have cut other spending, with a third slowing hiring or reducing headcount. 

"Microsoft's customers are telling us the system is broken. Businesses are being steered to Azure by financial penalties rather than by merit," said Ryan Triplette, CFSL executive director.

"They are passing the costs on to their own customers and delaying the AI tools they need to compete. Some are choosing not to migrate to the cloud at all, rather than incur the costs associated with Microsoft’s licenses to do so."

More than two-thirds said they'd been audited in the past three years, with a quarter incurring unexpected added costs – and those who evaluated a competitor say they are 2.2 times more likely to face an audit.

As a result, 94% said they support letting businesses run software they already own on any cloud without added fees, and 86% said federal regulators should examine software licensing practices that limit which cloud providers businesses can use.

"The closer a decision-maker is to Microsoft's licensing practices, the more urgently they want regulators to step in," said Triplette.

"Regulators should take note: what happens next matters to every American business, and every consumer paying more because of Microsoft's anticompetitive licensing practices."

Licensing practices under scrutiny

Microsoft is already facing scrutiny over its software licensing, and is currently under investigation by the UK's Competition and Markets Authority (CMA) over its Microsoft 365 licensing approach.

The CMA also plans to look into the way Microsoft bundles products, whether customers have an effective choice, and the impact of Microsoft’s licensing practices on these choices.

ITPro approached Microsoft for comment, but did not receive a response by time of publication.

FOLLOW US ON SOCIAL MEDIA

Fragmented enterprise communication practices are causing “information overload” for workers, and it’s severely affecting productivity.

That’s according to a new study from Forrester on behalf of Staffbase. The survey found that more than half of respondents typically receive “critical company news and information” across six or more channels.

Crucially, more than one-third (35%) of respondents said they receive conflicting, unclear, and often outdated information multiple times a week. The result is that broader workforce alignment takes a serious toll on employees and general productivity, Forrester warned.

Nearly half (48%) of respondents, for example, reported lower productivity levels and operational efficiency while 44% detailed a higher rate of errors, quality issues, and missed deadlines.

Frank Wolf, chief strategy officer and co-founder of Staffbase, said the study highlights a growing disconnect between how organizations invest in communications technology and how it’s used in daily operations.

“In the UK and Europe, we’re seeing organisations invest heavily in the systems that run the business, and increasingly in AI, but too often that value never extends the last mile to frontline employees,” he commented.

“This research shows both what that gap costs in productivity and accuracy, and how much employees want one place that brings everything together. Closing that gap means giving every employee a place they can trust to find out what matters, get the right answer and know what to do next.”

Tackling information overload

According to Forrester, employees are now pushing heavily for a more consolidated approach to workforce communication.

The consultancy noted that “consolidating what makes sense and connecting what remains helps information and experiences flow across applications, giving employees a simpler, more cohesive way to stay informed and productive.”

Around 83% of respondents said that a single application or platform that brings together “work-related activities and information” would have a positive impact on efficiency.

Demand for AI tools on this front is also growing, the survey found. Nearly half (47%) of respondents ranked AI-powered answers and employee guidance as “among the top three capabilities” they want to see moving forward.

The perils of “context switching”

Information overload has become a recurring pain point for workers and enterprises alike in recent years, with many operating across disparate communications systems and applications.

Research from Workplace 365 in March 2025, for example, found that six-in-ten employees had become overwhelmed by workplace solutions, with two-thirds calling for greater simplification and consolidation.

Working across multiple tools and applications forces workers into “context switching”, and separate research shows this has an adverse effect on productivity and mental wellbeing.

Indeed, context switching is an issue that now spans multiple industries and professions – from cybersecurity to software development and more.

More recent research from Workday shows that switching between disconnected tools and systems wastes nearly a full working day each week, per employee.

Analysis from the firm in May 2026 found that one-in-four UK workers spent seven hours or more each week copying information between applications and various platforms.

FOLLOW US ON SOCIAL MEDIA

UKAI, the trade body for more than 270 British AI businesses, is calling for a dedicated sovereign AI action plan to save the UK from dependency on foreign tech giants.

The trade body said it wants to see next week's budget include a plan for AI sovereignty amidst lingering geopolitical uncertainty and in the wake of recent cloud outages.

"Piecemeal funding announcements are tactical at best, and we need detailed strategy about how the country will build and design a new wave of AI tools to support critical national infrastructure," said Charlotte Wilson, head of enterprise at Check Point.

"This should be written into the defense budget, especially with geopolitical uncertainty and hostile foreign states bombarding the country with increasingly malicious attacks.”

The government has made a number of moves aimed at improving the UK's AI sector, including efforts toward greater sovereignty.

In summer 2024, it launched an AI Opportunities Action Plan, followed earlier this year by a £500 million Sovereign AI fund aimed at boosting support for domestic AI companies. A further £60 million for the program was pledged last week.

Earlier this summer, it unveiled an AI Hardware Plan designed to give a helping hand to home-grown AI chip firms. However, UKAI said that while all three are valuable initiatives, they need to be merged into one overarching strategy.

"On their own, they are building blocks. Joined up as a strategy, they would be transformative," said Flagg.

AI sovereignty in the spotlight

UKAI joins a number of industry associations calling for a more aligned approach to AI sovereignty. Just last week, a new industry taskforce, Project Sovereign AI Leadership (SAIL), called for a clear definition of sovereign AI.

This would entail creating a workload classification framework that grades sovereignty across each layer of the stack - infrastructure, including data centers, compute and networks, data, models and applications, and workloads.

In July this year, the Council for Science and Technology (CST) called on the government to develop a UK AI Sovereignty Plan, set up clear governance and coordination for AI sovereignty choices, and increase investment in long-term domestic AI capability.

“The stakes could not be higher. Without immediate action, Britain risks becoming a vassal state, dependent on countries that control the AI infrastructure our economy increasingly relies on. We have the entrepreneurs, the research and the talent to compete, but they are fragmented and disconnected," said UKAI CEO Tim Flagg.

“Businesses are calling for action and the government has signalled its intent, yet nothing concrete has followed. Next week’s Budget is the moment to act. We urge the Chancellor to fund a Sovereign AI strategy and secure the UK’s place as a world leader in AI, rather than leave our future in other countries’ hands.”

FOLLOW US ON SOCIAL MEDIA

Westcon-Comstor has teamed up with Palo Alto Networks to launch a new channel initiative aimed at accelerating growth for select Westcon partners across EMEA.

Announced at the distributor’s WestConnect event in Barcelona, the Partner Growth Circle has been designed to provide partners with structured business planning, enablement, and growth support to help them build and scale their Palo Alto Networks business.

Westcon-Comstor said it will work with participants to develop joint Palo Alto business plans tailored to priority solutions, target accounts, as well as agreed pipeline objectives, supported by coordinated sales and technical engagement.

In an announcement, Daniel Hurel, senior vice president of Westcon-Comstor’s Westcon EMEA go-to-market business, said demand for Palo Alto solutions has remained strong across the region as AI continues to reshape the cyber security landscape.

“The Partner Growth Circle is about helping partners translate that demand into scalable, repeatable business growth,” he explained.

“By bringing together joint business planning, technical enablement, demand generation and our wider value-added capabilities, we can help partners build stronger pipelines, expand customer relationships and develop more repeatable sources of revenue.”

Growth-focused partner benefits

Partners that successfully meet the targets laid out in their joint business plans will gain access to a host of exclusive Westcon-Comstor benefits, from tailored services workshops and certification support, to demand-generation funding.

They will also be able to utilize the distributor’s existing value-added capabilities – which include its Tech Xpert community, virtual demonstration environments via 3D Lab, as well as sales and pre-sales enablement.

Partner performance will be measured against their business plan and objectives, Westcon-Comstor said, with quarterly reviews designed to maintain a focus on execution and growth.

Additionally, the distributor will deploy its Intelligent Demand (iD) analytics-led sales and marketing program, which uses predictive data analysis to help partners identify the most promising opportunities.

“It is a focused approach built around shared commitments and measurable progress, and the next step in our collaboration with Palo Alto Networks,” Hurel added.

Expanded EMEA collaboration

The launch of Partner Growth Circle marks the latest phase of a long-standing partnership between Westcon-Comstor and Palo Alto Networks, with the pair’s existing distribution agreement spanning multiple markets across EMEA.

Previous collaborations also include SASEvolution, which packages Palo Alto Networks’ Prisma SASE solution with Westcon’s managed services to provide channel partners with market-ready security solutions.

Commenting on the pair’s latest offering, Palo Alto Networks’ vice president of EMEA ecosystems Patricia Murphy said The Partner Growth Circle will equip partners with the structure, enablement, and resources they need to scale effectively in the era of AI.

“By aligning our products and services with Westcon-Comstor’s deep channel expertise, we are creating a clear path for our mutual partners to accelerate growth, expand their technical capabilities, and deliver exceptional value to our joint customers,” she said.

FOLLOW US ON SOCIAL MEDIA

Nearly nine-in-ten (89%) organizations have scaled back or been forced to redesign AI plans due to token costs this year, according to research from Cloudera.

Findings from the firm’s State of Enterprise AI 2026 report show enterprises are still struggling with AI-related spending, despite a notable decrease in token costs over the last three months.

Brian Martin, CTO of Applied AI at Cloudera, said the findings highlight a “new reality for enterprise AI”, adding that “what works today may not make economic or operational sense tomorrow”.

“Costs change, models evolve, regulations shift, and the right place to run a workload changes with them,” he commented.

“Leaders need an AI strategy built for that reality, one that gives them the freedom to adapt without giving up control of their data, governance, or spend.”

Cost volatility spooks IT leaders

The study specifically highlighted cost volatility as a key challenge for enterprises, with nearly half (45%) having moved AI workloads as a result.

According to Cloudera, this shows that “AI’s price tag is starting to shape its path through the enterprise” – and that could spell further bad news in terms of ROI and adoption rates.

Last year’s report, for example, found cost was the leading barrier to AI implementation, and that trend has intensified across 2026 amidst surging token costs.

Figures from the LLM Token Expenditure Index show prices hit over $2 per million tokens in June this year. As of 25 October, the index shows token prices stand at $0.95 per million tokens.

That price decrease will offer little solace for IT leaders, however, many of whom have been battling costs throughout the first six months of the year. Cloudera said the cost of the technology has placed huge pressure on enterprises to “demonstrate returns and manage the ongoing cost of AI at scale”.

More than half (55%) of respondents said their AI investment increased, yet despite greater spending that is yet to translate into “clear returns”. Indeed, 58% of respondents the value generated by AI initiatives is roughly equal to what they cost.

Fewer than one-quarter (23%) said AI generates more value than it costs.

From a business impact perspective, the situation is roughly the same, according to Cloudera, with IT leaders reporting mixed returns on the technology.

“More than a quarter (27%) report little or no measurable impact from their AI initiatives, while 41% have encountered higher-than-expected costs,” the report states.

Cloudera added that for those investing heavily in the technology, its findings “raise questions about how quickly that spending will translate into meaningful returns”.

A year of AI costs

The study from Cloudera is the latest in a string of reports questioning the costs associated with AI over the last year - and there have been a number of high profile incidents involving lavish overspending.

Uber, for example, revealed it blew through its entire annual AI budget in just four months, prompting the ride hailing firm to introduce spending caps for staff.

As ITPro reported in late June, Accenture also ordered staff to stop using AI for basic tasks such as converting PDFs to slides amidst rising costs.

It’s worth noting that a key factor behind these incidents lay in the tokenmaxxing trend, rather than general costs associated with AI. This is a practice of maximizing AI use within the enterprise by incentivizing staff to use the technology.

Some companies introduced leader boards to track usage rates, while others used it as a means to measure productivity.

In response to growing costs, some enterprises have begun reviving time-tested FinOps practices, as ITPro reported in late July, enabling them to better track costs and cut down on spending.

Cloudera’s report also highlighted a sharpened focus on this front. Nearly all enterprises believe they now have “some visibility” into AI spending, which marks a move in the right direction.

“Ninety percent say they can measure end-to-end AI costs at least somewhat accurately,” the report notes. Cloudera added that there’s still room for improvement here, however.

“Only 27% say they can do so very accurately, suggesting there is a considerable gap between having a general understanding of AI costs and a precise picture of where that spending goes.”

FOLLOW US ON SOCIAL MEDIA

Microsoft Teams will soon use AI to watch for phishing and other scams, the company has revealed.

In a post detailing new features on the roadmap earlier this month, the company said AI-powered anti-phishing tools will arrive in November. The new features follow a series of attacks in which Teams has been targeted by hackers to spread ransomware or otherwise gain access to company networks.

The aim, Microsoft said, is to use AI to better understand messaging conversations in Teams, in particular "first contact chats" with an outsider.

"Microsoft Teams is introducing AI-powered phishing detection that uses conversation context to identify phishing and social engineering in higher-risk messaging scenarios, primarily external first-contact chats," the post explains.

"Additional protection may apply in certain regions or scenarios," the post continues. "The capability is used only for security protection, and users may see warnings when suspicious activity is detected."

The new phishing detection capabilities will work in the background, spotting phishing, impersonation, and other social engineering techniques by looking for suspicious behavior and other indicators such as dodgy links or files.

Conversation context

The AI-powered tool will use conversation context, Microsoft said — which does mean it needs to look at messages in Teams. However, the tech giant said none of the content will be retained.

"This capability is used only for security protection and not for productivity, summarization, advertising, user monitoring, or other non-security purposes," Microsoft said in a post.

"Customer message content is not retained by the detection system for model training or other secondary uses."

The feature will be enabled automatically, rolling out over November and December, and are part of wider efforts to protect Teams as it increasingly becomes a target for phishing scams.

Rise in Teams phishing

Microsoft Teams has become a popular hunting ground for cyber criminals. Last year, Sophos spotted hackers attempting attacks via Teams by pretending to be tech support workers.

Months later the FBI and other authorities warned about the Scattered Spider hacking group abusing Teams and Slack to target employees.

In January, Check Point researchers warned Teams users to be on alert for scam guest invitations that attempted to trick users with false billing and subscription notifications that look as though they came from a genuine Microsoft user.

Just this week, Arctic Wolf Labs has spotted hackers using Microsoft Teams' feature that allows for external chat creation for impersonation scams or to send dodgy files, studying more than 400 incidents.

"Microsoft Teams ships with external access (federation) turned on by default, meaning any Teams user in another Microsoft 365 tenant can find, chat with, and call an organization’s employees, provided both tenants allow external access," Arctic Wolf noted in a post.

"This is the feature attackers most frequently abuse. This activity does not exploit any known Teams vulnerability; it abuses a legitimate, default-on collaboration capability."

These are the sorts of "first contact chats" that Microsoft is hoping to address with the new AI feature.

FOLLOW US ON SOCIAL MEDIA

Legacy systems and widespread human error are putting police and fire services in England and Wales at huge risk of cyber attacks, according to the policing and fire inspectorate.

A report from His Majesty’s Inspectorate of Constabulary and Fire & Rescue Services (HMICFRS) noted that while there's been some improvement in cybersecurity over the last six years, it’s still not enough.

"The cyber threat to police forces and fire and rescue services is significant and expanding rapidly. A major cyberattack is not a hypothetical scenario and successful attacks have been disruptive, put the public at risk and were expensive to fix," said His Majesty’s inspector of constabulary Michelle Skeer.

“While there have been gradual improvements, many forces and services still need to urgently redouble their efforts to respond to the increased risk of cyber attacks."

According to the report, the biggest issue lies in continued dependence on legacy systems. Indeed, tech leaders in both services identified legacy dependence as their greater strategic cybersecurity risk.

Similarly, there are significant concerns about cybersecurity risks linked to third-party ICT suppliers, particularly where suppliers store or manage sensitive police data covering victims, safeguarding, intelligence, and ongoing investigations.

Gaps in training are also a lingering problem, the report noted, with poor security controls for staff joining, moving within, and leaving services. Elsewhere, researchers found poor password management and a lack of up-to-date security measures such as multi-factor authentication (MFA) were rampant.

Cyber resilience needs to improve

Inspectors warned that not enough is being done in terms of preparedness and resilience arrangements, with "unsatisfactory" arrangements for backing up and restoring ICT systems following a cyber attack.

All these issues are being made worse by a lack of commitment from leaders, with several senior police and fire leaders saying that they didn’t consider cybersecurity to be part of daily operational decision-making.

Unsurprisingly, HMICFRS wants to see changes and has made a series of recommendations.

These include making sure all police and fire services achieve baseline standards for cybersecurity capabilities, introducing robust external validation to check up on the services’ own assessments of cybersecurity capabilities, and improving the procurement and contract management of third-party IT suppliers.

It also wants improvements to the way government and policing cybersecurity leads collaborate, and wider use of the Police Digital Service’s National Management Centre, along with a similar national capability for services.

In terms of preparedness and resilience, the report noted that services require significant improvements on this front.

HMICFRS said police and fire services need to be capable of responding swiftly to a cyber attack and should improve learning and development for both security staff and senior leaders.

"Cybersecurity should be viewed as a core organizational priority and not solely a technical risk. Leaders need to prioritize and invest in their cybersecurity arrangements to improve their organization’s ability to prevent, detect, respond to and recover from attacks," said Skeer.

“The government’s program of police reform and local government reorganization could offer both sectors opportunities to improve and better co-ordinate the approach to cybersecurity. These opportunities to strengthen cybersecurity cannot be missed. Protecting systems and data is essential to protecting the public.”

Repeated warnings

The report from HMICFRS comes after the Information Commissioner's Office (ICO) issued a stern warning to the Metropolitan Police Service earlier this month over security practices.

The data protection watchdog found that members of staff had uploaded data to an unauthorized third-party platform, putting highly sensitive information at huge risk.

Elsewhere across the UK, security capabilities have contributed to a number of incidents, most recently an attack on Dyfed-Powys Police earlier this month, which caused disruption to some non-emergency systems.

"We intend to carry out a reinspection in due course, to assess each sector’s progress in implementing these recommendations," she said. "Police and fire and rescue ICT systems need to become much more secure."

FOLLOW US ON SOCIAL MEDIA

Previder has announced the acquisition of London-based managed service provider (MSP) Wanstor, as the Dutch IT solutions provider continues its international expansion.

The deal marks the company’s entry into the UK market, building on its established presence in the Netherlands, Belgium, and Germany.

Previder, a part of the Odin Group, specializes in helping organizations build, manage, and secure their IT environments, offering expertise across cloud, infrastructure, cyber security, digital workplaces, data, and AI.

The firm employs 650 IT specialists and operates its own data centers located in the Netherlands.

Founded in 2002, Wanstor provides a range of IT services across cyber security, cloud, data, and AI, backed by 24/7 service desk support. The company has around 200 employees on its books.

Previder said Wanstor’s services target three key areas: enhancing the user experience, ensuring the responsible adoption of AI technologies, as well as strengthening security and digital resilience.

In an announcement, Odin Group CEO Arno Witvliet described UK MSP’s services and wider vision as “closely aligned” with Previder’s.

“We share the belief that technology creates real value when organisations can use it securely, reliably and with a clear purpose,” he said. “Wanstor’s presence and expertise provide us with a strong foundation in the UK and create significant opportunities for us to grow together.”

International growth ambitions

The Wanstor acquisition is the latest phase of Previder’s international growth plans and further expands its reach across North-West Europe following its recent purchase of Belgian IT service provider AppSys ICT Group. Last year, the MSP also snapped up Belgian IT firm Assyst Europe.

By extending its operations to the UK, the company is looking to create a broader international platform for sharing expertise and strengthening support through local teams.

The MSP said Wanstor’s established UK market presence, combined with its local expertise and existing customer relationships, will provide a solid platform for growth in the region while retaining a local service delivery model.

For Wanstor, company CEO Francesca White said the acquisition represents “an exciting next step” for the business that will help create fresh opportunities for its own future growth.

“We will retain the local commitment and customer intimacy that define our organization, while gaining access to a broader pool of knowledge, capacity and expertise across the group,” she explained.

“This gives us a stronger foundation to develop our services and help customers respond to evolving technology, security and operational need.”

Clearwater acted as exclusive sell-side advisor to Wanstor. Financial terms of the acquisition were not disclosed.

FOLLOW US ON SOCIAL MEDIA

Tesco appears primed to switch to an open source VMware alternative as the supermarket giant continues its feud with the virtualization provider.

The company has posted an ad for a new ‘Head of Software Engineering: Edge Platform’ role in recent weeks, with the ad first spotted by The Register.

According to the posting, the new engineering lead will coordinate “two major, interconnected engineering priorities”.

This includes the creation of a “robust, scalable software driven edge management platform” alongside modernization of the firm’s edge virtualization estate “through the migration from VMware to Proxmox”.

Proxmox Virtual Environment (Proxmox VE) is an open source server management and virtualization platform based out of Vienna.

Tesco’s “business-critical” focus

The new position, which is based in Bengaluru, is a significant one, according to Tesco.

Indeed, the supermarket giant said the edge platform is “business-critical” and provides the “underlying computing environment and software capabilities that enable applications to run across our stores”.

“Store technology must remain dependable despite connectivity disruptions, constrained local resources and the complexity of managing software and infrastructure changes across thousands of locations,” the job ad reads.

“Failures or poorly executed changes can directly affect store operations, colleague productivity, and customer experience.”

The ad notes that Tesco is primarily seeking those with:

• “15+ years of experience in software engineering and technology”
• “Strong technical foundations and credibility across Java, Micronaut or comparable Java frameworks, microservices, REST APIs, Python automation, and Terraform”
• “Solid experience with Linux operating systems, edge computing, server hardware, virtualization and storage technologies, including the design, integration, deployment, or lifecycle management of infrastructure platforms”

Those who fit the bill have their work cut out for them, based on the job description.

Tesco said the new engineering head will “define and execute” the company’s edge platform engineering strategy, modernization roadmap, the aforementioned migration, and implementation of automated engineering practices.

A long-running spat

The job ad – and apparent shift away from VMware – marks the latest in a long-running spat between the supermarket giant and VMware owner Broadcom.

As ITPro reported last year, the company filed a lawsuit against Broadcom for £100 million over VMware licensing contracts.

At the time, Tesco accused the company of failing to maintain support for business critical software which underpins operations across the UK.

Broadcom has been repeatedly criticised for changes to VMware’s licensing setup since acquiring the virtualization giant in 2022 for $61 billion.

In court filings last year, Tesco said licensing changes raised prices by 237% and accused Broadcom of refusing to negotiate terms or packages. The filing alleged that Broadcom is taking advantage of its market dominance to raise prices – an accusation it has faced from European industry stakeholders.

In March this year, CISPE lodged an antitrust complaint with the European Commission, alleging that Broadcom uses unfair software licensing terms to maintain a dominant position in the European cloud market.

FOLLOW US ON SOCIAL MEDIA

Microsoft is offering buyouts to 60,000 staff, equivalent to more than a quarter of its total workforce as the company looks to further reduce headcount.

That figure comes via sources in multiple reports, but Microsoft has confirmed the looming job cuts in a memo to staff, since published online.

The reduction comes as Microsoft invests further in AI and amid wider job losses in the industry. Earlier this year, Microsoft laid off 4,800 staff following a voluntary retirement offer in the spring.

Microsoft reports its quarterly results later this week.

Leaving by choice

As many as 60,000 workers are eligible to opt for the “voluntary exit” offer, sources told CNBC, out of a total global headcount of 223,000. It’s worth noting that the 60,000 figure represents those eligible, not the number expected to take up the offer.

Indeed, one publication reported that Microsoft predicts a smaller proportion of staff to take up the deal than a voluntary retirement offer earlier this year. That offer was accepted by around 30% of those approached by the tech giant.

Another source told Reuters that the buyout offer would be applicable across a wide range of business divisions, including AI experiences, Copilot, finance, gaming, Windows + Devices and more, but not marketing, commercial business, or security.

In a memo published online, Microsoft's chief people officer Amy Coleman said that employees offered the buyout span teams in Canada, India, the UK and the US, at experience level 70 and below.

This is based on an internal system for grading staff. Level 70 refers to senior positions such as a general manager or partner-level technical leader, according to one social media post.

Coleman added that the voluntary exit offer was time limited, with CNBC noting that it would expire by early December.

"This offer gives eligible employees who may be considering a future outside the company a new choice to make that transition now with support," Coleman wrote in the memo.

"It also gives participating organizations another way to adapt their workforce to changing needs."

Microsoft offered that aforementioned voluntary retirement program in April to 7% of American employees, followed by layoffs of 4,800 staff in July. Last year also saw multiple rounds of layoffs at the company.

Cuts everywhere

Microsoft isn't the only tech company continuing to reduce headcount. A host of major tech companies have announced layoffs across 2026 so far. In May, Cloudflare revealed plans to cut 1,000 roles, equivalent to around 20% of its workforce.

Oracle also announced 21,000 jobs would be axed in June, pinning the blame on AI. Last year also saw sweeping cuts at Dell Technologies, Salesforce, IBM, and Intel.

Much of this has been pinned on AI, though analysts have suggested the technology isn't ready to start taking over human roles yet, if ever.

A study by Oxford Economics earlier this year suggested evidence of an AI-inspired shake-up of jobs is "patchy" at best, with job losses really down to wider economic forces.

Some companies have said just that, with Atlassian saying last year's cuts to customer service have nothing to do with AI, and Amazon's 14,000 cuts pinned on reducing bureaucracy.

Microsoft’s motivation behind the voluntary exit scheme is also reportedly due to AI-related costs. Reports from Reuters, for example, suggest the company aims to reduce costs amid heavy spending on AI infrastructure.

Capital expenditures for the next quarter are expected to top $50 billion.

ITPro approached Microsoft for confirmation and comment, but did not receive a response by time of publication.

FOLLOW US ON SOCIAL MEDIA

Cisco has expanded available incentives in its 360 Partner Program, as well as making Cisco IQ generally available for partners as part of its mission to continue to deliver the support its channel ecosystem needs.

Details of the new offerings and updates were announced at the firm’s Partner Summit in Vancouver, Canada, today, but ITPro attended a pre-brief before the main event.

“Cisco didn’t wake up and realize that partners matter,” exclaimed Tim Coogan, senior vice president, global partner sales, told journalists during the pre-brief call last week.

That being said, Cisco understands that partners need to move “first and fast,” especially in the AI era, where threats have intensified, and traditional models of supporting customers are no longer fit for purpose.

Changes to the 360 program include dedicated paths for advisors, developers, and distributors, so they can be recognized for the valuable role they play. In addition, Cisco has introduced Partner Value Indexes (PVIs) for advisors and developers, with a dedicated Distributor PVI coming by Spring 2027.

Additional cross-sell bonuses were also unveiled in addition to a Cisco IQ adoption incentive.

Change is necessary for continued success

The 360 program was unveiled at the beginning of the calendar year and marked a big change; however, Coogan was keen to stress that the previous programs had evolved in response to partner feedback.

“We don’t do anything at Cisco without asking, ‘What about partners?. Are we building it the right way? Are we providing that platform?” Coogan said.

“When we built the [360] program, we didn’t build it and unveil it. We built it with our partners. Thousands of meetings, countless hours spent understanding the program.

“It was big news, and it has required our partners to do things differently. Part of the reason our previous programs, most notably Value Incentive Program (VIP), were around for 23 years. What some people may not know is that there were 46 versions of VIP. We are deeply committed to an iterative process over time.”

Coogan added: “It’s not a set it and forget it mentality. We believe that feedback is a constant source, and we have already made numerous changes. Change is difficult. We ask partners to invest in their capabilities to deliver this incredible portfolio, and we are as deeply committed to modifying it over time based on that same feedback.”

The B2B buying landscape is forever changed

Customers, on average, work with up to seven trusted partners, according to Coogan. What’s more, the B2B buying journey is non-linear with more than 28 touchpoints. This places even more emphasis on partners to help organizations navigate this new normal.

“We recognize that, at the end of the day, growth and profitability are fundamental to our company and to our partners as well. [Offering] Cisco IQ, not as a product, but as a platform, [means] our partners can use it to deliver new services revenue, new capabilities, and a different kind of buying and use experience for our clients. Cisco IQ will become a really, really powerful tool in the bag of our partners.”

Coogan also spoke to the importance of partner experience: “We believe incredibly deeply that our ability to save our partners time is just as important as our ability to help them drive growth and profitability. Finding an easier way to do business with Cisco, improving tools, and leveraging AI becomes fundamental to the experience our partners have with us,” he said.

“Our partners don’t owe us anything, and they don’t work for us; we earn the right to work with them every single day. Partner experience is one of the ways we can invest in their time with us by making that experience as positive and productive as possible.”

Coogan also stressed the importance of constant innovation, being able to react quickly, and scaling but without adversely affecting efficiency.

“It’s our 30th year of Partner Summit. This is not a revelation that partners are important. This is a 30-year journey with our partners, founded on trust, growth, agility, and innovation. We’re so very proud of our heritage and our legacy,” he added.

“Everything for us is founded around our principles of build, buy, and partnering… Ultimately, what we build and what we buy falls short in meeting the expectations of our customers if we don’t have the partner ecosystem to support it. We believe deeply that that partner ecosystem is the enabler for this build, buy, and partner strategy.

“This is a no-ego environment where we learn from each other, provide the platform and the foundation to deliver value in the field. And I think that's really what separates us.”

While much focus on AI has been about increasing machine intelligence levels, it should really be about how you can support your people to become better versions of themselves - more capable humans.

So said Oracle co-CEO Mike Sicilia during the opening keynote, ‘Where AI means business,' at Oracle AI World in Las Vegas today.

For AI to be successful, he said, there are four key ingredients:

1. Access to data, but securely and with the right permissions
2. The ability to understand that data in the context of your business and the systems therein
3. High-performance infrastructure that enables AI to operate efficiently, at scale, and cost-effectively
4. AI needs to work inside the applications and processes where decisions are made and actionable intelligence is derived

A foundation of innovation

“This is where I think Oracle has a unique advantage that has been decades in the making. We’ve built technology that manages your data, runs your business, and powers your most important workloads,” Sicilia added.

These are:

• AI database delivers AI directly to enterprise data that is trusted
• Cloud applications put business intelligence to work, efficiently and safely
• Data platform provides the context and security AI needs
• OCI provides the efficiency and performance needed to operate AI at scale

He said the company had put more information at people’s fingertips than ever before. But added that work has historically been organized around software rather than people and what they need.

“[AI] allows for far more intuitive software. In fact, AI should allow you to barely think about the software at all. So instead of navigating applications and managing processes, you simply tell the system what you’d like to accomplish,” he said.

“Because it understands your business, it can figure out how to get the work done. So instead of spending your day operating the software, the software is working and operating for you.”

Applying AI to build a bridge between humans and machines

The ability for AI to recognize, anticipate, and then help is what Oracle is striving for when it comes to AI: creating meaningful connections between people and technology.

“We’re freeing people from system burdens. We’re giving people more time to be human. That’s the ambition we have for AI. Not simply more capable machines, but more capable people. People who have more time to think, to create, to solve problems, and to care for one another,” Sicilia added.

"Of course, as these systems take on more responsibility, they must also earn more trust… More AI intelligence does not mean fewer controls. Trust is what allows us to put AI to work where the stakes are highest and, therefore, the benefits can be the greatest.”

As expected, a slew of related announcements were rolled out on the first day of Oracle AI World, including:

• A revamped and rebranded version of what was formerly Oracle Cloud Success Navigator, now dubbed Oracle AI Success Navigator. It marries specialist AI agents, best practices, guidance, and training to help businesses more quickly move from theory to real-world value from their Oracle Fusion application implementations.
• Deep Trust AI Architecture, acting as a blueprint that bakes in trust to help organizations speed up their path to AI innovation without increasing risk
• Oracle Fusion Companion, which delivers an intelligence capable of understanding business objectives to decide upon and orchestrate the relevant agents, applications, approvals, and workflows required to achieve said goals.
• Oracle Fusion Agentic Home offers workers a more personalized experience, powered by AI, to help delegate work to agents as appropriate and track progress.
• New and expanded capabilities for Oracle Autonomous AI Lakehouse, including AI Data Catalog, Business Semantic Layer, Data Lake Accelerator, Data Studio, in addition to centralized controls and security
• New Oracle Fusion agentic applications to serve specific use cases such as customer experience, HR, and supply chain operations

Sicilia challenged event attendees to bring Oracle the problems they’ve learned to live with as well as their ambitions. He asked them to come forward to talk about the things they couldn’t do and the things they want to do, but haven’t had the technology to support those efforts, until now.

“We want the complexity to move into the background, and the possibilities for people to move to the foreground,” he said.

Entire, a startup launched by former GitHub CEO Thomas Dohmke, has officially unveiled an alternative to the popular development platform.

The new Git forge is designed specifically with agent-human collaboration in mind, according to the startup, and will offer users the same basic abilities as GitHub – albeit with a twist for the AI era.

Entire claims its platform is built on “fundamentally new primitives” compared to GitHub and other platforms. The system is built on a new distributed source control server compatible with Git, meaning that every developer has their own dedicated server.

Using this method, the startup claims it pushes up to 89 times faster than GitHub and six times faster than Cursor’s Origin.

“This makes Entire the fastest Git forge in product today,” the startup said in an announcement. “Developers can create, migrate, and natively host private repositories in the region of their choice, including the US, EU, India, and Australia.”

Other basic functions like code reviews have received a sprucing up with the ‘Trails’ feature, according to Entire. While other platforms rely on a classic pull request model to review code changes, Entire will provide users with a “heads-up display similar to an airline pilot”.

This will include rolling, customized evals that are assessed and scored by agents with each code push, the company added.

Notably, Entire also leverages continuous memory, which it said represents a “new approach” that allows agents and developer teams to sync sessions and prompts within the repository.

The advantage here, according to Entire, is that data is constantly available and searchable for coding agents. This approach relies on two core components: a codebase graph that allows agents to “find answers faster” and reduce token consumption, and an “agentic brain”.

This essentially stores previous agent sessions and prompts within a system of memory that can be referred to or queried further down the line.

Entire targets agentic orchestration gains

Dohmke said these features come in direct response to the growing use of agents in software development processes.

JetBrains’ Developer Ecosystem Survey found around 90% of developers now use AI coding agents at work on a weekly basis. More than two-thirds (68%), meanwhile, are using them on a daily basis.

“The Pull Request revolutionized first open source and later enterprise software development. Instead of sending diffs and patches on email lists, developers could fork a repo and send their code changes back to the maintainer,” he commented.

“But agents now write almost all of it, faster and more complex than ever before.”

Dohmke added that Entire treats the “idea, the agent trace, and the outcome of a developer’s sessions as first-class artifacts for review alongside the code”.

The platform also uses multiple agents to conduct evals to ensure developers can confidently merge code without repeated reviews.

“This allows coding agents to address findings in a loop, while the human developer validates the progress,” he explained. “When all evals are satisfied, they can merge the code without needing to look at the code itself.”

Dohmke’s first move post-GitHub

The announcement marks the first big move by Entire since it launched earlier this year with an eye on building the “world's next developer platform for the era of AI”.

Entire hit the ground running in February backed by a $60 million seed round at a $300 million valuation. The investment round was led by Felic, with participation from Madrona, M12, 20VC, and Cherry Ventures.

That announcement also marked Dohmke’s first venture since departing GitHub as CEO.

When he announced his departure in August 2025, Dohmke specifically noted that his “startup roots have begun tugging on me”, prompting speculation about a new venture.

A viable GitHub alternative?

While Entire frames itself as a viable alternative to GitHub, it faces stiff competition on this front, and not only from the aforementioned platform.

As ITPro reported in August, vibe coding startup Cursor launched its own alternative to tap into what has become a highly lucrative market.

When Cursor launched Origin, the company said it was “starting with the essentials”, offering users much of the same basic features found in GitHub. Long-term, the plan is to provide “agent-native features”.

Alongside the launch, Entire revealed it has secured partnerships with Buildkite and Depot to ensure build and test pipelines “keep up with how fast agents ship”.

Entire said this will allow users to move off GitHub Actions by converting existing workflows using Buildkite’s bk pipeline or Depot CI, enabling them to subscribe the repository in its own platform.

This move by Entire mirrors Cursor, which also announced partnerships with Depot and Buildkite to build a broader “app ecosystem” aimed at tempting users away from GitHub.

FOLLOW US ON SOCIAL MEDIA

Most neoclouds are doomed, according to Elon Musk, with funding thin on the ground for companies with no revenue source other than AI data centers.

With around 200 players currently in the market supplying specialized cloud infrastructure to run AI workloads, they're struggling to secure debt-market financing, and a massive shakeout is on the cards, he said.

"As of the past few weeks, debt markets have almost entirely shut off access to money for any company that doesn't have substantial revenue independent of AI data centers," he wrote on X.

"That means the 200+ neoclouds are going to see guppy-level death and consolidation. Some will make it through, but not many."

"I think we're going to see a lot of stranded compute in partially complete data centers," he added.

Musk contrasted the lack of investment with SpaceX's position. The firm has successfully secured $40 billion of debt for Nvidia GPUs, he said, because it's "investment grade", and has additional revenue coming in from its Starlink, satellite internet, and rocket launch operations.

The comments appear to confirm a recent report from the Financial Times claiming that SpaceX was engaged in talks to secure $40 billion in funding, with Apollo Global Management acting as the lead investor. The cash would come in the form of around $10 billion worth of bank loans and $30 billion in investment-grade debt, the report said.

The cash will be used to support GPU deliveries in the first and second quarters of next year; the firm is expected to repay the debt early.

Musk isn't the first to sound the alarm about the long-term future of neoclouds. Earlier this month, Gartner warned that by 2030, eight-in-ten neocloud providers are likely to cease independent operations.

While hyperscalers, the firm said, have massive and highly diversified revenue sources that could plausibly sustain AI investments for years, neoclouds can't hang about, and need to quickly earn returns on AI-optimized IaaS and associated platforms if they're to sustain operations.

"The growth in spending on AI-optimized IaaS will be too low for most AI compute providers to recover their AI investments before the current generation of AI semiconductors is replaced," said Will Sommer, senior director analyst at Gartner.

Meanwhile, venture capitalist Chamath Palihapitiya has expressed similar concerns, saying that hyperscalers like Amazon, Microsoft and Google are, unsurprisingly, focusing on their own internal compute needs rather than any third party.

"All of this is to say that it does look like there will be a lot of partially stranded compute and compute sitting in inventory in 2027 than is currently forecasted," he wrote on X.

"This dislocation will benefit two kinds of orgs: the non-bureaucratic big scalers who can build industrial scale quickly and the nimble, well-capitalized players feeding them. 2027 will be a turbulent year because it will clear out a bunch of wrong/bad bets. It will also be a consolidation year for a few."

The warnings come just a couple of weeks after CoreWave – the world's largest neocloud – saw its stock price fall by 38% in a month, and 60% over the last year. And today, after Musk's warning, it's fallen further, along with Nebius and Iren.

Heads of infrastructure and IT operations need to focus their AI efforts carefully if they want to accelerate autonomous operations and support enterprise-scale AI initiatives, Gartner has warned.

In a survey of 272 heads of infrastructure and IT operations (I&O), the company found that 58% believe scaling proof of AI concepts to I&O adoption will be an important priority in the next 12 months.

And, said the firm, there are five AI trends worth adopting if firms want to improve operational efficiency with AI and optimize costs.

"AI is creating one of the most significant shifts the I&O function has ever faced," said Jonathan Forest, VP analyst at Gartner. "Rather than trying to address every aspect of AI simultaneously, heads of I&O should focus on a small number of strategic investments that deliver meaningful impact."

The five AI trends worth adopting for infrastructure and IT operations

The first, unsurprisingly, is agentic AI, used for tasks such as incident triage, change validation, and remediation. And while virtually no organizations are currently using AI agents with minimal human involvement in IT operations, Gartner expects half to be doing so by 2030.

"AI agents are driving a shift from reactive, human-in-the-loop operations to proactive, human-on-the-loop operations," said Forest. "Heads of I&O who fail to restructure their organization around agentic AI risk higher costs, poor operational agility and performance, and ultimately, irrelevance."

The move to agentic AI, though, is creating challenges in terms of token consumption – which is rocketing and likely to lead to unforeseen costs.

Through 2027, Gartner predicts that enterprises implementing AI agents in IT operations using uncapped variable pricing models tied to token usage will overrun their initial cost expectations by more than 50%, compared with those using predictable subscription and bundled pricing models.

The only answer, said the firm, is a strict "no telemetry, no deployment" policy to eliminate blind spots in AI spending and token usage.

Another major trend worth watching, said Gartner, is the way AI inference is driving the rise of hybrid AI infrastructure, driven mainly by privacy, cost, performance, and data sovereignty requirements.

Gartner predicted that a quarter of enterprises will have merged their network operations center (NOC) and security operations center (SOC) by 2030, up from just one in 20 now. And this, it said, will see total spend on tooling and staff resources falling by a quarter.

Finally, AI deployments across cloud, data center and edge environments are increasing the need for a coordinated approach to managing AI infrastructure, governance, security and operations. As a result, said Gartner, I&O is evolving from a traditional gatekeeper role to the orchestrator of the enterprise AI platform, enabling the business to deploy and scale AI reliably, securely and in a cost-effective way.

And, Gartner warned, over the next four years, organizations without a strong I&O function driving AI infrastructure design, architecture and support will be more than twice as likely to fail in their AI initiatives.

"The high cost of AI infrastructure leaves little room for error, placing I&O at the center of enterprise AI success," said Forest. "Heads of I&O must elevate their teams' capabilities, reduce technical debt, and shift from reactive operations to proactively enabling enterprise AI."

Japan’s Liberal Democratic Party (LDP) has called on the government to establish a cybersecurity task force to strengthen defenses against AI.

The call to action follows an emergency meeting of the LDP’s National Cybersecurity Strategy Headquarters (NCSH).

Hosted on 9 October, Masaaki Taira, head of the NCSH, declared Japan in “a state of emergency in cyber space”.

The announcement comes as a series of cyber attacks have disrupted more than 20 companies across transport, retail, finance, and cloud services, according to the Financial Times.

Rail operator JR East reported the loss of 1.67 million email addresses, while car rental company Times Car lost a large number of customer driving licence scans. Meanwhile, cloud services provider IDC Frontier reported a ransomware attack that reportedly linked data leaks to hundreds of businesses.

In the financial sector, Japan’s financial regulator warned banks against accepting driving licences to open new accounts, following reports from Reuters that nine banks had been hacked using AI.

An investigation by Japanese IT company Macnica found that Japan has been hit with 119 cyber attacks this year as of 6 October, with 68% occurring since July, marking a sharp increase from 86 recorded attacks in 2025 and 62 in 2024.

AI is accelerating the attack frequency

An investigation by the Japan Computer Emergency Response Team Coordination Center (JPCERT) into the attack servers found attackers used AI tools to "scan for known vulnerabilities and conduct attacks via APIs”.

JPCERT noted that evidence was found of attackers analyzing APK files to detect vulnerabilities such as Server-Side Request Forgery (SSRF).

Additionally, Japanese security firm GMO Cybersecurity, cited by The Japan Times, alleged that a Chinese-developed AI tool was deployed in cyber attacks against companies in retail, finance, and e-commerce.

Nobuo Miwa, president of Tokyo-based cybersecurity firm S&J Corp, told Reuters that AI makes cyber attacks faster, cheaper, and harder to detect because “AI doesn’t get tired”.

He added, “Japan is essentially being subjected to carpet bombing.”

Building a defense against AI

Reports suggest that Japan’s ageing cyber infrastructure has left it vulnerable to these attacks. With AI making the work easier for attackers, the LDP is aiming to build cyber resilience by establishing a cybersecurity task force under a new headquarters to strengthen defenses using AI as a tool.

Although the plan is yet to be formally submitted to the Japanese Prime Minister's office, the proposal would encourage defenders to adopt AI-enabled cybersecurity solutions and call on regulators to assist small and medium-sized businesses in detecting attacks targeting them.

Mihoko Matsubara, chief cybersecurity strategist at Japan’s NTT Corporation, told ITPro that the LDP's proposal aims to relieve public anxiety by breaking down organizational silos and helping defenders adopt AI-enabled tools.

“Once formalized, the LDP recommendations would help CISOs secure more cybersecurity budget and invest in security hygiene that was overdue because of resource constraints,” Matsubara said.

She added that government-funded support for SMBs would also help strengthen supply chain security. “This would ultimately contribute to the overall resilience of the Japanese economy and industry.”

FOLLOW US ON SOCIAL MEDIA

TrendAI has made Nvidia Nemotron models available inside customer environments as the Trend Micro unit aims to bolster data sovereignty capabilities.

The move will include integration of Nvidia's open-weight Nemotron models within its Vision One platform for Sovereign and Private Cloud, bringing AI-assisted security operations into customer-controlled environments.

This, the company said, extends capabilities such as guided investigation, security reasoning, and agentic SIEM to organizations, along with sovereignty, data residency, and operational control.

According to TrendAI, the move is primarily aimed at public sector organisations and those operating in regulated environments, many of which now face an expectation to run AI and process data locally.

With Nemotron open models, customers decide where the model runs, which version is deployed, and who can access it, running AI-powered security operations on Nvidia accelerated computing in their own data centers, sovereign clouds, and restricted-connectivity environments.

OpenShell improvements

Meanwhile, TrendAI said the collaboration with Nvidia on OpenShell provides an extra level of security for agents, giving organizations control and visibility of agentic activities.

“Sovereignty extends beyond where data resides. Enterprises also need control over where the intelligence acting on that data operates, and how it is governed.” said Rachel Jin, CEO of TrendAI.

"Organizations shouldn't have to give up the operational benefits of AI because their security data and operations need to remain within a customer-controlled environment. Our work is about bringing AI-powered security operations to the environments our customers choose to control.”

What users can expect

TrendAI Vision One for Sovereign and Private Cloud (SPC) with NVIDIA Nemotron integration will offer users AI-assisted threat analysis. This includes reasoning across security signals to identify threat patterns and attack chains, the duo said.

The firm said that guided security operations help security teams investigate threats and prioritize response activities, while agentic SIEM capabilities correlate telemetry and assist with security reasoning while maintaining team oversight.

The move marks the latest collaboration between the security provider and Nvidia in recent months. The company joined the firm's Open Secure AI Alliance, an industry coalition of more than 30 tech companies aimed at building open-source AI safety, security, and defense tools.

FOLLOW US ON SOCIAL MEDIA

Agentic AI security incidents are surging at an alarming pace, according to ServiceNow, and the company has warned many firms are unprepared to deal with future incidents.

A poll of cybersecurity leaders found 88% of UK firms have experienced an agent-related security incident in the past year. Crucially, only 36% of those polled said they were able to contain an incident in under 24 hours.

The findings come as agent deployments accelerate across a range of industries, the company said, from financial services and manufacturing to healthcare.

ServiceNow CISO Ben de Bont also highlighted high-profile incidents involving agents this year.

In July, OpenAI revealed that agents had escaped sandbox environments and breached third-party organizations, including Hugging Face. The admission by the firm was followed by similar cases involving agents at Anthropic and Meta.

These incidents underline the potential risks associated with the technology, de Bont said.

“The agentic incidents making headlines this year are a warning about what can happen when AI is deployed without the right controls,” he commented.

“Organizations shouldn’t have to choose between moving quickly and managing risk. The ones that get this right will build governance into how they deploy agents from the start, so they can realise the benefits of AI without losing visibility or control.”

Agentic AI security in the spotlight

According to ServiceNow, security leaders face a dual challenge when it comes to agentic AI security: the scale of adoption and adapting to “machine-speed” capabilities.

The current rate of adoption is “compounding organizations’ exposure”, the company said, with more than 51% of firms now running between 100 and 999 AI agents. Just over one-third (38%) are running upwards of 1,000 agents.

Yet despite the scale of adoption, just over half (53%) of security teams have a “full, accurate record” of every agent in production.

Moreover, 24% revealed they’d identified agents running in production that had never been registered and were unknown to them.

Running parallel to this, ServiceNow warned that the machine-speed capabilities of agents are “outpacing human-speed response” capabilities.

Three-quarters of respondents said they maintain a complete map of what services and systems agents can access, yet only 31% can monitor them in real-time.

This visibility gap means many security teams are unable to respond quickly enough in the event of a security incident or an instance where agents access unauthorized systems.

Observability has become a recurring concern since the advent of agentic AI, with enterprises unable to keep tabs on a growing array of agents operating behind the scenes.

ServiceNow’s findings on this front echo those in a recent study from Salt Labs. A survey by the security firm found the rate of adoption is placing a huge strain on security teams when it comes to visibility and governance.

Many enterprises also lack the appropriate containment controls for agents, Salt Labs warned. Indeed, the study found nearly half of respondents had observed an agent performing an action that wasn’t intended or authorized.

Assessing risk

ServiceNow noted that the use of agents will require a step change in how security leaders assess risk – and so far these efforts are falling flat.

The company said that while many security leaders “self-assess as having established agentic security postures”, just 13% have clear cut programs designed to measure leading considerations.

These key considerations span areas such as attack surfaces, accountability, visibility, and audit readiness.

According to ServiceNow, this shows that agentic AI security is primarily governed by “legacy frameworks and human-driven systems” that are unfit. Just over half (51%) of UK firms said they have governance frameworks that cover the aforementioned considerations.

Similarly, fewer than half (48%) of security teams build “design security” within the agent development process. The study warned this means that various permissions and guardrails are being implemented on an “ad-hoc, after-the-fact basis”.

FOLLOW US ON SOCIAL MEDIA

Hammer Distribution has announced a new UK-focused strategic partnership with cyber protection vendor Acronis.

Hammer’s channel network now has access to Acronis’ scalable portfolio of solutions, spanning cybersecurity, infrastructure, next-generation AI services, and MSP operations.

The move brings together two companies with established roots in the UK channel at a time when MSPs face increasing pressure to deliver greater value to clients while managing rising costs and complexity.

By pairing its own channel expertise with Acronis’ comprehensive cybersecurity platform, Hammer said partners will benefit from a single, integrated approach to tackling modern customer requirements.

In an announcement, Dominic Ryles, director of Cyber and Cloud at Hammer Distribution, described the collaboration as “a genuine step forward” for the company’s network of partners.

“Bringing together Hammer's channel expertise and Acronis's innovation in GenAI and XDR gives our partners a real competitive advantage, not just new products to sell, but an automated framework to secure and future-proof their clients' businesses,” he explained. “We're excited to see what our partners build with this."

Scalable cybersecurity for partners

Through the new agreement, Hammer partners now have access to a host of cyber security services, which include endpoint, managed, and extended detection and response (EDR, MDR, and XDR) tools, alongside email security, security posture management, security awareness training, and data loss prevention (DLP).

The deal also includes Acronis’ Cyber Frame, a new infrastructure offering designed for modern IT environments, as well as AI-native solutions such as GenAI Protection and Cyber Employee for augmenting and accelerating security operations.

Additionally, MSPs can now leverage automation tools across remote monitoring management (RMM), professional services automation (PSA), and workflow automation to help scale their operations.

Hammer said Acronis’ solutions are backed by its own enablement infrastructure, which covers onboarding support, technical training, and active pipeline development assistance.

Acronis general manager Jo Holliday said the partnership will benefit UK MSPs that find themselves under increasing pressure to deliver stronger protection and more efficient service delivery without increasing complexity.

“Hammer’s channel expertise makes them a strong route to market for Acronis in the UK,” she commented.

“Together, we can help partners bring natively integrated cyber protection, infrastructure management and service automation to more customers, enabling them to protect, manage and automate client environments more effectively while building scalable, profitable managed services.”

FOLLOW US ON SOCIAL MEDIA

The UK can capitalize on a £75 billion economic boost by 2035 if it acts quickly enough on AI adoption, according to a new industry taskforce, but time is running out to act.

The Project Sovereign AI Leadership (SAIL) report has called for a “Prosperity Compact” between government, business, regions and citizens - which needs to be established within the next 12 months.

This call to action has been backed by senior executives at Microsoft, NScale, Cisco, and BT.

“AI is the defining technology of our generation, but realising its £75 billion economic potential requires genuine mobilization of the entire nation. By establishing a clear Prosperity Compact between government, industry, and local communities, we can build the infrastructure we need, equip our workforce with future-ready skills, and ensure Britain’s digital destiny," said Steve Rigby, CEO of Rigby Group and chair of the Project SAIL Taskforce.

"This taskforce’s goal isn’t another strategy document, but high-impact actions that materially accelerate the UK’s transition to an AI-enabled economy.”

The report makes ten specific recommendations for the government, kicking off with a Compute Accelerator service for mid-scale infrastructure capabilities.

This would see the creation of a dedicated service within the Department for Business, Innovation, Science and Trade (DBIST) to support local authorities in identifying, matching, and planning mids-cale data center and networking sites.

Of the roughly 73 GW of data center applications in the connection queue, about 93% sit in the two largest size bands - very little sits between 10 and 100 megawatts, the report noted.

It’s this mid-scale range where the UK can build at pace, serving enterprise, research, defence, and health. The taskforce said Downing Street should back the mid-scale with the same ambition it has shown for the flagship tier.

The taskforce also wants to see grid connection queue reforms, prioritizing homes on distribution networks, and fast-tracking data centers on transmission lines.

AI skills and sovereignty are key

Crucially, the taskforce called for a stronger focus on AI training, led by Skills England, across priority sectors including construction, care, professional services, and manufacturing.

The country also needs a clear definition of sovereign AI - often just a marketing label, the report warned. This means creating a workload classification framework that grades sovereignty across each layer of the stack - infrastructure, including data centers, compute and networks, data, models and applications, and workloads.

Elsewhere, the government should publish Cabinet Office guidance and gap analyses, requiring fallback mechanisms for public services reliant on hosted frontier AI models, starting with healthcare; and return the Government Digital Service to the center of government to lead procurement.

"The government has taken important steps to set the UK's AI ambition; now it’s time for government and industry to come together to deliver. Our national strategy must translate into tangible benefits for every region and community," said Sarah Walker, chief executive, Cisco UK & Ireland.

"That starts by recognising that AI is only ever as powerful as the infrastructure that underpins it, the power that sustains it, and the robust cybersecurity that protects it. By backing these recommendations and accelerating digital skills through strong cross-sector partnerships, government and industry can build the secure, trusted ecosystems needed for AI to scale responsibly.”

FOLLOW US ON SOCIAL MEDIA

More than half of UK organizations have reported "surprise" bills for monitoring IT systems, according to new research from Cisco, and AI is a key factor behind surging costs.

In a new survey from the firm, 65% of respondents said their observability costs had exceeded infrastructure or operational costs this year, with half reporting surprise costs with telemetry data, and another third saying that led to reduced data coverage or retention.

The complaint isn't just high costs, but those that are higher than expected, with 55% of those asked pointing to surprise expenses that are straining operations more than typically baseline costs.

General AI adoption costs are also exacerbating the issue, Cisco found. Another 55% said they are finding it impossible to control AI costs, a problem as AI observability has become a priority, according to nine-in-ten respondents.

That echoes a previous study by KPMG, that found many companies struggle with costs and lack visibility into AI spending.

“For today’s enterprises, the excitement of AI is clashing with the reality of the bill,” added Kamal Hathi, SVP and GM, Splunk at Cisco.

It's not just Cisco spotting this trend, either. A poll by Asana earlier this year found that eight-in-ten UK IT leaders had seen unexpected costs increases from AI over the last year, with Gartner predicting that AI costs could exceed developer salaries by 2028.

Given the rising costs, companies began cracking down on "tokenmaxxing" and other AI overuse this summer, with Uber introducing a monthly AI cap and Accenture telling staff to cut back on AI use for basic tasks.

AI observability

While monitoring AI is a clear priority, more than half of those polled said they don't have a clear business outcome tied to their AI usage, and 56% said they're unable to measure AI workload metrics such as LLM response quality, which Cisco said was a core metric.

Indeed, 85% said they need to have visibility into AI hallucinations, but fewer than six-in-ten said they're effective at spotting such concerns.

“We believe observability is the essential bridge to restoring predictability and confidence to the agentic AI era," Hathi added.

"By providing the necessary guardrails and incorporating observability into an AI tokenomics framework, leaders can transform AI from an unpredictable expense into a measurable and strategic long-term business investment."

Collaboration and teamwork

One silver lining in the confluence of challenges faced by enterprises lies in heightened teamwork and collaboration, according to Cisco. More than half (55%) of those polled are worried about the unintended consequences of AI agents, prompting closer synergy between departments.

Eight-in-ten IT professionals have observed a marked increase in collaboration between observability and security teams as a result.

Nearly three-quarters (73%) also revealed they can accurately trace performance issues to security root causes, an increase from 65% in the survey last year. Similarly, there’s been a marked increase in data sharing between these two teams from 74% to 84% over the last year, with a similar leap seen in working together on troubleshooting.

"Most companies will soon have far more agents at work than people," said Jeetu Patel, president and chief product officer (CPO) at Cisco.

"Managing agents at scale requires reimagining both security and observability. Have our agents been compromised? Are they doing their job well? In the world of agentic AI, these questions are inseparable, and they're moving at machine speed."

FOLLOW US ON SOCIAL MEDIA

AI is speeding up coding, but what about everything else across the software development lifecycle? According to new research from Atlassian, developers still report mixed gains and growing frustration.

As part of its State of Developer Experience Report, 87% of respondents told Atlassian that AI helps them write code faster, but nearly three quarters still face the same – or even greater friction – across the development lifecycle as before.

Indeed, traditional organizational and workflow bottlenecks are still slowing down processes, and that's led to a reduction in time savings that can be attributed to AI.

Last year's version of the poll found that 68% of software developers saved at least ten hours every week thanks to AI. By this year, that had slipped to 25%.

Beyond that, half of developers polled said they spend at least four hours a week managing output from AI, with two thirds adding that they have to spend time fixing errors in work.

Atlassian's study is by no means the first to report mixed gains from AI in software development. Research from Harness, for example, showed that while the technology is speeding up coding, eight-in-ten developers now spend more time reviewing code and completing other "invisible work" tasks.

The AI coding conundrum

So what’s slowing down software development? The survey suggests half of developers are spending too much time finding information and attending meetings, with a further 45% pinning the blame on context switching.

That tracks with separate research from Workday, which found one-in-four UK workers spend seven or more hours a week copying information between apps including AI tools.

"AI can help developers move quicker, but faster code is not the same as better software delivered sooner," said Andrew Boyagi, Customer CTO at Atlassian. "If teams still struggle to find information, clarify requirements and move work through the delivery process, speeding up coding alone won’t translate into business outcomes."

Atlassian said that AI has potential to address some of these challenges – such as by streamlining knowledge discovery and automate handoffs – but most uses of AI across the software development lifecycle remains focused on code generation rather than workflow optimization.

"Making one task faster doesn’t improve the whole system," said Boyagi.

Measuring AI

Notably, the survey found that developers feel pressure to use AI, with four-in-ten using the technology more often than is strictly necessary because they feel it's expected of them.

That's perhaps no surprise given six-in-ten report that their employer sees AI usage as a measure of productivity – and that just 17% of devs and 23% of engineering leads say their own organization has a "clearly communicated and implemented AI strategy".

"Leaders need to be clear about the problems they want AI to solve and measure the outcomes for the whole team, not just how often the tools are used," added Boyagi.

When AI does manage to speed up software development successfully, it exacerbates another existing problem: burnout.

This has become a recurring issue for development teams since the advent of generative AI. As ITPro reported in March this year, research from Harness found that the increased velocity created by the technology is creating huge pressure.

Developers now face more after-hours work as a result of botched code and remediation tasks. The majority of those polled by Harness (96%) now report working evenings or weekend multiple times a month due to release-related work.

FOLLOW US ON SOCIAL MEDIA

Tech industry leaders and security experts have expressed shock amidst a surge of attempted cyberattacks and suspended websites in the wake of critical PHP vulnerabilities.

Speaking at its AI Tour event in Germany, Microsoft CEO Satya Nadella reportedly said: “I’ve not seen anything like this in a long, long time.”

“It was a long day and a long night, I know, for all the IT and security folks,” Nadella added.

Nadella’s comments come after an update was issued to address critical PHP vulnerabilities that could impact millions of websites globally.

PHP (PHP Hypertext Preprocessor) is a programming language used in web development, which underpins much of the internet. The two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, carry a CVSS score of 9.2, ranking them as ‘critical’.

Security experts have warned that both could allow unauthenticated remote code execution (RCE) and allow threat actors to seize control of servers, disrupt services, and steal data.

Given the severity of the flaws, several international cybersecurity agencies issued urgent alerts. CERT-EU and the UK’s National Cyber Security Centre (NCSC) urged organizations to patch immediately when available, or consider shutting down systems to prevent compromise.

“Millions of attempts”

While the PHP Foundation released an update on Wednesday, the patch was pushed forward by a day after a leak of CVE identifiers, meaning threat actors had some understanding of how to exploit the flaws.

An exploit tool known as ‘PHP2Shell’ was reportedly developed and showcased online.

Cloudflare CEO Matthew Prince revealed the company saw “thousands of attempts to exploit it” in the hours before it was publicly announced.

“Across the Cloudflare network we saw thousands of attempts to exploit it,” he wrote in a post on X. “That jumped to tens of thousands in the 45 minutes post-announcement, hundreds of thousands within 2 hours, and millions now.”

Websites taken down

The global impact of the PHP vulnerabilities cannot be understated, particularly given cybersecurity agencies actively encouraged some organizations to take systems offline.

Services worldwide have been taken down as a result of the vulnerabilities while organizations apply patches. Dozens of UK government services have been taken offline as a precautionary measure while updates have been applied, according to reports from BBC News.

In Japan, Asahi shuttered some websites and systems to conduct threat assessments, while French telecoms giant Orange temporarily suspended access to some PHP-based websites.

Matt Cooke, EMEA cybersecurity strategist at Proofpoint, described the incident as a “stake-in-the-ground moment” for enterprises and cybersecurity leaders alike.

“Organizations of every size have a finite window to shore up their cyber defenses, because threats now operate at machine speed,” he said.

“Patch fast, know your attack surface, and limit the blast radius, because that window is closing. If we don't act now, we will see more organizations forced to take their sites offline while they scramble to fix what should have been secured long ago."

Did AI help? find the PHP vulnerabilities

A key talking point in the PHP incident lies in how vulnerabilities were discovered: namely through the use of AI. Cybersecurity researchers at Calif originally identified the flaws using OpenAI’s GPT-5.6 Sol model as part of the firm’s Patch the Planet initiative.

Researchers at Wiz also independently discovered and reported both vulnerabilities.

In a blog post detailing the discovery, Wiz researchers said the findings “rank among the most severe vulnerabilities discovered in PHP, and arguably in software history”.

Researchers also emphasized the importance of AI in the discovery, which helped simplify processes and shed light on the flaws.

“The underlying flaws had been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve,” Wiz researchers wrote.

“Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit.”

Tom Exelby, head of cyber security at Red Helix, issued a stark warning, insisting that this “won’t be the last time we see an incident like this”.

“So much of our digital world rests on a comparatively small number of providers, platforms, and open source components, and that concentration means a single flaw can have a global impact in minutes,” he said.

“When a technology is embedded in millions of websites and services, a vulnerability stops being one organization’s problem and becomes everyone’s.”

FOLLOW US ON SOCIAL MEDIA

Veeam has launched a global initiative that combines its data protection capabilities with local service providers’ local expertise to help customers address data sovereignty requirements.

The new Veeam Sovereign Service Providers Program will be launched in phases, with the first introducing the Data Sovereignty Competency within the company’s Cloud & Service Provider (VCSP) program. Additional program offerings are set to follow later in the year.

The initiative will see the vendor work with participating service providers to deliver services tailored to customers’ business needs. These services will combine Veeam’s technical capabilities around sovereign data protection with providers’ local operating models, governance, jurisdictional expertise, and established market presence.

Veeam said this will enable customers to assess solutions across data location, operational control, access governance, and legal jurisdiction without compromising cyber resilience or recoverability.

“Sovereignty is defined by each customer’s regional government, legal, regulatory and operational requirements,” commented Michelle Graff, Veeam’s senior vice president of global partnerships. “Meeting those requirements depends on both technology and the way a service is operated.”

Graff said the company’s new initiative brings these two elements together by merging its own data protection capabilities with local expertise across governance and service delivery.

“The VCSP Data Sovereignty Competency gives customers a clearer way to identify providers that have invested in both,” she added.

Highlighting data sovereignty expertise

The VCSP Data Sovereignty Competency arrives as AI technologies become a critical element of business operations, security, and governance.

According to recent Veeam research, 70% of surveyed companies admitted that AI workflows are interacting with sensitive corporate data without full oversight, while 67% said employees are creating autonomous workflows that cannot currently be fully tracked.

The vendor said its new competency will now help customers identify providers that have demonstrated capabilities against its criteria for operational, legal, technological, and governance capabilities.

These requirements include local operating models, jurisdictional controls, in-region personnel, data governance, customer oversight, and resilient data protection.

The competency acts as a reflection of a provider’s alignment with its program requirements, rather than replacing a customer’s own legal, regulatory, risk, or compliance assessments.

Strengthening customer choice

By combining its own capabilities with local providers’ sovereign operating capabilities, Veeam said the resulting solutions will help customers address data sovereignty requirements as regulatory and geopolitical factors continue to evolve.

The new competency sits alongside other offerings in the VCSP program, with customers able to select service providers based on relevant requirements – including data sovereignty, disaster recovery as-a-service, and off-site backup.

Tim Pfaelzer, Veeam’s general manager and senior vice president for EMEA, said Europe has seen sovereignty evolve from a compliance consideration into a key strategic business requirement.

“As regulation expands and organizations scale AI initiatives, they need greater certainty over where data resides, who can access it and which laws govern its use,” he explained.

“Veeam’s technology, combined with the local operating capabilities of trusted service providers, gives customers a practical and defensible route to strengthen data control without sacrificing resilience or recovery.”

FOLLOW US ON SOCIAL MEDIA

Enterprises still face huge problems pushing AI projects from pilot to production, according to new research from Dell Technologies, with a confluence of factors hampering success.

Infrastructure deficits, regulatory friction, and fragmented modernization efforts are creating major barriers for enterprises, the study noted. Indeed, nearly two-thirds (64%) of EMEA IT leaders said their infrastructure isn’t ready for production-scale AI and analytics workloads.

More than half (55%), meanwhile, pointed to security and compliance-related issues as a leading factor behind stalled projects.

Notably, UK decision-makers are feeling the strain more than their European peers.

Around 84% said that running AI, workplace, and data center modernization in silos creates severe operational challenges, compared with 69% across EMEA as a whole.

Just over six-in-ten said they lack a clear, unified roadmap across AI, data, and security, compared with an EMEA average of 46%.

UK leaders are also more likely to require partners to demonstrate clear business impact and risk management before progressing new AI projects, at 77% versus 66%.

"Businesses are entering the next phase of AI adoption. The focus is shifting from exploring what's possible to connecting the infrastructure, data, security and workplace technology needed to turn AI into real business value at scale," said Steve Young, SVP and UK & Ireland managing director for Dell Technologies.

"Organizations that build these foundations today will be the ones that lead tomorrow."

Uncertainty is hampering AI adoption

Across Europe as a whole, economic uncertainty continues to influence technology investment decisions, with eight-in-ten leaders admitting they are more selective about investment.

There's a growing trend towards simplification and consolidation, with 81% saying they'd prefer to meet more of their technology needs through a single strategic partner.

IT leaders are also demanding more from their providers, with 77% shifting investment towards partners with greater scale, ecosystem, and supply chain capabilities.

Security, compliance ,and privacy have emerged as critical considerations, with 64% of leaders saying they're concerned about complying with government regulations when using data for AI.

More than half (55%) also report that security and compliance concerns have already slowed or delayed AI adoption initiatives.

Legacy hardware pains

With infrastructure capabilities still lagging, IT leaders are now scrambling to bridge gaps and shortcomings, according to Dell.

Indeed, 86% of EMEA firms said they are making AI PCs central to their future strategy with AI. Overhauling legacy hardware is a significant challenge for many, however, and 79% noted that it has a direct impact on AI adoption.

"EMEA organizations are navigating a complex environment shaped by economic uncertainty, accelerating AI adoption, growing cyber threats, and evolving regulations," said the firm.

"As organizations look to balance innovation with resilience and compliance, they are increasingly focusing on technology investments that deliver measurable business outcomes and support long-term competitiveness.”

FOLLOW US ON SOCIAL MEDIA

Zoom has unveiled a new Unified Context Layer designed to help enterprises bridge gaps between the platform and internal business knowledge sources.

Announced at the Zoomtopia customer conference this week, the Unified Context Layer will help enterprise users link conversation histories with relevant documents and data, the company revealed.

Put simply, the company hopes to close what it describes as a traditional gap between the platform itself and internal operations. Details from various meetings, conversations, and team calls are often left by the wayside, particularly when used alongside third-party applications.

With the new Unified Context Layer, Zoom will now bring together conversations with “near real-time activity” across the platform as well as connected third-party applications.

Zoom CEO Eric Yuan said this trend shows “AI models are only as powerful as their understanding of your business”.

“That context makes all the difference,” he commented. “Fragmented product experiences isolate conversations, stall decisions, and drag businesses down.”

“With the Unified Context layer, we’re laying the groundwork for a system of action designed to turn conversations into completed work.”

Poor business context has become a recurring pain point for enterprises dabbling in AI, as research shows. In a recent study from Alteryx, 77% of firms said business context is critical for AI, yet 53% said they struggle to incorporate this within AI systems and workflows.

Under the hood of Zoom’s Unified Context Layer

With the new Unified Context Layer, Zoom is rolling out a range of new features and capabilities. Include the ability to “follow the meeting”.

This will provide users personalized transcripts and summaries for those who miss a meeting, or at least parts of it.

“Enriched notes” will also link shared screens, charts, slide decks, and in-meeting chat conversations to specific parts within a transcript.

A key talking point with the new features centers around new notes workflows, according to Zoom. This will carry over meeting summaries into various third-party tools such as Salesforce.

Zoom said this will provide users with “ready-made workflows for sales, marketing, and IT”, or custom workflows built by describing what to automate using natural language.

The result here is that no separate workflow builders are required, improving ease of use and creating a more consistent workflow.

Tackling deepfake challenges

Elsewhere, Zoom also unveiled new tools aimed at tackling deepfake-related security threats. Deepfake risk detection capabilities will automatically flag “potential synthetic media” in meeting scenarios, as well as in hiring processes and customer experience contexts.

The move by Zoom comes amidst huge growth of deepfake-related incidents at enterprises spanning an array of industries.

As ITPro reported in September, nearly half of CISOs reported being hit by AI deepfake voice calls in the last year, with a further 36% reporting the same in a video call.

Deepfake techniques are also being used by cyber criminals to secure roles at enterprises, research shows.

This is a common tactic used by fake North Korean IT workers, with a host of organizations having unwittingly hired cyber criminals over the last 18 months.

FOLLOW US ON SOCIAL MEDIA

The government should do more to make sure UK taxpayers benefit from tech firms that have received public funding, the Public Accounts Committee (PAC) has said.

UK Research and Innovation (UKRI) is the UK’s largest single public funder of research and innovation, with a budget of £9.2 billion for 2026–27. However, a new report notes that while it’s great at handing out grants, the organization should be taking more equity stakes in companies where it provides funding. .

According to the government, UK universities proportionally generate more spinout companies and patents than in the US - but the way this intellectual property (IP) is then monetized is patchy, according to the PAC.

UKRI is too focused on avoiding inhibiting companies' growth, it said, warning: "The longer UKRI and the government spend thinking, reviewing and considering what they might do, rather than actively intervening on behalf of the taxpayer, the more opportunities will be missed."

UKRI gives free access to publicly-funded supercomputers to AI startups deemed to be 'strategically significant', while DSIT revised its procurement rules to improve UK companies' access to £400 million in specialist AI chips.

The British Business Bank, meanwhile, also invests alongside pension funds, giving the public a stake in supported businesses. However, while ministers hoped for faster pension fund investment, progress has been slow.

“It may strike followers of this committee’s work that our call for government to take a less cautious approach to taking a direct stake in British innovation is an unusual one," said Geoffrey Clifton-Brown, chair of the PAC.

"But we are a body dedicated to value for taxpayers’ money, not hoarding it. The nations currently leading the global tech race did not achieve their positions by avoiding more entrepreneurial policies. This is a simple case for the government of nothing ventured, nothing gained."

North-south divide widens

Meanwhile, the report points to a continuing north-south divide for researchers, with London, the South East, and East of England receiving half of all UKRI funding.

Although 20% of UKRI’s spending now takes place in the North – up from 12% five years ago – UKRI should build on this by setting specific targets around regional growth, the committee said.

It is also concerned that the current budget allocated by UKRI to the Science and Technology Facilities Council (STFC), which supports UK research facilities, could mean it has to cut its spending on collaborative projects with other nations.

"UKRI’s spending in the North seems to be going in the right direction, but without a dedicated focus on rebalancing the scales, there is every possibility of slipping back to the previous status quo," said Clifton-Brown.

"Further, if the UK doesn’t protect its ownership of innovative ideas, this intellectual property is then exploited by countries around the world who are then better able to compete with us."

Infrastructure bloat in the spotlight

The PAC has also urged UKRI to review the condition of its 'bloated' research infrastructure estate, and should be prioritizing decisions on what infrastructure could be decommissioned much more actively.

The report noted that UKRI cancelled funding for its airborne laboratory five years after deciding to upgrade it, after spending £46 million of the £49 million budget.

According to the committee, the organization should have been quicker in realizing the Science and Facilities Technology Council’s (STFC’s) plans were unaffordable.

"The research infrastructure funded by UKRI is becoming ever more important, as advancements and breakthroughs at the cutting edge of technology determine the new winners and losers on the global stage," the report read.

"The critical role UKRI will play in this race cannot be overstated, and it is vitally important that it spends the money available to it wisely, in accordance with a strategic plan and taking into account its existing infrastructure investments."

FOLLOW US ON SOCIAL MEDIA

HPE cut the ribbon on new features for its HPE Private Cloud AI service at Nvidia GTC in Berlin this week as the firm continues building out the HPE AI Factory portfolio.

According to HPE, the move aims to further support enterprises developing and scaling AI applications, with new capabilities designed to improve ease-of-use for developers and independent software vendors (ISVs).

This includes new governed APIs enabling developers and ISVs to ramp up inference and model refinement capabilities. With OpenAPI-based development, HPE said this will serve as a “single source of truth” for developers working on various interfaces.

This approach will help automatically generate documentation and software development kits for users, for example, as well as code samples that “help partners build integrations faster”.

Elsewhere, new AI pipelines designed to integrate HPE Private Cloud AI within applications and industry solutions will also streamline processes for customers.

Cheri Williams, SVP & GM for private cloud & flex solutions at HPE, said the capabilities come in direct response to growing agentic AI adoption among enterprises.

Indeed, agents are now becoming an “essential part of how enterprises operate”, meaning IT teams require more robust and flexible infrastructure capabilities.

“As organizations deploy AI across industries and increasingly sensitive environments, they need infrastructure that gives them greater control over security, sovereignty, and how enterprise data is accessed and used,” Williams commented.

“We’re helping customers scale AI across hybrid environments while maintaining the governance and operational control required to move from experimentation to production.”

HPE eyes governance and identity gains

Governance and identity security capabilities are a key focus for HPE with the new feature roll-out. New MCP servers, for example, will now be versioned and governed based on roles, tenants, and projects.

New auditing capabilities also allow multiple agents to interact with enterprise systems while maintaining “organizational governance”.

Notably, role-based access controls alongside machine identity monitoring capabilities are designed to help IT and security teams manage human and autonomous access to services in a more efficient manner.

Tackling boisterous workloads

HPE revealed it will also expand GPU flexibility within its Private Cloud AI service to help organizations support a more “diverse” array of AI workloads.

With this, enterprises operating under the private cloud service can now combine Nvidia H200 GPUs and Nvidia RTX Pro 600 Blackwell Server Edition GPUs within the same cluster.

According to HPE, this will help support a “broader mix of AI workloads through a common, governed operating environment.”

“Nvidia’s open source KAI Scheduler provides quota- and priority-based scheduling to improve GPU utilization and workload placement across projects,” the company explained.

FOLLOW US ON SOCIAL MEDIA

Japanese media giant Nikkei, owner of financial publications including the Nikkei and the Financial Times, has revealed a data breach in which 1.83 million records have been stolen.

The incident, which took place from the early hours of 7 October, involved the unauthorized access of a cloud service used by the firm for system development.

Nikkei said the credentials that were used have now been disabled, and that it doesn't yet know how they were stolen.

"As of October 16, we have found no secondary damage, such as misuse of the leaked personal information," said the firm. "We have also found no other problems, such as Nikkei system outages or data tampering."

Of the 1.83 million records that were stolen, around 150,000 contained one or more name, email address, postal address, phone number, or date of birth. Of these, about 120,000 included an email address - putting these people at risk of phishing attempts.

About 1.68 million items contained information that couldn't be used to identify an individual, Nikkei said, and no credit card information was leaked.

The firm said it's now working to assess the extent of the damage and find the cause, and that it is contacting all those whose data has been affected.

It has also reported the incident to Japan's Personal Information Protection Commission, but has found no evidence that the leaked data has been misused in any way.

"For businesses, this incident highlights the importance of strong access controls and protecting employee credentials. Implementing multi-factor authentication, regularly reviewing account permissions and monitoring for suspicious login activity can significantly reduce the risk of unauthorized access," commented Jamie Akhtar, CEO and co-founder of CyberSmart.

"Employee cybersecurity awareness training is equally important, helping staff recognise phishing attempts and avoid inadvertently exposing sensitive information."

A hat-trick of Nikkei breaches

The breach is the third to have hit the company in the last few weeks. Earlier this month, it disclosed a breach that occurred in late July, when hackers compromised employees’ Microsoft 365 business software accounts and accessed personal information belonging to employees and business partners.

It also revealed a second breach, in which a cloud service it used had been accessed without authorization since late July.

“Three breaches in a month point toward a systemic problem that a series of individual incident responses isn’t resolving. The investigation and remediation approach clearly needs to widen beyond what’s been done so far," commented Muhammad Yahya Patel, vCISO and cybersecurity advisor for EMEA at Huntress.

"For an organization whose core business is the integrity and trustworthiness of financial information, a month of successive data breaches is now a reputational problem.”

Looking further back, in May 2022, the firm revealed that it had fallen victim to a ransomware attack, while, in November last year, it disclosed a data breach that was caused by the compromise of a Slack account.

FOLLOW US ON SOCIAL MEDIA

An update has been issued for two critical PHP (PHP Hypertext Preprocessor) vulnerabilities after a working exploit was published online this week.

PHP is a server-side programming language used in web development, powering millions of websites globally.

The two vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619 and carry a CVSS score of 9.2, ranking them as ‘critical’. Both enable unauthenticated remote code execution (RCE), according to analysis.

On Monday 20 October, the PHP Foundation issued an advisory warning of the two vulnerabilities, urging organizations to prepare for an impending patch. The advisory was issued following reports that an exploit tool known as ‘PHP2Shell’ has been made available, with a video guide of the tool in action posted online.

In a follow-up announcement, the PHP Foundation said fixes for both flaws are now available, outlining organizations at risk of attack.

“Who is at risk: All PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed,” the foundation said.

“We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.”

How to patch the PHP vulnerabilities

According to the PHP Foundation’s advisory, organizations are required to update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Sources for the patches can be found via the foundation’s downloads page.

Windows sources and binaries are also available on the same page, according to the organization.

Linux distributions and LTS vendors were given access to the patches in advance, according to the foundation. Admins are advised to check with their respective vendors for updated packages.

Notably, PHP 8.1 and older versions no longer receive support from the PHP project, the foundation warned. Admins are therefore advised to contact vendors for details on a potential backported fix or to upgrade to a supported version.

PHP flaws had the cyber industry scrambling

A host of security agencies worldwide have issued alerts over the critical vulnerabilities amid warnings that both were being actively exploited.

CERT-EU said the vulnerabilities could affect all versions from PHP 5 onwards, which, given this dates back to 2004, underlines the scale of the potential threat.

This warning was echoed by similar analysis from cybersecurity firm watchTowr.

Crucially, CERT-EU said that if organizations cannot immediately patch, they consider “isolating internet-facing applications from public networks until a fix can be applied”.

The UK’s National Cyber Security Centre (NCSC) gave similar advice for organizations.

“Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated,” the agency said in a statement.

Jake Moore, global cybersecurity advisory at ESET, said that given PHP underpins large parts of the web, mass exploitation of the flaws represented a huge threat.

“When vulnerabilities are leaked before their patch is available, it is usually a scramble to do whatever possible to mitigate the damage,” he said.

“But the sheer scale of PHP across the internet makes this far more serious than the usual exploit. A vulnerability in technology used by millions of websites could immediately give cyber criminals an enormous number of potential targets.”

Notably, Moore said the leak gives attackers a “huge head start” and urged businesses to identify vulnerable systems and patch immediately when available.

FOLLOW US ON SOCIAL MEDIA

The Microsoft AI Tour is now the Microsoft Frontier Tour. A change that reflects the fact that we are no longer at the adoption stage of AI, but are now putting it to work, according to Microsoft.

However, this new frontier is fraught with challenges. One of the biggest of these appears to be a very human problem: confidence. From top to bottom of all businesses, there appears to be a crisis of confidence with AI.

The confidence to use the technology, confidence that it won’t make our working lives worse, and even confidence that it will ultimately deliver a return on investment.

Trust issues were a main theme of Microsoft’s AI Diffusion Report, released ahead of the Tour, which was covered by ITPro. It revealed a stark divide between UK leaders and employees on AI, with eight-in-ten leaders confident the UK can lead in the technology, while only half that number of employees agreed.

The reasons for low employee confidence were varied, though many suggested it had reduced their own job security and also limited opportunities for younger workers.

Speaking on stage, CEO Satya Nadella talked about the importance of the human element with AI.

“How do you put the human in the loop?” he said. “How do you really ensure that, ultimately, that sense of empowerment is not lost?”

Confidence in AI

Microsoft has made substantial commitments to the UK, investing in data centers and partnering with UK organizations like the NHS. And it dedicated a large portion of its keynote to call for more work to be done across the country.

UK and Ireland CEO Darren Hardman used his segment to talk about building confidence in AI across the UK. Laying out the challenge of turning AI’s potential into improvements that people can feel in their work or the services they use, and also the opportunities that are open to them.

“Our role at Microsoft is to bring intelligence and trust together,” Hardman said. “AI that puts your organization’s knowledge to work, helping people achieve more, while providing the safeguards and visibility to stay in control.

“You can give your people a say in how AI changes their work. You can set clear boundaries on the data AI can access. And the actions it can take. With human approval where it matters.”

A key pledge here is observability. Specifically with agents, which have raised questions of governance and control over the last year.

“For a leader, it means being able to answer a very straightforward question: ‘Do I understand and remain in control of what this system is doing?’”

“That is how we put Microsoft's mission into practice with you,” Hardman explained. “Helping people achieve more with the confidence and control to do it responsibly.”

Hardman ended his keynote with a call to action to build more confidence, more skills, and more opportunities in the UK so that AI opens doors for people “whatever their background, wherever they live”.

Talent, as he rightly pointed out, is everywhere in the UK, but there is a responsibility to make sure that the opportunity reaches all of it.

FOLLOW US ON SOCIAL MEDIA

NetApp has announced a new partnership with Emma Technologies (emma), which will see the pair deliver sovereign AI for European businesses.

The joint venture combines NetApp’s high-performance storage capabilities with emma’s GPU capacity and cloud operations platform for distributed architecture to create a single sovereign AI stack.

The new offering aims to provide organizations across the continent with sovereign AI infrastructure that doesn’t lock them into a single cloud platform.

In an announcement, Willem Hendrickx, NetApp’s senior vice president and general manager for EMEA and LATAM, said the move will help prevent European enterprises having to choose between AI innovation and data sovereignty.

"emma is building exactly the kind of next-generation sovereign cloud infrastructure that the European market needs,” he said. “With the NetApp Platform at its core, we are helping emma build the Intelligent Data Infrastructure it needs to make its vision a reality.”

[INSERT HEADER]

Enterprise software vendor emma’s cloud platform enables organizations to manage workloads across hyperscalers, regional and sovereign clouds, as well as AI-optimized providers and on-premises environments.

The firm also operates its own high-performance AI infrastructure in European data centers to help businesses retain control over their data, costs, and compliance without being constrained by vendor lock-in.

emma said its cloud-agnostic platform will help European organizations balance the running of high-performance, data-intensive AI workloads with the need to meet strict data sovereignty goals.

The NetApp Platform – which includes high-performance AI storage powered by the company’s ONTAP software – will provide both file and object storage within a single architecture to support emma’s multi-tenant AI environment.

The companies said the combined offering will provide data protection and cyber resilience while enabling the movement of workloads across hybrid and multi-cloud environments in line with emma’s flexible deployment strategy.

"The conversation with European customers has changed,” commented Dmitry Panenkov, founder and CEO of emma. “They no longer ask whether to run AI, but where they can run it without losing control of their data. With NetApp, we can give them a clear answer."

FOLLOW US ON SOCIAL MEDIA

HPE has unveiled the HPE Spaceborne Computer-4, an advanced compute module designed specifically to operate in space – and it’s heading to the moon.

The system will be deployed on Astrolab’s Flex Lunar Innovation Platform (FLIP) rover as part of an upcoming mission for the Moon Base II program. The move will see tests conducted to assess suitability of advanced computing capabilities for future missions.

According to HPE, these tests will benchmark AI and high-performance computing (HPC) capabilities, helping to create the “technological foundation” required for research on the lunar surface.

“Large language models (LLMs) will deliver insights, analyze visual data, and support autonomous monitoring at the lunar edge,” the company said in a blog post.

“Additional tests will process LiDAR data for mapping, navigation, terrain analysis, and infrastructure development, while an AI services container will demonstrate reliable deployment of scalable AI service applications on the Moon.”

Astrolab was selected by NASA earlier this year to provide lunar rover capabilities for Artemis astronauts as the agency prepares for a full return to the moon.

In a press briefing ahead of the announcement, Jaret Matthews, founder and CEO of Astrolab, said the move marks a significant first step in scientific research from the lunar surface.

“I think for the foreseeable future, the most valuable export from the moon is going to be data,” he said. “The technologies to collect, process, store data so that we can return that value to our customers are, you know, central to our business.”

The moon is “far away”, as Matthews noted, and this means the system faces problems in terms of time delays and bandwidth constraints. He told attendees that this project is essentially redefining the concept of edge computing.

“Pushing compute out to the edge so you can do more, create more value, and ultimately satisfy customer needs, these technologies are imperative for that,” he commented.

Under the hood of HPE Spaceborne Computer-4

HPE Spaceborne Computer-4 is a “lightweight, self-contained, and fanless” compute module designed specifically to survive harsh environments, according to HPE.

The system will be operating on the lunar south pole, and will be equipped with a lower-power CPU and GPU. Similarly, the module will leverage 1TB of flash storage through Japanese data storage firm, Kioxia.

Kioxia’s involvement builds on long-standing ties with the HPE Spaceborne program, the company said, with the two companies having worked extensively on mission activities and tests of data storage under lunar conditions.

As part of the move, HPE will also provide support for Astrolab’s mission control site in Hawthorne, California, with the company relying on HPE Private Cloud for storage purposes, and HPE CloudOps Software for workload management.

Lunar experiments

As part of the Spaceborne Computer-4 project, NASA and Deloitte will deploy a series of AI workloads on the moon and conduct experiments.

The Federated Learning for Unbounded and Intelligent Decentralization (FLUID) experiment, for example, will see NASA run an AI neural net model trained with data from the earth, moon, and on the International Space Station (ISS).

According to HPE, this aims to demonstrate how to coordinate three separate AI models from immensely disparate locations. NASA will also carry out tests on a tuned LLM with semantic processing capabilities to help find and interpret onboard documents.

Meanwhile, Deloitte’s Silent Shield will provide predictive cyber analytics and anomaly detection capabilities. This is a new cybersecurity system developed by the firm.

Extreme conditions

Faraz Valani, senior director and head of go-to-market at Kioxia, echoed Matthews’ comments regarding challenges, noting that the “rules are very different” for storage operating in harsh environments.

“You have a lot more challenges up there than we’re accustomed to down here,” he told attendees. “In space, everything is constrained.”

When deploying in a traditional data center, Valani noted that operators naturally have access to power, cooling, connectivity, and crucially, physical space. The upcoming lunar mission creates huge challenges across all those fronts.

“If something fails, you can simply just go out and replace it. In space, however, you don’t have that luxury because every watt of power, every gram of weight, and every inch of space makes a significant difference,” he explained.

“The slightest variation in any of these variables could simply make or break anything that you’re trying to accomplish up there.”

Scott Wiest, HPE’s CTO for global sales, noted that HPE “goes to pretty far extremes” when it comes to testing durability of traditional infrastructure, including freezing hardware, shaking it, and even putting it ovens to ensure it can handle extreme conditions.

“We have stuff deployed in extreme conditions, so this taught us to really go extreme,” he said. “Think about cooling differently, as you referred to. Think about being maximally efficient about weight, thermals, power, performance.”

Wiest said that long-running tests of HPE hardware on the ISS played a key role in fine-tuning capabilities on this front and will stand the compute module in good stead for the lunar mission.

FOLLOW US ON SOCIAL MEDIA

A lengthy Google Cloud outage has raised questions over the UK’s reliance on a handful of cloud providers, with organizations across a range of industries having been affected.

The incident began just after 7am UK time on 20 October and affected Google Cloud’s europe-west2-b region, one of three local availability zones in London.

Notably, the outage lasted roughly eight hours, with Google mitigating the issue at 3pm and services coming back online an hour later. By 6pm, the hyperscaler said services were restored for most customers.

Only a “very small number” of those impacted in the outage were still experiencing issues, the company added.

In a statement in the wake of the outage, Google Cloud said it will publish a full analysis of the incident once it has completed an internal investigation, urging any customers still affected to contact its support team.

Who was affected in the Google Cloud outage?

Organizations across an array of industries were impacted by the Google Cloud outage.

One of the worst-affected was online bank Revolut, with customers unable to make card payments, withdraw cash, or make transfers for several hours.

The neobank said customers’ funds and data remained secure throughout the incident.

Customers of Lloyds Bank, Halifax, and Bank of Scotland, all part of the Lloyds Banking Group, also reported issues, as did HSBC, with some customers unable to log in via the app and online.

The outage also hit the video system used by defendants, lawyers, and other parties to attend remote court hearings across England and Wales. DPD and Royal Mail are also believed to have been affected, along with Screwfix and Rightmove.

What was the cause?

As noted, Google Cloud is still to publish a full post mortem of the outage, meaning that at this stage there is very little information on the exact cause of the incident.

What we do know so far is that Google has blamed the incident on a “power event”, which is believed to have taken place at its London cloud facility.

Google is preparing a report on the outage, which should be available in the coming days or weeks. ITPro will update this article accordingly when a full explanation from Google has been published.

What happens next?

The Google Cloud outage has triggered the interest of the Financial Conduct Authority (FCA) and the Bank of England’s Prudential Regulation Authority.

The company is designated under the Critical Third Parties regime as critical to the financial services sector, and as such the two authorities have requested more information.

Muhammad Yahya Patel, vCISO and cybersecurity advisor for EMEA at Huntress, said the incident will naturally prompt serious discussions about its impact and resilience.

“[The] outage will generate a significant number of post-incident reviews and likely some difficult conversations between firms and their regulators about whether their cloud resilience testing adequately reflected a scenario where a major provider goes down in a key region.”

What can we learn from the Google Cloud outage?

As with the AWS outage this time last year, experts have warned the incident highlights how many essential services rely on a handful of infrastructure providers.

Scott Dawson, CEO at DECTA UK, said there will undoubtedly be “uncomfortable conversations in IT departments” as a result of the outage.

“Banks and payment providers spend a fortune on keeping their systems running, but how many know whether their backup supplier is using the same Google infrastructure as their main one? That's something I'd want an answer to," he said.

"We've known for years that cloud services can fail, and there's really no excuse for waiting until customers are locked out of their accounts to find out whether your contingency plans work.”

Other industry experts have reiterated that the Google Cloud outage shows the importance of digital sovereignty and stronger regional infrastructure capabilities.

Mark Boost, CEO of UK-based cloud provider, Civo, said the outage highlights the risk of overreliance on foreign infrastructure providers.

"True operational resilience simply cannot exist when critical workloads are concentrated in a handful of foreign platforms; it requires open, hybrid, and multi-cloud environments,” he said.

“When the failure of a single foreign hyperscaler has a large-scale impact on the UK’s digital economy, then the tech stack is not robust; it is merely a business risk.”

Boost added that the outage should serve as a “clear directive” that greater investment is needed in UK sovereign capabilities.

Jon Lucas, director and co-founder of Hyve Managed Hosting, echoed Boost’s comments regarding overreliance on foreign cloud providers.

“The incident highlights how businesses relying too heavily on a single cloud provider risk being left without a viable alternative when services fail,” he said.

Lucas noted, however, that diversification of services isn’t quite enough.

“Workload portability is essential,” he said. “Businesses must be aware and avoid unnecessary vendor lock-in and ensure they can move critical applications and data between environments without major disruption.”

FOLLOW US ON SOCIAL MEDIA

More than eight-in-ten business leaders are confident that the UK can lead in AI, but only half as many UK employees agree on that front, according to new research from Microsoft.

A survey of 5,000 UK employees and 1,000 of their bosses as part of Microsoft's AI Diffusion Report reveals a growing gap between how business leaders and their employees see the potential benefits of AI.

Of the business leaders surveyed, 84% reported feeling confident that the UK can become "a world-leading economy within five years," but only 41% of UK employees agreed.

Mind the AI gap

What's behind the gap? According to Microsoft, 35% of the surveyed workers believed AI had reduced their own job security, with 57% saying it hurts job prospects for younger people.

Despite those concerns, 71% also agreed AI had a positive impact on their work and 69% believe it had boosted the quality of their work.

While business leaders and workers may disagree on the job risks and utility of AI, about six-in-ten of both groups believe the government should do more to help the UK reap the benefits of the technology. Indeed, more than a third from each group are now calling for heightened regulation and safeguards.

"Government and industry must work together to respond to British business leaders' calls for greater action on skills, build trust in the technology and ensure its benefits reach everyone," said Darren Hardman, CEO of Microsoft UK & Ireland.

"If we remain divided on whether AI will have a positive impact, if we fail to build trust in the technology and if we cannot put the necessary safety ecosystem for models in place, then we will not create the society we want.

"The UK has a chance to lead, not just in AI adoption, but in AI safety. Get both right, and we can unlock growth while ensuring the benefits of AI are open to all."

AI diffusion in the UK

Microsoft's wider AI diffusion report shows the UK has leapt from 35.6% adoption to 43.7% as of the second quarter of 2026. That ranks the UK second in the G7 when it comes to adoption rates after France, and eighth globally, according to Microsoft's figures.

The report noted that this shows a disconnect between the countries making frontier AI and applying it, with the US and China centered in most discussions about the technology.

"This overlooks a distinction between frontier AI and the more prosaic routine, task-level AI use through which most productivity gains are likely to be realised: tools embedded across routine business processes, public services, and everyday work," the report notes.

"Frontier capability does not automatically produce broad diffusion, as the United States’ comparatively low adoption rate of 33.0% illustrates, ranking at 21st globally in Q2 of 2026."

Development vs diffusion

Notably, the study found that the UK can't match the US or China in frontier capital spending, adding that an "excessive focus on that contest" risks distracting from how the UK can gain economically from the technology.

As a nation, the UK "does not need to be a leader in model development to reap the benefits", Microsoft said. The report added that countries that use these technologies will see the greatest long-term gains.

Regardless, Microsoft said the UK should still strive to meet the government's stated goal of becoming the country with the fastest AI adoption in the G7.

"Our thriving technology sector is playing a fundamental role in the economic growth recognised by the IMF," Hardman commented. "Business leaders and employees across the country are embracing AI to change not only what they do and how they get things done, but how quickly."

The report from Microsoft comes amidst increased investment in AI-related support for British businesses. The company has committed to £23 billion in investment over the next three years to help drive adoption rates, including $15bn in cloud and AI infrastructure.

However, recent reports show the company has pulled out of a data center deal with Nscale. As ITPro reported on 19 October, the deal has fallen through due to lingering concerns over power supply for the Essex-based site.

The Loughton development was set to deliver 50 MW of AI capacity, scalable to 90 MW, and to initially house 23,040 NVIDIA GB300 GPUs. It was expected to create 250 permanent jobs.

FOLLOW US ON SOCIAL MEDIA

Security updates are vital in keeping software secure and users safe, but they could also act as a map for hackers to find weak spots in code, including subsequent patches.

That's according to research from Terra Security, which said the rate of patches later reported to be broken has surged from a "low, steady rate" by eight times.

"Software security fixes are both bug closers and maps: they show where a given bug used to live and how the developer chose to close it," Terra security researcher Oren Yomtov noted in a blog post. "Narrowing down the fix so that it only blocks the reported case can point the next attacker toward undefended gaps around the repair."

While Terra didn't pin the leap in patches needing patching on AI directly, the jump happened this spring, as security models such as Anthropic's Claude Mythos and OpenAI's GPT-5.5-Cyber were announced, though were only released later and in a restricted way to approved partners.

That said, AI has unquestionably led to a boom in the number of flaws being spotted this year.

Spotting broken patches

Terra noted this pattern of patches requiring subsequent fixes in its own efforts over the last year, with bypasses quickly found, necessitating yet another patch. To check that this wasn't simply the company's own experience, Terra researchers looked at every flaw listed in the CVE system as well as GitHub advisories.

Researchers noted it wasn't just Terra seeing an increase in patches requiring fixes.

"Broken fixes have been reported for years at a low, steady rate until 2026, when the share of open-source fixes on GitHub later reported broken rose about eightfold," Yomtov said.

A chart shared in Yomtov's blog post showed reports of open source fixes that needed their own patches within 90 days jumped from below 0.5% to 2.3% in a matter of months, with the leap happening after March 2026.

"The CVE record database gives much wider coverage than our GitHub data and shows the same jump in the same year," Yomtov added.

He added that patches for bugs on the known-exploited list are four times as likely to be reported as broken as flaws from the very same vendors.

"The likely reason is attention: exploited bugs draw more researchers, who study the patch and find what it missed," he added.

What can be done?

Security teams should be aware that patched flaws may still remain a vulnerability, according to Yomtov.

"The upshot is that the "patch and move on" habit is a bad one, especially for the bugs that matter most," he noted.

Yomtov added that one of the most common types of broken fixes are server-side request forgery and prototype pollution, where the usual solution is to create a list of inputs to automatically reject.

"The reason is simple: if the blocklist doesn't foresee every encoding of a bad input, the attacker only needs to find one," Yomtov added.

Beyond that, this technique for addressing flaws highlights what's broken to would-be attackers. As Yomtov noted, a patch that only blocks reported inputs can “give the impression the bug is addressed”, even if it’s still present in the underlying code.

"It functions as a map for attackers, marking out both vulnerable code and what the defender thought the bug was."

That means that security professionals should look "just outside the diff" – as opposed to looking only at the code that was changed – in order to spot potential problems. Calling it the "cheapest form of bug hunting," Yomtov added: "We believe a growing share of attacker effort, and AI tokens, goes into exactly this."

Because of that, he advises security pros should "diff-hunt your own fix before shipping it," as attackers certainly will, taking into consideration whether the patch actually fixes the root cause – rather than merely blocking one input – and whether it covers the whole bug class or might break anything else.

"The same goes for patches you install," he adds. "If a vendor fixes an exploited bug, assume someone is reading the patch for a way around it."

FOLLOW US ON SOCIAL MEDIA