Binance has confirmed a security breach thought to be the largest crypto heist in history, with more than $6.3 billion (£4.7 billion) stolen by hackers.

In a statement, the crypto exchange firm revealed around half of affected assets have been frozen in response to the incident. A significant portion still remains in the hands of cyber criminals, however, and Binance has pledged to “cover all losses”.

Initial findings from blockchain analytics firm TRM suggests Ethereum accounts for roughly $3.79 billion of the total stolen, with Bitcoin accounting for $1.47 billion.

At $6.3 billion, this makes the Binance hack the single largest cryptocurrency theft in history.

Research from Elliptic noted that this “dwarfs” the $1.46 billion stolen from Bybit during a February 2025 attack, which itself was more than twice that of any previous incident.

Who’s behind the Binance hack?

Cybersecurity researchers have attributed the attack to the TraderTraitor group, a North Korean state-sponsored hacker unit associated with the infamous Lazarus Group.

Rafe Pilling, senior director of threat research at Sophos, said the attack bears all the hallmarks of the TraderTraitor group. Sophos’ Counter-Threat Unit has been tracking the group since 2009 under the name NICKEL ALLEY.

“This incident is still in the initial ‘fog of war’ phase, and Binance will need to take time to fully investigate how this attack happened,” he said.

“Initial reports do align with the playbook of the group known as TraderTraitor, a North Korean state-sponsored cluster associated with previous cryptocurrency thefts,” he said.

TraderTraitor is believed to have been behind the aforementioned attack on Bybit last year. In an advisory shortly after the incident, the FBI attributed the attack to the group.

North Korean hacker groups have frequently targeted cryptocurrency exchanges in recent years, with the Lazarus Group in particular having successfully breached a series of firms.

The aim here is to enable the North Korean regime to circumvent economic sanctions and provide it with a steady flow of cash. It’s a tactic highlighted by security experts as far back as 2017, and one that has clearly proved successful given the steady volume of attacks since then.

How was Binance hacked?

Reports on how TraderTraitor gained access to Binance systems are murky right now, especially given the crypto exchange has changed its tune over the last 24 hours.

Initially, it was believed that the incident stemmed from a single compromised developer workstation – a finding detailed by Binance co-CEO Richard Teng in a post on LinkedIn.

“Our initial investigation suggests this security incident may have started with a compromised DevOps engineer's laptop. That gave an attacker access to a service container, where they submitted unauthorized withdrawal transactions,” he wrote.

“To be clear: the attacker did not simply use one engineer's permissions, and this was not a single ‘one-click’ action. It involved a more complex attack process. Our investigation has not attributed responsibility to any individual.”

According to Pilling, this tracks with previous attacks by the TraderTraitor group, who typically aim to compromise employee devices – particularly those used by developers and engineers with deep access to mission-critical systems.

This enables the threat group to “conduct reconnaissance and develop the technical attack,” he explained. “Then, in a relatively short space of time, they launch the attack using rapid, coordinated transactions to steal cryptocurrency from the victim organization.”

While there is a clear link between the group’s techniques and the initial statement from Binance, the company has since revealed a subsequent probe uncovered “additional points of breach”.

The crypto exchange is yet to provide any additional details on the attack.

“This was a complex attack, and we are doing all we can in coordination with law enforcement to resolve it. We are still gathering the facts, and will share more directly as we have them,” the company said in a post on X.

“Staggering in both its scale and potential consequences”

Cybersecurity experts across the globe have weighed in on the Binance hack over the last 24 hours, conveying shock at the scale of the incident.

Jamie Akhtar, CEO and co-founder of CyberSmart, described the incident as “staggering in both its scale and potential consequences”.

“Initial investigations suggest the attack may have begun with a compromised employee laptop, although further points of compromise have since been identified,” he said.

“The fact that cybercriminals were reportedly able to move billions in digital assets in a matter of minutes demonstrates just how devastating a successful attack can be.”

Chris Dimitriadis, chief global strategy officer at ISACA, said incidents such as these “affects trust in cryptocurrency as a whole”. Dimitriadis warned that the incident may prompt further attacks as threat groups look to capitalize on confusion among customers.

“High-profile incidents like this are often exploited by hackers on other platforms to trick users into taking immediate action that could compromise their crypto assets,” he said.

FOLLOW US ON SOCIAL MEDIA

Lakeside Software has announced the appointment of Mark Benson as channel director for EMEA, as the digital employee experience (DEX) software specialist looks to expand its partner ecosystem.

Benson will work alongside global partner director David Whiting to extend the company’s reach beyond its existing partnerships with global systems integrators (GSIs) and major service providers.

A seasoned industry leader, Benson brings extensive experience in developing technology ecosystems and distribution-led partnerships.

Prior to joining Lakeside, he served as head of Arrow ECS’ modern datacentre alliances for EMEA and ANZ and has previously held the role of chief technology officer at Logicalis UK.

His career has also included spells at Roc Technologies, Nexthink, 1E, Liquidware, and RES Software.

Expanding channel opportunities

In his new role, Benson and Whiting will work to engage a wider range of partners as Lakeside expands its channel operations around its DEX platform SysTrack.

Designed to deliver insights and automated resolutions using high-resolution, first-party telemetry, the solution provides organizations with visibility into their IT environments to help identify and tackle issues while reducing operational costs.

In an announcement, Lakeside global partner director David Whiting said the firm wants to build relationships that “create meaningful opportunities” for both partners and customers.

“For global systems integrators and major service providers, that means understanding their existing services and identifying where SysTrack can strengthen and differentiate what they take to market,” he explained.

“We want SysTrack to become an integral part of those solutions, supported by the expertise and insight Lakeside brings to the partnership.”

A revamped partner program for 2027

Alongside Benson’s appointment, Lakeside also revealed it is in the process of revamping its channel partner program and portal. Set to roll out early next year, the firm said its new-look initiative will introduce clearer objectives and incentives, while directing investment and support towards partners developing their propositions around SysTrack.

As AI-capable PCs continue to gain prominence, Lakeside said its platform can help partners advise customers on potential hardware upgrades and investment priorities, while using diagnostics and automation to reduce IT service management costs.

Additionally, partners can also leverage SysTrack to monitor shadow AI use across customer organizations, including identifying which tools are being used, potential security and data risks, and assessing the value of tools such as Microsoft Copilot.

Commenting on the revamp, Benson said Lakeside’s aim is to help partners tailor their propositions around modern customer challenges, rather than simply adding further technology to their portfolios.

“That means identifying where SysTrack can deliver tangible value, whether that is helping customers plan their AI PC strategy, reduce IT support costs or gain greater visibility into how AI is being used across the organisation,” he said.

FOLLOW US ON SOCIAL MEDIA

Governments now face ransomware attacks more than once a day, according to research from Comparitech.

Research from the firm recorded a 47% increase from the second quarter of 2026 to the third quarter, with the number of attacks tracked rising from 90 to 132.

That works out to 1.4 attacks every day, with attacks also surging by 91% compared to the same period last year.

"It goes without saying that governments remain a focus for hackers because of the sheer amount of disruption these attacks can cause, both through system encryption and data theft," said Rebecca Moody, Head of Data Research at Comparitech.

"But what our Q3 report demonstrates is that, as ransomware attacks continue to increase in volume, it has never been more important for government entities to do what they can to mitigate these risks and have a worst-case-scenario plan in place."

The US was targeted with the most attacks, 41 of the total 132 recorded, an increase of 78%, followed by Germany – but ransomware hit governmental organizations across the world.

"No government entity, large or small, previously targeted or not, is immune," added Moody.

More ransomware disruption ahead

Some of the organizations affected faced severe downtime following attacks, according to Comparitech. The firm noted that the Angolan state telecommunications agency Unitel suffered three weeks of disruption after an attack.

The American city of Coweta took two weeks to restore services, while in Ayuntamiento de Collado Villalba, Spain, services were brought online after a week of 16-hour workdays.

Comparitech noted that the US county of Merrimack was able to avoid paying a ransom and dodged serious disruption "thanks to its regular backups."

"As part of their worst-case-scenario plan, government entities not only need to have a clear strategy in place for how they will deal with an attack (e.g. making sure there are regular backups in place to get systems back online as soon as possible), but they also need to assume that a data breach has occurred," Moody added.

High costs

The costs can also be high, the study warned. Beaver County Behaviour Health paid $175,000 to unknown hackers, with Comparitech saying the average ransom demand was more than half a million dollars.

Some authorities faced higher ransom demands. Anne Arundel County, for example, was hit with a demand for $2m, though such ransoms weren't paid. In that latter incident, attackers from Rhysida stole 2.6TB of data, some of it sensitive including medical information, social security numbers and payroll data.

As Comparitech noted in a blog post, it's the second ransomware incident to hit that US county in the last year and a half: "Official letters to those affected in the first attack from February 2025 have only just been sent in the last month."

Moody added that warnings to victims need to arrive in a timely manner to help avoid fraud.

"Hackers will have stolen data in the majority of cases, so issuing warnings to anyone involved promptly is essential to safeguarding this data," she said.

"Better to warn people straight away and retract this warning later on if data hasn't been stolen, than to avoid warning people until months after the attack when there's little they can do if their data has been floating around on the dark web for all that time."

FOLLOW US ON SOCIAL MEDIA

Alibaba Cloud is pushing ahead with its plans for European expansion, launching its first public cloud region in the Netherlands with two new data centers in Amsterdam.

The Chinese firm said the move will help it deliver more resilient, low-latency services, strengthen disaster recovery, and support customers who require their data to be processed and stored locally in the Netherlands and within Europe.

“The Netherlands is one of Europe’s most vibrant digital economies, and our first region here is a direct response to the strong demand we see from local businesses building and scaling with AI,” said Feifei Li, chief technology officer and president of international business at Alibaba Cloud Intelligence.

"By bringing our advanced AI and cloud capabilities to Amsterdam, we are giving customers the in-region infrastructure, performance and data residency they need to innovate faster, scale securely and operate with greater efficiency in the AI era."

The firm plans to offer a suite of cloud computing products spanning elastic computing, storage, containers, networking, big data, security, database, and cloud native services.

It also plans to bring a suite of agentic AI services to the region. These include ACS Agent Sandbox, which provides hardware-level security isolation while reducing the operational cost of AI agents.

Elsewhere, the firm is rolling out its Agent Security Center, an integrated defense platform for AI agents, and AI Security Guardrails 2.0, an upgraded security solution with end-to-end risk detection capabilities.

Agentic SOC, meanwhile, is an enterprise-grade, AI agent-driven security operations platform, while STAROps is an intelligent operations platform.

The company also launched the latest generation of Apsara Stack, a flexible hybrid cloud solution built on public cloud architecture for public sector and enterprise AI workloads.

This, the company said, will deliver more than 80 cloud and AI products, with round-the-clock service to customers worldwide.

Alibaba Cloud’s growing European footprint

The company already has some customers in the Netherlands, including software development company JetBrains, which is looking at integrating Qwen models to power Junie, JetBrains' AI coding assistant, across both cloud and local scenarios.

“AI development is moving quickly, and developers need the freedom to choose the tools and models that work best for them,” said Kirill Skrygan, CEO of JetBrains.

"Working with Alibaba Cloud gives us an opportunity to combine JetBrains’ expertise in software development and AI with Alibaba Cloud’s infrastructure and AI capabilities, giving developers more choice while keeping them in control of how they build with AI."

Alibaba Cloud now has 109 availability zones across 32 regions worldwide. The firm recently launched its first cloud regions in Türkiye and Finland alongside existing regions in Frankfurt, London, and Paris.

It's also increased its data center footprint in Malaysia, the United Arab Emirates, and Hong Kong. By 2032, the company said it's aiming for a total global data center capacity of more than 20GW.

FOLLOW US ON SOCIAL MEDIA

Data belonging to more than 40,000 employees at the Department of Homeland Security (DHS) has been leaked online in a move cyber experts have described as a “severe operational failure”.

A hacktivist group dubbed the ‘Department of Peace’ published the information on agents, which was then distributed online by transparency collective Distributed Denial of Secrets under a database codenamed ‘Icepick’.

As the database name suggests, a significant portion of employees exposed in the incident work for the Immigration and Customs Enforcement (ICE) and Customs and Border Protection agencies.

Leaked employee details include names, job titles, email addresses, and phone numbers, as well as information on agents working on surveillance operations, undercover work, and other various activities.

In a statement, the DHS said it is “aware of a potential breach and is actively working to address the situation swiftly and effectively”.

The federal department added that it will provide more information in due course and will “work to ensure all [agents] are properly protected”.

Dray Agha, senior manager for tactical response at cybersecurity firm Huntress, said the incident is “a severe operational failure that places the physical safety of undercover personnel at direct risk”.

“Exfiltrating this directory data gives hostile actors a complete map of sensitive departments and their internal reporting structures,” Agha commented.

Compromised identity behind DHS breach

The hacktivist group behind the attack claims it gained access to DHS systems through Identity and Access Management (IAM) platform Okta, using exposed user credentials.

A spokesperson for Okta told ITPro: "We are aware of this report. Okta is secure, and we have no evidence our data or systems were compromised."

Graeme Stewart, head of public sector at Check Point, said the incident is a “stark reminder that identity is now the front door for attackers”.

“If the reports are right and the attackers got in by abusing a single sign-on system, then one compromised login was enough to reach the personnel records of tens of thousands of people,” he said.

Stewart echoed Agha’s comments on the nature of information exposed in the breach, warning that this poses a real-world threat for agents working across a range of departments.

“The most worrying part is not the volume of data but its nature. Job titles and contact details for people working in surveillance and undercover roles create a real-world safety risk, not just a privacy one,” he added.

“Exposed data like this also tends to fuel follow-on phishing and impersonation campaigns for months afterwards.”

Government workers in the crosshairs

The DHS data leak comes just weeks after a similar incident involving the Federal Bureau of Investigation (FBI).

As ITPro reported in September, the ShinyHunters threat group claimed responsibility for a breach at the law enforcement agency, stealing information on thousands of agents.

Compromised data included agent names, badge numbers, and even home addresses.

In a similar vein to the DHS breach, exposed information also included highly sensitive data on investigations into foreign intelligence and drug cartel activities.

Security experts told ITPro at the time this data could have severe real-world consequences if it fell into the wrong hands.

FOLLOW US ON SOCIAL MEDIA

Where does enterprise technology go at the end of its lifecycle? The answer, as it turns out for some, is sleepy Erskine. Just a 20-minute drive outside of Glasgow, Scotland, HPE’s Technology Renewal Centre (TRC) is where end-of-life technology and components get cleaned, wiped, and reused in other hardware, or recycled.

It is the main operational hub for HPE Financial Services (HPFS), the company’s financing and lifecycle management arm, which provides closed-loop solutions for its enterprise customers.

The 240,000 sq ft facility is all that remains of Silicon Glen, a local technology innovation hub that operated from the 1940s to the 1990s when American defense and electronics firms first expanded into Europe post-war.

First acquired by HPE in 2011, the facility processes 150 pallets and around 8,000–9,000 individual assets daily, running on a 90% wholesale and 10% certified pre-owned remarketing model. Alongside its similarly-sized sister site in Andover, Massachusetts, the TRCs are global centers of excellence, supported by around 40 local regional intake sites worldwide. Assets are returned to the facility as part of HPE’s IT Asset Disposition Services or at a customer’s end of lease, the latter of which makes up 56% of the assets returned.

This year to date, the TRCs have processed 3.7 million assets, two-thirds of those being servers and PCs, according to HPE. The company says 4.3 million assets were processed globally in 2025, with a mammoth 84% going on to be reused in some way, or refurbished and resold.

Built on a site with a rich manufacturing history – a former Compaq and HP manufacturing facility – the facility’s roots can still be seen within its operations, with almost 70% of workplace assets that come through its doors being HP branded.

The site started with a mere 40,000 sq ft and a fleet of 50 highly skilled employees, eventually growing to a 200-strong workforce, says Jackie Rafferty, TRC operations manager at HPE Financial Services, who himself has been with the facility for 39 years, as he delivers one of many facility tours HPE offers prospective customers.

“The reinvention of this site has been really impressive for decades,” says Matt Harris, SVP and managing director for UKIMEA at HPE, who also started his career at this very site 23 years ago. “It aligns quite well to the conversations we're having now as a major technology renewal center [which] are all around reinvention and a new lease of life”.

The AI boom and a shifting economy

HPE has found a new burgeoning market over the last five years, thanks in part to the increasing global demand for components – largely driven by the rapid investment in AI infrastructure and development. At the same time, tightening macroeconomic conditions are changing how businesses procure this highly sought-after hardware.

“Customers who previously bought cash are looking to buy and use financing,” says Maeve Culloty, president and CEO at HPFS, in her opening presentation before the tour. “HPFS has been financing GPUs for almost 10 years, but the renew market wasn't in existence [back then] and the value of residual [tech] wasn't very clear.”

“About five years ago, we started making major investments and helping our customers acquire GPU technology. What was unclear and uncertain at the time was can we carry a residual value or risk on that technology, and can we see a secondary market for those GPUs? If I were here three years ago, I would have struggled to answer that question…”

“The concern was that the market would have been flooded by the initial investment into H100s and H200s, and that they would come to the secondary market. Now it's super clear: there is a secondary market for GPUs… Our customers do want access and are very happy to take second-life GPUs.”

To meet this demand – and to answer EU and UK sovereign requirements – Culloty says HPE is currently building out its initial GPU capacity and testing infrastructure in Boston. In time, it hopes to bring those capabilities to Europe.

“As workloads move between GPUs and CPUs, we expect continued demand with regard to the performance of AI infrastructure and GPUs,” she notes.

Building trust in ‘Certified pre-owned’

Historically, the industry has had a complicated relationship with refurbished technology. While in theory it makes a great case in a circular economy and for cost-saving, operational stigmas persist, with many procurement teams hesitant to risk pre-owned tech for long-term investment, particularly when it comes to data hygiene.

Leading the tour through the facility’s 2.2m perimeter fence, Rafferty highlights that building trust is Erskine's true core product. “What we see today is data security gaining a bit of a competitive advantage,” he says.

Because of the confidential nature of the memory and storage components it works with, the facility takes every precaution to ensure safety and security. The TRC leverages its roots once again, testing all refurbished units using the exact same OEM-grade testing infrastructure used on Compaq’s original manufacturing lines and is ISO 27001 compliant.

This guarantees that pre-owned equipment meets factory performance standards. HPE notes that the facilities are fully licensed, consistent with HMG IA Standard No. 5 sanitization, and subject to regular audits.

“Everything you see here is appropriately subdivided with extensive cybersecurity because of the money involved in that. Everyone in the operation has been security cleared by the Ministry of Defense. So, we've got high-caliber, vetted staff with huge amounts of experience,” says Rafferty, whose passion for the facility and its workforce is palpable. “This is probably the most flexible staff I've ever had in the last 15 years.”

“In the operations, we have 40 360-degree fisheye cameras in the area. There are infrared alarms and fire alarms across all the fence lines. There are vibration alarms – there's everything,” he explains.

“It's really a top-tier physical security install, really just to showcase to our customers that we are serious about data and willing to use professional equipment to maintain the standard.”

But beyond physical fences, the Erskine facility relies on a rigorous chain of custody to secure the customer's peace of mind. As David Connell, engineering manager at HPE, notes during the tour, the two most top-of-mind questions for customers are “data security, and the second one is data security”.

He explains that the moment a customer's equipment arrives at the dock door, it is registered using barcode scanners, instantly generating a receipt acknowledgment report so the customer has immediate visibility. These assets' serial numbers continue to trace chain of custody, repairs and modification, data sanitation records and the final disposition.

To date, HPE says it has securely sanitized 1.7 exabytes of data – that’s 1.6 million drives overwritten, equivalent to watching around 97 million years of HD movies.

But not every customer is convinced on paper. That’s why Rafferty believes in the power of bringing customers into the operation to see things for themselves. Indeed, the center hosts around 50 customer tours per year.

“Seeing is believing,” he says, adding that every tour they’ve completed has led to a new customer signing a contract with them. “That's where trust comes in… we want to deliver that to customers.”

Real-world value and the circular economy

When customers do sign on, they quickly find that this refurbished technology and flexible financing play a vital role in meeting corporate sustainability targets.

During his presentation, Karim Abu-Dahab, principal technologist, sustainable transformation at HPE, pointed out that “green IT” is often misunderstood by the industry. “Any gain in efficiency that our customers may have almost automatically translates into a gain in sustainability,” he explains.

“A while ago, when it came to IT, after I'm done with a server we just throw it away, right? Now this is not the case anymore,” he says. In fact, HPE estimates that over 8.4 million kg of waste has been kept from landfill – equivalent to the annual e-waste of over 1 million people.

Not only are companies able to support their environmental goals by avoiding landfills, they are also able to recover value from their returned assets, “and then the cycle goes on and on,” Abu-Dahab adds.

“Every year, HPFS hands back about $1 million a day to our customers in order to fund the next innovation,” says Culloty. “We look at both their leased and non-leased environments, and if there's value in that current infrastructure, we return it back to the customer.”

HPE says that through this value return system, $1.25 billion has been infused back into customer budgets between 2020 and 2025. Harris offers the example of Liverpool John Moores University as one customer making the most of this cash injection. He explains the university recently retired old assets and used the resulting money to increase their student hardship loan facilities.

This isn’t the only way HPE is proving refurbished technology can have serious business value. According to Culloty, HPFS’s 90/9 financing model “allows customers to acquire the technology today and pay a very low rate of financing while they deploy that product over a period of time”. With this system, a customer pays nothing in the first 90 days, and then pays one percent for the following nine months.

Rob Pickering, CTO at Tottenham Hotspur FC, is one of HPE’s customers who leveraged this flexibility to support the club's goal of reaching net-zero by 2040. Pickering says the club is currently two-thirds of the way through replacing 63 server rooms and eight data centers.

“From a footprint perspective, we're probably about 60% smaller... because the technologies have become more capable, so you get more cycles per rack effectively,” he says.

Rather than sending the old hardware to a landfill, the club is injecting it back into the secondary market to realize its remaining value and fund ongoing innovation. “Simply running equipment that's eight or nine years old is significantly more expensive than running the new equipment,” he adds.

Indeed, HPE estimates over the course of its operations that it has saved over 29M kWh of energy – enough to charge an EV 486,000 times.

“I think there's a world where we pay almost entirely for the new assets from the power savings… and then we can pay back some of that equipment that we're recycling.”

This is not only bringing down costs, but also directly contributing to the club’s sustainability goals. “It's a win-win-win,” he says.

“We want to be innovative, we want to be sustainable, we want to make sure we deliver the best experiences to our fans and HPE helps us do all of those in a way that's financially responsible and environmentally responsible.”

Just 3% of organizations have been able to achieve “desired cost savings” through productivity gains, according to new research from Gartner.

A survey conducted by the analyst firm highlighted a growing disconnect between board members and the on-the-ground reality of AI.

Despite the small number of firms who’ve recorded gains, three-quarters of board members still expect AI to deliver value in terms of productivity and costs.

Moreover, Gartner’s survey found that 85% are planning to spend even more in the coming year as they ramp up adoption rates.

CV Viverito, senior director analyst in the Gartner HR practice, said the survey identifies that while AI shows promise for enterprises, many are still failing to unlock tangible value.

“Ultimately, organizations will not generate cost savings from AI at this point,” he said. “The greater opportunity is to use AI to do things that weren’t possible before, such as shifting employee time into new capabilities, outcomes, and sources of growth.”

Using AI to unlock time savings – and thereby costs – for employees isn’t proving easy, however. A similar study from Gartner found that just 21% of the time freed up by the technology was redirected into more “innovative work”.

“There isn’t a struggle to create capacity; that’s happening already as organizations redesign work,” Viverito commented. “What organizations are struggling with is how to make that capacity usable and redirecting it to what is valuable.”

For organizations hoping to “make that capacity usable”, Gartner said those with several key traits and skillsets rank among those recording the most success.

These include those with high AI fluency, which helps them in “knowing when to trust technology, when to challenge it, and how to be accountable for the results”.

Leveraging “human connection” is another area in which workers are using AI to their advantage, the firm noted, particularly in areas such as stakeholders management, teamwork, and communication.

Mixed results with AI adoption

Gartner’s findings mark the latest in a string of studies highlighting lackluster returns from AI adoption in recent years. As ITPro reported in January this year, research from PwC showed widespread discontent among executives after heavy investment in the technology.

In the consultancy’s Global CEO Survey, just one-in-eight CEOs said that AI delivered both cost savings and revenue gains for their business. A third, meanwhile, reported gains in one or the other, but rarely both.

Crucially, more than half (56%) said they’d recorded no significant financial benefit at all. Optimism on this front was also lacking, the survey found. PwC noted that only 30% were confident about AI-related revenue growth across 2026.

A key factor behind growing discontent with AI lies in an inability to push projects from pilot to production, PwC noted. Enterprises have invested heavily in the early stages of the technology, but typically encounter difficulties when integrating the technology across the business.

Indeed, research from Accenture in April this year found that only one-in-ten UK firms had successfully deployed – or scaled – AI in core operations. The consultancy’s Generating Impact report also pointed to a “widening gap” between the basic use of the AI and its broader impact on organizational change.

Put simply, individual workers using the technology are seeing tangible benefits, such as increased productivity and time savings. Yet on a business-wide scale, these gains aren’t be translated into revenue.

Alignment is critical for success

Integration of AI across the business requires close collaboration and enterprise-wide alignment, Gartner noted. A July 2026 survey found that 78% of leaders have no clear alignment on “where AI creates value”.

Arj Bagga, VP analyst in Gartner’s HR practice, said this underlines the importance of a clear-cut strategy and expectations with the technology during the early adoption phase.

“Without a shared view of where AI matters the most for the organization, there is a disconnect in how to position the workforce, and ultimately, how to capture value from AI investments,” Bagga commented.

FOLLOW US ON SOCIAL MEDIA

A new malware campaign uses fake AI apps with names like "GPT-6 Astra", "GPT-5.6 Sol", and "Claude Opus" to infect victims and mine cryptocurrency.

The campaign uses fake GitHub projects to impersonate the applications, and doesn't need phishing emails, as the fake download pages rank prominently in search results - probably through the use of SEO poisoning.

In an advisory, researchers at Check Point said the campaign, dubbed Yoba, uses real OpenAI and Anthropic software, with each download including a genuine, signed ChatGPT or Claude installer. The package looks legitimate, but when the real app runs, the malware runs along with it.

Importantly, neither ChatGPT and Claude nor OpenAI and Anthropic have themselves been compromised. Instead, the attackers abuse legitimate signed binaries and the credibility associated with the brands.

“The AI boom is creating a new opportunity for cybercriminals: they can attack the trust surrounding AI without ever attacking the AI itself," said Eli Smadja, head of research at Check Point Research.

"Yoba shows how search results, recognised brands and even legitimately signed software can be combined to make malicious downloads appear credible."

Duping users

Check Point said Yoba uses several checks designed to complicate automated analysis before moving on to its second stage.

YobaDropper verifies that it was launched by the expected Setup.exe, introduces a lengthy delay if this check fails, applies regional language checks, and requires administrator privileges to continue.

Once these checks have been carried out, YobaDropper deploys YobaLoader alongside a legitimate Windows executable and creates a scheduled task that enables the legitimate executable to sideload YobaLoader after system startup.

It uses trusted internet services – such as Telegram, Google’s DNS-over-HTTPS service, and Catbox – to retrieve payloads, reducing its dependence on traditional command-and-control infrastructure and making malicious communications harder to distinguish from normal activity.

In this particular campaign, the final payload was XMRig 6.26.0, which is used to mine cryptocurrency. However, Smadja said the campaign “should not be viewed simply as cryptomining malware”.

“YobaLoader is a generic loader capable of delivering different Windows executable or PowerShell payloads, meaning the same infection chain could potentially be used to distribute other malware."

The hackers behind the campaign appear to have Russian origins, operating primarily in the UTC-4 time zone, and deliberately avoiding infecting computers set up for Russian and other CIS languages.

To avoid infection, organizations should verify AI software at the source, restrict unauthorized applications and administrator privileges and inspect downloads and application behaviour, Check Point said.

"As adoption accelerates, users and organisations need to verify AI software at its source and apply prevention-first controls to unauthorised applications and endpoint behaviour," said Smadja.

"In the AI era, knowing where your software came from may become just as important as knowing what it does."

FOLLOW US ON SOCIAL MEDIA

The Acer Googlebook 14 is the most accessible and affordable of the five Googlebooks in the initial launch line-up, bringing you a premium 14in convertible with prices starting at £999 inc VAT. Both the price and the laptop itself indicate how Googlebooks depart from existing Chromebook Plus devices. This isn't in any way a cut-price laptop. Google's Googlebook OS is new and somewhat idiosyncratic, but it's more ambitious and less compromised than Chrome OS has been in many areas. From its aluminium-magnesium chassis to its OLED screen to its Core Ultra 5 and Ultra 7 CPUs, the Googlebook 14 is designed to deliver a high-end experience akin to what you'd expect from a Pixel phone. It's informed by Google's experience with Chromebooks, but not constrained by it in the way that Google's Chromebook Plus devices were.

It's undeniably a fascinating laptop, but can it handle serious professional use? Having spent a week working on the Googlebook 14, the answer is, well, complicated.

Acer Googlebook 14: Design

Acer hasn't completely developed its Googlebook from scratch, which makes perfect sense. It's been churning out excellent 13in and 14in 2-in-1 laptops for over a decade, and it's not hard to see echoes of previous Chromebook Plus Spin and Swift Spin devices in the Googlebook 14. It's a lightweight 2-in-1 convertible, 1.15Kg in weight and just under 14mm thick, with a tough magnesium-aluminium body. The familiar hinge allows the screen to unfold flat against the desktop or clamp against the base in a tablet configuration, or sit with the screen outwards in a tent configuration in-between. The latter setup can be useful for entertainment purposes or for ad-hoc presentations.

The inky dark blue finish gives it a very polished, professional styling, and Acer has cleverly kept the branding minimal, and even placed the signature Googlebook glowbar discreetly in the top-left corner of the lid. This shows a colour spectrum while the Googlebook is starting, then glows dimly while it's on as a subtle battery indicator. It also changes colour while Google's Gemini AI is active, to give you some visual feedback, though of course you won't actually see it given its positioning behind the screen. That's a sign that it's more about giving Googlebooks a shared visual identity than anything really practical.

Connectivity is equally stripped-back, with just three USB-C ports and a 3.5mm audio jack. Two of the USB-C ports are 10Gbps USB 3.2 Gen 2 ports, while the third is a Thunderbolt 4/USB 4.0 port, with data transfer speeds of up to 40Gbps. There's no dedicated HDMI or DisplayPort output, but you have DisplayPort 1.4 through the slower USB-C ports and DisplayPort 2.1 through the Thunderbolt 4 port. Meanwhile, Wi-Fi 7 and Bluetooth 6 support mean you're up to date on wireless connectivity.

The keyboard stretches across most of the laptop's deck, flanked by two slim top-firing DTS-branded speakers. There's a slightly odd, squishy feel to it at first, but also a few millimetres of travel and a nice, crisp tactile response. In practice, it's easy to get used to and very speedy, while Google has improved on the slightly odd Chromebook layout by retaining a Delete key in the top-right corner – next to the fingerprint and power button – and by allowing what's traditionally the Caps Lock to operate as both a Caps Lock and the more Google-specific Quick Insert key. As on Chromebooks, Quick Insert is handy for accessing AI features, but sometimes you just want a simple Caps Lock. Press Fn + Caps Lock and you have one.

Meanwhile, Acer has fitted an enormous touchpad for a relatively compact laptop, spanning 125mm horizontally and 90mm vertically. It's silky smooth, sensitive, and very good at spotting gestures, which is handy as Googlebook OS gives us some new gestures to master. More on this later.

Acer Googlebook 14: Display and features

Acer has brought its A-game to its first Googlebook display, fitting a 14in 2880 x 1800 resolution OLED touchscreen with a 120Hz refresh rate. It's a beauty, especially with the Boosted color setting, giving you superb contrast, deep blacks, and extremely vibrant colors. It reaches a 541cd/m2 maximum brightness level with the Natural color setting and 609.4cd/m2 in Boosted, and it covers 100% of the sRGB color gamut with a 130% gamut volume. We couldn't replicate Acer's claimed 100% DCI-P3 coverage, but 91% isn't far off, and it also covers 89.6% of Adobe RGB. Color accuracy is solid, with an average Delta-E of just over 2.

We're not at the stage where many people will be doing color-critical design work on a Googlebook, but this screen wouldn't be an impediment if you needed to. The size and resolution also makes it a great workspace for running multiple productivity apps, with crisp text and plenty of room for split-screen views and floating windows.

The audio doesn't go incredibly loud, but it stays clear and avoids growing harsh across nearly all its volume range, while there's a fairly wide stereo spread. Using the Googlebook in video meetings, we had no problems hearing others or being heard, and the 1080p camera captured clear, well-exposed video even when the lighting wasn't bright.

Acer Googlebook 14: Software

Acer's hardware is great, but it's Google's software that's really going to make or break the Googlebook. Googlebook OS, which now seems to be the official name, sees Google shifting focus away from the web and browser-based approach of Chrome OS to what's effectively a desktop-friendly spin on Android. Some aspects, like the way windows are handled or the toolbar, still feel very much like Chrome OS, but it uses the same Material 3 Expressive design language as Android 17 and gives Android apps the same prominence that Chrome OS gave Progressive Web Apps. Most importantly, it has a comprehensive file manager, to the extent that you can finally add folders to your desktop, creating the kind of barely organised mess that many MacOS and Windows owners know and love.

Some Chromebook users were delighted to throw away the old desktop paradigms, but if you never quite gelled with the purely cloud-focused approach, Googlebook OS can feel more straightforward and usable. You can keep using PWAs and Google Drive where that fits into your workflows, and bring in Android apps and local files where that makes more sense to you. The interface isn't a huge departure from MacOS or Windows, and multitasking features work well. The Android 17 widgets, which you can use AI to create yourself, are great for keeping crucial info in your eyeline, even if the local AI powering them can't always access the services and data that you'd like it to.

However, two things make Googlebook OS distinct. Firstly, Gemini is even more embedded here than it was with Chrome OS on Chromebook Plus devices. The app sits on the toolbar, while content-creation and summary features are never further than a two-fingered tap or a prod of the Quick Insert key away. The AI-powered Rambler voice dictation feature doesn't just accurately recognise what you say, but strips out all your awkward 'ums' and 'errs' and spots when you self-correct. Wiggle the cursor over a section of text or an image on a Web page, and it comes up with context-sensitive prompts to explain or summarize the text or talk about symbolism in the picture. Googlebook OS surfaces AI tools in a useful and appropriate way that Windows Copilot+ has never really mastered.

Secondly, it's designed to work in concert with Android smartphones. Pair the two and, provided both are working on the same Wi-Fi network, you can run your phone's apps on your Googlebook screen, read and respond to messages, and even pass tasks from your phone to your Googlebook. If there's something slightly magic about using smartphone apps you've not actually installed on your Googlebook, that goes double when you switch from your phone to your laptop and find you can carry on with your current browser page or app, just where you left off. It would be even better if it worked every time with every app, but it's still impressive.

App support is still Google's biggest issue. Googlebook OS improves on Chrome OS by having 'built for desktop' and 'optimised for desktop' apps that support the desktop UI and don't feel so much like smartphone or tablet apps. Some, like the desktop versions of Luminar or LumaFusion, actually operate like useful and functional desktop apps that you can use to get real work done. However, there's no ignoring that the Android versions of Adobe and Microsoft's apps remain reduced-functionality mobile versions, or that you're better off using Google Workspace or Microsoft 365 in your productivity workflows than the more restrictive Android apps. This won't be a problem for Workspace users, but if you're in a primarily Microsoft Office-based or Adobe-based environment, Googlebooks aren't a natural fit any more than Chromebooks were.

Acer Googlebook 14: Performance

There's certainly nothing wrong with the performance of the Googlebook 14. We've tested the £1099 Core Ultra 7 355 configuration rather than the £999 Core Ultra 5 325 version, but it feels snappy and delivers benchmark results in line with what we'd expect from the Panther Lake chip. Due to the OS we can't run any Windows benchmarks, but it scores 2487 (single-core) and 11457 (multi-core) in Geekbench, which is in the same ballpark as the Windows-based Dell 16S, which uses the same chip. The score of 1773 in 3DMark's Steel Nomad (light) test is nothing to write home about, while the score of 20866 in Geekbench's GPU Compute test is equally mediocre. Still, the Googlebook 14 isn't likely to be employed as a graphics workstation or moonlight as a games machine.

Battery life is arguably more important, but in our usual video rundown test the Googlebook 14 lasted just only nine minutes over 14 hours. That's not a terrible result, and in a week of working the Googlebook 14 made it to the end of the working day without a recharge. All the same, it sometimes needed to be plugged in again if we had to carry on working in the evening. In this respect it's slightly behind the pace for lightweight Windows laptops, and it's going to be interesting to see how other Googlebooks compare.

Acer Googlebook 14: Is it worth it?

There are a lot of ways in which the Googlebook seems like a big step forward from the Chromebook. The Gemini and Android smartphone integration is just what we'd like to see in a forward-looking laptop. The desktop UI, apps, and file manager make it feel more like a versatile PC and less like a browser-based device with aspirations to do more.

All the same, there's a sense that the wider app ecosystem isn't really where it needs to be yet, and some inconsistencies and occasional glitches spoil the experience. Acer's hardware is fantastic, and a great way to trial Googlebooks without investing too much. However, while Google's software shows a lot of potential, it works best if you're already invested in Android, cloud-native apps, and the wider Google ecosystem. For some enterprises, that's going to be a barrier.

Acer Googlebook 14 specifications

Halloween is upon us, and October has already been full of IT horror stories. French supermarket fridges were filled with spoiled cheeses after internet-connected temperature controls were hacked. And another hyperscaler outage taking down banking services.

While they are different and unique incidents, both raise questions of reliability and safety. Could they have been avoided? Will they happen again? And what can we learn from them?

On this week's episode, ITPro news and analysis editor Ross Kelly joins Bobby and Scott to talk through the biggest stories of the month.

Highlights

"I'm very much of the opinion that some things don't need to be connected to the web. You don't need to have a sprawling IoT web in your home. That's just opening the doors to attackers."

"A lot of the time, when we talk about big hyperscaler outages, the first thing that comes to your head is US East 1. Because when something goes down across the Atlantic, a lot of the time in Europe there's an impact there."

Links

• French fridges hacked in country-wide supermarket attack
• Google Cloud outage explained

Amazon has joined the growing list of companies telling software engineers to stop tokenmaxxing just to look like you're using AI, and instead use the technology only when it actually makes sense.

That's the clear message from Amazon to its engineers via a memo the company chose to publish, telling staff: "if your work does not benefit from current AI tooling, that is a finding, not a failing."

The memo to staff follows reports earlier this year that suggested Amazon staff were using AI for unnecessary tasks in order to move up internal rankings on an AI adoption leaderboard.

The memo was sent in September to software development engineers (SDEs) and software development managers (SDMs).

Not every task needs AI

Terk Terkowitz, vice president and distinguished engineer at Worldwide Amazon Stores, said engineering leaders at the organization had created an "updated role guideline" after concluding that the key elements of software development hadn't really changed despite the impact of AI coding.

"Our most prolific engineers have demonstrated that neither the developer role nor their output is defined by the use of AI," Terkowitz said. "We're now in the era of the Renaissance Developer, blending AI tools with human judgment and domain expertise to build entirely new things."

The new attitude suggests a shift in thinking at the retail and tech giant, following a pattern of companies going all-in in AI only to take a step back — especially after facing big bills from "tokenmaxxing”.

This refers to a practice in which users ramp up their use of the technology, often regardless of whether it’s needed. Indeed, tokenmaxxing has been a recurring talking point across 2026 so far, with some companies rapidly accelerating their use of AI.

Uber, for example, was forced to introduce a cap on AI usage after chewing through its entire annual AI budget in just four months. As ITPro reported in late July, Accenture also followed suit, ordering staff to stop using the technology for basic tasks due to skyrocketing costs.

Elsewhere, Microsoft sent a similar memo to its engineers over the summer, telling them to seek value for customers and the business, as "tokenmaxxing is not what we are optimising for."

AI needs to add value

The memo still makes clear that AI is core to software engineering at Amazon, and a spokesperson told CNBC there was no cap on AI usage at the company.

"We are certain that whatever future best practices are, AI will be at the center of software engineering practice," the memo notes. "If you haven’t already, you should take the time to learn and apply AI into your daily work as soon as possible."

However, Amazon also admitted difficulties with its previous attempts to measure AI using "input metrics" like token usage or AI tool adoption, as well as throughput metrics like code changes or reviews.

"We are all aware of how deeply flawed these metrics are, primarily because they are disconnected from what matters," the memo added, admitting these metrics could be used as a target that would "drive negative outcomes".

These outcomes include high costs from tokenmaxxing and unnecessary complexity contrary to Amazon’s “invent and simplify” mantra.

That doesn't mean Amazon isn't considering metrics, however. Instead, the memo directed managers to consider the bottom tenth of teams when it comes to AI usage as well as the top, to understand why some aren't using the technology and why others are.

"Deploying AI in your organizations requires carefully balancing between exploring new and better ways to do things and investing in doubling down on the ones you already have," the memo said.

Amazon called on its engineers to tell the company when AI isn't useful. "An engineer who can explain where AI does not yet help their work is demonstrating the judgement we are asking for," the memo notes.

FOLLOW US ON SOCIAL MEDIA

Chancellor John Healey's Autumn Budget yesterday included a package of measures aimed at driving data center growth while keeping local communities on side.

Under the new Data Centre Covenant, developers will be expected to make 'credible' commitments for the grid capacity they request, support security of supply, and invest in clean power and net zero while offering benefits to local residents and businesses.

"This Covenant sets out a clear offer: government will support faster and more certain delivery of the data centers the country needs in return for responsible development that delivers lasting benefits for communities," the government said.

"Together, these measures will help keep more of the benefits of AI in Britain, supported by infrastructure that serves our long-term interests."

Data center developers will be expected to agree to a Local Benefit Plan that commits them to 'substantial' investment, developed with the local community and linked to the project’s size. This can be spent on local priorities like transport, parks, and town centers.

Firms will also be asked to minimize water and power use, and to harness waste heat for local homes, schools, hospitals, or businesses wherever practical.

"Developers should create good, well-paid jobs that last beyond construction. They should recruit locally where possible and invest in apprenticeships, colleges and universities,” Downing Street said in a statement.

“Where roles cannot currently be filled locally, they should invest in education and training to enable more local people to access these opportunities in the future."

Elsewhere, data centers should provide secure, resilient UK access to compute for critical services and national priorities, meeting current and future cyber resilience standards.

They should also work with suppliers to develop plans for foreseeable disruption, and take part in government exercises to test arrangements for prioritizing essential services.

Mixed industry reaction

Much of this is aspirational, rather than a set of hard-and-fast rules. Walter Kulvik, digital infrastructure partner at law firm Simmons & Simmons, said most developers are operating under similar principles already.

"Commentary around public support for data center developments has been an increasing issue for a number of years, and major data center developers have already put investment in local communities - both in terms of job creation and development of public infrastructure - into their development plans and budgets," he said.

"As such it is unclear whether the government’s proposal will make much of a difference for the bigger sites and developers."

For developers that can fulfil the criteria, the government will establish a new Ministerial Control Centre aimed at speeding up access to electricity connections.

This will use new powers in the Planning and Infrastructure Act to prioritize strategically important projects by reserving future capacity and reallocating capacity when other projects leave the connections queue.

It will also work to identify locations where capacity may be available before 2030 and enable access to temporary power to bridge the gap to grid connections.

Ash Gawthorp, CTO at Scale Factory, said that despite these measures, power constraints are likely to continue.

"The British data centre covenant acknowledges a real constraint. Faster grid connections and on-site generation might help projects move forward, but they will not make wider power infrastructure problems disappear," he said.

"A major AI data center project in Essex has already lost its anchor customer after grid delays pushed its expected connection into the 2030s. Keeping sensitive NHS and defence data in Britain will require dependable electricity infrastructure."

Kulvik noted that encouraging community investment by offering prioritized grid access or permits for on-site power generation could incentivize the building of larger-scale data centers, particularly where the community investment costs would be a marginal part of the overall cost.

Small-scale developments, though, could find it harder to balance the books.

Matthew Baynes, VP for secure power and data centers at Schneider Electric, said the chancellor’s announcement nonetheless represents a “significant opportunity for a new era of responsible data center development”.

“The opportunity now is for government, energy providers and the data centre industry to work together to turn this commitment into action,” he commented.

“By embracing innovative energy technologies and taking a more integrated approach to infrastructure planning, we can unlock the next wave of AI investment while ensuring data centre growth is sustainable, resilient and delivers lasting value to the communities it serves.”

FOLLOW US ON SOCIAL MEDIA

NCC Group has announced the appointment of Guy Ellis as its CEO following the company’s transition into a pure-play cybersecurity business.

He succeeds former CEO Mike Maddison with immediate effect, who is stepping down following four and a half years leading the business and delivering its transformation.

Ellis takes the role having served as the company’s chief financial officer (CFO) since 2023. During that time, he played a key role in strengthening NCC’s financial performance and commercial discipline, including delivering the successful divestment of software escrow business Escode.

Current group financial director Andy Beaver will become interim CFO to support the leadership transition, NCC said.

“Over the past four and a half years, Mike and the Executive team have transformed NCC into a focused and strategically positioned cybersecurity business,” said NCC Group chair Chris Stone.

“The successful disposal of Escode, the strengthening of our balance sheet and the substantial return of capital to shareholders have created a strong platform for future growth.”

According to Stone, Ellis was identified by the board as the right person to lead NCC through its next growth phase, following an internal and external process.

“Having helped shape and deliver our strategy, Guy brings a unique combination of operational, commercial and financial leadership experience, together with a deep understanding of our clients, people and markets,” he added.

As CEO, Ellis said he will focus on deepening the company’s client relationships, expanding its managed services capabilities, and scaling its cyber expertise.

“We are privileged to work with many of the world's leading organisations and there is a significant opportunity to build on those relationships,” he explained. “As AI continues to reshape the risk landscape, the need for trusted independent cyber expertise has never been greater.”

Building on increasing revenues

Alongside the appointment, NCC announced a trading update for the year ended 30 September 2026, with the company stating it expects full year revenue to be in line with market expectations and adjusted EBITDA to be ahead of forecasts.

The firm’s cyber business is anticipated to generate revenue of approximately £235 million, marking a 3.7% increase on the previous comparable period, while gross margin is forecast to hit a record 38.4%, up 1.8%. Adjusted EBITDA is expected to be £16.3 million – equating to around 6.9% of revenue.

Looking ahead, NCC said its cost and efficiency program is on track as it eyes further organic growth, while financial expectations for the year ahead remain unchanged.

“I want to thank all our colleagues for their commitment, hard work and focus throughout FY26,” Ellis added.

“Everyone at NCC is focused on the significant opportunity ahead of us as we target organic growth, recurring revenues and to drive profits through a continued margin expansion with a plan to get to mid teen EBITDA margins.”

NCC expects to publish its audited FY26 results on 10 December 2026, which it said will disclose a more in-depth update on its growth strategy.

FOLLOW US ON SOCIAL MEDIA

IT leaders are concerned that public key infrastructure (PKI) – one of the most widespread applications of cryptography today – will need to change significantly to support post-quantum cryptography (PQC).

Research from Sectico found that as organizations adapt to shorter SSL/TLS certificate lifespans and the operational demands they create, 78% of IT and security leaders believe that PKI will need to change too.

Organizations are making progress in assessing the systems that might be vulnerable to quantum attacks, up from 14% in 2025, the study found. Another 44% say their assessment is mostly complete.

Meanwhile, 83% have allocated budget to quantum-readiness initiatives over the next year. Of those, 93% expect PQC investment to increase over the next two to three years.

Post-quantum preparations accelerate

Last year, researchers said organizations were mostly preparing for shorter certificate lifespans and the future transition to PQC.

Now, though, both are becoming active operational priorities – priorities that mean a great deal of work across cryptographic discovery, automation, architecture, governance, and investment.

“Organizations have moved from asking whether they need to prepare for cryptographic change to confronting what that change actually requires,” said Nick France, CTO at Sectigo.

“PQC is not simply an algorithm swap, and shorter certificate lifespans are not simply a renewal problem. Both require organizations to rethink how they discover, manage, and adapt the cryptographic infrastructure they depend on, across both public and private PKI environments. That ability to execute continuously is what crypto agility looks like in practice.”

The report examines Merkle Tree Certificates (MTCs), a proposed certificate architecture under development by the Internet Engineering Task Force (IETF), as one example of the architectural thinking underway.

Yet even among those familiar with the proposed MTC architecture, only 40% believe they clearly understand the changes their systems, processes, and environments would require to support it.

Certificate lifespans are getting shorter, with the maximum validity period for publicly trusted SSL/TLS certificates having fallen from 398 to 200 days in March, and scheduled to drop to 100 days in March 2027 and 47 days in March 2029.

This is already presenting problems, the study noted. While 62% report a complete, up-to-date inventory of public SSL/TLS certificates, more than double the 28% reported in 2025 say they are ‘very prepared’ for monthly renewals – largely because they already have automated systems in place.

Nearly three-quarters (73%) said they plan to increase certificate-management automation because of shorter lifespans, and 61% said they'd experienced a certificate-related outage or incident in the past 12 months.

“We’ve entered a time where organizations can no longer manage cryptography as static infrastructure, yet at the same time, we need to make cryptography itself boring again. As algorithms, standards and requirements change, organizations need to be able to adapt without turning every cryptographic transition into a major operational event," said France.

"The next stage in crypto agility is about turning awareness into repeatable, testable, and scalable operations through an approach built around continuous cryptographic discovery, risk prioritization, migration planning and governed change.”

NIST publishes quantum timeline guidance

The research comes after the National Institute of Standards and Technology (NIST) released advice on the best approach and timelines for transitioning away from quantum-vulnerable algorithms to quantum-resistant standards.

"We lay out how certain encryption algorithms people are using today will get phased out,” said NIST mathematician Dustin Moody, who heads the PQC standardization project.

“It’s important to know how a given algorithm might be disallowed in federal systems after a certain date, for instance, or whether it will be allowed but at the user’s own risk. Factors like this can help an organization plan.”

FOLLOW US ON SOCIAL MEDIA

Tech industry stakeholders have voiced optimism in the wake of the UK government’s Autumn Budget.

Chancellor John Healey's inaugural budget includes a £600+ million package to support British AI development, security, and skills capabilities.

Julian David, CEO of techUK, described the funding pledge as a “strong” indication of the government’s focus on AI’s economic potential.

“It signals that government is focused on the right issues on both securing the benefits of AI for the whole of the UK whilst also tackling the biggest questions and challenges around safety, security and economic impact,” he said.

Speaking in the House of Commons, Healey said the government aims to “forge a British way to seize opportunities and guard against the risks” associated with the technology.

On the security front in particular, the government will allocate £165 million for a new National AI Biosecurity Initiative, along with £120 million for the AI Security Institute (AISI).

An additional £60 million, meanwhile, will go toward funding the National Cyber Shield. First announced by the National Cyber Security Centre (NCSC) in May this year, the Cyber Shield initiative will build a nationwide defensive network using AI agents.

Investment on this front will be mirrored by a new £70 million Nation Exposure and Real Time Vulnerability (NERV) Centre, the government revealed. This will help identify cyber-related weaknesses in critical infrastructure.

Alexandra Rose, Head of Global Affairs, Policy, & Partnerships at Sophos, said investment in AI security capabilities will be critical to the success of the UK industry moving forward.

“Strengthening national cyber resilience and continuing to make cybersecurity a strategic priority is always welcome,” Rose commented.

“As AI accelerates vulnerability discovery and cybercriminal activity, investments such as the proposed National Exposure and Real-Time Vulnerability (NERV) Centre offer an important opportunity to strengthen our collective defences.”

Piero Gallucci, Regional VP for UK&I, Veeam Software, echoed Rose’s comments, noting that the investment is a “welcomed” step in the right direction.

“As we scale AI, we must also secure it. And so it’s hugely encouraging to see the Chancellor’s extensive AI growth plan, particularly the £120 million investment in the AI Security Institute and the £60 million allocated to the National Cyber Shield development,” he said.

Sovereign AI in the spotlight

The Budget also confirmed additional funding for the Sovereign AI Fund in the form of a $60 million investment.

Sovereignty has become a recurring flashpoint for firms across the UK and Europe more widely in recent years amidst rising concerns about overreliance on foreign tech firms.

As ITPro reported ahead of the Budget, UKAI said the country risks “becoming a vassal state” due to reliance on overseas technology providers.

The trade body, which represents hundreds of British AI firms, called for heightened investment in sovereign AI and compute capabilities to bolster self-reliance.

According to Downing Street, increased support for the Sovereign AI Fund will “enhance its ability” to invest in UK AI companies and support scaling.

“This will include expanding into a new focus area of Physical and Industrial AI,” the government said in a statement.

Mark Boost, CEO at Civo, welcomed the investment, noting that support for home-grown firms must be a priority for the government.

“Much of today’s Budget is encouraging, with the government having set out genuine ambition for the country’s digital future. Whether that ambition reaches British companies is a different story,” he said.

“If public spending continues defaulting abroad, AI will be running on foreign providers' platforms, with all of the value produced flowing overseas. All of the government’s best-laid plans for its AI goals will go awry if its procurement bravery fails to match its rhetorical ambition.”

Elsewhere, an additional £60 million will support the Sovereign AI’s R&D Procurement Scheme, Healey announced.

Downing Street said this will help provide “innovative solutions to challenges across the health and care system” as well as in AI security and adoption.

Boost once again reiterated that the focus should be directed toward supporting home-grown companies.

“Schemes like the new £60 million R&D Procurement competition are designed to help UK AI hardware and software companies deploy solutions at scale across public services like the NHS,” he said.

“But the sad truth is that UK public cloud spending has defaulted to US hyperscalers for years. Expanding the Sovereign AI Fund with an additional £60 million in equity capacity will help ensure homegrown AI scales securely and sustainably.”

FOLLOW US ON SOCIAL MEDIA

Every AI agent entering a customer environment becomes part of its digital workforce. It can hold credentials and make decisions, yet its identity may never appear in the processes used to govern employees.

That gap matters because agents are moving from controlled pilots into everyday operations. They are connecting to collaboration platforms and business-critical systems where they can send messages and alter records at machine speed. The permissions behind those actions often receive less scrutiny than those given to a new employee.

For Managed Service Providers (MSPs) and solution providers, this changes the customer conversation. Partners need to know what each agent can reach and who remains accountable for its actions.

Many customers will struggle to answer those questions because agents may have appeared through SaaS features or experiments run outside IT. This blurs ownership as a pilot grows, while its original access follows it into production. By the time an auditor starts asking questions, the business may depend on that workflow.

Security researchers recently demonstrated how GitHub Agentic Workflows could be manipulated into retrieving information from private repositories and publishing it in public comments. A routine issue became a route between untrusted input and protected information because the agent could access both.

The case should focus partners’ attention on the architecture around an agent. Every connected system can widen its reach and increase the potential impact if it is compromised or behaves unexpectedly.

Temporary access has a habit of becoming permanent

The route to over-privilege often begins with a reasonable decision. For example, a team wants to prove that an agent can deliver value, so it grants access through an existing service account or API key.

Problems emerge when that access outlives the assumptions behind it. The pilot enters production, yet its original token stays active. New tasks bring broader permissions, while ownership becomes harder to trace.

Traditional joiner, mover, and leaver processes offer little help. Employees have managers and defined roles, but agents may be created inside a SaaS platform, inherit their creator’s permissions, and remain active after that person changes position. Agents need lifecycle events of their own.

OWASP’s guidance for agentic applications identifies identity and privilege abuse as a major threat, covering the misuse of delegated permissions and inherited access. Autonomy gives these long-standing identity weaknesses a larger blast radius.

Our research, surveying 800 IT leaders across the UK and US, found that non-human identities outnumber employees in 83% of organizations. Only 21% have controls in place to govern them. Human oversight is also becoming less common, with a quarter of organizations requiring human review before high-risk AI actions, compared with 40% six months earlier.

These findings should prompt partners to reconsider where an AI project ends. Installing an agent marks the beginning of an access-management responsibility that may last for years.

Give every agent an owner and an expiry date

Partners can start by helping customers build an inventory of the agents operating across their environments. This should include the credentials each one uses and the systems within its reach. Every production agent needs a named business owner, with its purpose recorded in language the customer can understand.

A distinct identity should replace borrowed or shared credentials where the platform supports one. Permissions can then reflect the agent’s job instead of copying the access held by the employee who deployed it.

Least privilege also needs to account for actions. An invoice-processing agent may need to read documents and update selected fields. Changing supplier bank details belongs behind an approval gate. The same principle applies wherever an agent can make an irreversible decision or expose sensitive information.

Partners should plan for the moment when an agent moves outside its intended role. Customers need a tested way to suspend its identity and revoke access. Searching across disconnected systems during an incident is an expensive way to discover that no kill switch exists.

Access should also have a shelf life. Permissions that made sense during deployment may become redundant as workflows change. Reviews tied to the agent’s risk level can remove dormant access before it fades into the background.

In practice, this means helping customers discover their agents, register them with named owners, manage their access and govern their actions over time.

The channel can make agent governance operational

Customers are adopting agents faster than many internal teams can catalogue them. Partners already understand their systems and identity environments, putting them in a strong position to close that visibility gap.

MSPs can add non-human identity discovery to security assessments and then build access reviews into managed services. Solution providers can design role-based policies before an agent reaches production. Managed Security Service Providers (MSSPs) can bring agent activity into monitoring and response processes.

Partners should apply the same discipline to their own operations. An MSP’s internal agent may connect to tools with privileged access across customer accounts. Its permissions deserve as much scrutiny as those of an engineer with administrative rights.

Ultimately, AI adoption will continue because customers can see the productivity gains. Sustaining those gains depends on whether they can trust the access behind them.

Partners that make ownership visible and keep permissions aligned with purpose will offer something more valuable than an AI deployment, and that’s the confidence to put automation into production without surrendering control.

To many enterprises, AI costs – from compute to tokens, licenses, integration, and data – are now a familiar part of company expenditures, as we approach four years since OpenAI released ChatGPT, kickstarting the explosion of generative AI.

Just below the surface, however, is a less visible layer of costs: approvals, testing, audit trails, human review, and documentation all take time and resources, while weak or late governance can lead to rework, additional tooling, and delays to production.

The rise of capable AI models and, in recent times, AI agents that can carry out increasingly complex tasks with less human intervention means that, as pilots move into production, AI governance is now an extra workload spanning IT, security, legal, risk, and data teams.

AI governance is not the highest cost for companies – tokens and licenses are likely to rank higher – but it is an increasingly important part of AI’s total cost of ownership (TCO), and is naturally spread across a variety of teams and processes.

To make sense of the hidden costs associated with the latest AI wave, ITPro spoke to Enza Iannopollo, VP and principal analyst at Forrester, and David Menninger, executive director of software research and distinguished analyst at ISG.

The two analysts share a similar argument: governance is necessary, but the actual costs can vary significantly depending on how and when it is introduced. Controls that are added too late can mean months of additional work, while manual governance can itself become a bottleneck.

How governance gets expensive

As is so often the case in both life and in business, foresight is key, and many of the biggest AI governance costs – monetary, staff time, and otherwise – stem from adding controls too late in the process.

“Unfortunately, in many enterprises, the biggest cost has been retrofitting governance into AI deployments,” says ISG’s Menninger.

“When AI governance is not built into the project from the start, it can add months to the project rollout.”

“Our research of 1,200 AI use cases shows that about one third have made it into production,” Menninger continues. “The good news is that’s double what it was a year ago. The bad news is that two-thirds are still not in production.”

That gap between experimentation and production is where hidden costs can start to pile up.

“The same study indicates that, on average, it will cost twice as much as has been spent already and will take more than a year to complete,” he says.

“These figures suggest that much [of the] cost is not anticipated and that enterprises are learning as they go.”

Governance is only one part of that extra spend, but retrofitting it after the fact adds another speed bump just as companies are trying to move beyond the pilot stage.

Forrester’s Iannopollo argues that the answer is not so much to govern less, but to govern earlier: “Failing to scale an AI pilot is one of the most common costs organizations pay for not building the right governance from the start.”

“Relying on solid AI governance from the start means ensuring the appropriate controls and guardrails are in place,” she says.

“Pilots are the right moment to test them, adjust them, and prepare them to enable scale.”

Having a “human-in-the-loop” comes at a price

AI-driven automation is perhaps the hot trend in 2026, with companies increasingly experimenting with ‘swarms’ of powerful AI agents able to carry out work that until recently would have required human input – but people are still heavily involved in checking the eventual outputs.

In other words, automation does not necessarily remove labour; in many cases, it simply shifts where that labour sits.

“ISG Market Lens research indicates that 90% of AI-enabled work still involves humans, either with AI providing assistance or with humans reviewing and approving the outputs,” says Menninger. The bill for supporting all this human oversight naturally lands on people and the manual processes they perform.

The irony is that AI is often best at automating the most mundane tasks, leaving the hardest work for humans. “The manual review process is typically only needed for the most complex scenarios, so it’s no surprise that those would take more time and effort,” he says.

In effect, the easier work can disappear while the expensive judgement calls remain.

“Human review thresholds seem to be one of the most successful techniques for managing cost and risk,” says Menninger.

“It enables enterprises to focus their resources on the areas with the most exposure.”

The aim, then, is to concentrate their attention where the potential consequences are greatest, not to remove humans from oversight entirely.

“As AI-enabled processes become more accurate and more refined, the percentage of AI-related decisions requiring review will decrease, but our research suggests it will take time. By year-end 2027, only 13% of AI-enabled work will be fully autonomous.”

Iannopollo likewise says human oversight must be targeted: “Humans must focus on reviewing and approving high-risk use-cases, responding timely in situations where AI performance and/or behavior drift, and acting with full authority to ensure the business keeps running, even if they have to ‘kill’ an LLM, an agent, or an entire agentic workflow.”

Manual governance can be a bottleneck

Operating at a small scale, ideas like central boards or manual checks can work well; the problems emerge when companies try to scale them across the organisation. A model that works for, say, ten AI projects can quickly break at 100.

“AI governance that relies only on manual checks and processes becomes a bottleneck,” says Iannopollo.

“Governing AI requires [the] implementation of technical controls, automation, and careful distribution of human-led activities.”

It’s at this point that AI governance moves beyond policy documents and (human) committees and becomes something operational and technical – embedded in the systems used to manage approvals, enforce data and access controls, maintain auditability, and monitor AI in production.

“Our research suggests that enterprises need to supplement the governance provided by AI software platforms and tools,” says Menninger

“For example, only one-third of more than two dozen vendors evaluated fully met our criteria for agent evaluation tools. Less than one-fifth met our criteria for A/B testing and less than half met our criteria for human-in-the-loop reviews.”

“As a result, we recommend that enterprises anticipate they will need to incorporate additional tools and processes to complete their governance over AI,” he says.

Dedicated governance tooling is already becoming a sizable market in its own right: Gartner forecasts spending on AI governance platforms will rise from $275 million in 2026 to $462 million in 2027.

“The other common misunderstanding is that governance always means a lot of processes, controls, and documentation,” says Iannopollo.

“This is certainly true for some use-cases, but not for most. Assessing risks of AI use-cases early means that the measures can be implemented in a proportionate manner.”

“Starting from low-risk use cases increases the likelihood of success, further strengthening the confidence of the organization in AI,” she says.

The scalable option, then, is a risk-tiered governance model that uses automation to reduce the routine burden while concentrating human oversight and heavier controls on higher-risk use cases.

Governance should be an enabler

The costs of AI governance – labour, delayed rollouts, more tooling, oversight – are now clear; the answer for companies is not to minimise governance at all costs.

“Too often [organizations] embrace the rhetoric about governance as a road blocker and an inhibitor of innovation,” says Iannopollo.

“The truth is that in most cases lack of governance is the road blocker.”

Just as companies price in the costs of compute, data, integration, licenses, and so on, governance should be priced into AI projects from the outset.

Making governance proportionate and repeatable is the key, and the later companies leave it in the process, the greater the risk of costly rework and delays. A repeatable, scalable governance model is the dream – one that can grow with AI adoption without requiring the same increase in manual oversight.

The US Cybersecurity and Infrastructure Security Agency (CISA) has urged federal agencies to implement PHP (PHP Hypertext Preprocessor) patches after observing exploits in the wild.

CISA added the two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities (KEV) database on 26 October.

The agency has set a 29 October deadline for Federal Civilian Executive Branch (FCEB) agencies to implement patches, adding that it “encourages all organizations” to follow suit where possible.

“CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619,” CISA said in its advisory.

“These vulnerabilities, known as “php2shell,” allow for unauthenticated remote code execution in PHP. The vulnerabilities affect all PHP installations serving web requests, including Apache with mod_php (Note: PHP considers this highest risk), PHP-FPM, php-cgi, FrankenPHP and LiteSpeed.”

With the deadline fast approaching, federal agencies will be required to update to PHP versions 8.5.12, 8.4.27, 8.3.36 or 8.2.35.

PHP2Shell rocked the web

CISA’s advisory comes after the vulnerabilities sent the security industry, and indeed much of the web, into a frenzy last week.

PHP is a programming language used in web development and underpins up to 70% of websites globally.

On 20 October, maintainers of the language, The PHP Foundation, issued an advisory warning of an impending patch after the critical vulnerabilities were discovered by security researchers.

While the patch landed on Wednesday, the incident sparked widespread disruption and panic amidst reports that the vulnerabilities were being actively exploited.

As ITPro reported last week, Cloudflare CEO Matthew Prince said the company saw “thousands of attempts to exploit it” in the hours before it was publicly announced.

“Across the Cloudflare network we saw thousands of attempts to exploit it,” he wrote in a post on X. “That jumped to tens of thousands in the 45 minutes post-announcement, hundreds of thousands within 2 hours, and millions now.”

CISA recommendations

In its advisory, CISA outlined a series of actions that organizations can take to limit exposure, including:

• Identify and inventory systems running any version of PHP across your organization. PHP is often a component of other software, and its prevalence may not be directly observable.
• Apply the patch immediately, prioritizing internet-facing systems.
• Organizations that cannot update immediately, or that continue to use PHP 8.1 or earlier unsupported versions, should take PHP-based systems offline until they can be patched or updated.
• A web application firewall may provide some protection until systems are updated or patched.
• Review the official PHP security advisory for guidance on patching.
• Monitor for suspicious activity, including PHP worker processes launching shells or downloading tools.

Ramy Rahman, senior principal solutions engineer at ArmorCode, said that although federal agencies might face a tight deadline, it’s certainly possible to meet this “with the right resources”.

“The biggest challenge will be the versions of PHP they’re running, and the dependencies tied to them,” he said.

“Administrators should prioritize upgrading to the patched versions of PHP, including 8.5.12, 8.4.27, 8.3.36, or 8.2.35, depending on their release branch.

"The reality is that many organizations are likely running older, unsupported versions, which introduces the additional complexity of upgrading applications, addressing compatibility issues, or working with vendors to obtain supported fixes.”

For systems that cannot be patched immediately, Rahman said: “compensating controls need to be applied to reduce exposure”.

This includes disabling vulnerable functionalities, restricting access, and taking systems offline if they cannot be adequately protected. The latter of these was recommended by security agencies last week, including CERT-EU and the UK’s National Cyber Security Centre (NCSC).

FOLLOW US ON SOCIAL MEDIA

Organizations are sticking with Microsoft Azure largely due to the risk of financial penalties rather than merit, according to a new survey.

A poll conducted by the Coalition for Fair Software Licensing (CFSL) has concluded that Microsoft's software licensing practices are a widespread barrier to competition and choice.

More than three-quarters (83%) of software and cloud decision-makers said Microsoft's rules meaningfully limit which cloud providers they can realistically consider.

61% that shopped around said they chose Azure to avoid fees, not because it was the better product. Nearly all reported at least one concrete harm from Microsoft’s licensing practices, with 65% reporting three or more.

Notably, if cost wasn't a factor, eight-in-ten said they would migrate workloads away from Azure if Microsoft's licensing restrictions were lifted.

These concerns have led nearly two-thirds of organizations to keep a workload on their own servers, rather than migrating to the cloud, according to the CFSL.

Microsoft licensing practices raise the stakes with AI ambitions

According to the survey, 82% of respondents with AI projects said Microsoft licensing practices have affected which AI platform they can use. More than half (52%) said they’ve subsequently delayed, scaled back, or cancelled a project.

Meanwhile, licensing cost increases have led 56% to raise prices for their own customers, with 42% of all organizations passing on most or all of the increase. More than half have cut other spending, with a third slowing hiring or reducing headcount. 

"Microsoft's customers are telling us the system is broken. Businesses are being steered to Azure by financial penalties rather than by merit," said Ryan Triplette, CFSL executive director.

"They are passing the costs on to their own customers and delaying the AI tools they need to compete. Some are choosing not to migrate to the cloud at all, rather than incur the costs associated with Microsoft’s licenses to do so."

More than two-thirds said they'd been audited in the past three years, with a quarter incurring unexpected added costs – and those who evaluated a competitor say they are 2.2 times more likely to face an audit.

As a result, 94% said they support letting businesses run software they already own on any cloud without added fees, and 86% said federal regulators should examine software licensing practices that limit which cloud providers businesses can use.

"The closer a decision-maker is to Microsoft's licensing practices, the more urgently they want regulators to step in," said Triplette.

"Regulators should take note: what happens next matters to every American business, and every consumer paying more because of Microsoft's anticompetitive licensing practices."

Licensing practices under scrutiny

Microsoft is already facing scrutiny over its software licensing, and is currently under investigation by the UK's Competition and Markets Authority (CMA) over its Microsoft 365 licensing approach.

The CMA also plans to look into the way Microsoft bundles products, whether customers have an effective choice, and the impact of Microsoft’s licensing practices on these choices.

ITPro approached Microsoft for comment, but did not receive a response by time of publication.

FOLLOW US ON SOCIAL MEDIA

Fragmented enterprise communication practices are causing “information overload” for workers, and it’s severely affecting productivity.

That’s according to a new study from Forrester on behalf of Staffbase. The survey found that more than half of respondents typically receive “critical company news and information” across six or more channels.

Crucially, more than one-third (35%) of respondents said they receive conflicting, unclear, and often outdated information multiple times a week. The result is that broader workforce alignment takes a serious toll on employees and general productivity, Forrester warned.

Nearly half (48%) of respondents, for example, reported lower productivity levels and operational efficiency while 44% detailed a higher rate of errors, quality issues, and missed deadlines.

Frank Wolf, chief strategy officer and co-founder of Staffbase, said the study highlights a growing disconnect between how organizations invest in communications technology and how it’s used in daily operations.

“In the UK and Europe, we’re seeing organisations invest heavily in the systems that run the business, and increasingly in AI, but too often that value never extends the last mile to frontline employees,” he commented.

“This research shows both what that gap costs in productivity and accuracy, and how much employees want one place that brings everything together. Closing that gap means giving every employee a place they can trust to find out what matters, get the right answer and know what to do next.”

Tackling information overload

According to Forrester, employees are now pushing heavily for a more consolidated approach to workforce communication.

The consultancy noted that “consolidating what makes sense and connecting what remains helps information and experiences flow across applications, giving employees a simpler, more cohesive way to stay informed and productive.”

Around 83% of respondents said that a single application or platform that brings together “work-related activities and information” would have a positive impact on efficiency.

Demand for AI tools on this front is also growing, the survey found. Nearly half (47%) of respondents ranked AI-powered answers and employee guidance as “among the top three capabilities” they want to see moving forward.

The perils of “context switching”

Information overload has become a recurring pain point for workers and enterprises alike in recent years, with many operating across disparate communications systems and applications.

Research from Workplace 365 in March 2025, for example, found that six-in-ten employees had become overwhelmed by workplace solutions, with two-thirds calling for greater simplification and consolidation.

Working across multiple tools and applications forces workers into “context switching”, and separate research shows this has an adverse effect on productivity and mental wellbeing.

Indeed, context switching is an issue that now spans multiple industries and professions – from cybersecurity to software development and more.

More recent research from Workday shows that switching between disconnected tools and systems wastes nearly a full working day each week, per employee.

Analysis from the firm in May 2026 found that one-in-four UK workers spent seven hours or more each week copying information between applications and various platforms.

FOLLOW US ON SOCIAL MEDIA

UKAI, the trade body for more than 270 British AI businesses, is calling for a dedicated sovereign AI action plan to save the UK from dependency on foreign tech giants.

The trade body said it wants to see next week's budget include a plan for AI sovereignty amidst lingering geopolitical uncertainty and in the wake of recent cloud outages.

"Piecemeal funding announcements are tactical at best, and we need detailed strategy about how the country will build and design a new wave of AI tools to support critical national infrastructure," said Charlotte Wilson, head of enterprise at Check Point.

"This should be written into the defense budget, especially with geopolitical uncertainty and hostile foreign states bombarding the country with increasingly malicious attacks.”

The government has made a number of moves aimed at improving the UK's AI sector, including efforts toward greater sovereignty.

In summer 2024, it launched an AI Opportunities Action Plan, followed earlier this year by a £500 million Sovereign AI fund aimed at boosting support for domestic AI companies. A further £60 million for the program was pledged last week.

Earlier this summer, it unveiled an AI Hardware Plan designed to give a helping hand to home-grown AI chip firms. However, UKAI said that while all three are valuable initiatives, they need to be merged into one overarching strategy.

"On their own, they are building blocks. Joined up as a strategy, they would be transformative," said Flagg.

AI sovereignty in the spotlight

UKAI joins a number of industry associations calling for a more aligned approach to AI sovereignty. Just last week, a new industry taskforce, Project Sovereign AI Leadership (SAIL), called for a clear definition of sovereign AI.

This would entail creating a workload classification framework that grades sovereignty across each layer of the stack - infrastructure, including data centers, compute and networks, data, models and applications, and workloads.

In July this year, the Council for Science and Technology (CST) called on the government to develop a UK AI Sovereignty Plan, set up clear governance and coordination for AI sovereignty choices, and increase investment in long-term domestic AI capability.

“The stakes could not be higher. Without immediate action, Britain risks becoming a vassal state, dependent on countries that control the AI infrastructure our economy increasingly relies on. We have the entrepreneurs, the research and the talent to compete, but they are fragmented and disconnected," said UKAI CEO Tim Flagg.

“Businesses are calling for action and the government has signalled its intent, yet nothing concrete has followed. Next week’s Budget is the moment to act. We urge the Chancellor to fund a Sovereign AI strategy and secure the UK’s place as a world leader in AI, rather than leave our future in other countries’ hands.”

FOLLOW US ON SOCIAL MEDIA

Westcon-Comstor has teamed up with Palo Alto Networks to launch a new channel initiative aimed at accelerating growth for select Westcon partners across EMEA.

Announced at the distributor’s WestConnect event in Barcelona, the Partner Growth Circle has been designed to provide partners with structured business planning, enablement, and growth support to help them build and scale their Palo Alto Networks business.

Westcon-Comstor said it will work with participants to develop joint Palo Alto business plans tailored to priority solutions, target accounts, as well as agreed pipeline objectives, supported by coordinated sales and technical engagement.

In an announcement, Daniel Hurel, senior vice president of Westcon-Comstor’s Westcon EMEA go-to-market business, said demand for Palo Alto solutions has remained strong across the region as AI continues to reshape the cyber security landscape.

“The Partner Growth Circle is about helping partners translate that demand into scalable, repeatable business growth,” he explained.

“By bringing together joint business planning, technical enablement, demand generation and our wider value-added capabilities, we can help partners build stronger pipelines, expand customer relationships and develop more repeatable sources of revenue.”

Growth-focused partner benefits

Partners that successfully meet the targets laid out in their joint business plans will gain access to a host of exclusive Westcon-Comstor benefits, from tailored services workshops and certification support, to demand-generation funding.

They will also be able to utilize the distributor’s existing value-added capabilities – which include its Tech Xpert community, virtual demonstration environments via 3D Lab, as well as sales and pre-sales enablement.

Partner performance will be measured against their business plan and objectives, Westcon-Comstor said, with quarterly reviews designed to maintain a focus on execution and growth.

Additionally, the distributor will deploy its Intelligent Demand (iD) analytics-led sales and marketing program, which uses predictive data analysis to help partners identify the most promising opportunities.

“It is a focused approach built around shared commitments and measurable progress, and the next step in our collaboration with Palo Alto Networks,” Hurel added.

Expanded EMEA collaboration

The launch of Partner Growth Circle marks the latest phase of a long-standing partnership between Westcon-Comstor and Palo Alto Networks, with the pair’s existing distribution agreement spanning multiple markets across EMEA.

Previous collaborations also include SASEvolution, which packages Palo Alto Networks’ Prisma SASE solution with Westcon’s managed services to provide channel partners with market-ready security solutions.

Commenting on the pair’s latest offering, Palo Alto Networks’ vice president of EMEA ecosystems Patricia Murphy said The Partner Growth Circle will equip partners with the structure, enablement, and resources they need to scale effectively in the era of AI.

“By aligning our products and services with Westcon-Comstor’s deep channel expertise, we are creating a clear path for our mutual partners to accelerate growth, expand their technical capabilities, and deliver exceptional value to our joint customers,” she said.

FOLLOW US ON SOCIAL MEDIA

Nearly nine-in-ten (89%) organizations have scaled back or been forced to redesign AI plans due to token costs this year, according to research from Cloudera.

Findings from the firm’s State of Enterprise AI 2026 report show enterprises are still struggling with AI-related spending, despite a notable decrease in token costs over the last three months.

Brian Martin, CTO of Applied AI at Cloudera, said the findings highlight a “new reality for enterprise AI”, adding that “what works today may not make economic or operational sense tomorrow”.

“Costs change, models evolve, regulations shift, and the right place to run a workload changes with them,” he commented.

“Leaders need an AI strategy built for that reality, one that gives them the freedom to adapt without giving up control of their data, governance, or spend.”

Cost volatility spooks IT leaders

The study specifically highlighted cost volatility as a key challenge for enterprises, with nearly half (45%) having moved AI workloads as a result.

According to Cloudera, this shows that “AI’s price tag is starting to shape its path through the enterprise” – and that could spell further bad news in terms of ROI and adoption rates.

Last year’s report, for example, found cost was the leading barrier to AI implementation, and that trend has intensified across 2026 amidst surging token costs.

Figures from the LLM Token Expenditure Index show prices hit over $2 per million tokens in June this year. As of 25 October, the index shows token prices stand at $0.95 per million tokens.

That price decrease will offer little solace for IT leaders, however, many of whom have been battling costs throughout the first six months of the year. Cloudera said the cost of the technology has placed huge pressure on enterprises to “demonstrate returns and manage the ongoing cost of AI at scale”.

More than half (55%) of respondents said their AI investment increased, yet despite greater spending that is yet to translate into “clear returns”. Indeed, 58% of respondents the value generated by AI initiatives is roughly equal to what they cost.

Fewer than one-quarter (23%) said AI generates more value than it costs.

From a business impact perspective, the situation is roughly the same, according to Cloudera, with IT leaders reporting mixed returns on the technology.

“More than a quarter (27%) report little or no measurable impact from their AI initiatives, while 41% have encountered higher-than-expected costs,” the report states.

Cloudera added that for those investing heavily in the technology, its findings “raise questions about how quickly that spending will translate into meaningful returns”.

A year of AI costs

The study from Cloudera is the latest in a string of reports questioning the costs associated with AI over the last year - and there have been a number of high profile incidents involving lavish overspending.

Uber, for example, revealed it blew through its entire annual AI budget in just four months, prompting the ride hailing firm to introduce spending caps for staff.

As ITPro reported in late June, Accenture also ordered staff to stop using AI for basic tasks such as converting PDFs to slides amidst rising costs.

It’s worth noting that a key factor behind these incidents lay in the tokenmaxxing trend, rather than general costs associated with AI. This is a practice of maximizing AI use within the enterprise by incentivizing staff to use the technology.

Some companies introduced leader boards to track usage rates, while others used it as a means to measure productivity.

In response to growing costs, some enterprises have begun reviving time-tested FinOps practices, as ITPro reported in late July, enabling them to better track costs and cut down on spending.

Cloudera’s report also highlighted a sharpened focus on this front. Nearly all enterprises believe they now have “some visibility” into AI spending, which marks a move in the right direction.

“Ninety percent say they can measure end-to-end AI costs at least somewhat accurately,” the report notes. Cloudera added that there’s still room for improvement here, however.

“Only 27% say they can do so very accurately, suggesting there is a considerable gap between having a general understanding of AI costs and a precise picture of where that spending goes.”

FOLLOW US ON SOCIAL MEDIA

Anthropic is set to go public in late November at a valuation of between $1.5 trillion and $2 trillion. The higher end of the range would make it the biggest initial public offering (IPO) ever, beating SpaceX’s $1.8 trillion public debut in June. The Claude creator filed its much-awaited IPO prospectus on Monday 26 October, giving investors and tech leaders a peek into its financials, especially its dependencies.

The document, also known as an S-1, highlights a reliance on a limited number of customers for its revenue. Nearly half (47%) of sales in 2025 were routed through its cloud partners, Amazon and Alphabet’s Google. Meanwhile, each of its two biggest customers, who remained unnamed, accounted for 12% of revenue last year.

Some progress is being made to reduce this dependence. While 48% of revenue between January and September this year came through its cloud providers, the five biggest customers accounted for approximately 25% of revenue for the nine-month period. No single customer had a share greater than 10%.

The company noted in its filing: “We anticipate that we will continue to derive a significant portion of our revenue from a limited number of customers for the foreseeable future, and in some cases, the portion of our revenue attributable to certain customers may increase in the future.”

The IPO prospectus has raised questions about an overreliance on AI models and vendors – and the risks this brings for enterprises.

“It’s a reminder that the model, the vendor and the route you access it through can all change for reasons outside your control,” cautions Jan Karstens, CTO at AI-powered SAP automation platform Avantra. For example, enterprises that have built their critical business processes around one AI supplier could face operational disruption, even if it’s temporary.

“We’ve already seen what that looks like. When Anthropic was ordered to block foreign nationals from its top models this summer, the only way to comply in time was to switch them off for everyone. Teams that had already assumed any model or vendor could disappear overnight barely noticed. Everyone else had to scramble,” says Karstens.

Charles Radclyffe, CEO of SaaS enterprise provider EA Global AI adds: “The interesting thing about the reported Anthropic numbers is that they're not just a story about one AI company. They're a reminder that concentration risk runs through the AI ecosystem, and enterprises need to understand where those dependencies sit.”

Earlier this year, automation platform Zapier polled 500 US executives and found that 47% of enterprises would stop functioning properly if their primary AI vendor were to shut off its service tomorrow. Just over a quarter (27%) indicated they were reliant on AI vendors for nearly all of their business operations.

Question vendors’ own dependencies

Part of the problem is that enterprises focus too much on model performance, when they should be questioning their AI service’s supply chain.

“If a provider depends heavily on a small number of cloud platforms, strategic partners or major customers, changes in those relationships can ultimately affect enterprise users through pricing, availability, product direction, or service levels,” says Radclyffe.

So, what does he think CIOs should be doing? Asking companies supplying the AI services about their own critical dependencies, how workloads are delivered, the knock-on effect if key commercial relationships change, and what notice customers receive before major model changes. “AI procurement needs to become a resilience conversation,” he stresses.

Karstens believes asking model makers about their critical dependencies is reasonable, but he cautions against acting on their responses alone. He’d “be mildly nervous about concentration among my direct AI vendors. I’d answer that with my own visibility and multiple suppliers, not with questionnaires.”

CIOs need to “start from the assumption that any model, vendor or access path can be withdrawn without warning,” he adds. “They should build governance that doesn’t depend on any one of them staying in place. Periodic audits and vendor assurances after the fact aren’t enough when the [AI] market moves fast.”

Be wary about vendor lock-in

A key takeaway from Anthropic’s S-1 is that consumption-based, or per-token, revenue made up 83% of revenue in the first six months of 2026. However, many of its main customers are not locked into long-term contracts.

AI model makers are pushing hard for customers to agree to contracts to secure multi-year revenue visibility amid fierce competition. If enterprises find themselves signing contracts, then they need to ensure they agree to “meaningful exit rights, portability provisions, and the ability to export not just data but the prompts, workflows and evaluations that support business processes,” advises Radclyffe.

Karstens agrees. “Vendors like Anthropic are moving deeper into everyday work, with documents, slides and projects now living inside the AI tool itself. If that continues, data portability will become a real issue for CIOs in the next 12 to 24 months.”

The Zapier study also surveyed senior executives about AI vendor lock-in. Just over eight in 10 (81%) admitted they were at least slightly nervous about being locked into contracts, with 29% very concerned. Almost half (46%) were worried about data migration and an overreliance on a single vendor. Sudden price hikes were a concern for 41%, while another major worry for 37% was having a single point of failure.

Ideally, enterprises should avoid finding themselves in a situation where these worries come to fruition by ensuring they have a practical alternative to turn to if costs rise, there’s a change in circumstances, or unexpected events.

Radclyffe sums it up perfectly: “There's nothing unusual about [vendor] concentration in a fast-growing technology market. The risk comes when enterprises don't understand how dependent they've become until they're forced to make a change.”

When people say they prefer to work on a bigger monitor, very few will have anything as large as the UltraSharp U5226KW in mind. This is a monitor that takes the ultrawide designation as a challenge: its 52-inch IPS Black panel measures 120cm wide, and its 6,144 x 2,560 resolution packs in almost twice as many pixels as a standard 4K display.

Walk around the rear of the monitor, and its other asset – no pun intended – is connectivity. Thunderbolt 4 is centre stage, and this ferries 140W of power and 6K video and data via a single cable. This is allied with a further three upstream USB-C ports which allow you to take full advantage of the vast 52-inch canvas by using four systems on the same display – either one at a time, or simultaneously in the U5226KW's various picture-by-picture modes.

Suffice to say, the U5226KW is a power user's dream come true. But whether you're just someone who wants an all-in-one alternative to a multi-monitor setup or a dedicated day trader, the question is whether the UltraSharp U5226KW is worth paying well over £2,000 for.

Dell UltraSharp U5226KW : Design and Features

Before you do start reaching for the company credit card, take a moment to ask whether your PC or laptop can actually handle the demands of the U5226KW. Achieving its maximum 6,144 x 2,560 resolution and 120Hz refresh rate requires a dauntingly large 47Gbit/s of data; an amount so high that not even the fastest current connections can supply it without using data compression. The result is that you'll require a DisplayPort 1.4, HDMI 2.1, or Thunderbolt 4-equipped device and need Display Stream Compression to be enabled, too. Drop below those specs, and you may have to make do with 60Hz – or drop the resolution – so it's essential to check your PC, laptop or Mac's specifications before buying.

If you can vault those particular hurdles, then the next challenge is physical – actually getting the monitor onto your desk. To put it in perspective, if you've seen any of Dell's recent and more sensibly-sized 32in UltraSharp monitors, then just try to imagine what they look like to a 2-year-old child. This is the kind of scale which the U5226KW commands to an adult – just the panel itself is over 51cm tall and 120cm wide. That's around the width of two 27in monitors side by side, and one and half times as tall.

Despite the Alice in Wonderland proportions, the styling is classic UltraSharp. The wedge-shaped base is heavier and wider, as you'd expect to keep the monitor stable, and the panel itself is thicker, but the overall design and silver and dark grey palette are instantly familiar. It doesn't feel any more solid than its slightly plasticky stablemates, although this is probably just as well as it'd be unmanageably heavy. As it stands, it's just under 17kg with the stand – so you may want to phone a friend or colleague before attempting to haul it onto the desk.

The adjustable stand is fairly limited in its range of motion, but that's to be expected for such a large panel. There's 90mm of height adjustment and enough tilt, swivel and rotation to get the panel positioned comfortably on most desks.

Talking of getting it positioned: you'll want to take some time connecting all of the cables before you shuffle it into place. If, like me, your desk is hard up against the wall, it's essential to get everything connected first. Once it's in position, it's almost impossible to get around the back of the monitor as it's so tall and wide.

There's plenty of connectivity to choose from, too. The upstream Thunderbolt 4 port is accompanied by another three upstream USB-C ports, and these provide access to the monitor's various connections. In addition to 2.5GbE Ethernet and four USB-A ports at the rear, there are also a couple of front-facing ports which pop out from underneath the panel's front left edge. Press the panel inwards, and a little module drops down to reveal a single USB-A port and a pair of USB-C ports. The USB-C ports support up to 27 watts of power delivery, more than enough for charging mobile devices.

One thing to note: there's no downstream Thunderbolt 4 port for daisy-chaining extra devices – all of the allotted display bandwidth is tied up with refreshing the U5226KW's 15.73 million pixels 120 times per second.

And for some strange reason, Dell has omitted a 3.5mm audio output entirely. This would have potentially been a useful addition to the trio of front-facing ports, and it's a shame there isn't one – the integrated speakers are marginally better than the very poor ones integrated into most monitors, but they're not good. If you want audio that matches the visual spectacle, good headphones or dedicated speakers are a must.

As on most of Dell's pricier UltraSharp monitors, there's also an integrated KVM switch – and here it's essential for getting the most out of the U5226KW's multi-machine, multi-tasking abilities. It's possible to have four devices connected simultaneously, and in hardware KVM mode you can swap between each connected system with a keyboard shortcut (as long as your keyboard is connected directly to the monitor). You can't, however, cycle through the monitor's various picture-by-picture or picture-in-picture modes without reaching around the monitor's lower right corner – no mean feat given the size of the U5226KW – and adjusting the settings using the four-way joystick and on-screen display. That might be a workable scenario for some use cases, but universally convenient it most certainly is not.

This is where Dell's Network KVM feature becomes invaluable. Install Dell's Display and Peripheral Manager software (available for both Windows and MacOS) on every connected machine, and you can cycle through the fullscreen and picture-by-picture split the screen using keyboard shortcuts. What's more, it allows you to move your mouse seamlessly across the screen from one system to another, with the keyboard following suit. If you want to expand one system's view to fill the screen, you can just toggle the view mode with your preferred keyboard shortcut. It's incredibly neat.

There are limitations, of course. With the Network KVM mode enabled, both the Ethernet and USB ports are locked to the primary system. While this primary system can be designated as any one of the four upstream USB-C inputs, it does mean that you'll need to think about which devices you want to be connected to which machine. If you want those USB-connected devices to follow the currently active machine, then you'll need to decide whether you can live with hardware KVM mode – or use a separate USB hub.

One other useful feature is the integrated ambient light sensor. This can be tailored to your preferences and room lighting with the Auto Brightness Range Level, which lets you pick from Low, Med, or High settings. There's also an Auto Color Temp setting which attempts to match the display's white point to your lighting. While some of these modes can tend to create an overly warm, orangey tone to the image, the U5226KW's is far more subtle, just adding a hint of warmth or coolness where required.

Dell UltraSharp U5226KW: Display quality

It's fair to say that the U5226KW looks impressive from the off. The sheer size is one thing, but the clarity is impressive, too. The actual pixel density is a little lower than a 32in 4K monitor, but text remains nice and crisp. In fairness, you'll probably be sitting a little further away than a 32-inch 4K monitor, too, so the slightly larger pixels won't prove noticeable.

The matte anti-glare coating is quite light, and the result is that really bright light sources aren't quite as subdued as with more aggressive coatings. It does a pretty good job of suppressing glare from my office spotlights and skylight, although I noticed a little more glare than I'd like from the spotlights behind my seating position. It's a question of trade-offs – more glare suppression would add a more intrusive grain to the image. I think Dell's made a sensible compromise for a display of this size, but brighter offices hanker for a more aggressive anti-glare finish.

Color reproduction is very good indeed. It's immediately obvious that the panel reproduces an impressively wide palette – the default Standard mode renders colors with a decidedly over-the-top vibrancy. Strictly accurate for sRGB content, no. Pleasingly oversaturated, yes.

There are color-accurate modes if you want them, however. Dell claims that the panel reproduces 99% of the P3 color space, in addition to 100% of sRGB, and it promises an average Delta E of less than 1.5 in all of its factory-calibrated sRGB, Rec.709, DCI-P3 and Display P3 modes. The good news is that that is exactly what it delivers – I didn't see any average Delta E above that in any of the tested modes, and the color coverage was almost as promised, too, with 100% coverage of sRGB and DCI-P3 coverage falling just short of the claimed 99% at 96.5%. The only disappointment here is that there's no Adobe RGB mode.

All the usual plus points of an IPS Black panel are in evidence. Viewing angles are nice and wide, and the panel's subtle 4200R curve gives you a little more latitude to sit fairly close to the monitor. You don't want to get too close, though: both color shift and IPS glow become more noticeable in the panel's corners as you lean in.

The backlight and panel uniformity are more consistent than you might expect given the basic LED edge-lit design, too. You can see a little vignetting around the panel's edges where brightness isn't as consistent as it should be, but the U5226KW is actually more consistent than many smaller panels I've reviewed. On my review unit, brightness was about 10% lower on one section along the right-hand edge, 12% dimmer in the far top left corner, and only the very top right corner was a noticeable outlier – it was 16% dimmer than the centre of the screen. That's not going to trouble professional design displays, but it's respectable for such a large panel. Perfect it is not.

Similarly, the IPS Black panel produces much better contrast than standard IPS panels, but it's resolutely unimpressive when compared with TV-sized OLED panels. Blacks tend to look soft and greyish, and the result is that dark scenes lack the punch and perfect blacks of OLED. That said, it actually exceeded Dell's claimed 2000:1 contrast ratio, producing 2,234:1 in the Display P3 preset. That might not set any records, but it's more than good enough for the intended uses of the display.

One thing that's entirely absent is HDR, but given that brightness tops out at around 369cd/m2 and contrast is mediocre, that's a sensible decision by Dell.

Like all IPS Black panels, motion clarity is not a strong suit. Stand still in a game, and you'll wonder at the sheer size and clarity of the image. Start moving, however, and that clarity dissipates as the pixels struggle to keep up. While switching the response time mode from Normal to Fast helps to speed things up a tad, it's not enough to bring action into perfect crystal-clear focus – and at 60Hz it actually adds a really intrusive amount of inverse ghosting, which causes bright halos to float around the edges of moving objects. If gaming isn't a priority, then this probably won't bother you unduly – and it's more than good enough for movies – but if you're looking at the 120Hz refresh rate and hoping for crisp high framerate gaming, you'll come away disappointed.

Dell UltraSharp U5226KW: Is it worth it?

The UltraSharp U5226KW is not the right choice for every desk. Color-critical workers will benefit more from a display that supports hardware calibration – the stunning Dell UltraSharp U3226Q, for instance. Users who demand more impactful, blur-free gaming and a vivacious HDR movie experience should naturally consider an OLED monitor – or perhaps a TV – instead.

The U5226KW's talents lie in more productive enterprises. The sheer size of the panel fundamentally changes how you interact with the display: whether it's countless data dashboards, project management tools, vast spreadsheets, documents, or pixel-hungry applications, there's the scope for huge amounts of data to usefully coexist. Given the right desk – and the right use case – the U5226KW deserves to be a big hit in a very small niche.

Dell UltraSharp U5226KW specifications

Microsoft Teams will soon use AI to watch for phishing and other scams, the company has revealed.

In a post detailing new features on the roadmap earlier this month, the company said AI-powered anti-phishing tools will arrive in November. The new features follow a series of attacks in which Teams has been targeted by hackers to spread ransomware or otherwise gain access to company networks.

The aim, Microsoft said, is to use AI to better understand messaging conversations in Teams, in particular "first contact chats" with an outsider.

"Microsoft Teams is introducing AI-powered phishing detection that uses conversation context to identify phishing and social engineering in higher-risk messaging scenarios, primarily external first-contact chats," the post explains.

"Additional protection may apply in certain regions or scenarios," the post continues. "The capability is used only for security protection, and users may see warnings when suspicious activity is detected."

The new phishing detection capabilities will work in the background, spotting phishing, impersonation, and other social engineering techniques by looking for suspicious behavior and other indicators such as dodgy links or files.

Conversation context

The AI-powered tool will use conversation context, Microsoft said — which does mean it needs to look at messages in Teams. However, the tech giant said none of the content will be retained.

"This capability is used only for security protection and not for productivity, summarization, advertising, user monitoring, or other non-security purposes," Microsoft said in a post.

"Customer message content is not retained by the detection system for model training or other secondary uses."

The feature will be enabled automatically, rolling out over November and December, and are part of wider efforts to protect Teams as it increasingly becomes a target for phishing scams.

Rise in Teams phishing

Microsoft Teams has become a popular hunting ground for cyber criminals. Last year, Sophos spotted hackers attempting attacks via Teams by pretending to be tech support workers.

Months later the FBI and other authorities warned about the Scattered Spider hacking group abusing Teams and Slack to target employees.

In January, Check Point researchers warned Teams users to be on alert for scam guest invitations that attempted to trick users with false billing and subscription notifications that look as though they came from a genuine Microsoft user.

Just this week, Arctic Wolf Labs has spotted hackers using Microsoft Teams' feature that allows for external chat creation for impersonation scams or to send dodgy files, studying more than 400 incidents.

"Microsoft Teams ships with external access (federation) turned on by default, meaning any Teams user in another Microsoft 365 tenant can find, chat with, and call an organization’s employees, provided both tenants allow external access," Arctic Wolf noted in a post.

"This is the feature attackers most frequently abuse. This activity does not exploit any known Teams vulnerability; it abuses a legitimate, default-on collaboration capability."

These are the sorts of "first contact chats" that Microsoft is hoping to address with the new AI feature.

FOLLOW US ON SOCIAL MEDIA

Legacy systems and widespread human error are putting police and fire services in England and Wales at huge risk of cyber attacks, according to the policing and fire inspectorate.

A report from His Majesty’s Inspectorate of Constabulary and Fire & Rescue Services (HMICFRS) noted that while there's been some improvement in cybersecurity over the last six years, it’s still not enough.

"The cyber threat to police forces and fire and rescue services is significant and expanding rapidly. A major cyberattack is not a hypothetical scenario and successful attacks have been disruptive, put the public at risk and were expensive to fix," said His Majesty’s inspector of constabulary Michelle Skeer.

“While there have been gradual improvements, many forces and services still need to urgently redouble their efforts to respond to the increased risk of cyber attacks."

According to the report, the biggest issue lies in continued dependence on legacy systems. Indeed, tech leaders in both services identified legacy dependence as their greater strategic cybersecurity risk.

Similarly, there are significant concerns about cybersecurity risks linked to third-party ICT suppliers, particularly where suppliers store or manage sensitive police data covering victims, safeguarding, intelligence, and ongoing investigations.

Gaps in training are also a lingering problem, the report noted, with poor security controls for staff joining, moving within, and leaving services. Elsewhere, researchers found poor password management and a lack of up-to-date security measures such as multi-factor authentication (MFA) were rampant.

Cyber resilience needs to improve

Inspectors warned that not enough is being done in terms of preparedness and resilience arrangements, with "unsatisfactory" arrangements for backing up and restoring ICT systems following a cyber attack.

All these issues are being made worse by a lack of commitment from leaders, with several senior police and fire leaders saying that they didn’t consider cybersecurity to be part of daily operational decision-making.

Unsurprisingly, HMICFRS wants to see changes and has made a series of recommendations.

These include making sure all police and fire services achieve baseline standards for cybersecurity capabilities, introducing robust external validation to check up on the services’ own assessments of cybersecurity capabilities, and improving the procurement and contract management of third-party IT suppliers.

It also wants improvements to the way government and policing cybersecurity leads collaborate, and wider use of the Police Digital Service’s National Management Centre, along with a similar national capability for services.

In terms of preparedness and resilience, the report noted that services require significant improvements on this front.

HMICFRS said police and fire services need to be capable of responding swiftly to a cyber attack and should improve learning and development for both security staff and senior leaders.

"Cybersecurity should be viewed as a core organizational priority and not solely a technical risk. Leaders need to prioritize and invest in their cybersecurity arrangements to improve their organization’s ability to prevent, detect, respond to and recover from attacks," said Skeer.

“The government’s program of police reform and local government reorganization could offer both sectors opportunities to improve and better co-ordinate the approach to cybersecurity. These opportunities to strengthen cybersecurity cannot be missed. Protecting systems and data is essential to protecting the public.”

Repeated warnings

The report from HMICFRS comes after the Information Commissioner's Office (ICO) issued a stern warning to the Metropolitan Police Service earlier this month over security practices.

The data protection watchdog found that members of staff had uploaded data to an unauthorized third-party platform, putting highly sensitive information at huge risk.

Elsewhere across the UK, security capabilities have contributed to a number of incidents, most recently an attack on Dyfed-Powys Police earlier this month, which caused disruption to some non-emergency systems.

"We intend to carry out a reinspection in due course, to assess each sector’s progress in implementing these recommendations," she said. "Police and fire and rescue ICT systems need to become much more secure."

FOLLOW US ON SOCIAL MEDIA

Previder has announced the acquisition of London-based managed service provider (MSP) Wanstor, as the Dutch IT solutions provider continues its international expansion.

The deal marks the company’s entry into the UK market, building on its established presence in the Netherlands, Belgium, and Germany.

Previder, a part of the Odin Group, specializes in helping organizations build, manage, and secure their IT environments, offering expertise across cloud, infrastructure, cyber security, digital workplaces, data, and AI.

The firm employs 650 IT specialists and operates its own data centers located in the Netherlands.

Founded in 2002, Wanstor provides a range of IT services across cyber security, cloud, data, and AI, backed by 24/7 service desk support. The company has around 200 employees on its books.

Previder said Wanstor’s services target three key areas: enhancing the user experience, ensuring the responsible adoption of AI technologies, as well as strengthening security and digital resilience.

In an announcement, Odin Group CEO Arno Witvliet described UK MSP’s services and wider vision as “closely aligned” with Previder’s.

“We share the belief that technology creates real value when organisations can use it securely, reliably and with a clear purpose,” he said. “Wanstor’s presence and expertise provide us with a strong foundation in the UK and create significant opportunities for us to grow together.”

International growth ambitions

The Wanstor acquisition is the latest phase of Previder’s international growth plans and further expands its reach across North-West Europe following its recent purchase of Belgian IT service provider AppSys ICT Group. Last year, the MSP also snapped up Belgian IT firm Assyst Europe.

By extending its operations to the UK, the company is looking to create a broader international platform for sharing expertise and strengthening support through local teams.

The MSP said Wanstor’s established UK market presence, combined with its local expertise and existing customer relationships, will provide a solid platform for growth in the region while retaining a local service delivery model.

For Wanstor, company CEO Francesca White said the acquisition represents “an exciting next step” for the business that will help create fresh opportunities for its own future growth.

“We will retain the local commitment and customer intimacy that define our organization, while gaining access to a broader pool of knowledge, capacity and expertise across the group,” she explained.

“This gives us a stronger foundation to develop our services and help customers respond to evolving technology, security and operational need.”

Clearwater acted as exclusive sell-side advisor to Wanstor. Financial terms of the acquisition were not disclosed.

FOLLOW US ON SOCIAL MEDIA

Tesco appears primed to switch to an open source VMware alternative as the supermarket giant continues its feud with the virtualization provider.

The company has posted an ad for a new ‘Head of Software Engineering: Edge Platform’ role in recent weeks, with the ad first spotted by The Register.

According to the posting, the new engineering lead will coordinate “two major, interconnected engineering priorities”.

This includes the creation of a “robust, scalable software driven edge management platform” alongside modernization of the firm’s edge virtualization estate “through the migration from VMware to Proxmox”.

Proxmox Virtual Environment (Proxmox VE) is an open source server management and virtualization platform based out of Vienna.

Tesco’s “business-critical” focus

The new position, which is based in Bengaluru, is a significant one, according to Tesco.

Indeed, the supermarket giant said the edge platform is “business-critical” and provides the “underlying computing environment and software capabilities that enable applications to run across our stores”.

“Store technology must remain dependable despite connectivity disruptions, constrained local resources and the complexity of managing software and infrastructure changes across thousands of locations,” the job ad reads.

“Failures or poorly executed changes can directly affect store operations, colleague productivity, and customer experience.”

The ad notes that Tesco is primarily seeking those with:

• “15+ years of experience in software engineering and technology”
• “Strong technical foundations and credibility across Java, Micronaut or comparable Java frameworks, microservices, REST APIs, Python automation, and Terraform”
• “Solid experience with Linux operating systems, edge computing, server hardware, virtualization and storage technologies, including the design, integration, deployment, or lifecycle management of infrastructure platforms”

Those who fit the bill have their work cut out for them, based on the job description.

Tesco said the new engineering head will “define and execute” the company’s edge platform engineering strategy, modernization roadmap, the aforementioned migration, and implementation of automated engineering practices.

A long-running spat

The job ad – and apparent shift away from VMware – marks the latest in a long-running spat between the supermarket giant and VMware owner Broadcom.

As ITPro reported last year, the company filed a lawsuit against Broadcom for £100 million over VMware licensing contracts.

At the time, Tesco accused the company of failing to maintain support for business critical software which underpins operations across the UK.

Broadcom has been repeatedly criticised for changes to VMware’s licensing setup since acquiring the virtualization giant in 2022 for $61 billion.

In court filings last year, Tesco said licensing changes raised prices by 237% and accused Broadcom of refusing to negotiate terms or packages. The filing alleged that Broadcom is taking advantage of its market dominance to raise prices – an accusation it has faced from European industry stakeholders.

In March this year, CISPE lodged an antitrust complaint with the European Commission, alleging that Broadcom uses unfair software licensing terms to maintain a dominant position in the European cloud market.

FOLLOW US ON SOCIAL MEDIA

Microsoft is offering buyouts to 60,000 staff, equivalent to more than a quarter of its total workforce as the company looks to further reduce headcount.

That figure comes via sources in multiple reports, but Microsoft has confirmed the looming job cuts in a memo to staff, since published online.

The reduction comes as Microsoft invests further in AI and amid wider job losses in the industry. Earlier this year, Microsoft laid off 4,800 staff following a voluntary retirement offer in the spring.

Microsoft reports its quarterly results later this week.

Leaving by choice

As many as 60,000 workers are eligible to opt for the “voluntary exit” offer, sources told CNBC, out of a total global headcount of 223,000. It’s worth noting that the 60,000 figure represents those eligible, not the number expected to take up the offer.

Indeed, one publication reported that Microsoft predicts a smaller proportion of staff to take up the deal than a voluntary retirement offer earlier this year. That offer was accepted by around 30% of those approached by the tech giant.

Another source told Reuters that the buyout offer would be applicable across a wide range of business divisions, including AI experiences, Copilot, finance, gaming, Windows + Devices and more, but not marketing, commercial business, or security.

In a memo published online, Microsoft's chief people officer Amy Coleman said that employees offered the buyout span teams in Canada, India, the UK and the US, at experience level 70 and below.

This is based on an internal system for grading staff. Level 70 refers to senior positions such as a general manager or partner-level technical leader, according to one social media post.

Coleman added that the voluntary exit offer was time limited, with CNBC noting that it would expire by early December.

"This offer gives eligible employees who may be considering a future outside the company a new choice to make that transition now with support," Coleman wrote in the memo.

"It also gives participating organizations another way to adapt their workforce to changing needs."

Microsoft offered that aforementioned voluntary retirement program in April to 7% of American employees, followed by layoffs of 4,800 staff in July. Last year also saw multiple rounds of layoffs at the company.

Cuts everywhere

Microsoft isn't the only tech company continuing to reduce headcount. A host of major tech companies have announced layoffs across 2026 so far. In May, Cloudflare revealed plans to cut 1,000 roles, equivalent to around 20% of its workforce.

Oracle also announced 21,000 jobs would be axed in June, pinning the blame on AI. Last year also saw sweeping cuts at Dell Technologies, Salesforce, IBM, and Intel.

Much of this has been pinned on AI, though analysts have suggested the technology isn't ready to start taking over human roles yet, if ever.

A study by Oxford Economics earlier this year suggested evidence of an AI-inspired shake-up of jobs is "patchy" at best, with job losses really down to wider economic forces.

Some companies have said just that, with Atlassian saying last year's cuts to customer service have nothing to do with AI, and Amazon's 14,000 cuts pinned on reducing bureaucracy.

Microsoft’s motivation behind the voluntary exit scheme is also reportedly due to AI-related costs. Reports from Reuters, for example, suggest the company aims to reduce costs amid heavy spending on AI infrastructure.

Capital expenditures for the next quarter are expected to top $50 billion.

ITPro approached Microsoft for confirmation and comment, but did not receive a response by time of publication.

FOLLOW US ON SOCIAL MEDIA

Containers are no longer the new story. For most customers, containerization is already embedded in the way software is built and delivered.

More than half of organizations now use containers for most or all of their production applications, according to the Cloud Native Computing Foundation. That means the challenge for partners is no longer persuading customers to adopt containers, but helping them ensure the way software is being developed today does not create security and governance problems later. Development teams are under pressure to move faster than ever. They are using more open-source components, pulling in code from multiple sources, and increasingly using AI to help write, test, and review software.

Docker's Latest State of Application Development Report found that 64% of developers were already using AI to support coding, documentation, and research.

None of that is a problem in itself. The risk arises when security and governance don't keep pace. Small compromises that seem reasonable at the time can gradually introduce bigger problems. A team takes a shortcut to hit a deadline. Someone pulls in a component that hasn't been properly checked. Neither looks particularly serious in isolation, but together they can leave customers exposed.

A bigger conversation

This is why the conversation is no longer just about containers. It is about how modern software is being built, where code and components are coming from, and what controls are in place around AI use.

AI is a good example of this. It's helping development teams move faster, but it's also changing the questions organizations need to ask. Where did that code come from? Has anyone reviewed it properly? And were your security policies written for the way development teams are working today, or for an approach that's already changed?

The issue does not stop with developers. Across the wider business, employees are starting to use AI tools to speed up everyday work, creating a broader governance challenge.

The question is not simply whether AI can improve productivity, but whether organizations have the guardrails and visibility to ensure it is being used safely. The rapid evolution of AI agents has only added to those concerns. If AI agents can act in ways their users did not expect, organisations need to think more carefully about runtime visibility, access boundaries and what happens if those systems step outside the rules they were meant to follow.

That is exactly where partners should be adding value.

Most customers will not ask how to reduce security debt or tighten AI governance. They will ask how to modernize applications, speed up development, or get more value from AI.

The opportunity for the channel is to help them achieve those goals without creating unnecessary risk at the same time. That starts with asking the right questions. These are not just technical questions. They are business questions because the impact of getting them wrong is operational, financial, and reputational. Partners don’t need to be software developers, but they do need to understand how software is being built and how AI is being used today.

Customers are looking for help to move quickly without losing control. In that environment, experience, judgement and the ability to ask the right questions are just as valuable as the technology itself.

The wider issue is trust. Modern applications depend on increasingly complex software supply chains, and AI adds another layer of uncertainty if businesses do not know what tools are being used, what data they can access, or how decisions are being made. Security cannot begin once something is already live. By then, many opportunities to prevent problems have already passed.

We know that customers will always want to move faster. That’s not going to change. The partners that stand out will not just be the ones recommending the latest tool. They’ll spot risks early, ask the questions their customers haven’t thought about yet, and help to build security and governance into the process from the start.

Sometimes that simply means asking a few awkward questions before anyone starts building. Those conversations may not always be comfortable, but they are far easier and less expensive than trying to fix problems once software is already live.

Five questions every partner should ask

• Where are your container images coming from, and who is verifying them?
• How much third-party or open-source code is making its way into production?
• Has AI changed the way developers write, review, or ship code?
• Are employees using AI tools outside development without clear guardrails in place?
• If an AI agent behaved unexpectedly, would you have the visibility to detect it quickly?

Ultimately, the partners that add the most value will be those who help customers move faster without losing control. As software development evolves and AI becomes more deeply embedded, that means identifying risks early and making security and governance part of the process from the outset.

Earlier this month, Japan’s government declared a cyber emergency. The move followed a series of cyber attacks against businesses and institutions across the country. Rail transport, internet services, retailers and even the police have been impacted, according to the Financial Times.

At one point, the Japanese financial services regulator even told banks not to accept driving licences as proof of identity for anyone opening new accounts.

The declaration by Japan’s NCHS cyber agency is unusual. Few countries have declared a cyber emergency, even if security services and regulators have warned of heightened threats.

The move came after rail operator JR East reported the loss of 1.67 million email addresses, and car rental company Times Car lost a large number of scans of its customers’ driving licences. In addition, cloud services operator IDC Frontier reported a ransomware attack. This, in turn, linked to the leak at JR East and other public sector bodies.

“Incidents like this highlight why supply chain attacks can be so disruptive,” Alexandra Rose, head of global affairs and policy at cybersecurity company Sophos told ITPro.

“An attacker doesn't need to compromise a bunch of organizations individually in order to have a widespread impact. They gain access to a single organization and then can move through interconnected systems or disrupt services that many other organizations depend on. We’ve seen the downstream consequences extending beyond the initial victim time and time again, affecting operations, customers, and more.”

Big in Japan?

Japan, though, is not generally viewed as more exposed to cyber attack than other advanced economies, experts say. But the country is certainly seeing an increase in the seriousness of attacks, if not their frequency. There is also evidence that some businesses, at least, were less well prepared.

“I think it’s a response to the increasing severity of attacks they are seeing,” Rob Demain, founder of security firm e2e-assure, told ITPro. “One of the key ones was the platform IDC Frontier that was taken offline. I think it’s a trend of more impactful cyber attacks being seen, and trying to move quicker and keep pace.”

The Japanese government also moved to bring in active cyber defense (ACD), where police and other organizations can go after attackers, taking down servers and, hopefully, neutralizing attacks. Japan is also considering wider changes to its cybersecurity strategy, after lawmakers recently called to strengthen its use of AI for cyber defense.

But publicly announcing a cyber emergency brings its own risks, not least that businesses may rely on government intervention instead of taking proactive measures themselves. And useful advice could be lost in increased noise.

“How many times can you cry ‘cyber emergency’ before people stop worrying about it?” asks Demain. “But I don’t think there has been anything similar in Japan. So I think if you hear that message, you are going to take notice… You need to make sure everyone’s taking this seriously, and that was just one method to get the message out.”

Not everyone is convinced, however.

“A cyber emergency declaration has value if it changes the response, not just the rhetoric,” cautions Nazir Esmail, chief autonomous enterprise officer at Sapiens, a business that develops software primarily for the insurance industry.

“CISOs are well versed in threat vectors and don’t need additional warnings that threats are on the rise. What would be useful to CISOs and the security community in general, is faster access to actionable intelligence. In addition, if attacks threaten critical services or infrastructure, a coordinated incident response effort and a clear escalation mechanism are essential to contain the impact and accelerate recovery,” he told ITPro.

Actions, not words

This poses the question of whether declaring an emergency has a practical value for enterprises, and the wider security community. If it brings additional assistance or funding, then CISOs would no doubt welcome it. And government positioning can help security leaders to promote security to the board.

As Charl van der Walt, head of security research at Orange Cyberdefense points out, a full state of emergency can unlock new resources. This, he recalls, happened in Costa Rica in 2022, when the country declared a state of national emergency following a series of ransomware attacks against public sector bodies. But Japan’s cyber emergency stops short of that.

“The Japanese story seems to me to be a bit of a knee jerk response to a series of incidents that happened online,” he told ITPro. “The latest one was an attack against an infrastructure as a service provider. They have about 500 businesses that depend on them, and so the impact on them cascaded through the whole ecosystem.”

Van der Walt likens the incident to a similar attack on a shared software platform in South Korea, which also impacted a large number of businesses. But, he adds, we see fewer public data leaks in Japan than the size of the economy would suggest. “One reason may be that Japanese businesses are just paying [the ransom] before there’s any leaks,” he suggests.

We also do not know what the Japanese government’s, or indeed any government’s, playbook is for a cyber emergency, and for good reason. Given cyber attacks are increasingly part of grey zone conflict or hybrid warfare, governments will want to keep potential adversaries guessing.

“There’s two facets to think about,” says van der Walt. “One is the signalling effect to the adversary, and that’s really an issue for diplomacy and international humanitarian law. How do you keep your adversaries in check? How do you keep them constrained? Signalling is a big part of that.”

The other is the impact on the wider population, and overall cyber awareness. CISOs stand to benefit, at least indirectly, if employees, customers and other stakeholders have a better understanding of cyber risk.

“You also need to signal to your populace. You need to maintain the health, the sense of confidence, and the trust that your economy and society have,” he says. “I don’t know Japan’s playbook and I don't know their rationale. But I would think this needs to be done very, very cautiously.”

Cisco has expanded available incentives in its 360 Partner Program, as well as making Cisco IQ generally available for partners as part of its mission to continue to deliver the support its channel ecosystem needs.

Details of the new offerings and updates were announced at the firm’s Partner Summit in Vancouver, Canada, today, but ITPro attended a pre-brief before the main event.

“Cisco didn’t wake up and realize that partners matter,” exclaimed Tim Coogan, senior vice president, global partner sales, told journalists during the pre-brief call last week.

That being said, Cisco understands that partners need to move “first and fast,” especially in the AI era, where threats have intensified, and traditional models of supporting customers are no longer fit for purpose.

Changes to the 360 program include dedicated paths for advisors, developers, and distributors, so they can be recognized for the valuable role they play. In addition, Cisco has introduced Partner Value Indexes (PVIs) for advisors and developers, with a dedicated Distributor PVI coming by Spring 2027.

Additional cross-sell bonuses were also unveiled in addition to a Cisco IQ adoption incentive.

Change is necessary for continued success

The 360 program was unveiled at the beginning of the calendar year and marked a big change; however, Coogan was keen to stress that the previous programs had evolved in response to partner feedback.

“We don’t do anything at Cisco without asking, ‘What about partners?. Are we building it the right way? Are we providing that platform?” Coogan said.

“When we built the [360] program, we didn’t build it and unveil it. We built it with our partners. Thousands of meetings, countless hours spent understanding the program.

“It was big news, and it has required our partners to do things differently. Part of the reason our previous programs, most notably Value Incentive Program (VIP), were around for 23 years. What some people may not know is that there were 46 versions of VIP. We are deeply committed to an iterative process over time.”

Coogan added: “It’s not a set it and forget it mentality. We believe that feedback is a constant source, and we have already made numerous changes. Change is difficult. We ask partners to invest in their capabilities to deliver this incredible portfolio, and we are as deeply committed to modifying it over time based on that same feedback.”

The B2B buying landscape is forever changed

Customers, on average, work with up to seven trusted partners, according to Coogan. What’s more, the B2B buying journey is non-linear with more than 28 touchpoints. This places even more emphasis on partners to help organizations navigate this new normal.

“We recognize that, at the end of the day, growth and profitability are fundamental to our company and to our partners as well. [Offering] Cisco IQ, not as a product, but as a platform, [means] our partners can use it to deliver new services revenue, new capabilities, and a different kind of buying and use experience for our clients. Cisco IQ will become a really, really powerful tool in the bag of our partners.”

Coogan also spoke to the importance of partner experience: “We believe incredibly deeply that our ability to save our partners time is just as important as our ability to help them drive growth and profitability. Finding an easier way to do business with Cisco, improving tools, and leveraging AI becomes fundamental to the experience our partners have with us,” he said.

“Our partners don’t owe us anything, and they don’t work for us; we earn the right to work with them every single day. Partner experience is one of the ways we can invest in their time with us by making that experience as positive and productive as possible.”

Coogan also stressed the importance of constant innovation, being able to react quickly, and scaling but without adversely affecting efficiency.

“It’s our 30th year of Partner Summit. This is not a revelation that partners are important. This is a 30-year journey with our partners, founded on trust, growth, agility, and innovation. We’re so very proud of our heritage and our legacy,” he added.

“Everything for us is founded around our principles of build, buy, and partnering… Ultimately, what we build and what we buy falls short in meeting the expectations of our customers if we don’t have the partner ecosystem to support it. We believe deeply that that partner ecosystem is the enabler for this build, buy, and partner strategy.

“This is a no-ego environment where we learn from each other, provide the platform and the foundation to deliver value in the field. And I think that's really what separates us.”

While much focus on AI has been about increasing machine intelligence levels, it should really be about how you can support your people to become better versions of themselves - more capable humans.

So said Oracle co-CEO Mike Sicilia during the opening keynote, ‘Where AI means business,' at Oracle AI World in Las Vegas today.

For AI to be successful, he said, there are four key ingredients:

1. Access to data, but securely and with the right permissions
2. The ability to understand that data in the context of your business and the systems therein
3. High-performance infrastructure that enables AI to operate efficiently, at scale, and cost-effectively
4. AI needs to work inside the applications and processes where decisions are made and actionable intelligence is derived

A foundation of innovation

“This is where I think Oracle has a unique advantage that has been decades in the making. We’ve built technology that manages your data, runs your business, and powers your most important workloads,” Sicilia added.

These are:

• AI database delivers AI directly to enterprise data that is trusted
• Cloud applications put business intelligence to work, efficiently and safely
• Data platform provides the context and security AI needs
• OCI provides the efficiency and performance needed to operate AI at scale

He said the company had put more information at people’s fingertips than ever before. But added that work has historically been organized around software rather than people and what they need.

“[AI] allows for far more intuitive software. In fact, AI should allow you to barely think about the software at all. So instead of navigating applications and managing processes, you simply tell the system what you’d like to accomplish,” he said.

“Because it understands your business, it can figure out how to get the work done. So instead of spending your day operating the software, the software is working and operating for you.”

Applying AI to build a bridge between humans and machines

The ability for AI to recognize, anticipate, and then help is what Oracle is striving for when it comes to AI: creating meaningful connections between people and technology.

“We’re freeing people from system burdens. We’re giving people more time to be human. That’s the ambition we have for AI. Not simply more capable machines, but more capable people. People who have more time to think, to create, to solve problems, and to care for one another,” Sicilia added.

"Of course, as these systems take on more responsibility, they must also earn more trust… More AI intelligence does not mean fewer controls. Trust is what allows us to put AI to work where the stakes are highest and, therefore, the benefits can be the greatest.”

As expected, a slew of related announcements were rolled out on the first day of Oracle AI World, including:

• A revamped and rebranded version of what was formerly Oracle Cloud Success Navigator, now dubbed Oracle AI Success Navigator. It marries specialist AI agents, best practices, guidance, and training to help businesses more quickly move from theory to real-world value from their Oracle Fusion application implementations.
• Deep Trust AI Architecture, acting as a blueprint that bakes in trust to help organizations speed up their path to AI innovation without increasing risk
• Oracle Fusion Companion, which delivers an intelligence capable of understanding business objectives to decide upon and orchestrate the relevant agents, applications, approvals, and workflows required to achieve said goals.
• Oracle Fusion Agentic Home offers workers a more personalized experience, powered by AI, to help delegate work to agents as appropriate and track progress.
• New and expanded capabilities for Oracle Autonomous AI Lakehouse, including AI Data Catalog, Business Semantic Layer, Data Lake Accelerator, Data Studio, in addition to centralized controls and security
• New Oracle Fusion agentic applications to serve specific use cases such as customer experience, HR, and supply chain operations

Sicilia challenged event attendees to bring Oracle the problems they’ve learned to live with as well as their ambitions. He asked them to come forward to talk about the things they couldn’t do and the things they want to do, but haven’t had the technology to support those efforts, until now.

“We want the complexity to move into the background, and the possibilities for people to move to the foreground,” he said.

As an organization, ISACA is well-versed in and has a long history of helping its members stay up to date with the latest developments in IT security, governance, and risk.

But the pace of change, particularly in the AI era, can be unrelenting. Indeed, at this year’s ISACA Europe conference held earlier this month in Munich, Germany, there was a clear sense that changes in the technology landscape are putting more pressure on the association’s membership to stay current.

ISACA oversees a range of professional certifications, including CISA and CISM, and attending conference sessions helps attendees earn CPE credits that go towards maintaining these certifications. Sessions covered at this year’s ISACA Europe Conference 2026 covered everything ranging from cross-border data privacy, operational technology and proving security ROI, to supply chain resilience, ransomware prevention and digital sovereignty. While the topics were varied, they shared a common theme. Indeed, across almost all of them, the looming specter of AI was a constant presence.

Professionals in the field are concerned about how this technology will impact their day-to-day responsibilities, and ISACA is having to adapt its own processes in order to support them. As well as speeding up the pace at which it updates its certifications and training, the association has put forward several amendments to its bylaws, including lowering the quorum for member votes, moving its legal home to Washington, DC, and moving to staggered three-year board terms.

Responding to changing member needs

Speaking at the opening session in Munich, ISACA board chair Massimo Migliuolo said the proposals give ISACA “the governance agility to respond faster to the needs of members wherever they are in the world”.

That speed is more in demand than ever. AI is impacting the industry so dramatically that not only is it difficult for professionals to keep their skills current, but it's also reshaping roles faster than they can be defined. On top of that, it's resulting in regulatory scrambles as authorities scramble to catch up.

The shift is most evident in how often IT professionals are now feeling the need to update their credentials, according to ISACA CEO Erik Prusch.

“[Previously] you got certified, and maybe five years later or six years later, you might be getting your second certification as you’re escalating through an organization,” he says.

“Now it’s much more current, and everybody’s having to stay not only trained and keep their current certifications up to date, but also bring in new technology.”

AI was inescapable across the conference. Although plenty of sessions on the agenda focused on practical, iterative work - including previews of ISACA’s updated COBIT governance framework, GRC automation, NIS2 and DORA - nearly half of the agenda touched on AI in some capacity, including keynote sessions on the first two days.

As one might expect from an audience of security and risk professionals, the response to AI wasn't entirely enthusiastic, but fears around losing their jobs to AI have largely waned.

“Even 18 months ago, there was that threat of ‘AI is going to eliminate all roles’,” says Tara Wisniewski, senior vice president of advocacy at ISACA.

“I think we’re all kind of moving away from that, but it is going to significantly change roles.”

AI through a security lens

Instead, practitioners appear to have transitioned to more immediate practical concerns, including how the rollout of these systems is affecting their security, risk, and governance posture. In her keynote, cybersecurity advisor and former CISO Monica Verma took aim at the more apocalyptic predictions about AI, calling that narrative “extremely dangerous”.

“It takes away from the actual real AI and cybersecurity risks that we do have today,” she says.

“[The ones] that are already present, that are already imminent, that you and your organizations need to be thinking about right now. There is no time to waste.”

ISACA is tapping into this need for clarity with three dedicated AI credentials (with a fourth in development), as well as integrating AI aspects into CISA and CISM. Prusch says demand is partly being driven by AI work landing on existing roles, with established professionals increasingly asked to pick up elements of AI management on an ad-hoc basis. An IT audit manager, for example, might become an IT and AI audit manager.

“I think everybody within our domains, their roles have changed to some degree,” he says.

“It just hasn’t been structured or formalized as yet. They’ve just taken on more responsibility, and there’s no other place for them to go.”

However, while ISACA members aren't worried about the immediate future of their own roles, AI has affected some jobs. In particular, AI has been blamed for a reduction in available junior and entry-level roles, and senior practitioners are concerned that this will exacerbate the industry’s existing pipeline problems. As Migliuolo noted during the event’s opening address, ENISA estimates that more than 300,000 cybersecurity positions are unfilled across the EU.

“What the hell is a 23-year-old [to do]? How are they going to get that experience?” says Wisniewski. “I fear that the gap is going to get a little bit bigger, to be honest… We’ll even see things like, ‘it’s an entry-level position, but three years’ work experience is required’. That’s a mismatch.”

A multi-pronged approach

ISACA is trying to tackle the problem from both ends. Prusch says it now tracks new roles as they emerge, to shrink the lag before training for them exists, and on the policy side, Wisniewski says workforce development is “the drum we beat every day”.

In the UK, the organization has proposed amendments to the Cyber Security and Resilience Bill to clarify its skills requirements, and more broadly it presses policymakers to consider the talent pipeline whenever they regulate, since meeting any new rules requires “a qualified workforce”.

Even the lawmakers are struggling to stay ahead of the changes, Wisniewski adds, explaining that “there are very few policymakers that actually have any technical depth”. The EU’s AI Act is among the most comprehensive AI laws in the world, but the bloc is already discussing revisions because, she says, the technology hasn’t developed the way Brussels expected, and other countries are even further behind in their journey towards AI regulation.

Meanwhile, as governments continue to argue over the best way to design and implement AI safeguards, organizations are already struggling to comply with existing rules.

“European organizations are navigating an increasingly complex regulatory and threat environment,” Migliuolo noted.

“…Through the EU AI Act and NIS2, DORA, CRA and other emerging regulations, I think Europe is setting a very good standard… The challenge in this transition is how we are going to do the implementation.”

That transition is proving slow. Despite the deadlines for NIS2 and DORA compliance having passed well over a year ago, conference delegates were still attending sessions framed around working out how to demonstrate compliance. While large multinationals with deep budgets are ahead of this curve, it’s a different story further down the market, according to Wisniewski.

“It’s still early days, especially for smaller organizations, because that’s where you see stress in the system,” she says, adding that compliance costs can squeeze other budgets.

“When the compliance burden gets too intense, the budget has to come from somewhere… Is it taking away from a training budget?”

With legislation struggling to keep up, Wisniewski believes professional bodies may end up filling part of the gap themselves, acting as de facto regulators by establishing industry-wide standards. That’s one of the reasons ISACA is investing in a more substantial advocacy program, she says; the association also wants a seat at the table in emerging debates, such as whether cybersecurity should become a licensed profession.

None of this is new territory for ISACA, though; helping professionals make sense of unfamiliar technology and shifting rules is what the association was set up to do. The difference now is how little time there is to do it. By the time one change has been absorbed, the next is already on the horizon - such as quantum, which Wisniewski expects to feature alongside AI at next year’s event.

That’s what makes the bylaw vote more significant than its modest contents might suggest. Whether it’s through its training, its advocacy, or the standards it sets, ISACA’s influence depends on keeping pace with the profession it serves. To shoulder those responsibilities, the association needs to be able to move at the same speed as the technology it hopes to help govern.

“This is not your typical kind of acceleration path [for] adoption of new technology,” Prusch says, emphasizing that the industry as a whole has a difficult task ahead of it.

“We’re not talking about two decades ago, when we had maybe 10 years to develop the infrastructure. We are already behind.”

“The reality is,” he says, “we’ve got to do this faster.”

Entire, a startup launched by former GitHub CEO Thomas Dohmke, has officially unveiled an alternative to the popular development platform.

The new Git forge is designed specifically with agent-human collaboration in mind, according to the startup, and will offer users the same basic abilities as GitHub – albeit with a twist for the AI era.

Entire claims its platform is built on “fundamentally new primitives” compared to GitHub and other platforms. The system is built on a new distributed source control server compatible with Git, meaning that every developer has their own dedicated server.

Using this method, the startup claims it pushes up to 89 times faster than GitHub and six times faster than Cursor’s Origin.

“This makes Entire the fastest Git forge in product today,” the startup said in an announcement. “Developers can create, migrate, and natively host private repositories in the region of their choice, including the US, EU, India, and Australia.”

Other basic functions like code reviews have received a sprucing up with the ‘Trails’ feature, according to Entire. While other platforms rely on a classic pull request model to review code changes, Entire will provide users with a “heads-up display similar to an airline pilot”.

This will include rolling, customized evals that are assessed and scored by agents with each code push, the company added.

Notably, Entire also leverages continuous memory, which it said represents a “new approach” that allows agents and developer teams to sync sessions and prompts within the repository.

The advantage here, according to Entire, is that data is constantly available and searchable for coding agents. This approach relies on two core components: a codebase graph that allows agents to “find answers faster” and reduce token consumption, and an “agentic brain”.

This essentially stores previous agent sessions and prompts within a system of memory that can be referred to or queried further down the line.

Entire targets agentic orchestration gains

Dohmke said these features come in direct response to the growing use of agents in software development processes.

JetBrains’ Developer Ecosystem Survey found around 90% of developers now use AI coding agents at work on a weekly basis. More than two-thirds (68%), meanwhile, are using them on a daily basis.

“The Pull Request revolutionized first open source and later enterprise software development. Instead of sending diffs and patches on email lists, developers could fork a repo and send their code changes back to the maintainer,” he commented.

“But agents now write almost all of it, faster and more complex than ever before.”

Dohmke added that Entire treats the “idea, the agent trace, and the outcome of a developer’s sessions as first-class artifacts for review alongside the code”.

The platform also uses multiple agents to conduct evals to ensure developers can confidently merge code without repeated reviews.

“This allows coding agents to address findings in a loop, while the human developer validates the progress,” he explained. “When all evals are satisfied, they can merge the code without needing to look at the code itself.”

Dohmke’s first move post-GitHub

The announcement marks the first big move by Entire since it launched earlier this year with an eye on building the “world's next developer platform for the era of AI”.

Entire hit the ground running in February backed by a $60 million seed round at a $300 million valuation. The investment round was led by Felic, with participation from Madrona, M12, 20VC, and Cherry Ventures.

That announcement also marked Dohmke’s first venture since departing GitHub as CEO.

When he announced his departure in August 2025, Dohmke specifically noted that his “startup roots have begun tugging on me”, prompting speculation about a new venture.

A viable GitHub alternative?

While Entire frames itself as a viable alternative to GitHub, it faces stiff competition on this front, and not only from the aforementioned platform.

As ITPro reported in August, vibe coding startup Cursor launched its own alternative to tap into what has become a highly lucrative market.

When Cursor launched Origin, the company said it was “starting with the essentials”, offering users much of the same basic features found in GitHub. Long-term, the plan is to provide “agent-native features”.

Alongside the launch, Entire revealed it has secured partnerships with Buildkite and Depot to ensure build and test pipelines “keep up with how fast agents ship”.

Entire said this will allow users to move off GitHub Actions by converting existing workflows using Buildkite’s bk pipeline or Depot CI, enabling them to subscribe the repository in its own platform.

This move by Entire mirrors Cursor, which also announced partnerships with Depot and Buildkite to build a broader “app ecosystem” aimed at tempting users away from GitHub.

FOLLOW US ON SOCIAL MEDIA

Most neoclouds are doomed, according to Elon Musk, with funding thin on the ground for companies with no revenue source other than AI data centers.

With around 200 players currently in the market supplying specialized cloud infrastructure to run AI workloads, they're struggling to secure debt-market financing, and a massive shakeout is on the cards, he said.

"As of the past few weeks, debt markets have almost entirely shut off access to money for any company that doesn't have substantial revenue independent of AI data centers," he wrote on X.

"That means the 200+ neoclouds are going to see guppy-level death and consolidation. Some will make it through, but not many."

"I think we're going to see a lot of stranded compute in partially complete data centers," he added.

Musk contrasted the lack of investment with SpaceX's position. The firm has successfully secured $40 billion of debt for Nvidia GPUs, he said, because it's "investment grade", and has additional revenue coming in from its Starlink, satellite internet, and rocket launch operations.

The comments appear to confirm a recent report from the Financial Times claiming that SpaceX was engaged in talks to secure $40 billion in funding, with Apollo Global Management acting as the lead investor. The cash would come in the form of around $10 billion worth of bank loans and $30 billion in investment-grade debt, the report said.

The cash will be used to support GPU deliveries in the first and second quarters of next year; the firm is expected to repay the debt early.

Musk isn't the first to sound the alarm about the long-term future of neoclouds. Earlier this month, Gartner warned that by 2030, eight-in-ten neocloud providers are likely to cease independent operations.

While hyperscalers, the firm said, have massive and highly diversified revenue sources that could plausibly sustain AI investments for years, neoclouds can't hang about, and need to quickly earn returns on AI-optimized IaaS and associated platforms if they're to sustain operations.

"The growth in spending on AI-optimized IaaS will be too low for most AI compute providers to recover their AI investments before the current generation of AI semiconductors is replaced," said Will Sommer, senior director analyst at Gartner.

Meanwhile, venture capitalist Chamath Palihapitiya has expressed similar concerns, saying that hyperscalers like Amazon, Microsoft and Google are, unsurprisingly, focusing on their own internal compute needs rather than any third party.

"All of this is to say that it does look like there will be a lot of partially stranded compute and compute sitting in inventory in 2027 than is currently forecasted," he wrote on X.

"This dislocation will benefit two kinds of orgs: the non-bureaucratic big scalers who can build industrial scale quickly and the nimble, well-capitalized players feeding them. 2027 will be a turbulent year because it will clear out a bunch of wrong/bad bets. It will also be a consolidation year for a few."

The warnings come just a couple of weeks after CoreWave – the world's largest neocloud – saw its stock price fall by 38% in a month, and 60% over the last year. And today, after Musk's warning, it's fallen further, along with Nebius and Iren.

Heads of infrastructure and IT operations need to focus their AI efforts carefully if they want to accelerate autonomous operations and support enterprise-scale AI initiatives, Gartner has warned.

In a survey of 272 heads of infrastructure and IT operations (I&O), the company found that 58% believe scaling proof of AI concepts to I&O adoption will be an important priority in the next 12 months.

And, said the firm, there are five AI trends worth adopting if firms want to improve operational efficiency with AI and optimize costs.

"AI is creating one of the most significant shifts the I&O function has ever faced," said Jonathan Forest, VP analyst at Gartner. "Rather than trying to address every aspect of AI simultaneously, heads of I&O should focus on a small number of strategic investments that deliver meaningful impact."

The five AI trends worth adopting for infrastructure and IT operations

The first, unsurprisingly, is agentic AI, used for tasks such as incident triage, change validation, and remediation. And while virtually no organizations are currently using AI agents with minimal human involvement in IT operations, Gartner expects half to be doing so by 2030.

"AI agents are driving a shift from reactive, human-in-the-loop operations to proactive, human-on-the-loop operations," said Forest. "Heads of I&O who fail to restructure their organization around agentic AI risk higher costs, poor operational agility and performance, and ultimately, irrelevance."

The move to agentic AI, though, is creating challenges in terms of token consumption – which is rocketing and likely to lead to unforeseen costs.

Through 2027, Gartner predicts that enterprises implementing AI agents in IT operations using uncapped variable pricing models tied to token usage will overrun their initial cost expectations by more than 50%, compared with those using predictable subscription and bundled pricing models.

The only answer, said the firm, is a strict "no telemetry, no deployment" policy to eliminate blind spots in AI spending and token usage.

Another major trend worth watching, said Gartner, is the way AI inference is driving the rise of hybrid AI infrastructure, driven mainly by privacy, cost, performance, and data sovereignty requirements.

Gartner predicted that a quarter of enterprises will have merged their network operations center (NOC) and security operations center (SOC) by 2030, up from just one in 20 now. And this, it said, will see total spend on tooling and staff resources falling by a quarter.

Finally, AI deployments across cloud, data center and edge environments are increasing the need for a coordinated approach to managing AI infrastructure, governance, security and operations. As a result, said Gartner, I&O is evolving from a traditional gatekeeper role to the orchestrator of the enterprise AI platform, enabling the business to deploy and scale AI reliably, securely and in a cost-effective way.

And, Gartner warned, over the next four years, organizations without a strong I&O function driving AI infrastructure design, architecture and support will be more than twice as likely to fail in their AI initiatives.

"The high cost of AI infrastructure leaves little room for error, placing I&O at the center of enterprise AI success," said Forest. "Heads of I&O must elevate their teams' capabilities, reduce technical debt, and shift from reactive operations to proactively enabling enterprise AI."

Part of the mighty Thales cybersecurity division, the Imperva WAF (web application firewall) solutions stand out from the competition as they support multiple deployment scenarios and are designed to be up and running in minutes. It looks to have every angle covered, as Imperva WAF is available as a SaaS-based service, can be hosted locally on customer equipment, virtualized on a choice of cloud and on-premises hypervisors, or delivered as a dedicated and hardened turnkey gateway appliance.

It offers an extensive range of security features, with many implemented as modules. Along with out-of-the-box website protection, options include advanced bot protection, API security, L3/4/7 DDoS protection, client-side protection, and attack analytics.

In this review, we tested the Imperva Cloud WAF solution, which is hosted on the Imperva globally distributed content delivery network (CDN) and protects any public-facing website along with its associated applications and APIs. At its foundation, Imperva Cloud WAF functions as a secure reverse proxy that intercepts and inspects all web traffic, but there's a lot more going on in the background as the CDN employs a global network of data centres to host these services.

Called points of presence (PoPs), Imperva Cloud WAF defaults to making all of them available to protect your websites but automatically uses the nearest one to a user for request handling. Typical benefits are website performance optimisation, reduced latency, intelligent caching, and integrated load balancing with Anycast routing providing automated failover between PoPs without requiring any changes to DNS resolution.

Thales Imperva Cloud WAF review: Simple deployment

To get the most realistic experience, we deployed Imperva Cloud WAF in a live environment and used it to protect three active websites. No limited simulations here, as all threats detected would be genuine and in real time.

From our account portal, we added the websites using their full domain names and chose to have Imperva manage all SSL certificates. Sensibly, Imperva requires you to prove you own the domains before it will issue site SSL/TLS certificates, and we used the automatically generated record name and CNAME record value to update our hosting provider's DNS services.

Once domain ownership had been validated, we added the A records provided to route website traffic through Imperva's servers. A validation process confirmed traffic was being correctly routed, and a quick glance at the portal's configuration posture status panel showed green lights for SSL certificates, DDoS and WAF settings, plus DNS configuration confirming that all traffic to our websites was going through Imperva's servers.

Protection is instant, as a default policy is created, applied to all websites, and set to block malicious visitors and requests. You can easily create your own custom policies and assign them to specific websites, with each one containing rules for cross-site scripting (XSS), illegal resource access, remote file inclusion, and SQL injection.

Thales Imperva Cloud WAF review: Attack alert

The cloud portal provided a wealth of information about our security posture, and we were alarmed to see that from the moment Cloud WAF had been activated, our websites were constantly under attack. Within a day, it had reported on illegal resource access, XSS, bad bot, DDoS bot, SQL injection, and remote file inclusion attacks from multiple countries.

During our extended testing period, we saw many thousands of attacks, but Cloud WAF cut cleanly through the alert smokescreen. The Attack Analytics service uses ML algorithms and AI to sort and condense daily security alerts into concise and manageable lists of incidents prioritised by threat severity.

This worked extremely well as the attack analytics dashboard presented a tidy graphical overview of events and incidents over time, which we could filter to show all protected websites or specific ones along with all blocked or alerted events. Charts showed the dominant attack origin countries, the top violations, the most popular attack tools, and the most attacked websites, with a highlight chart revealing the number of similar incidents identified by Imperva across its entire customer base and those associated with known CVEs.

Thales Imperva Cloud WAF review: Bad bots and DDoS protection

Imperva Cloud WAF includes sophisticated bot protection for smaller businesses that employs signature, IP reputation, and rate-limiting detection methods and is designed to block vulnerability scanners, simple scrapers, known bad bots, and DDoS attacks. The Advanced Bot Protection (ABP) add-on is aimed at larger businesses and dynamically sorts the good bots from the bad using behavioural analysis, ML, device fingerprinting, threat intelligence feeds, and progressive challenges.

The ABP dashboard presents a vast amount of information on bot activity and provides filters to fine-tune the information. The AI Tools page displayed graphs of all detected AI tools, agents, and web crawlers accessing our websites and showed how our website data was being scraped to train LLMs. We could see plenty of AI bot activity, such as ClaudeBot, Applebot, PetalBot, and GPTBot. Plus, the highly aggressive Bytespider and ABP policies and rulesets can be used to protect specific web pages from their unwanted attention.

Imperva Cloud WAF includes the DDoS Protection for Websites component, which blocks malicious DDoS activity, including volumetric attacks at Layer 3 and 4 and application-level attacks at Layer 7. Imperva's global network of over 60 high-capacity PoPs offers a total scrubbing capacity of 13Tbps and can process over 65 billion attack packets per second, allowing it to boast a 3-second mitigation SLA for any size, type, and duration of attack.

Protection was simple to configure for each website, and for testing, we used the HOIC (High Orbit Ion Cannon) tool to generate Layer 7 DDoS attacks – we own the websites, so there are no issues of legality. As soon as the tests started, Imperva Cloud WAF blocked all attack traffic, posted alerts in the portal summary page, issued email alerts in under a minute, and sent another when the attack had stopped.

Thales Imperva Cloud WAF review: Is it worth it?

For mid-sized businesses and enterprises – absolutely. The damage to their brand reputation and the clean-up operation after a successful website attack will probably cost many, many times more.

The simple cloud deployment process is a standout feature, as it didn't take long to get Imperva Cloud WAF protecting our websites. The cloud portal is another winner as it is capable of providing an incredible amount of information about all detected attacks and yet manages to condense it all down to manageable lists of actionable events.

Our test websites may be low-key affairs, but we were shocked by the sustained number of attacks they were being subjected to on a daily basis and from all around the globe. The level of attacks will no doubt be exponentially greater for high-profile corporate websites and will only get worse with the advent of dark LLMs and weaponised AI. From our experience, we rate Imperva Cloud WAF highly and consider it an ideal website security solution for mid-sized businesses and enterprises.

Japan’s Liberal Democratic Party (LDP) has called on the government to establish a cybersecurity task force to strengthen defenses against AI.

The call to action follows an emergency meeting of the LDP’s National Cybersecurity Strategy Headquarters (NCSH).

Hosted on 9 October, Masaaki Taira, head of the NCSH, declared Japan in “a state of emergency in cyber space”.

The announcement comes as a series of cyber attacks have disrupted more than 20 companies across transport, retail, finance, and cloud services, according to the Financial Times.

Rail operator JR East reported the loss of 1.67 million email addresses, while car rental company Times Car lost a large number of customer driving licence scans. Meanwhile, cloud services provider IDC Frontier reported a ransomware attack that reportedly linked data leaks to hundreds of businesses.

In the financial sector, Japan’s financial regulator warned banks against accepting driving licences to open new accounts, following reports from Reuters that nine banks had been hacked using AI.

An investigation by Japanese IT company Macnica found that Japan has been hit with 119 cyber attacks this year as of 6 October, with 68% occurring since July, marking a sharp increase from 86 recorded attacks in 2025 and 62 in 2024.

AI is accelerating the attack frequency

An investigation by the Japan Computer Emergency Response Team Coordination Center (JPCERT) into the attack servers found attackers used AI tools to "scan for known vulnerabilities and conduct attacks via APIs”.

JPCERT noted that evidence was found of attackers analyzing APK files to detect vulnerabilities such as Server-Side Request Forgery (SSRF).

Additionally, Japanese security firm GMO Cybersecurity, cited by The Japan Times, alleged that a Chinese-developed AI tool was deployed in cyber attacks against companies in retail, finance, and e-commerce.

Nobuo Miwa, president of Tokyo-based cybersecurity firm S&J Corp, told Reuters that AI makes cyber attacks faster, cheaper, and harder to detect because “AI doesn’t get tired”.

He added, “Japan is essentially being subjected to carpet bombing.”

Building a defense against AI

Reports suggest that Japan’s ageing cyber infrastructure has left it vulnerable to these attacks. With AI making the work easier for attackers, the LDP is aiming to build cyber resilience by establishing a cybersecurity task force under a new headquarters to strengthen defenses using AI as a tool.

Although the plan is yet to be formally submitted to the Japanese Prime Minister's office, the proposal would encourage defenders to adopt AI-enabled cybersecurity solutions and call on regulators to assist small and medium-sized businesses in detecting attacks targeting them.

Mihoko Matsubara, chief cybersecurity strategist at Japan’s NTT Corporation, told ITPro that the LDP's proposal aims to relieve public anxiety by breaking down organizational silos and helping defenders adopt AI-enabled tools.

“Once formalized, the LDP recommendations would help CISOs secure more cybersecurity budget and invest in security hygiene that was overdue because of resource constraints,” Matsubara said.

She added that government-funded support for SMBs would also help strengthen supply chain security. “This would ultimately contribute to the overall resilience of the Japanese economy and industry.”

FOLLOW US ON SOCIAL MEDIA

TrendAI has made Nvidia Nemotron models available inside customer environments as the Trend Micro unit aims to bolster data sovereignty capabilities.

The move will include integration of Nvidia's open-weight Nemotron models within its Vision One platform for Sovereign and Private Cloud, bringing AI-assisted security operations into customer-controlled environments.

This, the company said, extends capabilities such as guided investigation, security reasoning, and agentic SIEM to organizations, along with sovereignty, data residency, and operational control.

According to TrendAI, the move is primarily aimed at public sector organisations and those operating in regulated environments, many of which now face an expectation to run AI and process data locally.

With Nemotron open models, customers decide where the model runs, which version is deployed, and who can access it, running AI-powered security operations on Nvidia accelerated computing in their own data centers, sovereign clouds, and restricted-connectivity environments.

OpenShell improvements

Meanwhile, TrendAI said the collaboration with Nvidia on OpenShell provides an extra level of security for agents, giving organizations control and visibility of agentic activities.

“Sovereignty extends beyond where data resides. Enterprises also need control over where the intelligence acting on that data operates, and how it is governed.” said Rachel Jin, CEO of TrendAI.

"Organizations shouldn't have to give up the operational benefits of AI because their security data and operations need to remain within a customer-controlled environment. Our work is about bringing AI-powered security operations to the environments our customers choose to control.”

What users can expect

TrendAI Vision One for Sovereign and Private Cloud (SPC) with NVIDIA Nemotron integration will offer users AI-assisted threat analysis. This includes reasoning across security signals to identify threat patterns and attack chains, the duo said.

The firm said that guided security operations help security teams investigate threats and prioritize response activities, while agentic SIEM capabilities correlate telemetry and assist with security reasoning while maintaining team oversight.

The move marks the latest collaboration between the security provider and Nvidia in recent months. The company joined the firm's Open Secure AI Alliance, an industry coalition of more than 30 tech companies aimed at building open-source AI safety, security, and defense tools.

FOLLOW US ON SOCIAL MEDIA

Agentic AI security incidents are surging at an alarming pace, according to ServiceNow, and the company has warned many firms are unprepared to deal with future incidents.

A poll of cybersecurity leaders found 88% of UK firms have experienced an agent-related security incident in the past year. Crucially, only 36% of those polled said they were able to contain an incident in under 24 hours.

The findings come as agent deployments accelerate across a range of industries, the company said, from financial services and manufacturing to healthcare.

ServiceNow CISO Ben de Bont also highlighted high-profile incidents involving agents this year.

In July, OpenAI revealed that agents had escaped sandbox environments and breached third-party organizations, including Hugging Face. The admission by the firm was followed by similar cases involving agents at Anthropic and Meta.

These incidents underline the potential risks associated with the technology, de Bont said.

“The agentic incidents making headlines this year are a warning about what can happen when AI is deployed without the right controls,” he commented.

“Organizations shouldn’t have to choose between moving quickly and managing risk. The ones that get this right will build governance into how they deploy agents from the start, so they can realise the benefits of AI without losing visibility or control.”

Agentic AI security in the spotlight

According to ServiceNow, security leaders face a dual challenge when it comes to agentic AI security: the scale of adoption and adapting to “machine-speed” capabilities.

The current rate of adoption is “compounding organizations’ exposure”, the company said, with more than 51% of firms now running between 100 and 999 AI agents. Just over one-third (38%) are running upwards of 1,000 agents.

Yet despite the scale of adoption, just over half (53%) of security teams have a “full, accurate record” of every agent in production.

Moreover, 24% revealed they’d identified agents running in production that had never been registered and were unknown to them.

Running parallel to this, ServiceNow warned that the machine-speed capabilities of agents are “outpacing human-speed response” capabilities.

Three-quarters of respondents said they maintain a complete map of what services and systems agents can access, yet only 31% can monitor them in real-time.

This visibility gap means many security teams are unable to respond quickly enough in the event of a security incident or an instance where agents access unauthorized systems.

Observability has become a recurring concern since the advent of agentic AI, with enterprises unable to keep tabs on a growing array of agents operating behind the scenes.

ServiceNow’s findings on this front echo those in a recent study from Salt Labs. A survey by the security firm found the rate of adoption is placing a huge strain on security teams when it comes to visibility and governance.

Many enterprises also lack the appropriate containment controls for agents, Salt Labs warned. Indeed, the study found nearly half of respondents had observed an agent performing an action that wasn’t intended or authorized.

Assessing risk

ServiceNow noted that the use of agents will require a step change in how security leaders assess risk – and so far these efforts are falling flat.

The company said that while many security leaders “self-assess as having established agentic security postures”, just 13% have clear cut programs designed to measure leading considerations.

These key considerations span areas such as attack surfaces, accountability, visibility, and audit readiness.

According to ServiceNow, this shows that agentic AI security is primarily governed by “legacy frameworks and human-driven systems” that are unfit. Just over half (51%) of UK firms said they have governance frameworks that cover the aforementioned considerations.

Similarly, fewer than half (48%) of security teams build “design security” within the agent development process. The study warned this means that various permissions and guardrails are being implemented on an “ad-hoc, after-the-fact basis”.

FOLLOW US ON SOCIAL MEDIA

Hammer Distribution has announced a new UK-focused strategic partnership with cyber protection vendor Acronis.

Hammer’s channel network now has access to Acronis’ scalable portfolio of solutions, spanning cybersecurity, infrastructure, next-generation AI services, and MSP operations.

The move brings together two companies with established roots in the UK channel at a time when MSPs face increasing pressure to deliver greater value to clients while managing rising costs and complexity.

By pairing its own channel expertise with Acronis’ comprehensive cybersecurity platform, Hammer said partners will benefit from a single, integrated approach to tackling modern customer requirements.

In an announcement, Dominic Ryles, director of Cyber and Cloud at Hammer Distribution, described the collaboration as “a genuine step forward” for the company’s network of partners.

“Bringing together Hammer's channel expertise and Acronis's innovation in GenAI and XDR gives our partners a real competitive advantage, not just new products to sell, but an automated framework to secure and future-proof their clients' businesses,” he explained. “We're excited to see what our partners build with this."

Scalable cybersecurity for partners

Through the new agreement, Hammer partners now have access to a host of cyber security services, which include endpoint, managed, and extended detection and response (EDR, MDR, and XDR) tools, alongside email security, security posture management, security awareness training, and data loss prevention (DLP).

The deal also includes Acronis’ Cyber Frame, a new infrastructure offering designed for modern IT environments, as well as AI-native solutions such as GenAI Protection and Cyber Employee for augmenting and accelerating security operations.

Additionally, MSPs can now leverage automation tools across remote monitoring management (RMM), professional services automation (PSA), and workflow automation to help scale their operations.

Hammer said Acronis’ solutions are backed by its own enablement infrastructure, which covers onboarding support, technical training, and active pipeline development assistance.

Acronis general manager Jo Holliday said the partnership will benefit UK MSPs that find themselves under increasing pressure to deliver stronger protection and more efficient service delivery without increasing complexity.

“Hammer’s channel expertise makes them a strong route to market for Acronis in the UK,” she commented.

“Together, we can help partners bring natively integrated cyber protection, infrastructure management and service automation to more customers, enabling them to protect, manage and automate client environments more effectively while building scalable, profitable managed services.”

FOLLOW US ON SOCIAL MEDIA

The UK can capitalize on a £75 billion economic boost by 2035 if it acts quickly enough on AI adoption, according to a new industry taskforce, but time is running out to act.

The Project Sovereign AI Leadership (SAIL) report has called for a “Prosperity Compact” between government, business, regions and citizens - which needs to be established within the next 12 months.

This call to action has been backed by senior executives at Microsoft, NScale, Cisco, and BT.

“AI is the defining technology of our generation, but realising its £75 billion economic potential requires genuine mobilization of the entire nation. By establishing a clear Prosperity Compact between government, industry, and local communities, we can build the infrastructure we need, equip our workforce with future-ready skills, and ensure Britain’s digital destiny," said Steve Rigby, CEO of Rigby Group and chair of the Project SAIL Taskforce.

"This taskforce’s goal isn’t another strategy document, but high-impact actions that materially accelerate the UK’s transition to an AI-enabled economy.”

The report makes ten specific recommendations for the government, kicking off with a Compute Accelerator service for mid-scale infrastructure capabilities.

This would see the creation of a dedicated service within the Department for Business, Innovation, Science and Trade (DBIST) to support local authorities in identifying, matching, and planning mids-cale data center and networking sites.

Of the roughly 73 GW of data center applications in the connection queue, about 93% sit in the two largest size bands - very little sits between 10 and 100 megawatts, the report noted.

It’s this mid-scale range where the UK can build at pace, serving enterprise, research, defence, and health. The taskforce said Downing Street should back the mid-scale with the same ambition it has shown for the flagship tier.

The taskforce also wants to see grid connection queue reforms, prioritizing homes on distribution networks, and fast-tracking data centers on transmission lines.

AI skills and sovereignty are key

Crucially, the taskforce called for a stronger focus on AI training, led by Skills England, across priority sectors including construction, care, professional services, and manufacturing.

The country also needs a clear definition of sovereign AI - often just a marketing label, the report warned. This means creating a workload classification framework that grades sovereignty across each layer of the stack - infrastructure, including data centers, compute and networks, data, models and applications, and workloads.

Elsewhere, the government should publish Cabinet Office guidance and gap analyses, requiring fallback mechanisms for public services reliant on hosted frontier AI models, starting with healthcare; and return the Government Digital Service to the center of government to lead procurement.

"The government has taken important steps to set the UK's AI ambition; now it’s time for government and industry to come together to deliver. Our national strategy must translate into tangible benefits for every region and community," said Sarah Walker, chief executive, Cisco UK & Ireland.

"That starts by recognising that AI is only ever as powerful as the infrastructure that underpins it, the power that sustains it, and the robust cybersecurity that protects it. By backing these recommendations and accelerating digital skills through strong cross-sector partnerships, government and industry can build the secure, trusted ecosystems needed for AI to scale responsibly.”

FOLLOW US ON SOCIAL MEDIA

More than half of UK organizations have reported "surprise" bills for monitoring IT systems, according to new research from Cisco, and AI is a key factor behind surging costs.

In a new survey from the firm, 65% of respondents said their observability costs had exceeded infrastructure or operational costs this year, with half reporting surprise costs with telemetry data, and another third saying that led to reduced data coverage or retention.

The complaint isn't just high costs, but those that are higher than expected, with 55% of those asked pointing to surprise expenses that are straining operations more than typically baseline costs.

General AI adoption costs are also exacerbating the issue, Cisco found. Another 55% said they are finding it impossible to control AI costs, a problem as AI observability has become a priority, according to nine-in-ten respondents.

That echoes a previous study by KPMG, that found many companies struggle with costs and lack visibility into AI spending.

“For today’s enterprises, the excitement of AI is clashing with the reality of the bill,” added Kamal Hathi, SVP and GM, Splunk at Cisco.

It's not just Cisco spotting this trend, either. A poll by Asana earlier this year found that eight-in-ten UK IT leaders had seen unexpected costs increases from AI over the last year, with Gartner predicting that AI costs could exceed developer salaries by 2028.

Given the rising costs, companies began cracking down on "tokenmaxxing" and other AI overuse this summer, with Uber introducing a monthly AI cap and Accenture telling staff to cut back on AI use for basic tasks.

AI observability

While monitoring AI is a clear priority, more than half of those polled said they don't have a clear business outcome tied to their AI usage, and 56% said they're unable to measure AI workload metrics such as LLM response quality, which Cisco said was a core metric.

Indeed, 85% said they need to have visibility into AI hallucinations, but fewer than six-in-ten said they're effective at spotting such concerns.

“We believe observability is the essential bridge to restoring predictability and confidence to the agentic AI era," Hathi added.

"By providing the necessary guardrails and incorporating observability into an AI tokenomics framework, leaders can transform AI from an unpredictable expense into a measurable and strategic long-term business investment."

Collaboration and teamwork

One silver lining in the confluence of challenges faced by enterprises lies in heightened teamwork and collaboration, according to Cisco. More than half (55%) of those polled are worried about the unintended consequences of AI agents, prompting closer synergy between departments.

Eight-in-ten IT professionals have observed a marked increase in collaboration between observability and security teams as a result.

Nearly three-quarters (73%) also revealed they can accurately trace performance issues to security root causes, an increase from 65% in the survey last year. Similarly, there’s been a marked increase in data sharing between these two teams from 74% to 84% over the last year, with a similar leap seen in working together on troubleshooting.

"Most companies will soon have far more agents at work than people," said Jeetu Patel, president and chief product officer (CPO) at Cisco.

"Managing agents at scale requires reimagining both security and observability. Have our agents been compromised? Are they doing their job well? In the world of agentic AI, these questions are inseparable, and they're moving at machine speed."

FOLLOW US ON SOCIAL MEDIA

AI is speeding up coding, but what about everything else across the software development lifecycle? According to new research from Atlassian, developers still report mixed gains and growing frustration.

As part of its State of Developer Experience Report, 87% of respondents told Atlassian that AI helps them write code faster, but nearly three quarters still face the same – or even greater friction – across the development lifecycle as before.

Indeed, traditional organizational and workflow bottlenecks are still slowing down processes, and that's led to a reduction in time savings that can be attributed to AI.

Last year's version of the poll found that 68% of software developers saved at least ten hours every week thanks to AI. By this year, that had slipped to 25%.

Beyond that, half of developers polled said they spend at least four hours a week managing output from AI, with two thirds adding that they have to spend time fixing errors in work.

Atlassian's study is by no means the first to report mixed gains from AI in software development. Research from Harness, for example, showed that while the technology is speeding up coding, eight-in-ten developers now spend more time reviewing code and completing other "invisible work" tasks.

The AI coding conundrum

So what’s slowing down software development? The survey suggests half of developers are spending too much time finding information and attending meetings, with a further 45% pinning the blame on context switching.

That tracks with separate research from Workday, which found one-in-four UK workers spend seven or more hours a week copying information between apps including AI tools.

"AI can help developers move quicker, but faster code is not the same as better software delivered sooner," said Andrew Boyagi, Customer CTO at Atlassian. "If teams still struggle to find information, clarify requirements and move work through the delivery process, speeding up coding alone won’t translate into business outcomes."

Atlassian said that AI has potential to address some of these challenges – such as by streamlining knowledge discovery and automate handoffs – but most uses of AI across the software development lifecycle remains focused on code generation rather than workflow optimization.

"Making one task faster doesn’t improve the whole system," said Boyagi.

Measuring AI

Notably, the survey found that developers feel pressure to use AI, with four-in-ten using the technology more often than is strictly necessary because they feel it's expected of them.

That's perhaps no surprise given six-in-ten report that their employer sees AI usage as a measure of productivity – and that just 17% of devs and 23% of engineering leads say their own organization has a "clearly communicated and implemented AI strategy".

"Leaders need to be clear about the problems they want AI to solve and measure the outcomes for the whole team, not just how often the tools are used," added Boyagi.

When AI does manage to speed up software development successfully, it exacerbates another existing problem: burnout.

This has become a recurring issue for development teams since the advent of generative AI. As ITPro reported in March this year, research from Harness found that the increased velocity created by the technology is creating huge pressure.

Developers now face more after-hours work as a result of botched code and remediation tasks. The majority of those polled by Harness (96%) now report working evenings or weekend multiple times a month due to release-related work.

FOLLOW US ON SOCIAL MEDIA

Businesses are faced with a bewildering choice of network monitoring solutions, and WhatsUp Gold from Progress Software stands out for its simplified licensing plans. Progress is commendably transparent about pricing and offers flexible subscription-based and perpetual licence options, along with a free version that monitors 10 devices and all of their components.

The Progress WhatsUp Gold 2026 on review delivers plenty of new features; the SSL certificate discovery and tracking introduced in the previous version has been updated to allow certificates to be discovered on any port, with new dashboards helping to maintain compliance with more information on expired or expiring ones. Stored device credentials are protected by customer-specific encryption keys. And businesses invested in Hirschmann will be pleased to know WhatsUp Gold now provides out-of-the-box support for its industrial network devices.

Security is even tighter with the introduction of a master secret key. Created during WhatsUp Gold installation, this key encrypts sensitive information in the WhatsUp Gold database and will be required if you want to recover or migrate to a new environment – so make sure it's stored safely in a secure location.

Progress WhatsUp Gold 2026 review: Plan to monitor

Progress Software employs device licences that allow you to monitor everything on a device, regardless of the number of components, aspects, or channels. Aimed at SMBs, a Business subscription starts around £920 per year for 50 devices and enables network discovery, topology mapping, alerting and reporting, plus cloud, wireless network and storage monitoring.

An Enterprise subscription starts at £1,540 per year, adds internet, virtualization host and application monitoring, network path analysis plus log management, and supports two WhatsUp Gold installations for distributed monitoring. Larger businesses will find Enterprise Plus appealing as it starts at around £2,600 per year and adds switch, router and firewall configuration management along with the NTA+ (network traffic analysis plus) module and support for four distributed installs.

Value for the Enterprise and Enterprise Plus plans gets a boost as they both include access to the WhatsUp Gold 360 service. This is ideal for distributed networks as you can monitor multiple sites from a single cloud portal.

Progress WhatsUp Gold 2026 review: Swift deployment

We installed WhatsUp Gold on a Windows Server 2025 host in 20 minutes and followed the quick start wizard to create our first network discovery. You add your networks and subnets, enable AWS and Azure discovery, and expand it to look for virtualization hosts, wireless infrastructures plus storage devices.

After adding all required device and service credentials, you specify which ports you want the certificate discovery to query and then set the scan to run at scheduled intervals. Our first discovery on a single subnet took around 10 minutes and reported back with a detailed list of all our Windows servers and workstations, network switches, firewalls, printers, NAS appliances, and VMware and Hyper-V hosts plus their VMs.

From the console's network view, you can select devices and manually enable monitoring, but WhatsUp Gold can do all the hard work for you as discovery jobs can be set to automatically monitor devices using predefined sets of roles and sub-roles. WhatsUp Gold also applies base sets of active and passive monitors and thresholds to each discovered device.

Redfish is fully supported, and after providing the appropriate credentials, WhatsUp Gold assigned a group of monitors to our Dell iDRAC and HPE iLO server management controllers. These can gather a lot of valuable information on server hardware, including the status of the chassis, CPUs, memory, storage devices, fans, temperatures, and power supplies.

Progress WhatsUp Gold 2026 review: Console and actions

The WUG console is easy to use as it groups all features under five main menus in an upper ribbon bar. The NTA+ menu tab is specifically for viewing flow data from Progress Software's FlowMon Collector appliances.

Colour-coded icons are assigned to each monitored element so you can easily see if they are up or down, while frequently used views can be added as Favourites for quick access from the star icon to the right. Analysis dashboards are a great feature as you can design detailed custom views, while the NOC (network operations centre) feature presents support staff with a heads-up display that combines slide decks of multiple dashboards with a view duration.

WhatsUpGold spotted all our secure web servers during its discovery and added an active SSL certificate monitor to each one. These default to checking them every 11 hours, and if they have expired or will expire in the next 30 days, it changes their status icon to show them as requiring attention.

Plenty of tools are provided for creating alert policies, linking them with device state changes, and assigning actions. WhatsUp Gold currently provides 24 types of actions, including sending SMS and email, restarting a service, running a PowerShell script, and linking up with services such as Microsoft Teams, ServiceNow, and Slack.

The Application Monitoring module is the weakest link, as the list of available profiles desperately needs updating. Links to the Progress community for downloading third-party profiles have also been removed as Progress is in the process of moving them all to GitHub.

Progress WhatsUp Gold 2026 review: WhatsUp Gold 360

WhatsUp Gold 360 is easy to deploy, as we logged into the customer portal using our Progress ID and, from the Connectors page, downloaded the install file. The connector must be virtualised, and we chose the Hyper-V version – others are available for VMware, KVM, Nutanix and Azure, with AWS support coming soon.

Creating a new Hyper-V VM using the supplied VHD file took a minute, and for tighter security, the connector will only link up with and send data to the WhatsUp Gold 360 tenant that created it. Adding our WhatsUp Gold instance was equally swift as we provided a meaningful name, its IP address, and admin credentials along with the thumbprint copied from the certificate viewer in the local WhatsUp Gold web console.

After a brief synchronization, the WhatsUp Gold 360 portal presents a dashboard with a choice of customisable widgets, including ones for connector and instance status, connector availability, total WhatsUp Gold monitors and devices, and events over time. You can create multiple dashboards, choose the widgets you want, and drag them around the view to suit.

WhatsUp Gold 360 pulls in a lot of information from each WhatsUp Gold instance, with its Infrastructure menu providing lists of all monitored assets, detailed hardware and software inventories, used credentials, and more. Details can be refined as all lists are searchable, and you can select WhatsUp Gold instances to view specific sites.

Communications channels are being replaced by the new notification management feature, allowing WhatsUp Gold 360 to send alerts via email or webhooks to Microsoft Teams and Slack. The webhook service is currently in beta testing, and the only alert we could send to our Teams channel was to warn of connector state changes.

Progress WhatsUp Gold 2026 review: Is it worth it?

WhatsUp Gold 2026 is an affordable network monitoring solution, and the flexible device-based licensing plans make it easy to keep costs under control. The highly configurable web console delivers a remarkable range of network monitoring services, and the Enterprise and Enterprise Plus plans look like even better value, as these include access to the WhatsUp Gold 360 cloud portal.

As data centers are rapidly constructed around the world, people are inevitably beginning to question their sustainability and the impact they have on the communities that surround them.

From an enterprise perspective, there is even more to wrestle with. Data centers are long-term investments that need upgrades and maintenance to continue operating. Is there a cheaper and more environmentally friendly way to do this?

Chris Carreiro, the CTO of global IT infrastructure services firm Park Place Technologies, joins Jane and Bobby to discuss the pros and cons of flatpack data centers and how modular computing can help enterprises scale up.

Highlights

"These are now purpose-built for higher workloads – a few years ago we were building data centers for 5 and 10 kW cabinets; every rack was about 10KW – now we're going into the 40-40 kW on a regular build, and an AI facility, AI factory, is demanding 100 kW per rack now."

"A traditional data center, two years of trucks and construction carry us forward into maybe 5 to 7 years down the road without adding additional cooling capacity or additional pieces. So I think there is a little bit of runway for some of those systems. But as far as upgrading, if the design is chasing the 500 kW cabinet that Nvidia is talking about, as long as there is space for those types of cooling elements, you would be able to leverage just upgrading a few components inside of a facility."

Links

• The great data center backlash threatens to disrupt the future
• Data center markets are booming in these EMEA countries
• AI data center growth stymied by power constraints

Tech industry leaders and security experts have expressed shock amidst a surge of attempted cyberattacks and suspended websites in the wake of critical PHP vulnerabilities.

Speaking at its AI Tour event in Germany, Microsoft CEO Satya Nadella reportedly said: “I’ve not seen anything like this in a long, long time.”

“It was a long day and a long night, I know, for all the IT and security folks,” Nadella added.

Nadella’s comments come after an update was issued to address critical PHP vulnerabilities that could impact millions of websites globally.

PHP (PHP Hypertext Preprocessor) is a programming language used in web development, which underpins much of the internet. The two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, carry a CVSS score of 9.2, ranking them as ‘critical’.

Security experts have warned that both could allow unauthenticated remote code execution (RCE) and allow threat actors to seize control of servers, disrupt services, and steal data.

Given the severity of the flaws, several international cybersecurity agencies issued urgent alerts. CERT-EU and the UK’s National Cyber Security Centre (NCSC) urged organizations to patch immediately when available, or consider shutting down systems to prevent compromise.

“Millions of attempts”

While the PHP Foundation released an update on Wednesday, the patch was pushed forward by a day after a leak of CVE identifiers, meaning threat actors had some understanding of how to exploit the flaws.

An exploit tool known as ‘PHP2Shell’ was reportedly developed and showcased online.

Cloudflare CEO Matthew Prince revealed the company saw “thousands of attempts to exploit it” in the hours before it was publicly announced.

“Across the Cloudflare network we saw thousands of attempts to exploit it,” he wrote in a post on X. “That jumped to tens of thousands in the 45 minutes post-announcement, hundreds of thousands within 2 hours, and millions now.”

Websites taken down

The global impact of the PHP vulnerabilities cannot be understated, particularly given cybersecurity agencies actively encouraged some organizations to take systems offline.

Services worldwide have been taken down as a result of the vulnerabilities while organizations apply patches. Dozens of UK government services have been taken offline as a precautionary measure while updates have been applied, according to reports from BBC News.

In Japan, Asahi shuttered some websites and systems to conduct threat assessments, while French telecoms giant Orange temporarily suspended access to some PHP-based websites.

Matt Cooke, EMEA cybersecurity strategist at Proofpoint, described the incident as a “stake-in-the-ground moment” for enterprises and cybersecurity leaders alike.

“Organizations of every size have a finite window to shore up their cyber defenses, because threats now operate at machine speed,” he said.

“Patch fast, know your attack surface, and limit the blast radius, because that window is closing. If we don't act now, we will see more organizations forced to take their sites offline while they scramble to fix what should have been secured long ago."

Did AI help? find the PHP vulnerabilities

A key talking point in the PHP incident lies in how vulnerabilities were discovered: namely through the use of AI. Cybersecurity researchers at Calif originally identified the flaws using OpenAI’s GPT-5.6 Sol model as part of the firm’s Patch the Planet initiative.

Researchers at Wiz also independently discovered and reported both vulnerabilities.

In a blog post detailing the discovery, Wiz researchers said the findings “rank among the most severe vulnerabilities discovered in PHP, and arguably in software history”.

Researchers also emphasized the importance of AI in the discovery, which helped simplify processes and shed light on the flaws.

“The underlying flaws had been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve,” Wiz researchers wrote.

“Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit.”

Tom Exelby, head of cyber security at Red Helix, issued a stark warning, insisting that this “won’t be the last time we see an incident like this”.

“So much of our digital world rests on a comparatively small number of providers, platforms, and open source components, and that concentration means a single flaw can have a global impact in minutes,” he said.

“When a technology is embedded in millions of websites and services, a vulnerability stops being one organization’s problem and becomes everyone’s.”

FOLLOW US ON SOCIAL MEDIA

Veeam has launched a global initiative that combines its data protection capabilities with local service providers’ local expertise to help customers address data sovereignty requirements.

The new Veeam Sovereign Service Providers Program will be launched in phases, with the first introducing the Data Sovereignty Competency within the company’s Cloud & Service Provider (VCSP) program. Additional program offerings are set to follow later in the year.

The initiative will see the vendor work with participating service providers to deliver services tailored to customers’ business needs. These services will combine Veeam’s technical capabilities around sovereign data protection with providers’ local operating models, governance, jurisdictional expertise, and established market presence.

Veeam said this will enable customers to assess solutions across data location, operational control, access governance, and legal jurisdiction without compromising cyber resilience or recoverability.

“Sovereignty is defined by each customer’s regional government, legal, regulatory and operational requirements,” commented Michelle Graff, Veeam’s senior vice president of global partnerships. “Meeting those requirements depends on both technology and the way a service is operated.”

Graff said the company’s new initiative brings these two elements together by merging its own data protection capabilities with local expertise across governance and service delivery.

“The VCSP Data Sovereignty Competency gives customers a clearer way to identify providers that have invested in both,” she added.

Highlighting data sovereignty expertise

The VCSP Data Sovereignty Competency arrives as AI technologies become a critical element of business operations, security, and governance.

According to recent Veeam research, 70% of surveyed companies admitted that AI workflows are interacting with sensitive corporate data without full oversight, while 67% said employees are creating autonomous workflows that cannot currently be fully tracked.

The vendor said its new competency will now help customers identify providers that have demonstrated capabilities against its criteria for operational, legal, technological, and governance capabilities.

These requirements include local operating models, jurisdictional controls, in-region personnel, data governance, customer oversight, and resilient data protection.

The competency acts as a reflection of a provider’s alignment with its program requirements, rather than replacing a customer’s own legal, regulatory, risk, or compliance assessments.

Strengthening customer choice

By combining its own capabilities with local providers’ sovereign operating capabilities, Veeam said the resulting solutions will help customers address data sovereignty requirements as regulatory and geopolitical factors continue to evolve.

The new competency sits alongside other offerings in the VCSP program, with customers able to select service providers based on relevant requirements – including data sovereignty, disaster recovery as-a-service, and off-site backup.

Tim Pfaelzer, Veeam’s general manager and senior vice president for EMEA, said Europe has seen sovereignty evolve from a compliance consideration into a key strategic business requirement.

“As regulation expands and organizations scale AI initiatives, they need greater certainty over where data resides, who can access it and which laws govern its use,” he explained.

“Veeam’s technology, combined with the local operating capabilities of trusted service providers, gives customers a practical and defensible route to strengthen data control without sacrificing resilience or recovery.”

FOLLOW US ON SOCIAL MEDIA