Palo Alto Networks CEO Nikesh Arora has issued a stark warning to workers reluctant to adapt to generative AI: they face a “Darwinian moment”.

Speaking during a recent appearance on the 20VC podcast, Arora suggested a significant portion of workers globally lack necessary AI skills, which raises questions about how leaders can implement change and build workforces capable of meeting future demands.

“The challenge right now is 90% of enterprise employees are not AI savvy. They’re not,” he said.

“They have to learn. I can’t send them to university. There’s no course you can take in school anywhere. They have to be able to learn on their own. I think we’re back to a Darwinian moment where everybody has to figure out who’s really good.”

In some cases, building an AI savvy workforce has prompted some drastic action by executives. Nikesh pointed to Coinbase CEO Brian Armstrong’s approach of penalizing workers who refused to adapt or embrace the technology.

During a podcast appearance last year, Armstrong admitted to firing workers who refused to engage with the technology after paying for enterprise licenses for GitHub Copilot and Cursor.

Other organizations, such as Jack Dorsey’s Block, reportedly introduced AI mandates for workers. Both companies laid off staff this year amidst claims that the technology is changing how they operate.

“You’ve seen people like Brian Armstrong and Jack Dorsey go out and say, ‘I’m going to decimate my organization, and I’m going to start building from scratch’ and they’ve gone to some version of 30, 40% fewer people because they figured out there is no redemption,” Arora said.

As ITPro reported last year, punitive measures to spur AI adoption in the enterprise is a sure fire way to create workforce pushback.

It’s a similar dynamic to the return to office (RTO) mandates that caused widespread upheaval at a range of big tech firms in recent years. Encourage, but don’t push, or else it could come back to bite you.

Palo Alto Networks’ approach leans toward a gradual shift, Arora noted. The company, which has roughly 20,000 staff, has a “natural attrition of 2% a month. The focus now is on replacing these staff with people who are indeed AI-savvy.

Elsewhere, the company actively seeks out AI talent from events such as hackathons, Arora revealed. These are lucrative talent pools that the company can draw from to acquire staff.

“We hire from hackathons,” he said. “Give me 12 months, I’ll have sort of transformed 20, 25% of my team. Give me three years, I’ll hopefully have enough AI-savvy people working at Palo Alto.”

Top-down encouragement

Building an AI-savvy workforce also requires accountability on the part of leadership, Arora said. Delivering change requires leaders across an array of functions to have ambition and actively engage with the technology.

Arora has regular conversations with leadership figures aimed at establishing their progress with AI, allowing them to showcase potential wins.

“You have to make sure your leaders are ambitious. You have to make sure they're competitive. You have to make sure they want to win. You have to make sure that they have a learning mindset,” he said.

“When they watch their peers around them do cool [stuff], they want to show up and do cool [stuff] the next time. So for me, it's getting 14 people together and saying, ‘Hey, Harry, tell me today, what have you done for AI the last three days since I last talked to you in your organization, and whatever motivates you?”

This gives Arora a clear understanding of the direction some leaders are going in with the technology. Moreover, it appears to act as a springboard for motivating others across the company.

“It creates a little bit of Darwinian competition amongst them. It creates this urge to go embrace this new technology, and I think hopefully I get 14 people fully motivated, and then they go do that with the next set of people because I need to transform from the top down, not from the bottom up on this topic.”

FOLLOW US ON SOCIAL MEDIA

A proof-of-concept by the AI Now Institute demonstrates remote code execution in Anthropic's Claude Code and OpenAI's Codex when they're running in an autonomous mode that approves their own commands.

The Friendly Fire attack works against an out-of-the-box configuration of Claude Code in 'auto-mode' or Codex in 'auto-review', with researchers testing Claude Sonnet 4.6, Sonnet 5, and Opus 4.8 along with GPT-5.5.

It leverages prompt injections disseminated across a library’s source code that target AI-enabled cyber defense – without the need for hooks, skills, plugins, MCP servers, or configuration files as an injection vector.

Researchers noted the study highlights the potential risks associated with rapid adoption of AI-powered security tools.

Many organizations are doing so without “consideration of the substantial and unmitigated risks associated” with the technology.

AI-related cybersecurity concerns have been rising following the launch of powerful new models such as Claude Mythos. Anthropic rolled the model out as part of a gated release to prevent misuse, and US authorities temporarily imposed export controls amidst similar concerns.

How the Friendly Fire attack works

The attack works by inserting prompt injections into documentation files and adding README files that appear to be part of routine security tooling in an open source library.

Researchers used geopy, a popular Python used for searching for geographic coordinates, but said it could work with almost any project.

When a user asks Claude Code or Codex to perform a security assessment of the repository using the default auto-mode or auto-review automated modes, the agent can be persuaded to execute a malicious binary without any warning and without requesting any further user approval.

The proof of concept is causing alarm amongst security professionals. Roey Eliyahu, CEO and co-founder of Salt Security, said this marks the latest in a string of potential risks in recent months due to manipulation of agents.

“Friendly Fire, GitLost, Agentjacking, TrustFall. Four documented attacks in the past two months, different techniques, same underlying condition,” he said.

“Untrusted text reaches an agent that can run commands. The agent cannot reliably tell the difference between the code it is reviewing and the instructions it is being given. And the attacker's payload executes on the host.”

Eliyahu emphasized that this is not a “model problem that can be patched”. All four models were vulnerable to the same techniques and payload, without any modifications for each.

“When the same attack works unchanged across two vendors and four model generations, you are not looking at a software bug. You are looking at a structural property of how these agents work."

But, said Eljan Mahammadli, head of AI provenance at Polygraf AI, this shouldn't rule out the use of AI for defensive security work.

ITPro approached Anthropic and OpenAI for comment, but did not receive a response by time of publication.

FOLLOW US ON SOCIAL MEDIA

A ransomware negotiator has been sentenced to 70 months in prison after secretly conspiring with hackers to extort clients.

Angelo Martino, 41, of Land O’Lakes, Florida, worked at US-based cyber incident response company DigitalMint in April 2023 when he started conspiring with the operators of the BlackCat ransomware group.

BlackCat paid Martino to provide confidential information about the negotiating position and strategy of his employer’s clients, along with the details of their ransomware insurance, to help maximize the ransoms paid.

Notably, Martino also conspired with two former cybersecurity professionals between April 2023 and November 2023.

Kevin Martin, 36, of Texas, was hired as Martino’s co-worker at DigitalMint after the conspiracy began. Ryan Goldberg, 41, of Georgia, was manager of incident response at Sygnia.

All told, Martino was found to have extorted five different victims as part of his collaboration with the cyber crime syndicate while the trio also worked to deploy BlackCat ransomware against victims across the country.

Assistant attorney general A. Tysen Duva of the Justice Department’s Criminal Division, said victims had shared “heartbreaking accounts of how their businesses were nearly destroyed” during the trail.

“Today’s sentence accounts for the harm Martino caused and demonstrates that the Department of Justice can and will identify and prosecute cybercriminals to the fullest extent of the law.”

Working with the enemy

After successfully extorting one victim for around $1.2 million in Bitcoin, the men split their share of the ransom three ways and laundered the funds through various means.

Jason A. Reding Quiñones, attorney for the Southern District of Florida, said more than $10 million in criminal proceeds have been seized. These assets include digital currency, vehicles, a food truck, and a luxury fishing boat.

A separate hearing has been set for September 17 to decide the amount of restitution to be ordered against Martino.

The Justice Department started working to bring down BlackCat three years ago, developing a decryption tool that allowed FBI field offices across the US and law enforcement partners around the world to help victims restore their systems.

The scheme has reportedly saved victims from paying out $99 million in ransom payments so far. The FBI also seized several BlackCat websites at the same time.

"This case sends a clear message: we will pursue the hackers who deploy ransomware, the insiders who enable them, and the money they steal from American victims,” Quiñones said.

FOLLOW US ON SOCIAL MEDIA

Software developers aren't losing skills because of AI, but using time saved to skill up, according to research from O’Reilly.

Analysis from the learning platform found that rather than the boom in AI coding tools having a negative effect on developer capabilities, many view the technology as a way to streamline everyday tasks to help them focus on learning.

O'Reilly said that use of generative AI content on its own learning platform was up 89% in the UK over the last year, while machine learning grew by 51% and natural language processing was up 117%.

At the same time, O'Reilly noted that more traditional programming topics saw decline over the last year, with "programming fundamentals" down 74%, Agile falling 31%, and Git down 20%.

While that could be seen as software engineers handing off such work to AI and not bothering to study key subjects, the study noted this suggests many are learning such skills on the job and using AI to support learning.

Formal training time, meanwhile, is spent learning about more advanced AI-related topics.

Alexia Pedersen, SVP International at O’Reilly, said the study shows developers are now making AI a “core part of their learning priorities”.

"The UK tech workforce isn’t turning its back on programming," Pedersen said. "It’s building on years of engineering expertise to take advantage of the opportunities AI creates. That’s exactly what we’d expect from experienced developers."

"Many already have years of programming experience, which puts them in a strong position to adopt AI tools confidently and apply them in meaningful ways," she added.

AI isn’t a replacement for core skills

That said, O'Reilly warned that AI should complement, not replace, foundational programming knowledge – especially for newer developers.

As ITPro reported last year, concerns are rising that those entering the workforce are becoming too reliant on the technology. The result is that many could miss out on valuable learning curves in the early stages of their careers.

"The challenge now is making sure the next generation develops those same foundations before relying too heavily on AI," Pedersen commented. "AI will make great developers even better, but it can’t replace the technical judgement that comes from understanding how software really works."

The company suggested that while developers are choosing to learn in different ways, it's worth noting that employers still require specific programming skills.

React, Node.js and Java skills are still highly sought after while cloud-related knowledge is prevalent in many UK job ads.

Indeed, demand for the Clean Code courses grew 19% over the last year, O'Reilly said, with C# up 17% – showing practical coding capabilities remains important.

"What this data captures is a workforce making active choices about where their time goes," Pedersen said.

"UK tech professionals aren't casually browsing AI content – they're incorporating technical learning into new ways of working, building AI agents, testing different approaches, and exploring how these tools can improve productivity and outcomes.

FOLLOW US ON SOCIAL MEDIA

IBM has announced a series of updates to its IBM Bob software development tool, with a particular focus on better managing token consumption.

The move marks the first big batch of updates for the agentic development tool, which rolled out earlier this year. Bob will now offer multi-agent capabilities, the company said, alongside built-in AI cost and usage analytics features.

According to IBM, the new ‘Bobalytics’ feature will enable developers to monitor AI token consumption, streamline resource management, and improve visibility in terms of how AI tokens are consumed by teams.

Sub-agents and multi-agent capabilities will also play a key role in reducing costs, according to IBM. Sub-agents are those that operate under the direction of another to handle specific tasks within a larger workload.

The advantage here is that these dedicated agents will work in an “isolated context” within broader workloads to complete tasks in a more efficient manner, ultimately reducing costs.

Multi-agent features also contribute on this front, according to Michael Kwok, VP of IBM Bob. In a blog post detailing the updates, Kwok noted that Bob will now call on specific tools based on the underlying model, allocating agents depending on the intensity of tasks and associated costs.

“Parallel tool execution can significantly reduce the time required for complex tasks involving multiple searches, file operations and validation steps,” Kwok explained.

“Subagents improve efficiency by performing specialized work in isolated context before returning only the relevant results, while background tasks allow long-running work to continue without interrupting the developer’s workflow.”

AI cost optimization in the spotlight

The move by IBM comes amidst a sharpened focus on AI token consumption - and spiralling costs - by enterprises globally. As ITPro reported in June, the ‘tokenmaxxing’ trend has landed some organizations with eye-water bills.

Uber, for example, blew through its entire annual AI bill in just four months after incentivizing staff to ramp up use of the technology.

Developer teams are also contending with rising costs on this front, as Gartner told ITPro in late June. The consultancy projects that token costs could exceed engineer salaries by 2028 based on current usage rates.

Speaking to ITPro at the time, Nitish Tyagi, senior principal analyst at Gartner, said engineering teams are adopting a range of cost optimization practices to reduce the impact of token consumption.

New ‘premium packages’ for IBM Bob

IBM also unveiled three new specialized workflows for Bob aimed at driving Java, IBM Z, and IBM i operating system (OS) modernization. These capabilities come in separate ‘premium packages’, according to the firm, offering enterprises domain-specific versions of the tool.

“Modernizing a Java application requires different knowledge, tools and workflows than working with IBM i systems or mission-critical mainframe applications. Each environment carries its own architecture, runtime assumptions, integration patterns, validation needs and operational constraints,” Kwok explained.

“Premium Packages bring domain intelligence and decades of enterprise expertise directly into Bob while maintaining a consistent developer experience.”

The premium package for Java, for example, will help automate migration processes, allowing teams to move to more recent versions of the programming language. Bob will essentially guide users through the process, while also assisting with broader modernization practices.

This includes automated compatibility testing and the ability to identify and remediate vulnerabilities.

The premium package for IBM Z, meanwhile, will provide teams with a helping hand during mainframe modernization projects. The Z Code Mode feature, for example, will help “explain, generate, modify, refactor, and transform mainframe application code”.

Efforts to streamline mainframe modernization by the firm come after a high-profile spat with Anthropic earlier this year.

FOLLOW US ON SOCIAL MEDIA

Barracuda Networks has announced the acquisition of identity and access management (IAM) specialist Evo Security, in a move that will bring expanded capabilities to its BarracudaONE platform.

Founded in 2018, Texas-based Evo Security provides a platform that combines IAM capabilities with privileged access management (PAM) technology into a single, multi-tenant platform tailored to the needs of MSPs.

The acquisition will see the firm’s technology integrated into BarracudaONE, creating a unified offering that brings together access management, identity protection, and identity threat detection and response.

According to Barracuda, the expansion will provide partners with a single platform for delivering identity resilience while helping customers simplify identity security by reducing the need to manage multiple point solutions.

In an announcement, Barracuda CEO Rohit Ghai said combining Evo Security's technology with BarracudaONE will help customers stay ahead of identity-centric attacks as AI continues to reshape the threat landscape.

“In the agentic AI era, protecting both human and non-human identities is imperative for delivering cyber resilience,” he explained. “Existing enterprise identity solutions are complex, costly and fail to meet the needs of MSPs that must scale to securely manage millions of identities across thousands of customer environments.

“We are thrilled to combine Evo Security’s partner-first innovation with our vision of BarracudaONE and offer a complete, intelligent, easy, and open platform that closes this gap.”

According to the vendor, Evo Security’s integration into the BarracudaONE platform will provide partners with a unified identity security architecture that spans privileged access management, access control, identity protection, and identity threat detection and response.

MSPs will be able to manage customer identities from a single multi-tenant environment while enforcing authentication, access policies, identity protection, and identity threat detection.

Barracuda builds on resilience goals

The acquisition also builds on Barracuda’s wider cyber resilience platform, which already includes solutions that cover email security, data protection, network security, cloud security, and managed extended detection and response (MXDR).

For customers, Barracuda said the expanded offering will deliver integrated identity security that is designed to be easier to deploy and manage than traditional enterprise identity platforms, while allowing organizations to retain their existing security infrastructure rather than replacing it.

Alongside the technology integration, Evo Security’s team has joined Barracuda as part of the acquisition and the vendor said it will continue to support Evo’s existing MSP customers as the platform continues to expand.

Commenting on the acquisition, Evo Security founder and CEO Michael Roth said joining Barracuda will enable the business to expand its identity-first approach to a wider global partner base.

“We built Evo Security to solve the identity challenges MSPs face every day,” he explained. “Joining Barracuda gives us the scale, reach and resources to accelerate that mission globally.

“Our identity‑first approach was designed from day one for MSP operations, and now, together with BarracudaONE, we can bring modern identity security, privileged access management and automation to far more partners and the customers they protect.”

Financial terms of the acquisition were not disclosed.

FOLLOW US ON SOCIAL MEDIA

Researchers at Nebula Security have discovered a Linux kernel flaw dating back to 2011 that lets any logged-in user take full root control of an unpatched machine in just five seconds.

Dubbed GhostLock (CVE-2026-43499), it was introduced in Linux 2.6.39 and fixed in Linux 7.1.

The flaw allows an unprivileged local attacker to get a dangling kernel pointer to kernel stack memory with only regular threading syscalls, write a pointer to an arbitrary address, and hijack a function table to get root access.

GhostLock has been shipped by default in every mainstream distribution since 2011, and requires no special privileges or network access. Nebula, which uncovered the flaw, said its exploit is reportedly 97% reliable and can also escape containers.

This particular flaw is the second part of an attack chain dubbed IonStack, with the first step being CVE-2026-10702, a vulnerability in Firefox that allows code execution within the browser and escapes its sandbox.

The vulnerability is rated high (7.8) as the attacker would already need to have local access to the system.

How the GhostLock flaw works

Nebula researchers said the root cause is a function reused by a caller it was never written for: the helper function remove_waiter(). During certain futex operations, it incorrectly clears a pointer associated with the currently executing task, rather than the actual waiting task.

This leaves the kernel with a dangling pointer that points to a memory location that has already been freed and reused. This allowed the Nebula team to gain full control, tricking the kernel into running their own code as the root user.

Daniel Bechenea, security manager at Pentest Tools, said the flaw is of particular concern because kernel exploits have historically carried a “real operational cost for attackers”.

“An unreliable one crashes the box and burns the access,” he explained. “An exploit that Nebula reports as 97% reliable, with public code anyone can run, changes that math.”

"As GhostLock uses a kernel vulnerability, containers also represent a juicy target for attackers as the exploit escapes the container and obtains code execution as root on the host OS, meaning that: containerised workloads that teams treat as isolated become stepping stones to the host and everything else scheduled on it."

Patch now

Systems running older kernels remain vulnerable to exploitation, according to Nebula. Researchers urged users and administrators to update to patched kernel versions as soon as possible.

"On an unpatched host, treat any code execution as root, and plan containment accordingly," advised Bechenea.

"Prioritize the systems that run untrusted or semi-trusted code by design: CI runners, container platforms, shared development machines, multi-tenant hosts, and verify the fixed kernel package version on each system rather than trusting that the April fix propagated, because with several major LTS releases still lagging in early July, attackers who land a foothold will check your kernel version even if you haven’t."

FOLLOW US ON SOCIAL MEDIA

A 'category-level' security flaw in six leading AI coding assistants could give attackers remote control of a developer’s machine, according to researchers at Wiz.

Dubbed GhostApproval, the flaw affects some of the most popular coding tools on the market right now, including Amazon Q Developer, Claude Code, Cursor, Windsurf, and Google Antigravity.

The flaw has been reported to all six providers, with Amazon, Cursor, and Google having rated it critical or high-severity and fixed it, and there's no evidence that it's been exploited in the wild.

According to Wiz, the vulnerability is caused by a decades-old Unix primitive – symbolic links, or symlinks – which allows malicious repositories to trick AI agents into silently breaking out of their workspace sandboxes, leading to RCE and persistent access to a developer's machine.

In the case of Amazon Q Developer, the agent wrote to the filesystem before presenting the user with an Undo option. Testing by Wiz found the agent correctly identified the symlink in its internal reasoning, but proceeded with the write anyway.

Amazon has fixed the problem, which has been recorded as CVE-2026-12958.

"We have remediated this issue in language server version 1.69.0. The AWS Language Server updates automatically unless the customer's network configuration prevents it, so no action is required in most cases," the firm said in a statement.

"For existing customers, reloading the IDE will trigger an update to the latest language server version, which includes this fix. If auto-update is blocked, we recommend upgrading to the latest version of the Amazon Q Developer plugin for your IDE."

Wiz noted that new customers don't need to take any action, as the latest patched version will be downloaded automatically.

Anthropic issues customer warning

Claude Code, meanwhile, provides the clearest example of user interface misrepresentation of critical information, Wiz said.

"The agent explicitly recognized the dangerous target in its thinking - stating "this is a symbolic link to the Claude settings file" - then presented a prompt asking simply: "Make this edit to project settings.json?" the researchers said.

Anthropic, however, has rejected the threat on the basis that the user explicitly trusted the directory when starting the session and explicitly approved the file operation in the confirmation prompt.

Around the time Wiz revealed its findings, the company added a warning to users, and current versions (2.1.173+) now resolve symlinks.

Cursor's diff UI showed the symlink path; when the user clicked Accept, the backend followed the symlink and wrote to the resolved target. It's been fixed in version 3.0, and Cursor has issued CVE-2026-50549.

Google's Antigravity, meanwhile, displayed the symlink path in its permission dialog rather than the resolved canonical path. Wiz researchers were able to successfully write an attacker's SSH key via a symlink disguised as project_settings.json. Google's fixed the problem.

Windsurf flaw raises serious concerns

Notably, Wiz said Windsurf presented a particularly dangerous variant during testing of the vulnerability.

"The agent writes file modifications directly to disk before the Accept/Reject buttons appear in the UI. The confirmation dialog isn't an authorization gate - it's an undo mechanism," the researchers warned.

Wiz added that the system is compromised “the moment the agent processes the malicious instructions”. Indeed, by the time users even see the prompt asking to accept changes, an attacker’s SSH was already placed in the authorizedkeys file.

Researchers warned that the findings show that “trust boundary questions” will become critical for organizations rolling out AI agents en-masse.

"GhostApproval is a symptom of a broader challenge: building AI systems that are both powerful and trustworthy. Getting the human-in-the-loop right – truly right, not just formally present – is essential to that goal."

FOLLOW US ON SOCIAL MEDIA

PC shipments have fallen for the first time in more than two years, hit by the memory supply crunch caused in part by the rise of AI.

Recent analysis from IDC found global PC shipments slid 4.9% on year in the second quarter of this year to 68.2 million units, down from 71.7m in the same quarter last year.

The figures mark the first decline in the market after nine quarters of growth, and that’s largely down to continued memory shortages.

IDC noted, however, that the situation has been exacerbated by supply issues with storage and other components, as well as what the company referred to as "geopolitical issues".

The massive AI infrastructure build-out has led to a shortage in memory, spurred on by manufacturers pivoting to produce more lucrative data center components rather than those for consumer products.

That RAM shortage has led to a sharp decline in lower cost devices, with Gartner predicting earlier this year that PC sales will drop by 10%.

Consumers picking up the bill

IDC said that while units shipped slid, PC makers reported growth in revenue, showing how the cost of such challenges are being passed on to consumers and businesses.

"The real story here is the disconnect between units and dollars: shipments are falling, but revenue is climbing because vendors are pushing through price increases faster than demand is dropping," said Jitesh Ubrani, research director for consumer devices at IDC.

That's not likely to change anytime soon, Ubrani warned.

"Given worsening macro conditions and a memory shortage that isn’t expected to ease until early 2028, we don’t expect another round of inventory pull-forward, which points to a sharp slowdown in growth rates in the second half of 2026," he added.

"Vendors are bracing for further price hikes into 2027, and channels are already flagging concern about elevated inventory at these higher price points."

A host of device manufacturers have raised prices in response to the spiralling memory crisis. Outgoing Apple CEO Tim Cook said last month that the company would raise prices due to the issue.

"There's less supply at a time when consumers want devices and the memory guys are passing along huge price increases," he said at the time.

Apple wins with MacBook Neo

The increased pressure on brands could lead to vendor consolidation of market share, IDC warned. The consultancy noted that larger brands such as Apple, Dell, or Lenovo can use their scale across different product lines – be it smartphones or servers – to access memory supply.

The result here is that smaller rivals could be left in the dust and scrambling for what supplies are left.

"As market conditions continue to worsen… supply chain management and capabilities are increasingly important," said Jean Philippe Bouchard, vice president for consumer devices at IDC.

"The largest vendors, with their buying power and long-standing supplier ties, are best positioned to take share from smaller rivals."

Compared to the second quarter in 2025, the big three PC makers – Lenovo, HP, and Dell – were largely flat in terms of market share, though all three saw single-digit decreases in shipments, with HP in particular down 9%.

Apple, however, grew market share from 8.5% to 9.9%, with shipments up 10% from 6.1m to 6.7m in the second quarter of this year versus 2025.

"Apple’s share gain coincided with its latest product launch, the MacBook Neo, and while the company did raise prices in line with the broader market, it still remains well positioned against rivals facing the same cost pressures," added Bouchard.

FOLLOW US ON SOCIAL MEDIA

Cyber resilience firm Rubrik is set to invest more than £375 million in the UK over the next five years, which will include opening a new EMEA headquarters in London.

According to Rubrik, the plans for the new HQ reflect the country’s role as one of its fastest-growing and “most strategically important markets”.

The site will act as a springboard to scale regional operations and access the country’s “deep technology talent pool”, the company said.

“The UK is one of the world’s leading technology markets, and has become increasingly important to Rubrik’s long-term growth,” said Bipul Sinha, CEO, chairman, and co-founder of Rubrik .

“As organizations accelerate AI adoption, cyber resilience is now an urgent business imperative. This investment strengthens our UK ecosystem, helping EMEA customers address the critical need for European data sovereignty, quickly recover from cyber attacks, and safely scale AI.”

Rubrik’s new London office will provide a “collaborative workspace” for staff, including an ‘executive briefing center’ designed to support engagement with customers and partners, the firm said.

Kanishka Narayan, minister for AI and Online Safety, said the move by Rubrik is a “vote of confidence” in the UK’s technology sector, with the country establishing itself as a prime destination to “invest, hire, and grow”.

"It will create high-skilled jobs and deepen our strengths in the fast-growing fields of cyber and AI, another sign that the UK is where the world's leading tech companies are choosing to build their future,” Narayan said.

Rubrik eyes EMEA expansion

The company has secured several large customers for its cyber resilience platform in recent years, including Manchester City Council, Harbour Energy, and the Scottish Government.

Across the EMEA region as a whole, Rubrik now serves roughly 2,000 customers and has launched a series of EMEA-focused product ranges, including Rubrik Security Cloud on the AWS European Sovereign Cloud.

To meet growing demand, the company said it plans to accelerate hiring in the region for roles such as sales, marketing, and customer support.

FOLLOW US ON SOCIAL MEDIA

The National Cyber Security Centre (NCSC) has laid out its plans for the national Cyber Shield, first announced in May this year.

The aim of the project is to build a nationwide, collaborative approach to agentic cyber defense, using frontier AI to identify, reduce, and deal with national cyber risks.

According to the NCSC, the move comes amidst concerns that cybersecurity risks are growing in “scale, speed, and sophistication” - particularly from hostile states and organized crime groups targeting public services.

"Frontier AI is accelerating this trend, with the potential to shift the balance in favour of attackers – and with serious implications for defenders,” the NCSC said.

“We need to keep our critical technology systems secure against both existing and emergent cyber threats."

As part of the project, AI systems will initially identify vulnerabilities and threats at machine speed, before moving on to automated remediation.

Further down the line, the agency expects AI to eventually generate and share insights, detect and contain breaches, and work under the control of their owners across government and non-government bodies.

These agents, the NCSC noted, will need to be built on strong foundations of data, identity, reliability, cybersecurity, and regulatory compliance.

The NCSC will first partner with network defenders across government and critical UK sectors to test and deploy new capabilities, with the plan to then transition to commercially-scalable solutions to improve national resilience.

NCSC targets reliability in Cyber Shield scheme

To make all this happen, there's a fair amount that will need to be done – some of which will present big challenges.

The NCSC highlighted the need for reliable and explainable AI for cybersecurity that can be used confidently in production environments at scale, and authorized by system owners to make safe, reliable, and significant real-time changes in support of cyber defence.

Agents will run national-level operations under the control and authority of individual organizations, and have the ability to identify, trust, and communicate between themselves.

Elsewhere, national-level scanning will involve the automated monitoring of critical UK IP ranges for exposed vulnerabilities, as well as analysis of aggregated data to understand national level exposure.

The agency noted that workflows will need to be automated to allow rapid national-scale mitigation, such as the automated blocking of known malicious domains and networks.

A big, bold plan

Plans detailed by the NCSC have been welcomed by industry stakeholders as a positive step in protecting the UK against rising threats. Whether or not this is an achievable goal is up for debate, according to Pete Luban, field CISO at AttackIQ.

"The biggest challenge will be getting government, critical infrastructure, and private industry to share intelligence in a way that is trusted and actionable," Luban commented.

"If bought into, Cyber Shield could give the UK a stronger foundation to spot risk earlier, validate defenses faster, and respond before attackers gain momentum.”

Kevin Marriott, senior director of cyber content strategy & IP at Immersive, said the true test will be in how the government makes sure the system is utilized where it can bring value and return on investment.

"It would also be beneficial to hear how they plan to deal with the output from the frontier models, and whether they put robust practices in place which enable them to deal with the outputs," he said.

"If this is part of a well-considered strategy, it represents a significant step forward. If, however, it is a move towards ungoverned AI without clear oversight or a defined plan for where and how it should be used, then it is not.”

FOLLOW US ON SOCIAL MEDIA

IBM has cut the ribbon on a series of new mainframe offerings as the tech giant eyes data center efficiency gains.

The new IBM z17 and IBM LinuxONE 5 series mark the first time the company is offering rackmount options alongside single frame systems.

According to Tom McPherson, general manager for IBM Z and LinuxONE, the move here aims to help customers consolidate data center footprints without sacrificing performance.

“The number of mission-critical workloads is rising at an incredible pace, forcing organizations to make tough decisions about performance, AI integration, and infrastructure footprint,” McPherson commented.

“With these new IBM Z and IBM LinuxONE systems, we’re making it easier to run workloads where they make the most sense, while opening the door for a wider range of organizations to benefit from these technologies for the first time.”

IBM eyes data center flexibility

The new IBM z17 and LinuxONE 5 configurations support up to 82 cores and 18TB of memory across two processor drawers, according to IBM. The company said this represents a 20% increase in core count alongside a 12% increase in memory capacity.

The IBM z17 single frame is a fully packaged solution in an IBM rack designed to operate as a “complete enclosed unit ready to deploy now”.

With the IBM z17 rackmount, customers will have the option to install IBM Z components within their own industry-standard racks.

The company noted that customers can also co-locate IBM equipment with third-party components to “achieve the best fit-for-purpose installation” based on their needs.

“Each system is designed to help organisations reclaim space, improve energy efficiency, and integrate seamlessly into existing environments,” the company said in a blog post.

LinuxONE upgrades target AI performance

Elsewhere, the new IBM LinuxONE series comes in two dedicated configurations: the Rockhopper 5 and LinuxONE 5 Express options.

The Rockhopper 5 series is a “scalable, multi-drawer” configuration designed specifically for high-density workloads, according to IBM.

This comes equipped with on-chip AI acceleration features, as well as confidential computing and post-quantum cryptography capabilities in both single frame and rackmount configurations.

Meanwhile, the LinuxONE 5 Express option offers the same capabilities, albeit in a compact configuration. IBM said these are designed for smaller workloads, with a particular focus placed on cost-efficiency and scalability.

The z17 single frame and rackmount configurations, IBM LinuxONE Rockhopper 5, and IBM LinuxONE 5 Express series will be generally available for customers from 12 August.

FOLLOW US ON SOCIAL MEDIA

Databarracks has announced the acquisition of business continuity consultancy Acumen Business Services, in a move the company said will expand and strengthen its managed resilience offering.

The deal follows Databarracks’ purchase of PlanB Consulting in 2024 and continues the firm’s strategy of bringing business continuity and technology resilience services together under a single managed service model.

Founded in 1997, Acumen specializes in business continuity consulting services and serves more than 100 customers across sectors such as financial services, healthcare, and manufacturing.

Upon completion of the acquisition, Acumen’s customers will gain access to Databarracks’ Business Resilience Managed Service and Recovery Confidence assurance framework, which combines business continuity planning with technology resilience and recovery capabilities.

In an announcement, Databarracks’ resilience director Chris Butler said the two companies share a common approach to ensuring business continuity is practical for customers.

“Acumen has delivered business continuity and resilience services to some of the largest organizations in the UK and around the world,” he commented. “We share a common vision of embedding resilience and making BC practical and simple, while adding real value for our customers.”

Headquartered in London, Databarracks specializes in technology and business resilience services, providing managed backup, disaster recovery, cloud, and continuity solutions.

The company said its Business Resilience function has seen rapid growth following the previous acquisition of PlanB Consulting in 2024, as customer demand for integrated resilience services continues to grow.

Commenting on the deal, Acumen founder Andy Osborne said the companies’ combined abilities will help customers better address the growing overlap between business continuity and technology resilience.

“Technology and cyber risk are absolutely central to business continuity, and Databarracks is leading the industry in an approach that brings them together,” he explained.

“This is the right next step for Acumen and our clients, combining our business continuity expertise with Databarracks’ strength in business and technology resilience and recovery solutions.”

Databarracks chairman Mike Osborne praised Acumen’s depth of expertise and long-standing contribution to the wider business continuity industry.

“I’ve known Acumen for a very long time,” he commented. “In addition to the great work the team has been delivering for decades, Andy has been prolific in contributing to the progress of the industry, authoring books and generally sharing his expertise.”

Osborne added that the deal reflects the growing demand for the company’s own managed resilience offering following its expansion in recent years.

“Databarracks’ Business Resilience function is growing rapidly following our previous acquisition of PlanB Consulting in 2024,” he explained. “Given the sheer pace of change in risk, there has been a fantastic response to our approach of delivering resilience as a managed service.”

Financial terms of the Acumen acquisition were not disclosed.

FOLLOW US ON SOCIAL MEDIA

Accenture and Google Cloud have announced a new partnership aimed at driving AI adoption rates for mid-market firms amid sluggish deployment progress.

As part of the scheme, the duo will provide firms with a suite of six industry-specific agentic AI solutions designed to help push projects from pilot to production.

These solutions cover intelligence and growth, customer experience, cybersecurity, business operations, industry solutions, and workforce enablement.

"The companies that will define the next decade aren't waiting — they're building,” said Rajendra Prasad, technology reinvention engine lead at Accenture.

“Accenture Edge offerings built with Google Cloud technology help mid-market organizations do exactly that. They can deploy solutions in weeks and get measurable outcomes at the scale, budget and speed that they need to grow."

The collaboration will see Google Cloud provide the underpinning infrastructure and AI solutions to support organizations, including the Gemini Enterprise app, Gemini Enterprise Agent platform, and Agentic Data Cloud.

Accenture, meanwhile, is set to provide forward deployed engineers (FDEs) to offer guidance and technical support for participating firms.

Forward deployed engineers are in vogue

The move by the duo comes amidst a sharpened focus on driving enterprise adoption of AI and agents. The use of FDEs, in particular, has taken off as providers look to embed specialists within customer teams to support projects.

Last week, Amazon Web Services (AWS) and Microsoft both announced plans to invest heavily in FDE-related efforts, with the aim of hiring thousands of engineers in the coming years.

As ITPro reported, FDEs could become a key growth area for the industry moving forward, with big tech providers providing more bespoke support for customers.

Kevin Ichhpurani, president of Google Cloud’s global partner ecosystem, said the scheme will provide businesses with the “full power” of the hyperscaler’s product portfolio.

“We’re seeing tremendous demand as mid-market enterprises adopt AI agents to fundamentally reinvent their business workflows," Ichhpurani said.

"The launch of Accenture Edge brings the full power of Google Cloud’s entire portfolio including enterprise AI, our Agentic Data Cloud and AI Threat Defense directly to this sector. Together, we’re enabling mid-market companies to confidently scale AI across their organizations for growth.”

Driving mid-market adoption

According to Accenture, mid-market firms – or those with revenues of between $300 million and $3 billion – have largely been locked out of large-scale AI transformation due to complexity and integration barriers.

A recent study from Klarus highlighted the significant challenges faced by mid-market enterprises on this front. While nearly three-quarters (73%) have deployed AI solutions, around 90% of projects remain stuck or stalled in the pilot stage.

Although up to 94% of leaders feel confident about AI deployment, lack of expertise and governance concerns are causing projects to fail.

Mid-market firms aren’t alone in AI deployment challenges, however. Research from MIT last year found around 90% of all generative AI pilots fail, while similar research from Gartner warned up to 40% of agentic AI adoption programs are expected to fail.

These organizations are in a prime position to fully capitalize on the technology, however. Klarus CTO Alper Gunaydin said mid-market firms have the advantage of agility compared to larger competitors.

“Mid-market companies have a real advantage because they can often move fast, particularly when it comes to technology transformation. We see this agility in action when companies are turning to AI and automation to address productivity and accelerate growth," Gunaydin commented.

"However, our research shows that too many pilots stall because companies lack AI expertise, quality data and effective governance. Making that agility count requires clear priorities, strong foundations and access to senior expertise, all of which will help translate investment into tangible business outcomes and unlock growth without increasing the cost base.”

FOLLOW US ON SOCIAL MEDIA

Stronger powers could be needed to regulate the use of AI in financial services as consumers flock to the technology for advice, according to the Financial Conduct Authority (FCA).

Following an investigation into the technology and its impact on consumer finance activities, the regulator has recommended a formal review into how to regulate the use of general-purpose LLMs across the industry.

The FCA report – known as the Mills Review after its author – noted that companies and consumers are increasingly delegating decisions about finances to AI and AI-powered systems.

A survey by the regulator found that one-in-five adults were already open to the idea of general-purpose AI tools – such as Claude, ChatGPT, or Gemini – making financial decisions on their behalf, in particular around debt advice, pensions, and investments.

While that could help reduce existing challenges such as "advice gaps" and friction around switching services, the FCA warned about risks including fraud and scams, as well as disrupting market structure and competition.

"AI offers a once-in-a-generation chance to close the information asymmetries and frictions that have long left people making poor financial decisions," said FCA executive director and report author Sheldon Mills in the forward to the review.

"The right spur, in retail financial services, is ensuring consumers can make healthy ones; regulation, whether supportive or restrictive, should serve that outcome."

The FCA noted that many consumers may not be aware that they have no formal recourse if something goes wrong, and said some assume they receive equal protection akin to traditional sources of advice.

Emma Banymandhub, CEO of The Payments Association, agreed that the gap in understanding could cause issues and urged caution on the part of consumers.

"Consumers may be increasingly comfortable using AI agents for routine tasks such as weekly shopping, but AI-driven savings and investment decisions present a very different set of challenges," Banymandhub commented.

"While AI can increasingly explain investment concepts and analyse financial information, personalised investment recommendations remain subject to important regulatory constraints."

AI gains traction in financial services

The financial services sector has rapidly emerged as one of the key growth spaces in terms of the use of AI, with a host of major providers across the UK ramping up adoption of the technology.

As ITPro previously reported, high street lenders such as Nationwide, Lloyds Banking Group, and Yorkshire Building Society have all made significant strides on this front over the last six months.

A parliamentary inquiry into the use of AI in financial services, published in January 2026, found that the sector “substantially outpaces” others with regard to AI adoption.

Indeed, around 75% of UK-based financial services firms are now using the technology, with insurers and large banks among the most aggressive in their pursuit of AI adoption.

Running parallel to this, the use of AI by consumers is also surging, according to research from Lloyds Banking Group. The firm’s 2025 Consumer Digital Index found that AI has “rapidly become a financial tool for millions across the UK".

56% of adults – equivalent to around 28 million people – revealed they’d used AI over the preceding 12 months for financial advice. ChatGPT, for example, was referenced as the most popular platform in this regard, used by six-in-10 consumers.

What the Mills Review recommends

With this in mind, the Mills Review recommended that the existing "regulatory perimeter" needs to be secured and adapted to take in AI's impact on retail financial services – and that should come via a review within the next six months into how AI is affecting the market.

"The review should examine how consumers use AI including general purpose LLM tools for personal financial management across savings, investments, pensions, mortgages and debt management, and the implications for competition, innovation and growth," the Mills Review said.

"It should examine the risks of consumer harm, including how far its usage has or will move along the autonomy spectrum, and any impacts on market integrity and the potential for regulatory arbitrage."

Based on that review's guidance, the FCA could tweak regulation as necessary, the report said. Beyond that, the review called for the FCA to monitor for evidence of harm and new consumer models, engage with providers for better insight into changes, and be ready with intervention tools and mechanisms as necessary.

Frontier model monitoring in finance

In the longer term, the Mills Review called for the FCA to keep an eye on frontier model capabilities and AI adoption, considering its impact on its regulatory work, in particular where use of AI falls outside of existing protections and once AI agents start taking more action on behalf of consumers.

The review also called for stronger powers for the FCA so it can look at these issues more widely.

"As is clear in the report, we need to keep pace with a rapidly changing environment and the principles-based, outcomes focussed approach we’ve taken on AI – relying on the Consumer Duty and Senior Managers Regime – has been critical to us doing so," said Ashley Alder, chair of the FCA.

"The recommendations build on work the FCA has been doing – not least allowing firms to test their use of AI with us – and our own use of AI to be a smarter regulator, more efficient and effective."

Banymandhub added that walking that balance between enabling AI and protecting consumers and companies was key.

"The FCA’s Mills Review reinforces that firms should treat agentic AI as an accountability and governance issue now, while providing greater confidence to innovate responsibly as AI adoption accelerates," she said.

"AI has enormous potential for financial services, but realising that potential will depend on strong governance, clear accountability and maintaining consumer trust."

FOLLOW US ON SOCIAL MEDIA

Amazon Web Services (AWS) has announced a series of changes to Amazon OpenSearch aimed at streamlining data log analysis.

A new purpose-built log analytics engine for the service will provide users with marked performance gains and up to 70% lower storage costs, according to the firm.

OpenSearch allows users to search, analyze, and visualize data in real-time, and is typically used for application monitoring, observability, and AI/ML search applications.

The hyperscaler said the update comes in direct response to surging volumes of log data handled by enterprises in 2026, largely due to AI.

Research from AWS shows that log volumes have grown between 30-40% year over year, which is stretching budgets and creating bottlenecks.

Amazon OpenSearch overhaul

As part of the update, Amazon revealed OpenSearch will now store data in the Apache Parquet format. This is a column-oriented data file format designed specifically for more efficient data storage and retrieval purposes.

The service previously relied on inverted indexing. Amazon noted the shift will deliver significant efficiency gains and faster search and retrieval capabilities.

“Apache Calcite parses and optimizes each query, then routes operations to the engine best suited to execute them: Apache DataFusion for analytical operations on columnar data, or Lucene for search predicates,” the company explained in a blog post.

“The two hand off mid-query, so a single query can search log content and aggregate the results without additional roundtrips.”

Amazon noted that OpenSearch now also supports the Piped Processing Language (PPL) and SQL query languages, both of which “execute natively” through the platform.

Amazon eyes optimized log analytics

From a performance perspective, Amazon noted users can expect significant improvements alongside lower costs.

OpenSearch now boasts up to four-times price improvements compared to the existing engine, based on internal benchmarks.

Users can also capitalize on two-times faster analytics queries due to the fact the engine processes data in columnar batches, even across larger data sets. A two-fold improvement on ingestion rates also aims to reduce bottlenecks.

“The optimized engine sustained 1.78 million documents per second at matched concurrency, approximately 2x the throughput of the Lucene baseline, while consuming less CPU,” the hyperscaler explained.

“Both domains ran with zero write rejections. For teams ingesting terabytes per day, the throughput advantage translates to fewer nodes for the same volume, or longer retention on the same infrastructure.”

How to access Amazon OpenSearch

The new log analytics engine is available now for enterprises in AWS regions where OpenSearch Optimized instances are supported, the company noted. Similarly, there will be no additional premium for the optimized engine.

It’s worth noting that the new engine is a setting selected at creation time, meaning users can’t add this to an existing domain or enable it within individual indices or fields within a general-purpose domain.

“To adopt the optimized engine, create a new domain and migrate your ingestion pipelines into it,” the company explained.

“Create a new domain in the Amazon OpenSearch Service console and select Observability as your use case. The optimized engine is enabled by default.”

The in-built console will provide users with a side-by-side comparison of capabilities based on individual needs.

“After your domain is ready, ingest JSON documents through the same Bulk API and client libraries you use today. No changes to your ingestion pipelines or application code are required.”

FOLLOW US ON SOCIAL MEDIA

A security firm has spotted what it claims is the first documented case of a ransomware operation run entirely by a large language model.

The Sysdig Threat Research Team said the operator, dubbed JadePuffer, is the first agentic threat actor, describing it as using a known flaw in AI app builder Langflow to gain access to credentials and other key data.

Thereafter, researchers noted it took over a production database and encrypted it for extortion purposes.

"JadePuffer is a warning sign," Michael Clark, Sysdig’s director of threat research, said in a blog post.

"It’s a marker of where extortion tradecraft is heading. An autonomous agent reasoned about its targets, harvested and reused credentials, moved laterally, established persistence, and destroyed a database, narrating its own intent the entire way."

Clark has clarified that though the attack operation was run by an AI, the attack was still organized by a human who set up the infrastructure, found the initial credentials to break in, and chose a victim. But the rest of the attack was managed by the LLM itself.

Alarming attack

Clark noted that JadePuffer's payloads were "self narrating", containing detailed notes that a human wouldn't bother to write but an LLM generates innately about why each step was taken, including prioritization of targets. That narration data could prove useful for security teams looking to defend against such attacks, Clark added.

"The operation also adapted in real time, retrying failed steps within refined parameters," Clark added. "In one sequence, it went from a failed login to a working fix in 31 seconds."

That is perhaps the most alarming aspect of the incident, according to Roey Eliyahu, CEO and co-founder of Salt Security.

"A human attacker who fails an initial payload waits, reassesses, consults, and tries again on a different timeline," Eliyahu said. "An agent that fails a payload corrects and retries in under a minute. That compression of the attack cycle means the window between first detection signal and material damage is now measured in seconds, not hours."

The JadePuffer system even wrote a ransom note complete with Bitcoin address and Proton email contact, Clark noted, though the former appears to be a wallet address frequently used as an example in explainer text online.

That’s either a coincidence, said Clark, or a hallucination by the LLM due to the frequency of that address online, and therefore used in training data.

Clark also noted that the encryption key was generated and essentially random, so the victim would not be able to decrypt — even if they paid the ransom. The victim organization wasn't disclosed.

Warning about the future of security

While JadePuffer is just one incident, it shows that AI can help automate old vulnerabilities and that ransomware no longer requires skills to pull off an attack, according to Sally Vincent, senior threat research engineer at Exabeam.

"While the attack relied on known, older vulnerabilities rather than new exploits, it demonstrates how AI can automate and accelerate the exploitation of unpatched systems," Vincent said. "It also serves as a reminder that patching known vulnerabilities remains important, since AI can make exploiting them faster and more efficient."

While Clark stressed that none of the attack techniques were novel or sophisticated, JadePuffer is interesting because it was strung together into a complete ransomware operation by an AI model.

"The skill floor for running ransomware has dropped to whatever it costs to run an agent, and if that agent is running on stolen credentials through LLMjacking, the cost to an attacker is close to zero," he commented.

That means security professionals should expect to see more like this, as well as a higher volume of attacks, and should proactively protect "exposed application servers, unhardened configuration stores, and internet-facing database admin accounts," Clark added.

Salt Security's Eliyahu added: "The question every security team should be asking after this report is: what is holding credentials in our AI-adjacent infrastructure, and what can those credentials reach?"

FOLLOW US ON SOCIAL MEDIA

Yorkshire Building Society (YBS) is using AI agents to help reduce admin and improve customer service – and the high street lender said it's recording solid results so far.

Three AI agents named Penelope, Sam, and Alf are supporting customer service teams by summarizing complex complaints, searching policies and past cases, and drafting member communications, all with human oversight.

Penelope helps draft final responses for complaints, while Alf supports this process by searching policies, procedures, and past cases. Sam, meanwhile, summarizes long or detailed complaints.

According to the building society, Sam is saving an estimated seven minutes per use, with Penelope saving up to 26 minutes when supporting more complex complaint responses.

“That time really adds up,” said Polly Conner, senior manager of customer relations at YBS. “We’re able to minimize the amount of time staff are spending on admin tasks and actually spend that time talking to our customers, helping them resolve the challenges they’ve faced.”

The high level of regulation around financial services means that handling complaints from the building society's three million members and customers requires a lot of admin.

That can mean switching between multiple systems, searching for policies, summarizing long histories, and drafting detailed responses in advance of any conversation.

"This technology is going to give our members more choice and better access to information when they need it most,” said Simone Fox, director of customer support at YBS. “But there will always be a human available to speak to them when they need it.”

AI in banking

The results highlighted by YBS come amidst a sharpened focus on AI in the financial services sector, with a host of major providers ramping up adoption of the technology.

In January this year, Nationwide announced a partnership with Moneyhub to launch an AI-powered transaction analytics platform for customers across the UK.

Lloyds Banking Group, meanwhile, is also accelerating AI innovation internally in a bid to drive customer support capabilities. The bank unveiled plans to launch a new AI Academy earlier this year, with the aim of providing 67,000 staff with practical skills.

Building the foundations for AI

Before rolling out new tools, YBS built a cloud native data platform with Microsoft Fabric and strengthened data governance through Microsoft Purview.

It also enhanced its security with Microsoft Sentinel, expanded infrastructure foundations in Azure, and introduced Windows 365 remote desktops to enable secure, flexible working.

“Our ambition with data and AI is to improve our organization, help our colleagues be more efficient, make better decisions, and ultimately, serve our members better,” said Rebecca Fitzgerald, YBS director of data and AI. “All built on trust, with responsibility built in.”

Elsewhere, YBS is piloting AI agents to support internal risk and control testing, with early results suggesting efficiency savings of around 40%.

The high street lender is also rolling out a new customer service platform built using Microsoft Dynamics 365 Contact-Centre-As-A-Service. This brings customer history, previous self-service activity, and relevant guidance into one place for colleagues.

An AI assistant can summarize cases, highlight relevant knowledge and help draft responses, reducing the need to search across multiple systems.

“The platform is really going to help our colleagues better serve our members,” Fox commented. “It’s going to enable them to have a 360‑degree view of our members, so they’re not having to move between various platforms.”

FOLLOW US ON SOCIAL MEDIA

Arrow Electronics has signed a new pan-EMEA distribution agreement with ABB Electrification that will see the distributor add ABB’s uninterruptible power supply (UPS) portfolio to its enterprise computing offering.

The agreement builds on a long-standing relationship between the two companies and will enable Arrow to distribute the vendor’s critical power technologies to channel partners across key European markets – including the UK and Ireland.

Arrow said the deal will help partners deliver more comprehensive IT infrastructure projects by combining ABB’s power resilience capabilities with its existing portfolio of compute, management, and security solutions.

Initially, the deal covers ABB’s UPS portfolio, although the companies said the range is expected to expand over time to include additional electrification technologies designed for demanding enterprise and data center environments.

In an announcement, Mike Worby, head of strategic alliances at Arrow’s enterprise computing solutions business in EMEA, said the move opens up a range of “important new capabilities” for channel partners.

“Power protection is a vital part of any modern IT design and the addition of ABB uninterruptible power supplies means our customers can work with a broader and more complete set of solutions,” he explained.

“It is a strong addition to our existing portfolio and creates new opportunities for channel partners to support their customers’ evolving needs.”

Arrow provides technology distribution, integration, and supply chain services for channel partners across areas including enterprise computing, networking, cybersecurity, cloud, and data center infrastructure.

The firm said that adding ABB’s critical power portfolio will enable its partners to source technologies designed to support secure uptime and energy efficiency, while helping customers improve operational continuity and meet sustainability goals.

The agreement will initially be available across the Benelux region, France, Germany, Spain, the UK, and Ireland, with additional countries expected to be added over time.

“Working with Arrow enables us to reach a wider IT channel audience and support channel partners with high-quality electrification and critical power solutions suited to modern digital infrastructure,” commented Sebastien Surply, head of ABB Electrification’s Critical Power business line.

“Our technology is trusted by tech giants and data center operators worldwide, and we are seeing strong demand across a range of critical environments.”

FOLLOW US ON SOCIAL MEDIA

The UK government said more than 60 businesses have signed up for its Cyber Resilience Pledge so far, including M&S, Nationwide, ITV, Microsoft UK, and Cloudflare.

Announced in May, the voluntary scheme sees businesses committing to three concrete actions to improve cybersecurity capabilities.

They must commit to making cyber security a board-level responsibility, by implementing the Cyber Governance Code of Practice and ensuring all board members complete the NCSC’s Cyber Governance Training.

They must also register for the NCSC’s free Early Warning service, a tool that alerts organizations to potentially suspicious activity on their networks, and commit to taking a risk-based approach to requiring the government-backed Cyber Essentials certification across their supply chain.

The pledge has been designed primarily for medium and large organizations, with other signatories including Deloitte, Accenture UK, Vodafone Group, and VodafoneThree, but is open to businesses of all sizes and from all sectors.

"Today, some of Britain’s biggest businesses are taking action to strengthen their cyber defences and setting a powerful example for others to follow. By signing this pledge, they are showing that cyber resilience is no longer just an IT issue - it is a business imperative," said technology secretary Liz Kendall.

"The steps in this pledge are practical, achievable and proven to make a difference. Today’s signatories are leading the way, and I encourage organizations across the UK to follow their example."

Cyber Charter to beef up critical services

Alongside the pledge, the government has been developing a Cyber Charter for 39 companies designated as strategic suppliers for delivering critical services to the government.

These organizations have been invited to sign the pledge as an initial commitment to bolstering their cyber resilience, although so far only a little more than half have done so.

"We have long held the view that cyber resilience is a critical business and organizational enabler. It underpins our growth, our economic security, and the safety and security of our people," said Julian David, CEO of techUK.

"With the average cost of significant cyber-attacks to the UK economy recently estimated to be £14.7 billion annually – the equivalent of 0.5% of our GDP – it’s clear that cyber security and resilience must be recognised as a leadership responsibility and should no longer be viewed as an IT issue alone."

Pledge targets national resilience

Moves to bolster national resilience capabilities come amidst an increase in malicious cyber activity in the UK.

The National Cyber Security Centre (NCSC) recently confirmed it handled 204 nationally significant incidents in the year to September, up from 89 the year before.

The average cost of an attack on an individual UK business now stands at almost £195,000, with the annual cost to organizations estimated at £14.7 billion - and that’s in addition to the costs of wider economic disruption.

Last year, experts estimated that the attack on Jaguar Land Rover (JLR) cost the UK economy roughly £1.9 billion, making it the most costly cyber incident in British history.

FOLLOW US ON SOCIAL MEDIA

Cybersecurity experts have issued an alert amid reports that hackers accessed login credentials belonging to UK government officials and Foreign Office staff.

The credentials, which are reportedly being sold on the dark web, were exposed as part of the ongoing FortiBleed attack campaign.

FortiBleed targets internet-facing Fortinet VPN and firewalls, and is believed to have affected more than 70,000 devices spanning 194 countries since it was first uncovered last month.

Analysis from SOCRadar, for example, identified a vast database containing login credentials. The threat intelligence firm has since attributed FortiBleed to the Lynx/INC ransomware group.

While this database was believed to have been limited to basic usernames and passwords, reports from The Telegraph suggest some exposed details include privileged Fortinet credentials.

Volodymyr Diachenko, a security researcher who first uncovered the threat campaign, told the publication these credentials could give bad actors access to the Foreign Office’s “core networks” along with other government departments.

Some Foreign Office credentials are now being sold on the dark web, according to reports, going for up to £40,000.

Arctic Wolf CISO Adam Marrè warned that the incident could create a domino effect, impacting other government departments and also local authorities and public services.

According to The Telegraph, credentials at NHS trusts, energy companies, and local councils were also hosted in the illicit database.

“This major breach of email accounts of UK government officials and overseas Foreign Office workers is the latest development in the ongoing FortiBleed attack,” he said.

“While it may be tempting to think this is a simple credential-stuffing operation, our threat team found the threat actors have built a highly sophisticated and repeatable credential factory,” he said.

Marrè noted that analysis of the incident conducted by Arctic Wolf shows threat actors appear to have been using automated tools to harvest logins and target gateways at “exponential speed and volume”.

“This means while today it’s the Foreign Office which has been affected, the risk to every organization has increased exponentially.”

Back and forth on FortiBleed

The discovery of the FortiBleed sparked somewhat of a back and forth between Fortinet and security researchers last month. After threat intelligence firm Hudson Rock published a blog detailing the campaign, Fortinet disputed some of its claims.

Fortinet told ITPro at the time that the exposed credentials weren’t the result of a fresh breach, insisting that those following best practices were safe from exposure.

"Fortinet is aware of a reported third-party credential-harvesting campaign targeting Fortinet firewalls and VPN gateways. We are committed to safeguarding our customers, and we diligently and continuously monitor threat actor darknet activity,” a spokesperson for the company said.

“Based on our initial analysis, the data involved is likely a resharing of data from previous incidents, as well as brute forcing of credentials, and not related to any current incident or advisory."

Hudson Rock, meanwhile, said the campaign went “beyond simply credential reuse,” highlighting that hundreds of organizations are thought to have been affected.

FOLLOW US ON SOCIAL MEDIA

Workday has appointed HR Path as an authorized value-added reseller (VAR) partner for the UK and Ireland, as part of the vendor’s ongoing ecosystem expansion across EMEA.

The agreement will see HR Path directly sell Workday’s HR and finance platform to small and medium-sized businesses (SMBs) across Ireland and Scotland, as well as provide consulting, implementation, and operational support.

According to Workday, its expanded VAR strategy aims to help growing organizations adopt enterprise-grade HR, finance, and AI capabilities, while simplifying complex digital transformation projects through a single partner relationship.

As an authorized VAR, HR Path will act as a single point of contact for clients and will manage the full customer lifecycle – including strategic advisory, software procurement, implementation, and long-term optimization.

In an announcement, Daniel Pell, Workday’s vice president and country manager for the UK and Ireland, said the partnership is intended to accelerate time to value for businesses’ digital transformation initiatives.

“HR Path brings deep local experience and hands-on delivery, Workday brings a secure, AI-powered platform, and together, we can give customers one trusted route to modernising their HR and finance functions,” he commented.

Workday’s hybrid go-to-market strategy

The announcement marks the latest stage of Workday’s shift away from a purely direct sales model to a hybrid go-to-market approach, at a time when demand for advanced AI capabilities continues to grow.

The vendor said regional VAR partners will combine localized implementation expertise with its own AI-powered enterprise platform, enabling organizations to deploy advanced AI capabilities while ensuring compliance with local regulatory and market requirements.

The model is also designed to provide customers with continuous support as business requirements evolve, rather than focusing solely on initial software deployment.

To support the expansion, HR Path said it is investing in consultant training, Workday certifications, as well as joint enablement programs to provide earlier access to new AI capabilities and product developments.

Commenting on the expanded partnership, Angelo Gallo, partner at HR Path, described Workday’s VAR model as “the next logical step” in being able to provide more comprehensive support to SMBs in Ireland and Scotland.

“Our strength lies in combining world-class technology with local market knowledge and hands-on execution,” he explained.

“Together with Workday, we are creating an offering that delivers greater guidance, security, and trust throughout the entire transformation process.”

FOLLOW US ON SOCIAL MEDIA

AI-augmented developer roles have increased nearly six-fold over the last five years, as enterprises move from AI experimentation to implementation, according to new research from Randstad Digital.

While there's been an increase of just 28% for traditional developers, the figure for developers with AI expertise has grown by 597%, with nearly one-in-four developer roles now requiring these skillsets.

Analysis of more than 35 million job postings shows technical professionals who acquire specialized credentials are leapfrogging traditional seniority tiers, with AWS Solutions Architect (Pro) and LangGraph/RAG Architect certifications driving estimated salary increases of 54% and 31%, respectively.

"Enterprise AI is no longer a future investment; it is today's operational reality. Yet the biggest barrier to growth is not access to technology, it is access to the right people," said Michael Morris, global head of platform and talent at Randstad Digital.

"Buying AI is easy. Integrating it safely and securely across a complex enterprise is where the true challenge lies. The specialists who can integrate, govern and scale AI inside complex organizations are in critically short supply."

While foundational roles like prompt engineers are still growing at 174%, demand has rapidly escalated up the skills ladder, with AI trainers now the fastest-growing role globally, up 281%.

As ITPro reported in February, demand for AI trainers has skyrocketed over the last 18 months. Researchers said this reflects a broader market pivot toward roles that turn AI’s potential into real support for business growth.

Demand for AI solutions leads is up 226%, process automation specialists up 196%, and AI architects up 152%, Randstad noted.

Finding talent is harder than it looks

While demand for AI-related skills is there, actually filling these positions is far harder than it appears, Randstad noted. Indeed, enterprises are facing acute challenges in sourcing talent.

AI solutions leads are currently the hardest role to fill globally, for example, with time-to-fill timelines hitting 54 days in key markets and vacancy rates of nearly 27% in the US and 18% in the UK.

Despite having talent pools of roughly 100,000 professionals, machine learning engineers face vacancy rates of 8.2% in the US and 11.2% in India. Japan, meanwhile, is facing some of the sharpest shortages globally, with a 46.8% vacancy rate for AI engineers and 25% for generative AI engineers.

All this is reflected by hiring timelines, according to Randstad. While a standard IT role typically takes 38 days to fill, the recruitment window for advanced AI infrastructure roles has expanded to an average of 54 days in the UK and 53 days in the US.

This stretches to a high of 90 days for Process Automation Specialists in Italy.

The result of this is that salary offers are rising sharply, particularly in the US. Across the Atlantic, large language model (LLM) architects have a vacancy rate of 19%, commanding average salaries of $240,000.

Brazil and Argentina have rapidly emerged as a high-growth corridor for specialized AI services, now representing over 15% of global postings combined. In Europe, the UK, Poland, Spain, and Germany show steady demand, with individual national shares between 1.8% and 2.8%, while China accounts for 7.5% of the global job volume.

"AI talent concentrated in the US and India but fast-growing corridors emerging in Brazil, Argentina and beyond, cross-border hiring is becoming a core enterprise strategy," said Morris.

"Organizations that combine global talent sourcing with deliberate investment in upskilling their existing workforce are best placed to close the gap."

FOLLOW US ON SOCIAL MEDIA

Criminals are posing as Interpol cyber crime investigators to target small businesses across Europe, Asia, the Middle East, and North America.

According to new research from Bitdefender, the phishing messages claim to contain evidence that the recipients are carrying out suspicious activity, pressuring them into opening a password-protected archive.

"Based on information that has come to our attention, there may be activities involving accounts, systems or services associated with your organization that warrant further examination. We have obtained information and video material that may assist in your assessment of the matter," the emails read.

"We recommend conducting an internal review to determine whether any unauthorized, suspicious or potentially fraudulent activities have occurred. Prompt attention to such matters may help mitigate potential financial operational, reputational or regulatory risks."

Upon opening the link, recipients are directed to a Proton Drive-hosted file that delivers a ransomware payload hidden within multiple archive layers. Once executed, researchers said the malware seeks to encrypt files across available drives and presents victims with a ransom message.

The campaign is targeting organizations across multiple industries, including food and agriculture, legal services, pharmaceuticals, media, technology, and finance.

The ransomware is relatively simple, according to Bitdefender researchers. The code contains hardcoded values, including the password used during encryption and decryption, and lacks many of the features typically associated with large ransomware operations.

Interestingly, victims are instructed to contact the attackers through a Tox chat channel to negotiate a ransom, rather than through the more usual dedicated negotiation portal or victim site.

This, researchers noted, is another indication that this is likely a custom-built operation, perhaps assembled using publicly available code and tools rather than the work of an established ransomware group.

What small businesses need to know

Javvad Malik, Lead CISO advisor at KnowBe4, said that impersonating Interpol – or law enforcement in general – is specifically designed to trigger a “rapid emotional response” and dupe victims into ignoring red flags.

"What is interesting about this campaign is that it targets small business,” he said. “These are often understaffed and have no security or even IT expertise on hand, so it's not difficult to see why people would easily fall victim to these kinds of attacks."

Bitdefender has warned small businesses to be on the alert, urging them to verify all unsolicited correspondence by reaching out through official channels to confirm whether the communication is legitimate.

"One of the biggest red flags in this campaign is the delivery method itself," researchers said. "While the attackers impersonate Interpol, legitimate law enforcement agencies don't send unsolicited emails containing Proton Drive links to password-protected files and ask organizations to review alleged evidence of wrongdoing."

They should treat password-protected archives with caution, especially when the password is included in the email. Showing file extensions on Windows devices will make it easier to spot executables masquerading as videos or documents, and multi-factor authentication (MFA) should be used wherever possible.

Elsewhere, the company urged small businesses to ensure staff are trained to help spot tell-tale signs that communications are fraudulent.

"Small businesses are often viewed as easier targets than large enterprises," the researchers warned.

"Many operate without dedicated IT teams or cybersecurity staff. Security responsibilities are often shared among employees who already wear multiple hats, and limited budgets can make it difficult to invest in advanced security measures or ongoing training."

FOLLOW US ON SOCIAL MEDIA

Forward deployed engineers (FDEs) could be the key to driving successful AI deployments, as hyperscalers pledge billions to embed specialists within customer teams.

Last week, Microsoft announced plans to invest $2.5 billion in a new division, the Microsoft Frontier Company. The aim here is to deploy upwards of 6,000 AI experts and engineers inside customer organizations.

These specialists will work with enterprises to co-design and build AI systems in a bid to accelerate adoption rates, according to the tech giant.

The announcement came just days after Amazon Web Services (AWS) announced similar plans with a $1 billion investment in its Forward Deployed Engineering segment, once again aimed at bolstering customer AI capabilities.

With the scale of investment – and sheer number of engineers required – for AWS and Microsoft’s push on this front, FDEs are rapidly emerging as the most sought-after technology professionals globally.

Alastair Williamson‑Pound, CTO at Mercator Digital consultancy, told ITPro that the focus on FDEs is an “exceptionally strong signal” that this could become a key growth area for the industry – and a vital pool of talent to drive AI adoption.

“FDEs have become increasingly critical because they sit inside the client, where they can drop barriers, cut through red tape, and get in front of the decision-makers quickly,” he said.

“It’s perhaps why we’re increasingly seeing them considered as a commercial weapon by cloud providers to secure long-term relationships and spend,” he added.

“Another good aspect is that pricing is fixed and based on outcomes rather than time and materials (T&M), which gives customers greater certainty around delivery.”

Williamson‑Pound noted that this aligns with “what companies are after these days”, mainly support in pushing AI adoption projects from pilot to production.

AWS noted that its FDE strategy aims to “compress timelines from months to days” in terms of AI progress, and is “designed so customers are self-sufficient when a deployment ends”.

“Those organizations that are stuck between piloting and deployment can be given that final push by [an] FDE,” he commented.

“The training and documentation they leave behind also tends to give customers that final confidence boost, helping internal teams continue developing and maintaining the system by themselves.”

The rise of forward deployed engineers

Microsoft and AWS are by no means the first big tech providers to put their faith in FDEs. Palantir somewhat pioneered this approach more than a decade ago, and other companies in the AI space have ramped up activities on this front.

As ITPro reported in May, OpenAI launched a new consultancy arm aimed at embedding engineers within customer organizations.

A key distinction here, however, is that the OpenAI Deployment Company is a standalone entity, while both Microsoft and AWS have their own internal divisions dedicated to FDEs.

Crucially, both moves mark the latest attempt by big tech providers to move the needle with regard to enterprise AI adoption, which research shows has been sluggish and at times underwhelming.

Analysis from PwC in January this year found that executives have become increasingly restless when it comes to returns on investment (ROI). Separate research, meanwhile, shows a significant portion of AI projects fail at the first hurdle.

A key factor in adoption project failure often lies in technical capabilities, or lack thereof, according to research from Dynatrace.

With this in mind, providing enterprises with a helping hand throughout the process could provide a much-needed boost for IT leaders.

Initial feedback on Microsoft’s FDE activities show promise on this front, according to Judson Althoff, CEO of Microsoft’s commercial business. In a blog post last week, Althoff claimed that early results have demonstrated “meaningful impact”.

The tech giant embedded engineers within the London Stock Exchange Group (LSEG), for example, helping accelerate AI adoption and providing finance pros with tools to provide answers to complex queries.

Close collaboration between Microsoft’s FDEs and frontline staff at LSEG helped streamline adoption and essentially create a foundation for future improvements, according to Althoff.

“The solution is underpinned by a foundation that is iteratively refined through client feedback and real-time user testing that accelerates each cycle and steadily improves model quality and scope,” he wrote.

Partnerships with Unilever and Novo Nordisk have also delivered marked improvements in terms of AI adoption, Althoff noted.

How FDEs work

FDEs essentially operate like systems integrators (SI), albeit with a few notable distinctions. An SI, for example, is typically an external contractor used to streamline the adoption of individual solutions.

With FDEs, these engineers act as consultants embedded directly within the enterprise. They also offer technical guidance, but it’s the practical support in terms of custom product development that’s a key differentiator. Simply put, they’re building alongside your own engineers.

“Typically, FDEs work in small pods for a fixed period of time, during which they sit within the engineering and technical teams of the client, writing production grade code,” Williamson-Pound explained.

“They leave the customer with a working system in place supported by full documentation, as opposed to an implementation plan.”

JetBrains CEO Kirill Skrygan told ITPro there are a range of benefits to using FDEs for enterprises, and they’re more than just a temporary boost to engineering capabilities.

“FDEs work closely with customers to translate complex organizational challenges into solutions that technology can actually deliver. Doing that well requires more than coding ability," he said.

“It demands architectural expertise, technical leadership, communication skills, and sound business judgment — all qualities that are difficult to automate.”

FOLLOW US ON SOCIAL MEDIA

ITPro is 20 this month. To celebrate, we've taken a look back at the team's favorite stories from the beginning to now.

2008: Science fiction's influence on technology: ideas made real

"The influence of Sci-Fi on technology has become increasingly apparent in the years since Simon Bisson wrote this piece from CES 2008 – just 12 months after the launch of the iPhone. In 2026, futuristic technology like wrist-worn devices and voice activated computers from Star Trek, the IoT and generative AI from the novels of Philip K Dick have evolved into the mundane: smart watches, home assistants, white goods, and chatbots.

"Perhaps the biggest change, though, is not the influence of sci-fi on hardware development but on tech leaders themselves. Mark Zuckerberg has spoken of his love for Snowcrash, which in part influenced the Metaverse. The influence of The Morning Rocket on Elon Musk was even documented in a BBC podcast series."

Jane McCallion, managing editor

2019: Is AMD finally winning the chip wars?

"Tim saw what was coming with AMD and Intel really early on. This article is a fantastic showcase of the subject matter expertise our team and extended team have. We not only report on what's happening, but also use our real-world experience to anticipate what may come next."

Bobby Hellard, reviews editor

2016: Why are women such a problem?

"I wrote this piece a few months after ITPro's 10th birthday. While much has changed for the better since publication, we still have a long way to go when it comes to being able to say the IT industry really embraces diversity.

"Sure there are some organizations leading the way and the fact more conversations are happening can only be a good thing. However, we need action not just talk. And we ALL need to be part of the discussion and the doing."

Maggie Holland, global content director

2023: Hybrid cloud comes into its own with GenAI

This was an exclusive interview with NetApp CEO George Kurian at the company's annual Insight event in 2023. Less than a year after the launch of ChatGPT, the fledgling GenAI industry was well and truly booming. After several years of gradual shifts toward hybrid cloud approaches, Kurian argued that this strategy was ideal for generative AI due to security and flexibility capabilities.

Ross Kelly, news & analysis editor

Ransomware groups Vect and TeamPCP are now working together in a widespread campaign involving supply chain attacks and the extortion of multiple organizations.

The tie-up, which the two announced in March, sees TeamPCP’s credential harvesting and data theft capabilities combined with Vect’s ransomware deployment infrastructure.

According to Sophos, this alliance represents a huge shift in the ransomware threat landscape.

The convergence of supply chain credential theft, a maturing RaaS operation, and mass underground forum mobilization constitutes an "unprecedented" model of industrialized ransomware deployment.

Crucially, the collaboration has the potential to significantly lower the barrier to entry for up-and-coming cyber criminals.

"Threat groups are increasingly operating like businesses, collaborating to combine respective specialist capabilities and build new attack pipelines," said Rafe Pilling, director of threat intelligence at Sophos.

"As AI becomes increasingly accessible, we expect the ransomware landscape to industrialize even faster, lowering the barrier to entry by automating much of the work involved in launching attacks."

The Vect ransomware as a service (RaaS) operation first appeared at the end of 2025, going on to claim its first victims a month later. It's already shown it's a team player, announcing a partnership with BreachForums in March this year.

“Together, we are going to build something huge. Something that the entire ransomware ecosystem will remember for years,” the group said at the time.

TeamPCP, meanwhile, appears to be an offshoot of The Com, a global confederation of primarily English-speaking cyber criminals.

Between March and May this year, the group carried out a series of high-profile supply chain attacks, including one on Trivy, an open source vulnerability scanner that is made by Aqua Security.

The group has since partnered with other established extortion groups - including Lapsus$ - to monetize the stolen data.

Sophos said Team PCP has demonstrated the ability to repeatedly compromise trusted open source tooling, with at least one verified Vect ransomware deployment using TeamPCP-sourced credentials.

This, the company said, shows that the pipeline from supply chain compromise to ransomware execution is already in operation.

Remaining vigilant

Organizations that use open source tools in their development workflows should maintain an up-to-date inventory to enable a prompt assessment of potential impact when a supply chain compromise is announced, according to Sophos.

This will help facilitate a quick response to mitigate potential risks.

Similarly, because third-party software updates could be an attack vector, enterprises are advised to verify the integrity of updates before deploying them across environments.

"The software development environment has quietly become one of the most consequential and least governed attack surfaces in the enterprise," said Pilling.

"Organizations must shift to a posture where they are able to quickly assess exposure and respond to supply chain attacks. It’s crucial that they carefully verify the integrity and safety of third-party updates before deploying them across their environment."

FOLLOW US ON SOCIAL MEDIA

The SaaS industry is facing a pending wave of disruption as enterprises shift their focus towards agentic AI solutions, according to new research from Gartner.

With agentic AI adoption continuing at pace globally, the research firm said this poses a significant threat to traditional software revenue models.

Indeed, up to $234 billion of application spending will be exposed to "agentic arbitrage" – where agents render some services obsolete by removing the need to work across multiple interfaces – by 2030.

George Brocklehurst, managing vice president at Gartner, said the study shows agentic AI “changes the economics of software”.

“Agentic systems deliver outcomes directly, bypassing traditional user experience (UX)-heavy applications and making the software invisible,” he said. “This breaks the link between user growth and revenue growth for many enterprise software vendors.”

No ‘SaaSpocalypse’, but a ‘metamorphosis’

Long-term, Gartner noted that this agentic AI-focused shift will “refactor” how software is built, priced, and consumed. Indeed, Brocklehurst said a period of “redefinition” could come, with the firm describing this transformation as a "metamorphosis".

“This metamorphosis represents threats and opportunities for both incumbents and new challengers,” Gartner said.

Gartner’s claims regarding a period of transformation for the SaaS space align closely with predictions made by industry stakeholders on the potential impact of AI.

Earlier this year, software stocks plummeted amid a mass sell-off due to the arrival of powerful new AI solutions, particularly Anthropic’s Claude Cowork service.

This spooked investors, with some concerned about a ‘SaaSpocalypse’ whereby agents could remove the need for certain software services.

Despite lingering concerns, some industry leaders are still bullish on the future of SaaS – albeit with a few caveats. As ITPro reported in February, AWS CEO Matt Garman poured cold water on the prospect of a looming SaaSpocalypse, suggesting that “much of the fear is overblown.”

Staying competitive

Remaining competitive in a changing market will require incumbent software vendors to “move from interfaced-based value to outcome-based value,” according to Gartner.

Put simply, providers will need to embed agentic capabilities within their offerings to defend their position and meet changing expectations.

Enterprises don’t want disparate tools and dashboards anymore, the researchers claimed, they want streamlined, end-to-end workflow automation and solutions that “capture customer context and knowledge”.

“As organizations increasingly use agentic AI systems, the user interface is no longer a differentiation,” Brocklehurst said. “Legacy SaaS market share will be cannibalized by incumbents and taken by new entrants delivering horizontal agentic platforms.”

“While this shift is posing an existential threat for vendors who are defending legacy dashboards and seat-based models, it creates a substantial revenue opportunity for vendors who are enabling and developing services and platforms to support agentic enabled cross-domain workflows,” he added.

FOLLOW US ON SOCIAL MEDIA

One Identity has announced the appointments of Marianne Van Der Pluym and Tracey Mead as its new channel and alliances directors for EMEA and North America, respectively.

The pair bring extensive channel and cybersecurity experience and will lead the vendor’s regional channel strategy as it continues to strengthen its partner-first go-to-market model.

Van Der Pluym joins from Cryptomathic, where she served as global head of partnerships, having previously held senior channel leadership roles at OpenText Cybersecurity, Micro Focus, NetIQ, and IBM.

Meanwhile, Mead joins from Contrast Security, where she held the role of vice president of global alliances and channels. She also previously served in channel and alliances leadership positions at OpenText Cybersecurity, Micro Focus, NetIQ, Novell, and CA Technologies.

One Identity said the seasoned leaders add complementary experience across global alliances, managed services, and partner-led go-to-market programs as it continues to adapt its channel strategy to meet evolving customer and partner needs.

“Partners play an increasingly important role in helping organizations adopt and manage modern identity security solutions, and strong channel leadership is essential to supporting that success,” commented Ian Sutherland, One Identity’s chief revenue officer.

As the channel continues to move away from traditional resale models, Sutherland said One Identity’s new hires will help ensure its partner strategy reflects that shift.

“Marianne and Tracey both have a clear point of view about where partners are heading: away from resale, toward managed services and outcome-based engagement, and into depth around specific domains like identity,” he added. “That direction is where we are taking our partner program.”

One Identity wants to reshape identity governance

The double appointment follows shortly after One Identity announced plans to become an independent company headquartered in Cork, Ireland, in a bid to accelerate growth in the identity security market.

According to the company, the decision was designed to bring a faster, more focused approach as AI and non-human identities continue to reshape the unified identity governance space.

Commenting on her new role, Van Der Pluym said her immediate priority will be supporting partners across EMEA that are investing heavily in identity security expertise.

“Across EMEA, the partners growing fastest are the ones who have picked a lane,” she explained. “My focus is making sure we deliver a partner program and engagement that supports the partners who are going deep on delivering identity security outcomes.”

Mead added that One Identity’s partner-first culture and collaborative approach to the channel have made it well-positioned to support both customers and partners.

“I look forward to working closely with our partner ecosystem to build joint solutions that help customers secure their environments, address AI challenges, and achieve stronger security outcomes,” she said.

FOLLOW US ON SOCIAL MEDIA

Most UK business leaders have a “limited understanding” of their AI budgets, and they're struggling to turn AI investment into measurable business outcomes.

KPMG’s latest Global AI Pulse report found that 26% of UK companies are now using AI as part of everyday work, up from 18% in the first quarter of this year.

This increased adoption means that managing usage costs is becoming both more complex and more critical to realizing value.

Three-in-ten UK leaders told the firm that they struggle with usage-based costs, while 42% have only partial visibility into AI spending. One-third, meanwhile, cited “limited understanding” of AI cost structures, including tokens, as a challenge to deploying AI agents.

“AI is moving rapidly into everyday work, but scaling it responsibly brings a new set of challenges," said Dr Leanne Allen, head of AI at KPMG UK.

"Leaders now need to show not just that AI can be deployed, but that it can be trusted, financially controlled and clearly linked to value. Cost visibility is central to that."

Enterprises need a clear path with AI

According to KPMG, companies where CEOs are accountable for AI decisions often report higher confidence in their AI strategy, and are more likely to unlock meaningful business value and stronger returns on investment.

"As organizations use more AI tools and agentic systems, they need to understand how costs build, where value is being created and where governance controls are needed. Without that clarity, it becomes harder to make confident investment decisions or demonstrate returns," said Allen.

“Clear accountability, practical governance, and workforce adoption must move together if businesses are to turn AI momentum into sustained value.”

To help manage AI costs, the survey found organizations are implementing stronger governance controls, including monitoring and spending controls.

More than half (57%) of UK leaders report having AI cost monitoring dashboards, with 61% embedding cost reviews as part of AI approval processes to enable stronger control and decision-making.

Notably, organizations with stronger cost visibility are four-times more likely to report established ROI, at 25% versus 6%.

“AI cost management cannot sit as an afterthought. If businesses want to scale AI responsibly, they need to build financial discipline into the way AI is approved, monitored and governed from the start," said Allen.

"The organizations that can see their AI costs clearly are better placed to understand what is working, what is not and where to keep investing.”

AI costs are spiralling

Surging AI costs have become a recurring pain point for enterprises across a range of industries in recent months. As ITPro reported in June, these surging costs are the result of AI provider shifts toward consumption-based billing combined with increased usage rates.

The ‘tokenmaxxing’ trend, whereby users are encouraged to ramp up their use of AI tools, has already caused serious issues for some major companies, such as Uber.

Uber revealed that it used its entire annual AI budget in just four months after encouraging staff to use the technology, prompting a rethink of how AI is used internally. This included the introduction of a $1,500 monthly cap per employee, which is tracked through an internal dashboard.

Accenture has also urged staff to stop using AI for needless tasks in a bid to tackle mounting costs.

Last week, analysts at Gartner told ITPro that tackling this problem will require a concerted focus on cost optimization practices, including the use of context engineering techniques to maximize the use of the technology.

This call to action by Gartner came after research found AI token costs could exceed developer salaries by 2028.

FOLLOW US ON SOCIAL MEDIA

Opera has started to block ClickFix-style attacks in the browser by blocking malicious clipboard copy-and-paste techniques.

ClickFix pairs social engineering with a malicious code injection attack by fooling users into clicking a link, such as a fake CAPTCHA or similar familiar popup, starting a string of events that could compromise the device.

Opera cited a report by Huntress showing that ClickFix-style social engineering attacks make up 53% of all malware loader activity worldwide, underlining the scale of the threats faced by web users.

Last year, Proofpoint warned that state-sponsored hackers were turning to ClickFix techniques to target governments in particular.

To help battle that, Opera has introduced Paste Protect, a browser-native feature designed to prevent such attacks by stopping malicious code from being copied onto the clipboard, and notifying users when that happens.

"This means that if you’re accessing a website that is trying to copy something potentially harmful into your clipboard (or luring you into doing so), Opera will detect it, prevent it, and let you know about it," the company said in a blog post.

Opera said it is the first major browser to add this level of protection, though Microsoft Defender does notify users of ClickFix landing pages and there are extensions that do a similar job.

"Opera had already been protecting users from paste hijacking for half a decade — it made sense to expand that protection to address one of the most increasingly serious online threats," said Mohamed Salah, Senior Director of Product at Opera.

"Paste Protect gives your browser a robust early warning system that can alert less experienced users while still enabling more control for more tech-savvy users or developers."

The rise of ClickFix

ClickFix attacks work by fooling a user into clicking a box on a malicious popup, often by pretending to be a CAPTCHA or a "verify you're a human" box. That lets the dodgy website copy to the clipboard and open another window.

"When this prompt appears, the website has already 'copied' something to your clipboard, and now it instructs you to open the Windows Run dialog box (Win+R), then use 'Ctrl + V' to paste the malicious code, and then click 'OK'," the blog post noted. "This would execute the code and compromise your device, and the data on it."

Instead, Opera's Paste Protect examines the content being copied, and if concerned, blocks the code from being copied to the clipboard and notifies the user. They can then close the window without interacting.

"ClickFix attacks succeed because they turn the user into the weapon," said Pawel Kurzelewski, Head of Security at Opera.

"The clipboard is the last point before a malicious command is run, so that's where we built our defense. With Paste Protect, we're stopping these attacks at the exact moment they would normally succeed."

The Paste Protect system does mean that the Opera browser is scanning everything copied to the clipboard for potential threats or harmful commands. When those are spotted, the system displays a red warning icon.

Websites can be individually approved to circumvent these warnings if safe, and users can still check to see if a mistake has been made.

FOLLOW US ON SOCIAL MEDIA

‘Always on’ culture is placing significant pressure on workers across the UK, according to new research, with nearly half (42%) considering quitting roles due to stress.

A study from HR platform HiBob suggests the trend is “becoming the norm” for many employees, with workplace intensity building significantly in recent years.

More than half (58%) of respondents revealed pressure in their role has increased compared to two years ago, while 49% feel “expected to always be available”.

The result is that around one-third (36%) now work late on a regular basis, with 50% checking work messages while on holiday. Notably, the grind starts almost immediately on a daily basis for many, with 55% of respondents revealing they check work messages within just minutes of waking up.

Toby Hough, VP of people & culture for EMEA at HiBob, said the study highlights a concerning “structural shift in how work happens”.

“Many workers no longer feel there is a natural point where pressure eases or where they can properly switch off, while managers increasingly find themselves balancing rising performance expectations with protecting employee wellbeing,” he said.

“Left unaddressed, this shift poses a significant long-term risk to businesses.”

Workers can’t switch off

The study from HiBob suggests that mounting workplace intensity means workers are finding it “harder than ever” to switch off after their day is finished.

Around two-in-five (42%), for example, admitted checking work messages in the middle of conversations, while 29% do so on dates.

Managerial expectations are fanning the flames on this front, according to the survey, with nearly half (49%) highlighting a demand to always be available.

For some, these activities are warranted. More than one-quarter (27%) said they believe that failing to respond to work-related messages after hours could harm their career opportunities.

The source of this pressure often comes from senior leadership, however. Nearly three-quarters (72%) of managers said they’re now expected to maintain consistent high-performance levels, and many are absorbing this pressure.

HiBob noted that this spill over between work and personal life is having a serious negative impact on employee wellbeing. Nearly half (47%) feel mentally exhausted at the end of their working day while stress negatively affects sleep among 41%.

Managers are at breaking point

The top-down pressure at many organizations is causing significant stress across all seniority levels, according to the study. Around half (51%) of managers said they feel underprepared and out of their depth when it comes to dealing with heightened expectations.

Hough warned organizations that fail to tackle the issue could create huge downstream problems, particularly in terms of retaining talent.

“Companies therefore need to recognize that people-first cultures are performance-first cultures. Sustainable high performance cannot exist without the right support, recovery, and trust within teams,” he commented.

“Businesses now need to equip managers with the training, guidance, and tools needed to lead through this new era of constant pressure and help teams perform consistently over time.”

Crucially, around half (47%) of respondents noted there are no longer clear quiet periods at work, with employees locked in a state of constant activity. This tracks closely with a study from Twilio last year, which revealed that workers are calling for periods of ‘digital silence’.

That study found roughly half (47%) of workers are now prioritizing periods in their daily workflow that are free from distractions, email chains, and calls.

Twilio said the pushback comes largely due to the increasing array of communication platforms used by workers on a daily basis.

FOLLOW US ON SOCIAL MEDIA

Kyndryl is aiming to boost sovereign capabilities through a new deal with Microsoft designed to help customers keep up with evolving data residency requirements.

Governments and highly regulated industries are increasingly facing geopolitical uncertainty, expanding data localization preferences, and ever more complex IT environments, according to Kyndryl.

With this in mind, the company argues that regulatory frameworks such as GDPR, DORA, and NIS2 need to be translated into practical architectures. The aim of this deal is to combine Kyndryl’s advisory, engineering, and operational experience with Microsoft’s sovereign cloud offerings to address these needs.

The collaboration combines Kyndryl Sovereignty Solutioning with Microsoft Sovereign Cloud capabilities, and brings to the table the full spectrum of Microsoft’s public cloud capabilities and private cloud solutions using Azure Local.

This, Kyndryl said, will help organizations address sovereignty across data and operational domains, helping to reduce regulatory framework complexity.

“Kyndryl understands the reality of sovereignty through our first-hand experience with government expectations in Europe, and our strategic alliance with Microsoft brings together complementary strengths to help customers operationalize sovereignty in a practical, scalable way,” said Giovanni Carraro, global strategic alliances leader at Kyndryl.

“By collaborating with Microsoft, we can help customers align their sovereignty goals with real-world architectures, thus balancing control, resilience and performance across hybrid and distributed environments.”

Kyndryl eyes sovereign ‘readiness’

Customers can use Kyndryl’s Sovereignty Readiness Assessment to evaluate their current posture across data, operational, and technical domains, identify any gaps and dependencies and develop a phased roadmap.

The firm said it aims to support implementation using sovereignty-ready architectures that incorporate Microsoft Sovereign Cloud capabilities.

This includes public cloud solutions using Microsoft Azure and Microsoft 365, along with sovereign private cloud solutions using Azure Local in connected and disconnected deployment models.

These are designed to support varying levels of data residency, operational independence, and jurisdictional control as needed.

This unified approach, Kyndryl noted, supports sensitive and regulated workloads, including AI-enabled use cases, with a focus on data governance and model locality.

"Kyndryl’s deep expertise in designing and operating complex, regulated environments complements Microsoft’s comprehensive sovereign cloud capabilities, including controls designed to support data residency requirements, access governance and regulatory compliance,” said Ihab Foudeh, EMEA enterprise partner solutions general manager at Microsoft.

“Together, we are helping organizations adopt cloud services in ways that respect their local requirements while still enabling modernization and innovation.”

Sovereignty momentum

The move by Kyndryl comes amid a concerted focus on digital sovereignty across Europe. Recent research from Gartner, for example, revealed that a third of countries will be locked in to region-specific AI platforms within the next two years.

This shift is driven by a mixture of regulatory pressure, geopolitics, cloud localization, national AI missions, corporate risks, and national security concerns.

In a separate survey of UK IT decision makers last year, almost two-thirds told OVHcloud they were happy to pay between 11% and 30% more for a sovereign technology product that would meet all of their regulatory and sovereignty needs.

More than half acknowledged data sovereignty as a crucial aspect of their data management strategy.

FOLLOW US ON SOCIAL MEDIA

Anthropic's Fable 5 and Mythos 5 are back after a three-weeks-long restriction saw the security models effectively banned.

Earlier this month, the US government applied export controls to Claude Mythos and Claude Fable 5, banning any foreign users, inside or outside the US, from either model.

As Anthropic had no way of checking the nationality of its users, both models were de facto banned from use. Last week, the restriction was loosened to allow Mythos to be used by US organizations deemed trustworthy.

Now, Anthropic has said the restrictions have been mostly dropped following the introduction of new safeguards.

"Anthropic has agreed to proactively detect and address security risks associated with the models," US Commerce Secretary Howard Lutnick wrote in a letter to the tech company, according to the BBC,

Lutnick later added on social media: "Over the past two weeks, we have worked closely with Anthropic to analyze and approve Fable 5 to ensure alignment across the US Government and strengthen America’s leadership in AI."

Anthropic said it was still working to expand access to Mythos 5 to a wider set of partners in its Project Glasswing program – which gives access to the security model in a managed way – and hoped that would include domestic and international users.

Fable 5 should now be available again for all Claude users, with access reenabled for AWS, Google Cloud, and Microsoft Foundry as quickly as possible.

Why Mythos and Fable were restricted

Fable 5 and Mythos 5 are both security focused models, sharing the same underlying model, Anthropic notes.

As ITPro reported in early June, Fable 5 was built with "strong safeguards to make it safe for general use".

Mythos, meanwhile, has fewer protections in place, and as such was released to a limited number of trusted partners under Project Glasswing for the express purpose of defensive security.

Just days after the release of Fable 5, the government applied strict export controls. That was driven by Amazon researchers finding a way to dodge Fable 5's safeguards to use it to hunt for flaws in software and produce exploits.

Anthropic argued that most of its models could actually uncover the same vulnerability and exploit demonstration, and that the Amazon research didn't make use of any "unique Mythos-level cyber capabilities".

The workaround discovered by Amazon has now been blocked for most instances, with any users attempting similar techniques downgraded to a lesser model. Anthropic admitted that more "benign requests" may be flagged accidentally now, though it hopes to reduce such false positives as the system is improved.

"One particularly important safety mechanism involves classifiers — smaller automated AI systems that, during an interaction, detect when the model is asked to perform a potentially harmful cybersecurity task (or produces potentially harmful outputs)," the company said.

"When this occurs, the classifiers block the model from responding to requests. The ultimate goal of these classifiers is to prevent the model from engaging in uniquely dangerous behaviors."

Beyond the new safety classifiers and other safeguards, Anthropic is working with industry partners including Amazon, Microsoft, and Google to develop a framework for addressing AI model ‘jailbreaking’ techniques, developing a system for judging the severity of such attacks.

Plus, Anthropic said it would work more closely with the US government, offering expanded early access for models that could impact national security and sharing information about jailbreaks or misuse patterns.

The company called for the same rules to apply to its rivals: "These rules should be codified in strong regulation and applied equally across frontier model developers."

Mixed industry reactions

It's no surprise this was sorted quickly. Keven Knight, CEO, of cybersecurity firm, Talion, noted that the US government would not have wanted to risk slowing down AI development, particularly in security.

"Given that China is steadily advancing with its advanced AI model, with a platform that mirrors Mythos being launched by 360 Security Technology last week, the US could not afford to limit access to Anthropic's platforms for much longer," Knight said.

"Restricting access to the platforms would only leave western organisations on the backfoot, and at a time when the AI arms race is really heating up, this would be dangerous."

Though the export ban is now loosened, Andrew Bloster, senior R&D manager at Black Duck, said that won't end the "chilling effect" the incident has had on the use of such models.

"Security leaders globally are now wary to depend on AI as a service models that can be launched with much fanfare and then pulled from the global market," he said, pointing to the rise of sovereign AI.

Bloster added that "technology leaders are more concerned about resilience, data security, and cost, and Fable being permitted back on the world stage might not be enough to earn back global trust."

Though Anthropic was the first company to jump through these hoops, it actually tried to find a good balance between safety and use via Glasswing, said Mike Britton, CIO at Abnormal AI.

"On Mythos, the controlled rollout to a vetted set of US organizations is actually the right model. Limiting access to trusted institutions, with use cases focused on finding and remediating vulnerabilities, is how you derive real security value from a model at this capability level without creating new risks," said Britton.

"The goal should be more secure software — and that's achievable if the access controls stay disciplined over time."

FOLLOW US ON SOCIAL MEDIA

Westcon-Comstor has announced the appointment of Olya Scekaturova as VP of regional sales for the UK and Ireland, as the distribution giant continues to roll out its revamped European go-to-market strategy.

The seasoned channel executive brings more than 15 years’ experience in sales and technology services leadership, alongside expertise in leading large-scale transformation programs.

She joins the business from digital infrastructure provider Black Box, where she served as vice president for UK&I and Europe, and has previously held leadership roles at Computacenter and Insight Enterprises.

In her new role, Scekaturova will be responsible for driving growth across the UK and Ireland, strengthening partner and vendor relationships while driving sales execution across the region.

She will also take charge of the distributor’s newly integrated sales operation in the UK and Ireland, which brings together its Westcon and Comstor teams under a single structure.

As part of the company’s announcement, Scekaturova said she joins the business at a key stage in its European growth plans.

“The business has strong foundations and momentum in the UK and Ireland, with a clear strategy focused on helping partners grow through deeper engagement and consistent execution,” she commented.

According to Westcon-Comstor, its new unified operating model is designed to deliver a more consistent route to market across technologies, geographies, and sales engagements.

The firm said its network of partners can expect to benefit from clearer account ownership, coordinated engagement, and improved visibility of opportunities, while vendors gain a more streamlined sales approach across the region.

“My priority is to ensure we support partners in capturing high-margin, repeatable and lifecycle-led opportunities while enabling vendors to accelerate their channel-led growth, harnessing emerging technologies and simultaneously retaining the focus on human relationships that are central to success in the channel,” Scekaturova added.

Scekaturova will report to Stéphane Reboud, Westcon-Comstor’s senior vice president of sales for Europe, whose own appointment last year marked a key milestone in the firm’s European go-to-market transformation.

She will also be supported by a team that includes John Nolan, who has been named as the new senior director of vendor sales. Nolan previously led the distributor’s Westcon business in the UK and Ireland.

“This appointment reflects a broader shift in how we are reshaping our offering and go-to-market strategy across Europe to meet the changing needs of partners and vendors in an era defined by platforms, marketplaces and ecosystems,” Reboud said.

“UKI is one of our most important markets and, by building on our high-performance sales culture with ambition and accountability at the core, Olya and her team have the capability and mindset to drive the next phase of growth.”

FOLLOW US ON SOCIAL MEDIA

A teenager believed to be part of the Scattered Spider hacking group has been extradited from Finland to the United States.

Peter Stokes, 19, is the latest alleged member of the group to be nabbed by the FBI as part of Operation Riptide, an ongoing campaign targeting the criminals, infrastructure, and financial networks behind cyber crime.

Stokes, a dual citizen of the United States and Estonia, has been charged with conspiracy, computer intrusion, and fraud. He was arrested by Finnish authorities in April following an Interpol Red Notice, and extradited to the US last week. He made an initial appearance on Tuesday in federal court in Chicago.

“The criminal complaint charges Peter Stokes with membership in Scattered Spider, a hacking group that has been involved in over 100 network intrusions, resulting in more than $100 million in ransom payments and millions more in damages to the victims,” said assistant attorney general A. Tysen Duva of the Justice Department’s Criminal Division.

“The charges unsealed today are the result of years of work by the Criminal Division, the US Attorney’s Office for the Northern District of Illinois, and the FBI. We will continue to partner to ensure that cybercriminals cannot evade the reach of the United States.”

According to the complaint, Stokes and his fellow criminals breached a luxury jewellery retailer’s computer system, exfiltrated data, and made a ransom demand of around $8 million in cryptocurrency in May last year.

The firm managed to successfully evict the hackers from its computer network and no ransom was paid. However, it suffered a loss of at least $2 million due to business disruption, investigation, and threat mitigation.

The walls are closing in on Scattered Spider

The Scattered Spider group has been linked to more than 100 network intrusions, resulting in over $100 million in ransom payments and millions of dollars in damages to the victims.

The group targets companies across the US with social engineering and SIM swap attacks, encrypting data or exfiltrating it to remote servers. It then extorts cryptocurrency from the companies in return for the return of their data or to prevent it being disseminated.

Scattered Spider has rapidly grown to become one of the most notorious threat groups worldwide, having claimed responsibility for attacks on UK retailers Marks & Spencer and the Cooperative Group, as well as MGM Resorts in the US.

“Scattered Spider has repeatedly targeted US companies, extorting employees, inflicting millions of dollars in losses, and disrupting essential operations,” said assistant director Brett Leatherman of the FBI’s Cyber Division.

“Through strong domestic and international partnerships, the FBI will continue to identify, disrupt, and hold cybercriminals accountable, no matter where they are located.”

While the group has been repeatedly hit by law enforcement takedowns, it keeps emerging in different forms, for example teaming up with overlapping threat groups ShinyHunters and LAPSUS$ to form a unified collective.

FOLLOW US ON SOCIAL MEDIA

Netgear is making strides in helping businesses make the move into AI-powered network operations and management with the launch of Netgear Insight 10.0.

This next-generation cloud network management platform will be game-changing for small and medium-sized businesses (SMBs) and Managed Service Providers (MSPs), plugging the gap between need and resource, according to the firm.

Insight 10.0 is designed to support organizations through delivery of enterprise-grade AIOps, intelligence, and operational simplicity, helping them to make decisions faster and move their business forward.

One key benefit of the new platform is empowering network administrators to move from being purely reactive to being proactive, according to Luca Marinelli, Netgear’s head of Europe.

In terms of launches, Marinelli said this is a pretty significant one for the company and a key focus during his time with the business so far, following his appointment in October last year.

“The opportunity to have a single pane of glass, which will be managing simultaneously – like with multi-tenancy – several networks will free up time for [MSPs] to maybe start providing other additional services to attract new customers, which is always something very healthy to do in business.”

“[Also] if you perform certain types of activities in a reduced amount of time, your margin can be better. This results in a much more profitable business. So, there are multiple impacts [from] using more sophisticated state-of-the-art tools," Marinelli added.

"Sometimes the feeling is that AI is just a nice slogan that you need to just add in everything you say. [But] I think the important thing is to know what to do with this superpower. If you know what you want to do, it is extremely valuable.”

Outside of product innovation, Netgear has been heavily focused on how it partners to do business. Indeed, in November 2025 it unveiled changes to its partner program in a bid to make it easier to work together and drive joint success.

At launch, Netgear’s president and general manager, Pramod Badjate, said partners were at the center of everything the company does.

“Our big play at Netgear is delivering enterprise-grade products with the simplicity that the SME market needs. That all boils down to a product that is ready for those environments, but also, from a TCO point of view, fits that customer experience really well,” said Jordan Hobday, Netgear’s UK country manager.

“The Netgear Drive Partner Program is three tiers. It's there to really incentivize and reward our partners. There's a commercial benefit to that, but equally it's about how we [can] provide a good experience to our partners, like certifications, self-serve material, all the good things that you would expect.

“A big part for us is simplicity, and how easy it is to work with or do business with Netgear.”

Netgear’s EMEA business is in good health, according to Luca, but he said the company’s turnaround journey was not finished yet. Indeed, one priority for him is not just growing partner numbers for numbers' sake, but really focusing on deeper engagement.

“I think we have, in my opinion, enough partners that we are working with. The game is to keep them interested; I don't necessarily think we need to increase the number of partners broadly. It's going to be a very selective move in both the AV and IT markets to capture the real players that we need to work with, in a given territory, in a given market,” he said.

“We work with a lot of partners, but the number of partners we have this business intimacy with is not at all at the level where it should be. It’s about ways of working with partners; it's about tools that we keep evolving; it's about the value we bring to those partners and the way we spend time. We do spend time [with partners] already, of course, but [it’s about] the way we spend [that] time. It has to evolve.

“It's [about] more quality, more depth, more intimacy, more shifting the way we work with partners, which takes a little while. It doesn't happen overnight.“

Anthropic has launched Claude Sonnet 5 in a move the company said offers users more powerful agentic capabilities.

The new option is the “most agentic Sonnet model yet”, according to Anthropic, capable of building workflow plans for users, accessing browsers and terminals, and operating autonomously for longer periods.

Cost and performance are key talking points here for Anthropic, with the company noting that Sonnet 5 “narrows the gap” with its flagship Opus range in terms of efficiency.

“Claude Sonnet 3.5, 3.6, and 3.7 were the first models that showed impressive skills in coding and tool use. More recently, though, the clearest gains in agentic capabilities have been in our Opus-class models,” the company said in a blog post.

“Its performance is close to that of Opus 4.8, but at lower prices,” Anthropic added. “It’s a substantial improvement over its predecessor, Sonnet 4.6, on important aspects of agentic performance like reasoning, tool use, coding, and knowledge work.”

SWE-bench Pro results show that show that Sonnet 5 recorded a 63.2% score on agentic coding capabilities. That marks a solid increase compared to Sonnet 4.6, which came in at 58.1%.

The model still lags behind Opus 4.8 (69.2%), but clear gains are being made on this front.

Anthropic eyes cost improvements with Claude Sonnet 5

With concerns mounting over token consumption, Anthropic is keen to emphasize that Sonnet is a far more cost-efficient model.

Performance of the model at “different effort levels” – or the intensity and timeframe of tasks – on BrowseComp shows a “strict improvement” over Sonnet 4.6.

Compared to Opus 4.8, meanwhile, Sonnet covers a “much wider range of cost-performance options”.

“It provides substantially improved cost efficiency at medium effort,” the company explained. “Its higher-effort performance can match Opus 4.8 on some tasks.

Users will also be able to adjust effort levels to help them “find the right balance of cost and performance” with both Sonnet 5 and Opus 4.8.

Sonnet 5 safety improvements

On the safety front, Anthropic noted there has been an “overall improvement” with Sonnet 5, which is far more likely to refuse “malicious requests” than 4.8 and is capable of resisting hijack attempts, such as prompt injection.

“The model shows lower rates of hallucination and sycophancy than Sonnet 4.6,” the company noted. “On our automated behavioral audit, which tests a wide range of misaligned behaviors such as cooperation with misuse and deception, Sonnet 5 scored lower (that is, safer) overall.”

It’s worth noting that Anthropic admits Sonnet 5 displays higher rates of “misaligned behavior” compared to Opus 4.8 and Claude Mythos, urging caution by users.

Safety tests for Sonnet 5 come at a critical time for Anthropic, with the company having launched Claude Mythos earlier this year as part of a gated preview with select industry partners.

How to access Sonnet 5

Claude Sonnet 5 is available across all plans from today, according to Anthropic, including Max, Team, and Enterprise users. It will also act as the default model for Free and Pro plans.

For Claude Code and Claude Platform users, Sonnet will come with an “introductory” pricing of $2 per million input tokens, and $10 per million output tokens until 31 August.

Thereafter, Anthropic said prices will rise to $3 and $15 across input and output tokens respectively.

FOLLOW US ON SOCIAL MEDIA

Unmanaged SaaS guest accounts are creating massive security liabilities for small and mid-sized businesses, new research has shown.

According to Kaseya’s 2026 SaaS Security Report, 69% of SaaS accounts have more guest access than licensed users, with persistent third-party access and externally shared data leaving small and mid-sized businesses open to attack.

Gaps in multi-factor authentication (MFA), OAuth sprawl, and external file sharing are widening the SMB attack surface, the study noted. Indeed, threat actors are now abandoning perimeter attacks in favor of softer targets like identities, OAuth integrations, and collaboration workflows.

This, Kaseya noted, leaves a trust gap most small and mid-sized businesses can't even see, let alone close.

“Today’s AI-emboldened threat actors see one interconnected attack environment, whereas most organizations defend their infrastructure in pieces,” said Jim Lippie, chief product officer at Kaseya.

“The most resilient organizations will be those that embrace continuous monitoring, identity governance ,and automated response as foundational requirements.”

AI scramble has caused OAuth chaos

The rush to adopt AI has led to a sprawl of third-party OAuth integrations that use persistent tokens instead of credentials, and that risks granting attackers permanent data access even after password resets.

As a result, non-human service principal logins now account for one-fifth of critical security alerts.

At the same time, attackers are using AI-driven automation to instantly locate and exploit dormant guest accounts, moving faster than manual defenses can respond.

Legacy controls like geolocation blocks are also failing to help, as attackers route traffic through trusted cloud hosts and VPNs.

Outside North America, Kaseya found nearly half (44%) of unauthorized logins originated from trusted infrastructure and outsourced hubs.

India accounts for 14%, the Philippines 10%, Germany 7%, the UK 7% and the Netherlands 6%.

Hackers are exploit SaaS identity gaps

Once inside, attackers are able to exploit massive identity gaps, with 56% of accounts lacking active MFA and only 27% of SMBs enforcing it across the organization.

Meanwhile, researchers found data leakage is through the roof in productivity environments. In Microsoft 365, 45% of all shared files were sent outside the organization.

Companies are also failing to keep up with severe alerts. Last year, while 98.9% of security events monitored by SaaS Alerts were classified as low severity, organizations still faced more than 278 million medium- and critical-severity alerts requiring investigation.

Kaseya recommends transitioning from rigid perimeter defenses to active, identity-first governance frameworks.

"Bridging the modern trust gap requires businesses to move away from static event tracking and instead prioritize automated behavioral monitoring that can flag anomalous activity inside trusted accounts," the company said.

"By aggressively consolidating security stacks, enforcing organization-wide MFA and continuously auditing machine identities and external sharing permissions, SMBs can eliminate critical visibility silos and systematically neutralize attacker persistence before a breach occurs."

FOLLOW US ON SOCIAL MEDIA

Europe’s complex network of overlapping regulations is hitting startup founders hard and holding back business, according to a new research by startup support organization DutchBasecamp.

Some 79% of tech founders claim they've been hit by regulatory friction over the last year, according to the The Realities of Scaling in Europe report, which was launched in partnership with the Computer & Communications Industry Association (CCIA).

More than half (58%) said they'd delayed entering another EU market, 45% have paused or canceled features, and 44% have experienced delayed or lost deals.

As negotiations on the Digital Omnibus continue, the CCIA warned that many meaningful simplification measures could fall by the wayside, which has the potential to further compound challenges faced by startups.

Some member states are resisting a proposal allowing businesses to report a cybersecurity incident once, rather than separately under seven overlapping frameworks.

Meanwhile, a fix that would establish legitimate interest as a legal basis for responsible AI training has been stripped out.

While postponing certain deadlines has provided some breathing room, many simplifications have been rejected, leaving developers with limited implementation time while essential codes, guidance, and standards are still missing.

“We warned from the start that the Commission’s proposals to simplify the patchwork of EU tech and digital rules were only the bare minimum. Instead of going further, Parliament and Council are now weakening, rejecting, or delaying even the most basic fixes," said Daniel Friedlaender, senior vice president and head of CCIA Europe.

“Europe’s innovators have shown remarkable patience in navigating today’s regulatory maze, but that patience is running out. EU institutions and member states need to wake up: 2026 must bring real improvements for tech companies. Europe knows the problems. If we refuse to fix them, we can’t be surprised if our founders look outside the EU for success.”

Growing regulatory friction

Nearly a quarter of survey respondents said they'd spent more than 30% of their budgets on compliance costs, while 24% are considering or have already relocated their headquarters due to regulation.

In January, the European Investment Bank, with the European Commission, found that roughly one-in-ten EU scale-ups have relocated abroad, with around 85% of those moving to the United States.

The Commission’s Joint Research Center put the headquarters-relocation rate for venture-backed startups at between 3.3% and 4.3%, ten times the rate for comparable non-VC-backed firms.

More than half of founders said they'd steered clear of an EU country because of regulatory concerns, and only 21% said they'd seen no material impact from EU or national rules.

"Europe is already losing tech founders, products, and growth," said Masha Moisseyeva, managing director of DutchBasecamp.

"When 45% of those surveyed have paused or cancelled features, 58% have delayed entering another EU market, and 44% have lost or delayed deals in a single year, the urgent need for regulatory simplification is no longer a theoretical debate about EU competitiveness. The damage is happening now.”

Regulatory confusion is rife

Much of the cost, the researchers found, comes not from compliance itself but from not knowing what compliance will require.

Indeed, founders often cite uncertainty surrounding future EU AI Act obligations before any requirement has formally bound them.

“Founders are not asking the EU to lower its standards. They are asking for clear, workable rules they can rely on across the Single Market," said Moisseyeva.

"Instead, uncertainty and overlapping obligations are dictating what they build, who they serve, and how fast they grow.”

FOLLOW US ON SOCIAL MEDIA

Dropzone AI has announced an exclusive EMEA distribution partnership with QBS Software, in a move the company said will expand the availability of its AI-powered security operations platform to MSSPs and VARs across the region.

The agreement will see QBS distribute Dropzone AI’s Agentic SOC platform, which uses a team of AI agents to automate security alert investigations across existing security environments.

According to the vendor, the partnership aims to help channel partners address the growing demand for security operations capabilities as organizations contend with rising alert volumes, increasingly sophisticated cyber attacks, as well as an ongoing shortage of skilled SOC analysts.

For MSSPs, Dropzone said the platform can help scale managed SOC services without requiring a proportional increase in analyst headcount, while VARs will be able to offer the technology to customers operating in-house security operations centers.

"Security teams are under immense pressure to scale operations, meet increasingly stringent SLAs, and ensure regulatory compliance while maintaining resilience against rising alert volumes,” said Brett Candon, Dropzone AI’s vice president of international, in an announcement.

“Through this partnership with QBS, Dropzone AI will extend its reach to both MSSPs and VARs across EMEA. MSSP partners can scale service delivery and improve profitability, while VAR partners can help customers with in-house SOCs move from alert chaos to incident focus."

Dropzone’s Agentic SOC solution is built around its AI SOC Analyst, which investigates security alerts from across an organization’s existing security stack before escalating confirmed threats to human analysts for response.

The technology integrates with existing SIEM, SOAR, EDR, and case management platforms, allowing organizations to augment existing security operations without replacing current infrastructure.

Benefits for MSSPs and VARs

Dropzone said its platform will help MSSPs improve SLA performance, onboard customers faster, increase SOC capacity, and free up analysts to focus on high-value tasks while building higher-margin managed security services.

Meanwhile, VARs will be able to support customers operating their own SOCs by leveraging the offering to accelerate investigations, reduce false positives, ease alert fatigue, and address temporary cyber security skills shortages.

The companies said the agreement expands the channel opportunity across EMEA by enabling partners to support customers with managed, co-managed, and in-house security operations models while helping address the ongoing shortage of skilled SOC analysts.

"Our partnership with Dropzone AI strengthens QBS' security portfolio with advanced autonomous AI SOC capabilities that addresses a real challenge across the channel,” commented Tom Corrigan, chief revenue officer at QBS Software.

“By bringing category-defining AI SOC capabilities to our partner ecosystem, we're supporting growth, improving service delivery, and helping partners deliver stronger customer outcomes.”

FOLLOW US ON SOCIAL MEDIA

Hackers are sneaking into networks and staying undetected for longer than ever, according to new research, and many security teams are frightfully unaware.

A study from security firm ExtraHop found threat actors are managing to access corporate networks and quietly maintain access for an average of two and a half weeks before their presence is detected — with a small number remaining undetected for several months or even years at a time.

Nearly half of organizations polled said they didn't detect the intrusion until after data was stolen, marking a 31% increase compared to last year. Notably, 14% weren’t aware any attack had taken place until the hackers themselves alerted the enterprise, typically with ransom demands.

Detection is being delayed by a combination of sophisticated obfuscation methods and alert fatigue, the survey suggested. Four-in-ten respondents, for example, said detection was delayed by attackers using encrypted channels or by mirroring legitimate workflows and processes.

Another 34% reported attackers using high-privilege account permissions to dodge being spotted. But a further 30% said initial detection was missed because alert fatigue, while 27% said undetermined baseline behavior made it difficult to spot dodgy activity.

"Every hour ransomware goes undetected drastically increases its potential blast radius," the report noted. "A wider detection window grants adversaries the critical dwell time needed to move laterally and locate backups. This delays containment, turning what could have been a localized incident into an organization-wide crisis."

Concerning dwell times

Dwell times – which refer to the timeframe in which an attack starts to when it is detected – are by no means a new problem for cybersecurity teams.

Indeed, it’s been a long-running war of attrition for security practitioners in recent years, with threat actors becoming increasingly proficient in staying undetected before wreaking havoc.

As far back as 2023, ITPro reported that enterprises were facing huge problems with this issue, yet research from Sophos at the time found enterprises were improving their response to threats on this front.

More recent analysis from Mandiant’s 2025 M-Trends report, however, shows that global median dwell times also shrunk from 11 days to 10 days.

That may seem like a step in the right direction in terms of detection capabilities, but as Sophos noted, more rapid reaction times mean threat actors are accelerating attacks and acting more aggressively – particularly in ransomware cases.

‘Ransomware isn’t shrinking, it’s migrating’

The report also found that, among polled organizations, the number of ransomware incidents faced annually by each company had fallen from 5.4 to 3.5.

That doesn't mean the ransomware threat is going away, but rather shifting focus from the US, Western Europe, Australia, and Singapore to areas with rapid enterprise digitization such as Brazil, Mexico, Vietnam, Thailand, and Indonesia.

"Ransomware isn’t shrinking, it’s migrating," the report found. "As coordinated global law enforcement hardens traditional targets, syndicates are moving downstream to other targets."

ExtraHop researchers spotted some good news, though, mainly that the average ransom payment had fallen to $2.8 million from last year's $3.6 million. On the downside, the frequency of payments is up.

Of those polled, 83% of victims paid a ransom, up from 70% in previous surveys. ExtraHop noted that the financial costs of business disruption is what drives most companies to pay a ransom, with downtime per incident averaging nearly 30 hours.

AI is creating ‘noise’ for cyber pros

Beyond that, 55% of respondents said that AI was the attack surface presenting the biggest risk to their organisation.

Enterprises raised further concerns around AI-enhanced attacks, compromised AI identity and session theft, third-party or supply chain breaches due to their integrated AI, and shadow AI exposure.

Plus, AI is often adding to the "noise" faced by security teams, with 30% of those surveyed saying that AI alerts had produced false positives that had slowed down wider investigation timelines.

"When you look at the big picture of modern cyber risk, the thread connecting every major challenge, from missed detections and prolonged dwell times to AI false positives, is a fundamental lack of situational awareness, or ground truth," said Raja Mukerji, Co-founder and Chief Scientist at ExtraHop.

FOLLOW US ON SOCIAL MEDIA

Nissan has revealed it suffered a data breach after threat actors exploited flaws in Oracle’s PeopleSoft software, with information on both current and former staff exposed.

In a filing with the California Attorney General’s Office, the car manufacturer said it is “working as quickly as possible” to establish the full scale and scope of the breach.

An initial investigation by the company reveals that personal information such as contact and banking information, social security numbers, and financial and tax data was exposed in the breach.

Current and former employees in the US, Canada, Mexico, and Brazil are among those affected, the company said.

“As we continue our investigation, individuals whose personal information has been exposed will receive further communication with additional details and next steps,” the filing reads.

Nissan urged employees to take a number of precautionary steps in the meantime, including remaining vigilant for phishing emails or fraudulent phone calls and text messages.

Staff were also advised to monitor financial accounts and credit reports for unusual activity, and urged to change passwords for “all significant accounts” - such as banking services.

Nissan noted that systems have since been secured and the company is working with technical experts to prevent further leaks.

“Upon learning about this issue, we quickly activated incident response protocols. We have been in communication with authorities throughout our response to this attack,” the filing reads.

“Our technical teams, along with external experts, have secured our systems and will continue to work with Oracle to address this issue. We have taken steps designed to end unauthorized access and to prevent further disclosure of the information.”

Oracle PeopleSoft breach

The announcement by Nissan comes in the wake of a “cyber event” involving Oracle’s PeopleSoft software, which is used to manage employee information such as payroll, tax, and other personnel details.

More than 100 organizations are believed to have been affected by the breach so far, which has been linked to the ShinyHunters threat group.

Earlier this month, the University of Nottingham was among those impacted by the breach, with data belonging to around 450,000 present and former students compromised in the attack.

Simon Pamplin, CTO at Certes, said the breach is a single zero-day in “widely deployed enterprise software can become a mass-casualty event”.

“Nissan was not the target of a bespoke attack. It was one of many companies caught in a campaign exploiting a shared vulnerability in HR and payroll infrastructure used across industries,” he said.

“The data involved here is particularly serious. Social Security numbers, banking details, tax information and dependent records are not generic employee data. They are the durable financial backbone of a person's identity, and they were sitting inside a system many organisations treat as core infrastructure rather than a high-value target.”

FOLLOW US ON SOCIAL MEDIA

Apple has dropped an unexpected out-of-band patch, and it's apparently because of concerns that AI is helping hackers exploit vulnerabilities at lightning speed.

The tech giant released iOS 25.6.2 yesterday, with fixes for iOS and iPadOS, despite normally bundling such security patches into wider updates. Apple hasn't said when its next major update, iOS 26.6, is set to be released, but it's widely expected in the next few weeks ahead of iOS 27 in the autumn.

Apple told Reuters that the extra security update was down to concerns about AI shortening the time between a flaw being spotted and exploited by hackers.

The company said that shorter timelines from flaw to exploit meant it needed to respond by cutting the time between when updates are announced and released.

That shouldn't be taken as a suggestion that Apple was seeing any evidence that hackers were already making use of any of the flaws included in the update, the company noted.

ITPro approached Apple for confirmation of the changes made to its security patching policy, but did not receive a response by time of publication.

Apple responds to accelerating threats

The move comes in response to wider concerns that AI is helping hackers find flaws more easily and turn them into exploits more quickly. Indeed, this has been a recurring talking point since the release of powerful new frontier models such as Anthropic’s Claude Mythos range.

Last month, Google said it had spotted cyber criminals using AI to build a working zero-day exploit, with John Hultquist, chief analyst at GTIG, warning that an “AI vulnerability race is imminent”

That echoes a warning earlier this year from Daniel dos Santos, VP of research at Forescout, who told ITPro that enterprises should brace themselves for an explosion of vulnerabilities thanks to AI, further adding to the workload of security teams.

Jake Moore, Global Cybersecurity Advisor at ESET, told ITPro that while the “jury is still out” on how powerful tools such as Mythos are, AI advances do mean that security teams and threat actors alike are scrambling to find software vulnerabilities.

"Whenever a new issue is discovered, there's a race to patch flaws before they can be exploited – and if users or security teams hold off on installing updates, it's a gift to threat actors,” he said.

Moore added that increasing numbers of patches mean the process needs to be automated as much as possible to avoid update fatigue for both end users and security practitioners.

"In the age of automated vulnerability discovery, we're past the point of expecting users and security teams in organisations to manually patch everything," he commented.

"Updates should be automated wherever possible to reduce the burden on users while making sure patches are applied rapidly."

Apple iOS 26.5.2

The security fixes released by Apple were previously revealed via a beta of the update, as is Apple's usual procedure, and addressed more than 30 vulnerabilities across iOS and iPadOS.

Those include kernel vulnerabilities that could corrupt memory and trigger system shutdown and a stack of WebKit issues, including one that could leak sensitive data after visiting a website.

Three WebKit flaws were spotted by OpenAI's Codex Security, while another was spotted by a pair of AI researchers using Claude Anthropic.

The update should have already landed on devices, and is supported on these devices:

• iPhone 11 and later
• iPad Pro 12.9 inch, 3rd generation and later
• iPad Pro 11 inch, 1st generation and later
• iPad Air 3rd generation and later
• iPad 8th generation and later
• iPad mini 5th generation and later

FOLLOW US ON SOCIAL MEDIA

The US National Institute of Standards and Technology (NIST) has announced plans for a $20 million center to drive quantum research, development, and manufacturing.

The Quantum Manufacturing Engineering Center (QMEC) is being set up with the help of non-profit R&D organization SRI International, with the aim of strengthening the manufacturing of scalable, high-performance quantum components and systems.

“NIST is a world leader in quantum science and technology based on decades of fundamental research that helped launch the US quantum industry,” said under secretary of commerce for standards and technology and NIST director Arvind Raman.

“This public-private partnership with SRI International will accelerate the development of America’s quantum industrial base — the foundation upon which the quantum revolution is being built.”

The QMEC will recruit companies and quantum experts to conduct research and development aimed at boosting US manufacturing and strengthening supply chains to enable quantum technology production at scale.

Initially, the center will focus on areas such as cryostats and lasers, with the specific goal of improving the manufacturability of quantum-enabling components within three years.

This will include developing scalable processes for quantum chips and integrated photonic circuits and establishing standards and quality control methods for quantum technologies.

The project also aims to build a US-based supply chain for materials and components required for quantum systems, build expertise through programs focused on quantum, and accelerate commercialization pathways from laboratory to production.

“Our approach is results-driven and timeline-focused,” said Lawrence Lee, SRI’s QMEC program director. “Each project we undertake will have clear goals, defined milestones, and measurable outcomes that are informed by collaborative discussions with quantum technology companies, value chain partners, and end users."

US eyes competitive edge in quantum

NIST and SRI have been working together since 2019, establishing the Quantum Economic Development Consortium (QED-C) in response to the National Quantum Initiative Act – work that led NIST to identify quantum manufacturing as a critical gap in national efforts to develop a robust commercial industry.

Earlier this month, the white House issued an executive order, Ushering in the Next Frontier of Quantum Innovation, aimed at accelerating the deployment and commercialization of quantum computing, sensing, and networking.

Among other things, the EO directed the Secretary of Commerce to develop a plan for advancing the commercial readiness of quantum sensing, quantum-sensor manufacturing technology, and quantum-network-enhanced timing.

This will include prioritizing research, development, testing, and evaluation of applications and hardware for quantum sensing and quantum networking.

The new manufacturing engineering center will be a key component in the government’s push on this front, according to NIST.

"Quantum science promises to generate new knowledge and technologies that will supercharge scientific research and unlock enormous economic potential,” said deputy secretary of commerce Paul Dabbar.

“The new Quantum Manufacturing Engineering Center will bring together top experts to ensure both continued US leadership in quantum technologies and that we are the epicenter of manufacturing quantum systems at scale to drive advances in sensing, communications, encryption, computing, biomedicine and other critical areas.”

FOLLOW US ON SOCIAL MEDIA

The US Department of State is offering a reward of up to $10 million to anyone that can help it identify and locate members of the Russia-linked UNC5792 and UNC4221 hacking groups.

UNC4221 works on behalf of the Russian military services while UNC5792 is associated with the Russian Federal Security Service (FSB), and has carried out phishing campaigns targeting the Signal and WhatsApp accounts of US government officials, military leadership, and allied personnel.

"Using social engineering techniques, these malicious cyber actors exploit legitimate device-linking features in these secure messaging applications to gain unauthorized access to sensitive government communications, contact lists, and group conversations," said the US Department of State.

"After compromising an account, the malicious actors were also able to send messages and conduct additional phishing against other accounts using those same commercial messaging applications."

In some cases, UNC5792 actors altered legitimate group invite pages to redirect users to a malicious URL that linked a hacker-controlled device to the victim’s Signal account.

Officials said that while these activities did not exploit vulnerabilities in either platforms’ encryption standards, they successfully compromised “thousands of individual commercial messaging application accounts”.

Targets included US government officials, diplomatic personnel and foreign affairs officials, defense and national security personnel, policy analysts and advisors, NATO member-state officials and diplomats, and allied intelligence and defense partners.

The group also went after investigative journalists covering Russia, Ukraine, and international affairs, NGOs providing support and assistance to Ukraine, and academic researchers in security studies and Russian affairs.

Valuable intel

The announcement of the reward follows an advisory issued by the FBI and the Cybersecurity and Infrastructure Security Agency (CISA) last week, which warned of continued activity by the two groups as well as a change in tactics aimed at harvesting victims' backup recovery keys.

"If a victim inadvertently shares their backup recovery key, that same key remains valid even if they create a new account following the compromise using the same phone number," the advisory warned.

"Consequently, the actor could potentially use the compromised key to take over the new account in the future as well."

The department gives a list of what information it seeks, including:

• Names
• Locations
• Biographical information on UNC5792 members
• Affiliations with Russian intelligence services
• Identities of personnel providing technical support
• Contractors or third-party entities providing services

It’s also seeking information on domain names, server locations, hosting providers, data storage and processing infrastructure, and technical tools, frameworks, and software used in operations.

Elsewhere, officials are keen to hear about the financial side of operations, including:

• Funding sources
• Financial accounts and banking relationships
• Cryptocurrency wallets
• Payments for infrastructure
• Financial networks supporting operations

Anyone with dirt on either of the two groups can submit their tip here, uploading relevant files such as photographs, videos, and documents.

FOLLOW US ON SOCIAL MEDIA

Two-thirds (66%) of UK businesses could ditch US cloud providers due to rising concerns about digital sovereignty, according to a new study.

Research conducted by Civo found digital sovereignty is now viewed as a “strategic priority” by 73% of firms, marking a 12-point increase compared to last year and shaping decisions on what cloud services to use.

Reliance on a limited pool of foreign cloud providers is also an area of concern, according to Civo, with 64% highlighting this as a recurring talking point.

Notably, with businesses ramping up AI adoption, this adds another layer of complexity to sovereignty-related discussions.

More than half (58%) of respondents told the firm they’re concerned about their AI providers’ legal jurisdiction, while 43% said AI workloads must be hosted within the UK.

“AI has raised the stakes for digital sovereignty,” said Civo chief executive Mark Boost. “The issue is no longer just where data is stored, but also where systems are built, who controls the infrastructure and which legal jurisdiction it falls under.”

“The UK must control the infrastructure on which AI is built to ensure long-term competitiveness in the field. Sovereign cloud is about resilience, choice and control, not digital isolationism,” he added.

UK firms paying the ‘sovereignty tax’

While British companies are keen to reduce their reliance on US-based tech providers, the Civo study noted that many are unable to “break free” and are locked in a cycle of dependency.

Civo refers to this as a “sovereignty tax”, which creates “significant financial, operational, and strategic risks”.

“UK leaders clearly want to break free from Big Tech dependency, but find themselves trapped by an ever-tightening web,” Boost commented.

“This is not a proactive investment or deliberate strategy. It is a symptom of organizations becoming increasingly ensnared in the same hyperscaler ecosystems they acknowledge to be a significant long-term risk.”

Key hurdles to reducing dependence include technical lock-in, complexity of migration, contractual barriers, and various other financial implications of switching providers.

Civo noted that the number of companies that have successfully migrated to a domestic alternative has “stalled” at just 15% while only one-in-four UK companies believe they could ditch a US provider entirely.

Looking ahead, the company predicts that UK firms could end up becoming “more deeply entrenched” in US hyperscaler systems, with 28% having already found themselves in this predicament.

A ‘dangerous loss of autonomy’

Civo warned that remaining locked into foreign-owned infrastructure could result in a “dangerous loss of autonomy” for UK firms, and this isn’t just in terms of data privacy or security.

Other factors also play a role in the aforementioned sovereignty tax, such as unpredictable costs and events such as outages. The firm specifically highlighted the latter of these as a potential danger for UK businesses, with 39% of firms having experienced outages originating from US hyperscalers over the last year.

Enterprises across the country were impacted by a series of major cloud outages last year, most notably with Amazon Web Services (AWS) and Microsoft Azure. Similar outages at Cloudflare, meanwhile, also had a huge impact on operations for firms operating across a range of sectors.

These outages have a huge financial impact on UK enterprises, Civo noted. That tracks with research from Relic last year that warned many UK and Irish firms are “severely underestimating” the costs associated with outages.

Analysis from the firm revealed that “high-impact” outages carry a median cost of around $2 million per hour, with UK and Ireland-based organisations reporting losses of between $1 million and $3 million per hour.

FOLLOW US ON SOCIAL MEDIA

UK business leaders are confident that AI will create more jobs than it destroys, despite recurring claims of a pending ‘jobs apocalypse’.

According to research from Box, nearly two-thirds (65%) of UK business leaders said they expect their organization’s overall headcount to increase over the next three years, with just 14% expecting workforce numbers to decrease.

This optimistic outlook comes amid growing AI maturity at organizations across the country, the study noted. Many are entering a “new phase of AI adoption”, moving beyond basic experimentation to fully embedding AI and agents within core operations.

Notably, among those using agents, only 8% said the technology is eliminating existing roles. If anything, the majority of enterprises report surging demand for new, AI-focused positions to support adoption.

Nearly half (48%), for example, are hiring ‘AI agent operators’ within IT teams, with this new class of specialist working in tandem with automated bots across a range of areas.

Elsewhere, 32% are adding ‘workflow automation specialists’, security, risk, and compliance professionals (31%), and governance and AI ethics specialists (26%) to their roster.

Box noted that the findings suggest that UK firms are now coming to view AI as a “workforce transformation opportunity” that’s creating a demand for new skills and expertise, rather than a destroyer of roles.

"UK organizations are moving beyond AI experimentation and into operationalization,” said Samantha Wessels, president of EMEA at Box.

"We're entering the era of the agentic enterprise, where AI is becoming embedded into everyday business processes and workflows. The companies seeing the greatest success are not simply deploying more AI tools; they are building the foundations that allow AI to scale across the business, including trusted content, governance frameworks and the teams needed to manage agentic workflows.”

No AI ‘jobs apocalypse’ after all

The research from Box comes in stark contrast to what has become a prevailing sentiment across the tech industry in recent years, mainly that AI could render millions of roles obsolete.

Workers across a range of industries and professions – from software engineering and HR, to marketing and customer support – have been bombarded with warnings about a pending jobs apocalypse due to the technology.

Last year, for example, Anthropic CEO Dario Amodei warned that AI could destroy up to half of all ‘white collar’ roles, while concerns over the impact of AI on entry-level positions reached boiling point.

In March this year, Microsoft’s AI chief Mustafa Suleyman also warned that white collar roles could be automated by AI within just 18 months.

These bold claims by big tech figures have become a contentious topic in recent months. Some industry leaders have hit back at suggestions while others have changed their tune.

OpenAI CEO Sam Altman recently dismissed claims that AI advances could lead to mass workforce disruption, noting that roles across a range of industries will still require human involvement.

Speaking during a session at a Commonwealth Bank of Australia (CBA) conference, Altman said widespread upheaval in white collar work is yet to materialize.

"I don't think we're going to have the kind ​of jobs apocalypse that some of the companies in our space advocate or talk about,” Altman said.

AI will still cause upheaval

Mixed messaging over the impact of AI on global labor markets has become another point of contention in recent months. While debates among industry leaders rage, research does point to disruption.

In January this year, Forrester projected that roughly 10.4 million jobs could be eliminated due to AI by 2030 as enterprises ramp up automation of roles.

Speaking at the time, Forrester VP principal analyst JP Gownder noted the scale of cuts could eclipse the number of jobs lost during the Great Recession of 2008, which saw around 8.7 million people out of work.

What has become clear is that AI will fundamentally reshape roles and responsibilities for individual workers in years to come.

As ITPro reported in December last year, Gartner expects AI to prompt a mass wave of upskilling and reskilling as enterprises look to equip workers with new skills to compensate for the use of the technology.

Indeed, the consultancy projects that from 2028 onwards, roughly 32 million jobs a year will be “reconfigured, redesigned, or fused”.

Helen Poitevin, distinguished VP analyst at Gartner, told ITPro that this will create a degree of upheaval, but nothing akin to a jobs apocalypse.

Gartner estimates that around 150,000 people will need to be upskilled each day and “supported in new ways of working” due to the technology.

FOLLOW US ON SOCIAL MEDIA

Network Rail is fighting off millions of cyber attacks every month, according to new research, as experts warn of a rising tide of threats facing public services.

Freedom of information (FoI) requests show the organization blocked over 7.1 million malicious emails between December 2025 and March this year.

Of the 7,129,314 email attacks blocked by Network Rail, 331,352 were phishing emails, 1,412 were malware-laden emails, 2,066,392 were spam emails, and 4,730,158 were edge blocked emails.

This all adds up to an average of more than 800,000 attacks per day, including around 37,000 phishing attempts.

“With so many people in the UK depending on public transport for their daily lives, a successful cyber attack could cause significant disruption, such as potentially stopping people from getting to work," warned Simon Edwards, CEO of SE Labs.

"Therefore, it’s vital that our public sector organizations have a dedicated cyber strategy put in place and ensure rigorous testing to identify any security holes and keep hackers at bay.”

Just last week, two members of the hacking group known as Scattered Spider pleaded guilty over their involvement in an attack on Transport for London (TfL) systems.

The attack forced all 28,000 employees to attend a TfL office for a password reset and led to a reported £29 million in losses and recovery costs.

"As we've seen from the recent Scattered Spider convictions, hacking groups have the transport network firmly in their sights. A single successful cyber attack on the rail network could drive Britain to a halt, operationally and economically," said Graeme Stewart, head of public sector at Check Point.

"The transport network is also a treasure trove of personal and financial data, something unscrupulous criminals are eager to get their hands on. That’s why it's vital that our roads, rail and aviation systems are fully protected with the latest cyber defenses to keep hackers locked out."

What happened with the Network Rail cyber attack?

In 2024, Network Rail suffered a cyber attack on its WiFi systems that saw commuters who logged in at affected stations receive information pertaining to terrorist attacks in Europe, as well as a message stating “we love you Europe”.

The attack is believed to have taken place through a third-party service provider, Telent, which managed Network Rail's WiFi services.

More recently, train operator LNER said a cyber attack had led to unauthorized access to files managed by an unnamed third-party supplier.

Travel networks, particularly rail services, are among the top targets for cyber criminals and state-sponsored groups due to the critical role they play in the British economy, according to research conducted last year.

The UK's Department for Science, Innovation and Technology (DSIT) released a report from KPMG that concluded a major attack on the rail network could cost £1.8 billion for a one-week period of disruption.

The direct financial cost to Network Rail would, it concluded, cost around £123 million, with the cost to passengers due to delays adding up to about £281.3 million.

Notably, the impact on Gross Value Added (GVA) could be as much as £1.397 billion, representing approximately 2.8% of the UK’s weekly GDP and 0.05% of annual GDP.

FOLLOW US ON SOCIAL MEDIA

Three-quarters of utility firms are struggling to forecast energy demands due to rapid data center infrastructure expansion.

A new study from Capgemini Research Institute suggests that eight-in-ten utilities predict more extreme and volatile demand patterns. A key factor here is that consumption patterns from AI are less stable and more difficult to model.

The biggest problem is uncertainty, the study noted, with utilities increasingly forced to plan for demand that may never materialize.

Two-thirds of electricity executives refer to “phantom” data center load requests - with 19% of these never materializing.

This forecasting uncertainty creates real problems with capital allocation, Capgemini warned, with utilities having to decide not only how much capacity to invest in, but where and when to prioritize grid modernization investments to support future demand.

Hyperscalers are feeling the pinch

Things are just as bad for hyperscalers, which need to make major infrastructure decisions against a backdrop of uncertain demand forecasts, grid availability, and connection timelines.

The problem is made all the harder by the geographic concentration of data centers, which places significant strain on local grids.

More than half of electricity executives are finding that load concentration is a major obstacle to reliable service, while large clusters of high-density facilities are creating localized bottlenecks that affect system stability and investment planning.

“AI is transforming electricity systems far beyond demand growth. It is exposing structural constraints in grid capacity, planning, and power availability, while making demand more dynamic and harder to predict,” said Claire Gauthier, global head of energy & utilities at Capgemini.

“The challenge is no longer only how much power is needed, but whether it can be delivered reliably, where and when it is required. Utilities have a defining role to play as system orchestrators, leveraging AI-enabled insights to balance grid and customer-owned resources, accelerate deliverable capacity, and enable the next phase of data-center growth.”

What’s driving energy consumption?

The projected increase in electricity consumption is largely down to AI training and inferencing, according to Capgemini.

Training and inference processes currently account for around 25% of data center energy consumption, yet this is projected to reach 60% within the next three to five years.

The consultancy noted that this not only places significant strain on data center infrastructure, but also leaves other IT workloads on the sidelines as enterprises prioritize AI-related activities.

Data centers are increasingly shifting from backup-only approaches toward primary behind-the-meter (BTM) and near-site solutions. Nearly three-in-ten say they already deploy on-site power solutions and 39% plan to add on-site/BTM within the next couple of years.

Operating independently

Looking ahead, the majority (86%) of respondents see the ability to operate independently from the grid as a competitive advantage.

Around three-quarters of utilities and data center executives told researchers they were looking to try and establish a diversified energy mix to ensure reliability and long-term resilience.

Part of this lies in the fact that renewable energy alone cannot provide enough continuous power at scale for large data centers and AI workloads.

Battery energy storage systems (BESS) are emerging as a possible solution, with nuclear Small Modular Reactors (SMRs) expected to take time to deploy.

More than two-thirds of electricity and data center executives globally are looking to natural gas as a near‑term, transitional solution until renewable energy and storage technologies can scale.

"For both energy providers and data-center operators, the key challenge is no longer only scaling capacity, but doing so under uncertainty, speed constraints, and rising system complexity,” said Gauthier.

“Success will depend on the ability to align infrastructure investment, energy sourcing, and AI-enabled operations to manage both the scale and volatility of demand, while balancing reliability, cost, and sustainability.”

FOLLOW US ON SOCIAL MEDIA