Cisco Talos has uncovered a new Russian-speaking threat actor aggressively targeting victims across the United States and Europe.

Tracked as UAT-11795, the group has been active since June last year, and uses trojanized installers for legitimate software such as MobaXterm, WebEx, Zoom, DBeaver, and FaceIT to steal credentials and cryptocurrency.

A staple of the threat actor’s activities lies in deployment of two previously undocumented tools: Starland RAT and WLDR agent. The first of these is a Python-based remote access tool, while WLDR agent is a PowerShell-based C2 memory implant.

WLDR agent runs entirely in-memory, and features encrypted beaconing, task queuing, and a Runspace execution engine for executing additional payloads.

Both are built to steal credentials, browser data, and cryptocurrency wallet assets while keeping persistent access to victim machines. The group even hides a fallback command-and-control channel in a Polygon smart contract, Cisco Talos said.

UAT-11795 targets victims' credentials and cryptocurrency wallet assets, establishing a persistent connection to the victims' machines from the C2 server, with the potential to deliver and execute further payloads.

How UAT-11795 operates

Most infections have been spotted in the US, according to Cisco Talos, although Germany, Romania, and Venezuela have also been hit.

UAT-11795 gains initial access to the victim machine through a ClickFix social engineering technique that entices the user to execute a command, which then stealthily downloads and executes a remotely hosted weaponized HTA file.

This runs an embedded VBScript that drops a Windows batch file into the user profile’s application temporary folder, containing instructions to first download and implant a trojanized installer from the attacker-controlled staging domain onto the victim machine.

Muhammad Yahya Patel, CISO and cybersecurity advisor at Huntress, said the campaign is the latest in a string of attacks by hackers using “the very tools our remote and hybrid workers rely on”.

"By hiding the Starland RAT inside trusted software and likely utilising deceptive ClickFix social engineering tactics, these threat actors are completely bypassing traditional perimeter defenses to exploit human psychology rather than software vulnerabilities."

Talos’ research also uncovered a private live Telegram channel called “stuk komanda”, controlled by the same threat actor, created last June, and with three unknown subscribers.

Exercise caution when using video conferencing tools

Gabrielle Hempel, security operations strategist at Exabeam, said while the campaign specifically targets popular video conferencing software, one needn't avoid using Zoom or WebEx.

They should, however, exercise caution. This includes making efforts to verify where software comes from, monitor for unexpected processes and persistence mechanisms.

Elsewhere, Hempel said users shouldn't assume that 'signed installer' means a program is safe.

"This story is so interesting, not because of the trojans, but because of the way it shifts how we need to think about vulnerability management," she said.

"We often measure a program’s security maturity by patch SLAs, but we’re seeing so many successful intrusions starting with users executing software they believe is legitimate and not just unpatched systems. If your security program can’t answer 'where did this binary come from?' as quickly as it can answer 'is this CVE patched?' then you are behind on your threat model."

FOLLOW US ON SOCIAL MEDIA

Microsoft has confirmed it blocked a recent Windows 11 update for select Dell PCs due to compatibility and performance issues.

The Patch Tuesday update (KB5101650) began rolling out on 14 July and included several quality improvements for users.

Microsoft halted the update after revealing a “number of Dell devices” began displaying a yellow exclamation point next to the Intel Innovation Platform Framework Processor Participant driver in Device Manager.

In a health status update, Microsoft said the issue meant users working with Intel devices could “potentially experience unexpected shutdowns, poor performance, increased heat, and battery drain”.

The issue affects Windows 11 versions 25H2 and 24H2, according to Microsoft.

What caused the pause?

The source of the issue is related to an “incompatibility between the Intel driver and the new Windows USB-C Connection Manager interface”.

The issue was first flagged in the wake of a preview update rolled out in late June (KB5095093). These previews are rolled out to enable IT administrators to familiarize themselves with upcoming patches.

Microsoft said it is working closely with Dell to “prevent the affected models from experiencing the issue”. A spokesperson for Dell echoed the tech giant’s comments on a fix.

“We are aware of an issue impacting a limited number of Windows devices with the Windows 11, version 25H2 and 24H2 (KB5101650) update,” the spokesperson said.

“Microsoft has temporarily paused the update for those devices and published guidance for impacted users, and we are working closely with them to support a resolution.”

ITPro asked Dell to confirm which specific devices were affected by the update, but the spokesperson did not reveal any further details.

An exact timeline on when users can expect a fix is also yet to be revealed by both companies, although Microsoft said it plans to release a resolution “in the next few days”.

FOLLOW US ON SOCIAL MEDIA

Google DeepMind CEO Demis Hassabis says only the United States is up to the task of keeping AI safe – but it's unclear why technology rivals, notably China, would heed an American standards body.

Hassabis has called for a framework for testing frontier models, on the grounds that he believes progress has been faster than expected and artificial general intelligence (AGI) will arrive imminently.

He argues that such work should be led by the US because of its technical and economic standing.

"This US-initiated effort would provide a strong starting point for creating shared international standards on Frontier AI," Hassabis noted in a social media post.

"Since this technology is going to affect the entire planet, ideally this framework would spur the international community to reach a consensus on how to manage the most serious risks while ensuring everyone has access to and can benefit from the opportunities that AI brings."

Hassabis' call for a US-led framework for managing AI follows similar calls by Anthropic CEO Dario Amodei and OpenAI CEO Sam Altman. Following a meeting on the subject last month, China called for a global AI organization open to all countries, rather than one led by the US.

The US has pushed for AI developers to submit models a month before release for testing, while the UK has its own testing regime via its AI Security Institute; Hassabis is British, and DeepMind was founded in London before being acquired by Google.

It's unclear why international AI companies would submit to US approval. The only motivation given by Hassabis is that frontier models would be required to pass this standards body's assessment in order to be deployed in the US.

Hassabis’ comments come after Anthropic’s Mythos and Fable models were hit with a temporary export ban by the White House amidst security concerns.

How would it work

Beyond being US-managed, Hassabis described a standards body that was federally overseen, such as a public-private partnership or self-regulatory organization, pointing to the Financial Industry Regulatory Authority (FINRA).

"The Standards Body would be responsible for developing assessment protocols and working with appropriate federal agencies and the US National Labs to conduct testing in areas relevant to national security," he said.

Anyone making a "frontier model" – as defined by a set of benchmarks – would be considered a "frontier lab", and be "encouraged" to adopt certain best practices.

This would include publishing technical details, ensuring internal security is up to standard, vetting key personnel, and adequate resourcing safety research.

Non-frontier models, such as those made by startups or academia, would not be expected to take part.

Hassabis also called for frontier labs to share new modes with the standards body 30 days before release, something the US government has pushed key developers to do with their AI models.

"Once the assessment protocol is shown to be effective and robust, formalisation could quickly follow, meaning that Frontier Models would be required to pass it to be deployed in the US market," Hassabis said. "Labs would also work with the Standards Body to address any critical post-release vulnerabilities."

Assessments conducted by the standards body would evaluate security, biological, and other threats, and check how well they withstood attempts to dodge guardrails. The tests would be regularly updated.

"The strength of this approach is it would be technically focused, while at the same time supporting innovation and incentivising responsible behaviour," he said.

FOLLOW US ON SOCIAL MEDIA

Delinea has cut the ribbon on a new global partner program designed to improve partner profitability and simplify engagement with the identity security vendor.

The Delinea Partner Advantage Program introduces a range of new incentives and operational changes, including protected discounts, published deal registration rules, AI-powered training, and streamlined quote-to-cash processes.

Developed following partner feedback gathered through a global listening survey, the initiative aims to address ongoing channel concerns around margin erosion, channel conflict, and unclear rules of engagement, while providing partners with a more structured framework geared towards long-term growth.

In an announcement, Scott Goree, Delinea’s senior vice president of channel and alliances, said the company has avoided unnecessary complexity and focused on combating the practical challenges faced by partners.

“Partners don’t care about your partner program,” he commented. “They care about technology that works, protected discounts, and a vendor that’s easy to work with. We built this program around what partners told us they actually need.”

Inside the Partner Advantage Program

California-headquartered Delinea’s identity security platform governs access for human users, machines, and AI agents across on-premises and cloud environments, continuously working to discover identities, analyze risks, and apply least privilege access controls.

The firm said its new channel program has been built around three pillars – Protect, Align, and Scale – and includes codified rules of engagement, AI-driven enablement, and greater channel autonomy to help partners drive growth through the platform.

According to the vendor, partners will benefit from published deal registration policies, teaming protections, and earned incumbency discounts designed to reward them for maintaining and expanding customer relationships.

The program also includes AI-powered training and certifications alongside a new partner portal that offers guidance throughout the sales cycle.

Elsewhere, Delinea is also providing simplified tools and automation to help reduce administrative complexity across the quote-to-cash process, allowing partners to spend more time on customer engagement.

AI adoption fuels channel opportunity

The launch of the Delinea Partner Advantage Program comes as organizations continue to adapt to identity security challenges driven by the increasing presence of AI technologies.

According to the vendor’s 2026 Identity Security Report, 92% of surveyed organizations said they expect AI to amplify identity-related threats in the coming years, while 42% said that AI expansion has already increased their non-human identity risk in the past 12 months.

Delinea said its new program will help partners tap into this growth opportunity and benefit from a new revenue stream backed by its identity security platform.

Commenting on the launch, Mark Thornberry, senior vice president of partnerships at GuidePoint Security, a Delinea partner, said the vendor’s new initiative “reflects a strong commitment” to building successful, long-term channel collaboration.

“The program provides a clear framework that supports how we work together in the market, while recognizing the value partners bring through the customer relationships we cultivate and support," he said.

Enrolment for the Partner Advantage Program is now open for selling partners, with roles for MSPs, GSIs, advisory, and technology partners to follow.

FOLLOW US ON SOCIAL MEDIA

Airbus has picked European cloud and AI firm Scaleway as its sovereign cloud provider, and plans to transfer dozens of critical applications to its cloud platform over the next two years.

The contract covers workloads requiring strong governance, resilience, and legal protection, according to the aerospace company.

These include business-critical applications across aircraft design, engineering, manufacturing, and enterprise operations.

In keeping these core systems within a European cloud environment, Airbus aims to strengthen the protection of its intellectual property and industrial data while ensuring the continuity required across its global aerospace operations.

Why Airbus chose Scaleway

The deal follows a competitive tender, with several other suppliers in the ring. They were evaluated on the basis of technical capabilities, including advanced cloud services, interoperability and scalability and AI capabilities.

Airbus also took into consideration factors such as security, resilience, service continuity, and seamless integration within its existing multi-cloud ecosystem.

The firm specifically sought legal and governance safeguards, including European jurisdiction, data protection, and protection against non-European extraterritorial legislation.

“Artificial intelligence is redefining how the world's most advanced industries design, manufacture and operate," said Damien Lucas, Scaleway CEO.

"Unlocking its full potential requires digital infrastructure that combines world-class performance with trust, openness and long-term control."

A “significant milestone” for Airbus

Scaleway will provide a sovereign cloud platform that will be fully integrated into Airbus' existing technology ecosystem.

The company said this is designed specifically to evolve alongside the company's engineering and enterprise environments, while keeping operational control and flexibility.

"This collaboration marks a significant milestone in our broader commitment to European digital sovereignty," said Catherine Jestin, executive vice president digital, at Airbus.

"By integrating a trusted, high-performance cloud environment that keeps our critical data assets shielded from foreign extraterritorial laws, we are ensuring that our digital infrastructure keeps pace with our aerospace innovation, while maintaining control and resilience of our industrial operations."

Digital sovereignty in the spotlight

The deal has been a couple of years in the making, and marks a move away from AWS as Airbus, like many organizations, sharpens their focus on digital sovereignty.

Earlier this year, the firm announced plans to deploy Mistral's AI technology across military programs and certified aviation systems.

Research published last month by Civo found that two-thirds of UK businesses were considering ditching US cloud providers, with three-quarters saying digital sovereignty was a strategic priority.

Hyperscalers have accelerated efforts to comply with growing sovereignty requirements. AWS, for example, launched its own European Sovereign Cloud which it claims provides users with a fully independent setup located entirely within the EU.

Microsoft and Google Cloud have also made similar moves over the last 18 months.

European firms are still concerned about the US Cloud Act, however, which allows the US government to request data held in overseas data centers that are owned by US firms.

Earlier this year, the European Commission announced that it had selected Scaleway, along with Post Telecom, StackIT, Proximus, and Mistral for an €180 million contract to enhance European data sovereignty.

"This project proves there are robust alternatives in Europe, able to answer the highest standards," said Octave Klaba, CEO of OVHcloud, one of Scaleway's partners.

FOLLOW US ON SOCIAL MEDIA

Living off the land (LOTL) attacks are a worst-case scenario for enterprises globally, with hackers lurking in networks, extracting sensitive data, and biding their time before wreaking havoc.

These attacks rely on weaponizing the legitimate software and tools used by enterprises, and they're by no means a new trend.

Research from Bitdefender, for example, found 84% of major cyber attacks leverage these techniques, and security teams globally have developed an array of detection capabilities aimed at combatting the threat.

But the dangers posed by these methods could escalate with the arrival of AI agents, according to Zeki Turedi, CrowdStrike's Field CTO for Europe. Speaking to ITPro, Turedi said the deep access given to agents across enterprise IT estates represents a huge threat if even just one were to be compromised or manipulated.

“Organizations are giving them [agents] full access. They're giving them full capabilities. They will have the full privilege of the human user,” he told ITPro.

Turedi pointed to previous LOTL techniques that involved compromising tools like PowerShell. While this gave users access to valuable data, the risk with agents is drastically higher given how they operate, and, crucially, where they can go within networks.

“They also have further reach across an enterprise,” he said. There’s only so much PowerShell can touch or manipulate or modify, but an agent theoretically can touch every single part of that organization's technology ecosystem and architecture.”

“This is where it makes it so much more dangerous.”

Living off the land attacks are evolving

Findings from CrowdStrike’s 2026 Global Threat Report show these risks aren’t just theoretical, they’re now a reality, and the same logic with traditional LOTL attacks is being applied to agents.

Indeed, the cybersecurity firm has observed threat actors exploiting legitimate AI tools at dozens of organizations globally. In these cases, AI systems such as chatbots and assistant were abused to generate malicious commands and steal sensitive data.

The goal here is often focused on credential theft for initial access brokers, attacks later down the line, and even cryptocurrency theft. All typical hallmarks of financially motivated cyber criminals.

LOTL attacks have also become a go-to method for highly sophisticated, state-sponsored threat actors. As ITPro reported last year, the infamous Salt Typhoon threat group laid low in compromised US National Guard networks for nearly a year, accessing sensitive military and law enforcement data.

It’s here where risks are even higher as government departments and public sector organizations begin exploring the use of agents. A recent study from McKinsey, for example, found agentic AI is emerging as a key focus area for public sector organizations in the US.

Keeping up with hype cycles

Turedi told ITPro the focus on agents isn’t surprising given that threat actors will “follow the technology landscape that their victims are looking to invest in”.

“We've seen this time and time again. So previously, we saw as cloud got adopted, funnily enough, adversaries became very capable in cloud,” he noted.

“When organizations started to be more focused and store sensitive data in SaaS applications, SaaS tools, guess what? We saw adversaries go after the SaaS applications.”

Turedi added that the pace of change within the generative and agentic AI space, combined with rapid adoption efforts, could create additional challenges moving forward.

Enterprises across a range of industries are diving headlong into the hype cycle, and threat actors are keen to capitalize on the confusion and lack of risk awareness with the technology.

“This is just a brand new technology landscape that organisations are investing in,” he commented. “And of course, the adversary is very, very aware that for multiple reasons this is a great opportunity.”

“There’s a lot of confusion,” Turedi added. “There’s a lot of lack of knowledge and expertise in this space.”

An identity conundrum

According to Turedi, a key concern surrounding ‘living of the AI land’ attacks, as CrowdStrike dubs them, is that many organizations lack the visibility or governance capabilities to adequately monitor what’s going on with these bots.

This has become a recurring talking point since the advent of agents. Research from Ping Identity in March this year specifically highlighted IT architecture visibility as a key concern for enterprises rolling out agents.

The sheer volume of agents is jarring for security teams, the study noted, but things are exacerbated by sub-agents, essentially creating chains of untraceable bots – an ideal target for stealthy threat actors.

Identity is another area of concern, Turedi noted, albeit one within a broader range of overlapping considerations for security teams. He noted that efforts to improve processes on this front are falling flat.

Many organizations are working with infrastructure or tools that were struggling to manage human identities in the first place. Adding agents into the mix further compounds the problem.

“The problem we see is that a lot of organizations are only starting to think about things like identity security or IAM (identity and access management) hygiene,” he said. “These are typically infrastructures and architectures that were not designed for modern human identity usage, never mind for the AI identity usage.”

With living off the land attacks, the whole advantage for the attacker is that they’re blending into IT environments. They’re using your tools and software and thrive on the confusion. With agents, Turedi said this adds further complexity in terms of identifying what actions are legitimate and potentially nefarious.

“It's actually quite difficult to figure out if it's AI usage on an identity layer,” he said. “Can you truly say that that's a human accessing the network versus that's an AI agent accessing the network on behalf of a human?”

A recent survey from the Cloud Security Alliance (CSA) raised similar concerns with regard to agent identity. More than two-thirds (68%) of respondents said they couldn’t accurately identify agent activity compared to human activity.

Turedi said it’s crucial to have “data from multiple different domains” when it comes to monitoring agent activity, taking into account applications, endpoints, and broader network traffic and “marrying them together” for a clearer picture.

“You need to be looking at the identity layer, you need to be looking at the endpoint, you need to be looking at the application layer,” he said.

FOLLOW US ON SOCIAL MEDIA

Anthropic’s Claude AI tool will be able fill in passwords through a new 1Password browser integration that gives it access to stored credentials, the two companies have announced.

1Password's new 1Password for Claude service is a framework that allows agents to use stored credentials hosted in 1Password vaults without them ever reaching the model.

Access is granted per session, and scoped to a specific set of approved items so that authorization doesn’t carry over to other sessions.

According to 1Password, this means users can now authorize Claude to complete real-world tasks like booking travel and managing accounts securely, with credentials injected directly to the target system on their behalf.

"We need a new security model that is purpose-built for agents, not just humans. The answer isn't handing agents your secrets. It is to let a user give an agent permission to use a credential without letting the agent see it,” said Nancy Wang, CTO of 1Password.

"Claude knows it used your login; it does not need the password or one-time code in its context. That distinction is where trust in agents starts and the foundation we're building with Anthropic."

How 1Password’s ‘zero-exposure’ framework will work

1Password's zero-exposure security framework allows per-task, user-approved access, with Claude requesting the credentials required for each task from 1Password.

Users can approve or deny access with a single biometric prompt, eliminating standing access or persistent sessions.

Credentials are injected through a secure channel managed by 1Password, outside the agent's view, with the password and the MFA one-time code never accessible to the model or Anthropic's systems.

The moment an AI agent takes control of the browser, 1Password locks down automatically, limiting access to only the credentials explicitly granted for the current task. Nothing else in the 1Password vault is reachable.

1Password brokers credential access across multiple sites within a single task, so Claude can complete multi-step workflows without prompting the user for credentials at each step.

Elsewhere, continuous field analysis will see 1Password scan the page after every autofill to ensure no secrets remain exposed: if a form submission fails, it wipes any filled values before returning control to the agent.

New ‘agentic mode’ coming to 1Password

Alongside the Claude integration, 1Password is also introducing Agentic Mode for all users.

When a compatible AI agent takes control of the browser, 1Password locks down, so that the only credentials the agent can reach are those the user has explicitly granted for the current task.

It activates automatically and runs quietly in the background, and users have the option to cancel it at any time.

1Password for Claude is now available to 1Password users on Mac, across business, family, and individual plans.

FOLLOW US ON SOCIAL MEDIA

Microsoft’s Entra ID platform will now operate solely with passkeys as it looks to shift away from SMS and voice-based authentication practices.

The changes to the identity management platform, set to come into effect on 1 September 2026, will see passkeys established as the “default authentication experience” for users.

Microsoft urged customers to move to passkeys or alternative phishing-resistant methods before the changeover.

“As the rollout reaches each organization, users enabled for SMS or voice authentication will automatically be enabled for passkeys, and the next time they perform multi-factor authentication, they’ll be prompted to register a passkey,” the company explained in a blog post.

There is a grace period, however, with voice and SMS-based authentication still being possible until 1 February 2027. After that deadline, Microsoft will retire telecom delivery for both authentication methods and no longer offer SMS and voice as a “native Microsoft Entra capability.”

For those organizations that still require SMS or voice-based authentication, there is the option to do so via the Microsoft Security Store, where administrators can find approved telecom partners to facilitate this need.

This may incur additional costs, however, with Microsoft warning: "Customers will be responsible for any associated telecom-related costs charged by the telecom partners."

Why is Microsoft moving to passkeys?

According to Microsoft, the shift to passkeys is in response to growing concerns over credential theft, phishing, and social engineering attacks.

AI, the company added, has also prompted a rethink of identity security and a move away from “phishable methods” such as voice and SMS-based authentication.

“Authentication methods that use SMS or voice rely on shared secrets or channels that attackers increasingly intercept, phish, or manipulate,” Microsoft explained.

“The case for moving beyond SMS and voice is no longer just that attackers intercept or socially engineer these methods. The threat environment has changed in speed, scale, and sophistication.”

Microsoft said its Threat Intelligence division has observed a marked rise in AI-enabled phishing campaigns in recent months, with these methods reaching click-through rates as high as 54%.

That’s a stark contrast compared to the 12% click-through rates typically observed in traditional campaigns, highlighting the potency of this new wave of attacks.

Other tactics employed by threat actors, such as SIM swapping and MFA bypass techniques, have also become “more accessible and repeatable”, Microsoft noted.

As ITPro reported earlier this year, AI-generated phishing campaigns have become a recurring concern for cybersecurity leaders.

Research from Kaseya suggested that AI phishing “became the baseline” for threat actors in 2025: 83% of phishing emails used AI in some capacity, while 40% of business email compromise (BEC) attacks also fared similarly.

Why passkeys?

Passkeys are touted as a more reliable and secure method of authentication, as they tie credentials to a specific device, such as a smartphone or laptop. This removes the need for interceptable codes.

Indeed, Microsoft noted that because they use public-key cryptography rather than “shared secrets”, this makes them phishing-resistant by design.

“They also provide a faster, simpler sign-in experience for users,” the company noted.

Microsoft isn’t alone in advising the shift to passkeys. Earlier this year, the UK’s National Cyber Security Centre (NCSC) urged enterprises and consumers alike to adopt passkeys to provide “stronger resilience” and ease-of-use.

“We strongly advise all organizations to implement passkeys wherever possible to enhance security, provide users with faster, frictionless logins and to save significant costs on SMS authentication," NCSC CTO Ollie Whitehouse said at the time.

FOLLOW US ON SOCIAL MEDIA

EU cloud trade body CISPE has taken another shot at Broadcom, but this time has the backing of other industry groups.

CIPSE (Cloud Infrastructure Services Providers in Europe) has been calling for action against changes to Broadcom's pricing structures for VMware after its 2023 acquisition.

Last year the group filed a lawsuit against the European Commission (EC) for allowing the acquisition to proceed, and in March it called for EU regulators to stop Broadcom from ending the European version of its VMware Cloud Service Provider program.

At the time, CISPE claimed the system would limit sales of VMware products to a "tiny minority of hand selected partners" and exclude most European cloud providers from being able to sell VMware products.

The latest battle with Broadcom will see CISPE joined in its demand for measures by four other cloud groups: Belgium's Beltug, France's Cigref, Germany's Voice, and the Netherland's CIO Platform Dederland.

In a joint letter seen by Reuters, the consortium urged regulators to “act swiftly and impose interim measures now," and called for the VMware Cloud Service Provider program to continue for at least three years while the existing EU investigation into Broadcom continues.

Broadcom is yet to respond to ITPro's request for comment, but a spokesperson told Reuters the company disagreed with the allegations, which didn't reflect the realities of the cloud market.

The company added that CISPE is funded by hyperscalers rather than smaller cloud service providers.

"We continue to be committed to investing significantly in our European VMware Cloud Service Provider partners (VCSPs) helping them ⁠offer ​alternatives to the hyperscalers and meet the ​evolving needs of European businesses and organisations," the spokesperson said.

Broadcom vs CISPE: A timeline

Broadcom discussed plans to buy VMware back in 2022 for $61 billion, but immediate regulatory scrutiny quickly sparked suggestions that the deal was set to collapse. In the end, the EC approved the acquisition, and saw clearance from merger authorities elsewhere.

In the wake of the deal’s closure, Broadcom sought to reassure VMware customers and partners, promising investment, innovation and simplification of products.

However, that proved to be the calm before the storm, and changes to licensing and later the partnership program alarmed many. That disruption continued with further attempts by Broadcom to tweak the VMware ecosystem.

CISPE has been an outspoken critic of both the deal and the subsequent changes implemented by Broadcom. The trade group accused the firm of "holding the sector to ransom" with the license changes.

A report by its European Cloud Competition Organisation (ECCO) – set up by CISPE to monitor a settlement with Microsoft – claimed that VMware's new contracts were costing customers as much as 1,500% more than before the acquisition

CISPE has since taken the EC to court in an attempt to force the cancellation of the deal, specifically over the licensing rules.

The EU has repeatedly defended its approval of the dea;, but as ITPro reported in December 2025, CISPE suggested this amounted to a “blank cheque to raise prices”.

In March, CISPE was back with a further antitrust complaint related to Broadcom shutting down the VMware Cloud Service Provider program, saying businesses were "irreparably damaged."

Beyond legal challenges, the changes have sparked an exodus of customers, with 86% of those surveyed saying they were planning to reduce their dependency on VMware.

Broadcom has repeatedly denied the allegations, and pointed to the membership of CISPE being made up of hyperscalers.

FOLLOW US ON SOCIAL MEDIA

Google's Mandiant has warned that exposed serverless cloud functions can give attackers access to secrets and broader cloud environments, urging enterprises to implement new hardening measures.

Serverless deployments generally run custom-developed code that incorporates third-party packages, making them targets for a wide range of application-level attacks, including local and remote file inclusion (LFI/RFI) and command injection.

Mandiant said it’s observed an uptick in the number of public-facing serverless applications that lack authentication, often because of specific business requirements.

The rapid acceleration of generative AI adoption is a big factor here, the researchers noted, with AI workflows, including chatbot interactions, image generation, vibe coding, and multi-step AI agents relying on serverless functions to complete tasks for users.

Once they've managed to exploit an entry point, attackers typically attempt to escalate privileges or move laterally.

Common techniques include extracting secrets stored directly within the application code, reviewing application logic and sensitive data to identify further attack vectors within the environment, and exfiltrating service account bearer tokens from the metadata server via remote code execution (RCE).

"Leveraging these compromised secrets or service accounts allows threat actors to pivot to adjacent systems and workloads, potentially resulting in a total environment takeover if proper hardening strategies are not in place," said Mandiant security consultant Corné de Jong.

Shoring up defenses

The firm recommends a multi-pronged approach to harden security, including integration of security scanning, code reviews, and least-privilege identity and access management (IAM) capabilities within CI/CD pipelines before deployment.

When it comes to vibe coding, Mandiant recommends multi-layered security enforcement: isolating AI experimentation within dedicated sandbox environments and enforcing strict data egress controls to protect production systems and internal data.

Meanwhile, development environments should be restricted to approved IDEs with human-in-the-loop capabilities, using only verified plugins operating under least privilege to mitigate supply chain vulnerabilities.

Organizations will then need to ensure that all AI-generated software follows Secure Software Development Lifecycle (S-SDLC) controls, while establishing clear internal guidelines regarding permitted use cases.

Keep it in-house

As for runtime controls, Mandiant said that public-facing Cloud Run services should be hosted in a dedicated, isolated Google Cloud project to make sure attackers aren't simply given immediate access to critical internal resources.

Organizations should also restrict ingress traffic for serverless functions to internal only, and use an external Layer 7 ALB to manage internet exposure.

Here, it recommended Cloud Armor, which it said provides Web Application Firewall (WAF) protections that can be integrated with the Load Balancer to filter malicious traffic.

One aspect of a broader architecture

Notably, de Jong warned that hardening Cloud Run services is “only one part of a secure architecture” and a weak link elsewhere in the chain could result in disaster.

“Because these services often connect to other Google Cloud resources, a single compromise can expose additional services. Implementing defense-in-depth is critical,” he said.

“Specifically, when using direct VPC egress or VPC Access connectors, use VPC Service Controls to restrict lateral movement and exfiltration through granular access policies."

While serverless functions are designed to make cloud development faster and more flexible, threat actors are starting to find them as just as convenient, according to Nick Tausek, lead security automation architect at Swimlane.

"An alert tied to one function may suddenly become an identity issue or a lateral movement problem. Manual handoffs slow everything down at exactly the wrong moment. Security operations need to preserve context and adapt response actions as new risks emerge," he said.

"Integration of agentic AI into security platforms can support that process by connecting signals across tools, carrying investigative context forward and helping security teams determine the next appropriate action as an incident evolves.”

FOLLOW US ON SOCIAL MEDIA

Channel partners are increasingly adapting infrastructure strategies to help customers navigate hardware pricing volatility and component shortages, according to new research from Westcon-Comstor.

The distributor found that 87% of channel partners have already taken action to reduce the impact of supply constraints on customer projects, with project delays identified as the single biggest risk created by ongoing pricing pressure and hardware availability issues.

The findings are based on a survey of more than 100 members of Westcon-Comstor’s global Tech Xpert community, comprising technical specialists and decision-makers from resellers, systems integrators, and managed service providers across EMEA and APAC.

According to the research, partners are responding to these challenges by improving infrastructure planning and adopting managed services, while some are even switching technology vendors.

“Hardware pricing volatility and supply constraints are reshaping customer buying decisions and having a profound impact on the IT channel,” commented Callum McGregor, chief operating officer and chief financial officer at Westcon-Comstor.

“In response, partners are helping customers plan earlier, adapt architectures and stay flexible so they can keep projects moving despite uncertainty.”

Adapting mitigation strategies

In terms of mitigation strategies, improved infrastructure capacity planning was found to be the most common, cited by 60% of respondents.

Meanwhile, almost a third (29%) said they had already switched vendors or platforms in response to hardware availability constraints.

Meanwhile, 27% of partners said they were using storage tiering or caching to reduce reliance on memory-intensive workloads, while a quarter (25%) reported moving workloads or infrastructure components to managed services.

Evolving buyer behavior

The research also highlighted a shift in buying behavior, with 75% of respondents reporting some form of change.

More than half (52%) said either they or their customers had accelerated hardware purchases to reduce the risk of future shortages or price increases – although almost a quarter (23%) reported delays or cancellations as organizations weighed up growing uncertainty.

The distributor revealed that hardware availability is also influencing infrastructure decision-making, with 45% of partners stating that supply chain constraints had accelerated cloud adoption among customers and 7% reporting a shift back to on-premises infrastructure.

A balancing act for partners

According to McGregor, the ability to balance immediate performance with long-term requirements is becoming “increasingly critical” in order for partners to maintain success in the current climate.

“It also demonstrates the strategic role that channel partners, supported by distribution, can play in building resilience and helping customers navigate the pressures that have quickly become a systemic feature of the market,” he added.

Elsewhere, Westcon-Comstor’s research found that 39% of partners identified technical challenges – including performance instability, operational complexity, and reduced resilience – as key risks linked to hardware shortages.

Around one-quarter (24%) also said supply constraints were limiting their ability to scale infrastructure capacity.

FOLLOW US ON SOCIAL MEDIA

The IBC event is back again for another year, with that, we’re pleased to announce that our IBC Best of Show Awards program is now open for entries.

The Amsterdam-based event, which runs from 11-14 September, is designed to recognize the most outstanding broadcast products and solutions. ITPro's Best of Show awards aim to showcase the best of the best. Entries are open now until the extended closing deadline of 23:59 CET on Friday, Aug 28. You can enter via the website here.

ITPro is joined by other key Future B2B sites - AV Technology, Installation TV Tech, TVBEurope, Radio World,, and Sound & Video Contractor - in hosting the awards program.

Nominations are reviewed by a panel of industry experts who consider the overall quality and relevance of a given product, its design and build quality, the business/operational benefits, and other key factors such as cost-effectiveness and innovation.

It's £525+VAT per entry but it really is worth entering to ensure your innovation gets the attention it deserves.

The benefits of entering are:

•  Fully-licensed nominee badges for all entries to use in both digital and print promotions.
• Dedicated editorial coverage across participating brands. Online, newsletter and social promotional activity for all winners from participating brands. 
• Winner marketing assets to further promote your success. You will receive an official award winner's badge, fully licensed to be used with your winning product both domestically and overseas at no additional cost in addition to a winner's social assets.
• Complimentary winner trophies to display your success. Winners will receive a trophy to display their success to IBC attendees.

So don't delay, make sure you enter today! Or certainly before the closing deadline of 23:59 CET on Friday, Aug 28.

AI isn't replacing cybersecurity roles but it is changing them, and not always for the better, according to new research.

A study from ISC2 found that 65% of cybersecurity professionals who use AI in their roles are spending time deciding when to trust or act on AI-generated recommendations.

Nearly two-thirds (63%) said they often find themselves reviewing and validating AI outputs. While this is basic best practice from a safety perspective, these processes are wasting valuable time.

Regardless, the influx of AI tools within the profession has been welcomed by practitioners, according to the study.

More than half (53%) believe the technology is creating new entry-level opportunities, while 48% said AI makes them feel more optimistic about their long-term career prospects.

“AI is not replacing cybersecurity professionals; it is changing what the profession requires of them,” said ISC2 CEO Scott Beale.

“As AI takes on more repetitive tasks, as well as performing some complex cybersecurity analysis at speed and scale, cybersecurity roles are shifting toward higher-value work, from asking the right questions to validating findings, interpreting outputs and applying human judgment."

Beale noted that the use of AI is changing “how work is distributed across security teams”, meaning investment in areas such as governance, skills development, and validation practices is “essential”.

Too much time fixing problems

While nearly half of cybersecurity professionals reported that AI has reduced workplace stress, 32% said it has made it worse. A key factor here lies in the aforementioned validation and reviewing practices, the study noted.

Those experiencing higher levels of stress were significantly more likely to spend longer periods deciding when to trust AI-generated outputs and recommendations.

When AI-recommended actions lead to incorrect outcomes – which nine out of ten said had happened – half of the participants said their organization holds human decision-makers ultimately accountable.

Put simply, poor AI-related outcomes have a direct impact on wellbeing for cybersecurity practitioners when it’s their neck on the line.

Confusion over accountability and ownership of AI also adds to stress, the study noted. Nearly a quarter (21%) of respondents said accountability of AI-related issues varies depending on the severity.

Over-reliance is a worry

Other top concerns cited by ISC2 included over-reliance on AI, a recurring worry not just for cyber professionals but workers across a range of industries.

As ITPro reported in May, a study from GoTo warned over-reliance on the technology could erode key skills. Similar concerns have been highlighted in software development, particularly among entry-level workers entering the workforce.

62% of respondents identified this as a key concern in the ISC2 study while 56% also highlighted worries about reduced human judgement capabilities when it comes to business-critical decisions.

Foundational cybersecurity skills remain essential, according to ISC2, especially with AI in the mix. Notably, nearly two-thirds (62%) said they don't believe the technology has reduced the need for these skills, compared with just 26% who say it has.

FOLLOW US ON SOCIAL MEDIA

A group of current and former Meta employees is suing the company, claiming that it used AI to target those on medical or family leave for layoffs.

In May, Meta announced it was cutting around 8,000 staff, representing roughly 10% of its workforce. According to the lawsuit, the tech giant used AI systems to identify those set for redundancy.

These systems allegedly took into account keystroke monitoring data, AI token usage

“Meta did not assemble the termination list through the considered judgment of managers who knew the work,” court filings state.

“Instead, Meta used a constellation of internal artificial intelligence systems — including a system referred to internally as ‘Metamate,’ employee-trained ‘second-brain’ agents, keystroke- and activity-monitoring data, AI-token-usage dashboards, and algorithmically assisted performance ranking and calibration — to score, rank and select employees for inclusion on the list.”

Complainants allege this put employees on protected medical or family leave, or those whose output was reduced by a disability, at a disadvantage by penalizing them with reduced performance scores.

"The result was that employees who took protected leaves were disproportionately selected for layoff, based on scoring that not only failed to account for their protected leaves, but in effect penalized the employees for exercising their legal rights to these leaves."

In one example, an employee was laid off while on approved pre-birth pregnancy leave – the day before her waters broke, and just two days before she gave birth.

In another, a manager’s own performance review noted that his demotion followed his return from medical leave; he was put on the list sixteen days into a second medical leave.

The 26 plaintiffs claim that Meta has violated state-protected leave laws, the Family and Medical Leave Act, the Pregnancy Discrimination Act, and the Americans with Disabilities Act.

They're calling for a preliminary court ruling that would stop Meta from finalizing the layoffs while they pursue their ​claims.

“Once these separations are final, the harms are irreversible: employer-subsidized health coverage lost during pregnancy, postpartum recovery, and active medical treatment; time-bound leave rights extinguished; unvested equity forfeited; and immigration consequences triggered,” they said.

Plaintiffs are also seeking financial compensation that could include reinstatement, back pay, lost equity, benefits, and other damages.

AI in HR is a delicate balancing act

The use of AI systems in HR and recruitment has been a long-running point of contention, particularly with regard to the potential for bias or discrimination.

Workday, for example, is facing a class-action lawsuit amidst claims its AI software discriminated against job applicants. As ITPro reported in June, the company hit back at the claims, with a spokesperson insisting its AI solutions “don’t make hiring decisions”.

Ilia Kolochenko, founder of cybersecurity company ImmuniWeb and a lawyer practising in cybersecurity and data protection, noted that over-regulation of the use of AI in HR could cause long-term harm.

"With the current trend to restrict or even entirely ban AI in HR decision-making processes, most organizations will either conceal the use of AI or shift back to non-AI systems especially in those jurisdictions that have no GDPR-like protection against automated decision-making on human subjects," he said.

"Compared to AI-powered HR systems, their non-AI homologues are quite primitive, fail to consider the relevant context and often provide incorrect metrics or data,” Kolochenko added.

“For instance, a poor performance of a delivery truck driver will not be correlated with extreme summer heat or winter snowfalls, sudden family loss or simply a technical issue with the vehicle. Eventually, innocent persons are wrongly punished.”

ITPro approached Meta for comment, but did not receive a response by time of publication.

FOLLOW US ON SOCIAL MEDIA

British companies have doubled spending on AI, but they need to also invest in the basics to ensure real results.

That's according to research from ServiceNow, which ranked the UK 51/100 in terms of overall AI maturity despite companies spending 102% more than they did in the year prior.

ServiceNow pinned that on a failure to invest in the foundations needed for AI, including data management and governance processes, and updating legacy systems.

According to a service by the company, 73% of UK executives said they were finding inadequate data accuracy, access, and management a major barrier to rolling out and using AI.

Just 20% of UK businesses had implemented testing, auditing, and risk assessment for AI, for example. Under one-fifth (17%) of businesses surveyed in the UK had also replaced legacy systems with integrated platforms.

"UK organizations are investing heavily in AI, which tells us the challenge is not ambition," said Damian Stirrett, Group Vice President and General Manager for UK and Ireland at ServiceNow.

"It is connecting that commitment to the operational infrastructure that makes AI work across the enterprise."

The ServiceNow results follow similar research from Cisco earlier this year that found nearly all companies are expanding privacy and governance work in response to AI adoption.

Not ready for AI

While two-thirds of UK companies polled had used agentic AI, just 6% did so to create autonomous workflows, highlighting a lack of maturity in AI roll-outs.

That was echoed by findings showing that 15% of UK organizations have streamlined or integrated workflows using AI, which ServiceNow said showed a gap between AI investment and operational readiness

"Too many businesses are bolting AI onto fragmented systems, disconnected assistants and workflows that have not yet been reimagined," said Stirrett. "The next phase is about moving from isolated pilots to trusted, end-to-end workflows that can deliver at scale."

ServiceNow said improvements will require getting the right data, governance, and workflow foundations in place to scale AI.

You can't spend your way out of trouble

Despite the challenges, UK spending is largely on par with that across EMEA, which saw AI budgets leap by 113% over the last year. By 2027, AI spend will make up 20% of IT budgets, ServiceNow predicted.

However, the company noted that organizations that are succeeding with AI aren't necessarily spending more, pointing to 21% that are seeing strong returns.

Instead, they have the "most mature governance", including data management and risk controls, and that's helping to deliver a 164% return on investment now. The company predicts this could climb to a 199% return on investment within two years.

Governance, the company argued, doesn't slow innovation but is "operating discipline" that enables it, in particular when it comes to scaling quickly and ensuring systems are trusted and auditable.

That echoes comments earlier this year from Tenable co-CEO Stephen Vintz, who said enterprises need to consider the "responsibility gap" with regard to AI governance.

Speaking at RSAC Conference 2026, Vintz pointed to the fact that 90% of organizations had adopted AI and half have already had a related cyber incident.

"There is a fundamental mismatch between the exponential speed of AI adoption and the linear speed of traditional corporate governance, and things will only move faster and things will only become more complex," he said at the time

FOLLOW US ON SOCIAL MEDIA

IBM shares plummeted by more than 25% on Tuesday after the tech giant posted underwhelming preliminary second-quarter results.

In a profit warning released ahead of the company’s expected earnings call on 22 July, CEO Arvind Krishna attributed sluggish performance to the ongoing memory crisis and AI-related cybersecurity concerns.

Revenue for the quarter ending June came in at $17.2 Billion, marking just a 1% year-over-year increase and well below expectations. Notably, infrastructure revenue dipped by 7% across the quarter.

In a statement detailing the results, Krishna suggested the company had “faltered” and been taken unaware by rapidly changing enterprise spending habits.

Put simply, customers have shifted their focus away from software spending toward infrastructure investments ahead of expected price increases.

AI infrastructure build-outs have sent hardware prices skyrocketing in recent months, with enterprises scrambling to secure servers, chips, and storage components.

“In the last few weeks of June, we saw clients shift their quarterly capex spend toward servers, storage, and memory purchases to secure supply-constrained infrastructure ahead of expected price increases,” he wrote.

“While we anticipated some supply chain-related impact in our expectations, we did not anticipate the magnitude of the capex reprioritization.”

Krishna’s warning spooked investors, sparking yet another sell-off in the software market. Shares at Microsoft, Salesforce, and ServiceNow all dipped in the wake of the announcement.

Software investors have been through the wringer so far in 2026, largely due to concerns about a looming ‘SaaSpocalypse’ due to recent advances in AI.

As ITPro reported in February, Anthropic sparked a mass sell-off after the release of its Claude Cowork tool, with investors worried the solution could render some software services obsolete.

Chris Beauchamp, chief market analyst at IG, described the results as an “ugly moment for IBM and software stocks”.

“The big question will be how long the shift to infrastructure and cybersecurity lasts,” he said. “A few more months might be bearable, but more than that and serious questions will be asked all over again about software stocks.”

IBM falling flat

IBM’s infrastructure earnings are a clear sign of the ongoing rush and changing priorities for enterprise customers.

Krishna noted that many customers were scrambling to get ahead of further price increases, which impacted its higher-margin mainframe and associated software offerings.

In April, IBM unveiled its new z17 mainframe, hailing it as the “first mainframe fully engineered for the AI age”. General availability for z17 landed in mid-June, and as ITPro recently reported, the firm also plans to roll out compact versions in August.

While the z17 launch was met with much fanfare, Krishna noted results were “worse than our expectations”.

“These conditions require our teams to execute perfectly, and this quarter we faltered,” Krishna wrote. “We did not adapt and move quickly enough, and numerous large deals failed to close on the timelines we expected, driving the majority of our shortfall.”

“These are not excuses, but they are realities. Our job is to help our clients through uncertainty, to find paths forward to grow their businesses no matter what is happening in the external environment.”

Silver linings for cybersecurity vendors

While hardware price issues dominated the enterprise focus, Krishna also noted clients were “distracted” by AI-related cybersecurity concerns in recent months.

The IBM chief said the launch of powerful new models such as Anthropic’s Claude Mythos, for example, has sparked widespread concerns among cybersecurity experts.

IBM has moved quickly to compensate for these changes, according to Krishna. The company recently launched a new security initiative, Project Lightwell, aimed at driving AI-powered software security supply chain improvements.

As with hardware-related concerns, rapid changes in the cybersecurity landscape have also prompted a rethink on spending, Krishna told CNBC.

“Mythos is making people pause to say, wait, how much do I need to spend on cyber? They’re pausing on new deals until they know,” Krishna commented.

These comments sparked a rally in cybersecurity stocks, with CrowdStrike, Zscaler, Palo Alto Networks, and Okta all recording significant boosts.

CrowdStrike, for example, surged 12% while Palo Alto Networks and Zscaler stocks rallied at around 7% respectively.

FOLLOW US ON SOCIAL MEDIA

European small and medium-sized businesses (SMBs) are bullish on generative AI, according to new research from SAS and IDC, and some are setting an example in how to nail adoption.

Analysis conducted by IDC on behalf of the data management firm shows SMBs across the region are executing AI deployments in a far more efficient manner to global counterparts.

In North America, for example, SMBs scored strongest in terms of planning and building, but many aren’t reaching full deployment.

This contrast suggests European organizations are making “stronger progress in operationalizing AI and embedding it into day-to-day operations”.

A key factor in European SMB successes lies in readiness, according to the report. IT leaders across the region are prioritizing areas such as governance before diving head long into adoption projects.

“Organizations treating governance as a foundation rather than an obstacle are often the ones best positioned to execute,” said John Carey, Senior Vice President of Global Channels at SAS.

“The findings suggest European SMBs are taking a more operational approach to AI adoption – focusing not just on experimentation, but on putting the right structures in place to scale AI effectively.”

Notably, Carey suggested that “stronger execution performance” among European SMBs may be due to regulatory considerations such as the EU AI Act.

Simply put, IT leaders at small businesses across the region are accelerating preparation to ensure compliance with the legislation.

It’s perhaps no surprise then that governance, risk, and compliance for AI has emerged as the top priority for SMB leaders, cited by 26%.

Progress on this front is easier said than done, however. The study noted that uncertainty is rife with regard to compliance, risk management, and security.

Nearly one-quarter (24%) identified this as their biggest execution barrier with AI adoption.

Still a long way to go

Despite positive signs for European SMBs, on a global scale the pace of AI adoption is still slow. SAS noted that many are “still struggling to move from experimentation to meaningful business impact”.

Nearly three-quarters (70%) of SMBs worldwide either remain in ‘experimental’ or ‘opportunistic’ stages of AI maturity, for example. Similarly, only 9% have fully embedded AI into daily operations or decision making.

Slow progress in AI maturity is, at least in part, due to traditional data-related problems such as silos and visibility. Nearly half (45%) of SMB leaders said their data remains “scattered across systems with no clear ownership”.

A similar number (46%) said AI tools are often still used in isolated environments across the business, preventing teams from aligning workflows.

Notably, 90% of those in experimental phases report having no formal AI strategy in place, which is impeding progress for IT leaders.

“To actually make something of their AI strategy, SMBs need to move from disconnected pilots to true alignments of their data, people, and resources,” said Daniel-Zoe Jimenez, VP of research at IDC.

“Experimenting with the technology is one thing. Deploying it strategically and sustainably is quite another.”

FOLLOW US ON SOCIAL MEDIA

Pure Data Centres Group has announced plans to invest more than €7.5 Billion to build a sprawling data center campus in Finland.

The deal represents one of the largest ever inward investment projects in Finnish history, and will see an initial pledge of €1.5 billion to develop a 110MW AI campus in Seinäjoki.

Long-term, Pure DC said the site will eventually scale to a 500MW campus capable of hosting high-performance computing (HPC) and AI workloads.

Phase one of the project is already fully leased, the company revealed, with the substation for the first data hall constructed and live.

Gary Wojtaszek, Executive Chairman & Interim CEO of Pure DC, said the project marks the beginning of one of Europe’s largest-ever AI infrastructure projects and will help put Finland at the forefront of the region’s AI transition.

“Countries building AI infrastructure over the next decade will shape the global economy for the next fifty years. Finland has all the ingredients required to lead this transformation - world class engineering talent, abundant renewable energy and a culture of innovation that gave rise to Nokia”, Wojtaszek said.

“We are not building data centers in Seinäjoki. Together with our partners, including the Seinäjoki Municipality, we are helping create one of Europe’s most important AI ecosystems capable of supporting global tech leaders as well as the next generation of Finnish entrepreneurs and innovators.”

Pure DC will work closely with local partner, SDC Ventures, as part of the development, which is expected to provide over 3,000 jobs during the decade-long construction projects.

Inside the Seinäjoki data center campus

Designated SJK01, the Seinäjoki campus is a sprawling 370 acre estate that, upon completion, will support 550MW of IT capacity. Pure DC said the data center site is designed specifically for “mass-scale” AI and machine learning workloads.

The site also has access to 700MVA of renewable power, meaning it will operate with “exceptionally low” energy costs and a stable grid connection.

Notably, the development will use repeatable 40MW ‘AI-ready’ modules, which come equipped with built-in Direct Liquid Cooling (DLC) capabilities to support high-density workloads.

The data halls located at the site are also based on a modular design aimed at streamlining efficiency and predictability. Jaakko Kiiskilä, Mayor of Seinäjoki Municipality, said waste heat from the data center will be repurposed to support the district’s heating network.

“It’s fantastic to see a British-headquartered firm thrive on the world stage by delivering the UK's largest inward investment into Finland, cementing our position as a world leader in the AI space,” said Peter Kyle, secretary of state for the UK’s Department of Business & Trade.

“Through our Modern Industrial Strategy, we're ensuring the UK remains a leader in AI, setting ourselves apart globally while making sure our trillion-dollar tech sector continues to thrive for decades to come.”

FOLLOW US ON SOCIAL MEDIA

Databricks has announced the appointment of Lee Stockwell as head of public sector for the UK and Ireland, as the data and AI specialist looks to accelerate adoption of AI and advanced analytics across government organizations.

Stockwell will lead the company’s public sector strategy across the region, working with government departments and public sector bodies to modernize data platforms, expand the use of advanced analytics, and scale AI to improve service delivery.

He brings more than 20 years’ experience across enterprise technology and the public sector, most recently serving as head of the National Security and Public Safety division at ServiceNow.

Prior to that, Stockwell spent more than eight years at the UK Home Office, where he led its Live Services and Shared Services division.

In an announcement, Databricks said the appointment highlights its continued investment in the region as public sector organizations increasingly look to AI to strengthen resilience, operational efficiency, and productivity.

“Lee’s experience at the intersection of technology and the public sector will be critical as we increase our support to meet the growing needs of organizations across the UK and Ireland,” explained Samuel Bonamigo, Databricks’ senior vice president and general manager for EMEA.

“Government agencies are under real pressure to deliver tangible outcomes from their data and AI investments, and Lee brings the expertise and experience to help organizations advance these priorities.”

Databricks provides a unified data and AI platform that enables customers to consolidate data, develop analytics workloads, as well as build and scale AI applications from a single environment. According to the vendor, the platform now serves more than 20,000 organizations worldwide.

In his new role, Stockwell will work to deepen partnerships with government agencies and public sector organizations in the UK and Ireland – including the Department for Environment, Food and Rural Affairs (DEFRA), Department for Education (DfE), and VisitBritain – to improve service delivery and increase productivity.

Commenting on his appointment, Stockwell said strong data foundations will be essential if government organizations are to scale AI successfully.

“I’m proud to join Databricks at such a pivotal moment for public sector organisations across the UK and Ireland,” he said. “Government departments can only accelerate their AI strategies if they have the right data foundations in place.

“Databricks enables public sector organizations to unify their data, govern AI, and build and deploy agents at scale.“

FOLLOW US ON SOCIAL MEDIA

Companies using AI should be wary about losing control of their data – and the risk of AI developers making use of that knowledge.

That’s according to Microsoft CEO Satya Nadella, who in a recent blog post warned many AI users are "paying twice" thanks to what he calls the "reverse information paradox”.

This is a process through which AI providers, particularly frontier labs, get access to proprietary data about their own customers. Nadella said the trend represents a huge risk for enterprises, and called for protections akin to patents.

The critique is intriguing as Microsoft itself is an AI company, offering plenty of AI-driven products to customers and cramming AI features into its software. Beyond that, Microsoft was an early funder of OpenAI, though that relationship has weakened of late.

Nadella pointed to economist Kenneth Arrow's information paradox, in which the seller of data or knowledge risks giving it away in order to prove it's worth selling. He noted that AI has created the reverse problem, in which the buyer gives away knowledge in order to use the product purchased.

"You essentially pay for intelligence twice, once with money, and again with something even more valuable: the proprietary knowledge you must reveal to make that intelligence useful," he noted. "The better you want the model to perform, the more of that knowledge you have to feed it!"

"Over time, the information asymmetry becomes increasingly skewed. The seller learns more and more about you as you use what you purchased, while you learn very little about what the seller is learning in return."

The ‘AI exhaust’

This concern isn't just about uploading corporate data to systems, or accidentally including proprietary data in a prompt, though those are both concerns. Instead, Nadella said every interaction with AI inherently includes information that could be useful.

"Models learn from 'exhaust,' the prompts people write, the tools agents use, and especially the corrections people make when the model is wrong," he wrote.

"Every correction is distilled into institutional know-how. It’s the kind of knowledge a competitor could never buy, and the kind that leaks almost imperceptibly: trace by trace, correction by correction, eval by eval."

Ironically, Nadella said it was necessary for the "great innovation" of allowing model developers to use public data – some of them face lawsuits for hoovering up copyrighted data to train their systems.

When it comes to business data, providers should share anything learned with customers. Very few actually do this, however.

"If learning flows in only one direction, economic value converges toward the owners of the learning infrastructure rather than the creators of the knowledge itself," he said. "Therefore, it’s imperative that we distribute the learning infrastructure to every firm so that they can control their own learning loop."

Nadella's tips on how to protect your company from AI

Nadella said the existing setup requires a protection system on par with patents, but also advised companies to set a "trust boundary" by considering a few key aspects – some of which may be easier by simply switching to open source AI.

He suggested companies should control their own "evals", or evaluations of the AI system, because that reveals what looks "good" to the organization, and keep ownership of decisions, feedbacks, and other outputs for their own use.

Beyond that, companies should build capability with AI via their own learning environments where models can learn using real workflows without exposing corporate data.

Improving choice can be achieved by decoupling the orchestration layer from any single model, enabling the ability to switch to another model if one is withdrawn. This can also help organizations cut costs by choosing the right model based on their individual needs.

Lastly, he said to "compound" those four ideas to "create your own continuous learning loop".

"In other words, a company should be able to use a model without giving up the knowledge that makes it unique," he added.

FOLLOW US ON SOCIAL MEDIA

Intel has announced a €5 billion investment to expand its Leixlip campus in Ireland, with plans to scale capacity to deliver Intel Xeon 6 and next-gen Intel Xeon chips built on its Intel 3 node.

Using existing capacity across cleanroom space, the company said the investment will see it expand current production output and advance research and development activities.

As part of the move, the chipmaker will upgrade existing fabrication facilities and install new manufacturing equipment.

Key infrastructure enhancements, including an expansion of the automated track system, aim to integrate disparate campus modules into a single, high-velocity production environment.

“This €5 billion investment represents a definitive commitment to maximize capacity at our Leixlip campus and increase what we can deliver to Intel Foundry customers," said Naga Chandrasekaran, executive vice president, chief technology and operations officer and general manager of Intel Foundry.

“By investing in our existing fabs with state-of-the-art technology and installing cutting-edge tools, we are not just increasing output of critical products like Xeon 6 and next gen Intel Xeon processors built on Intel 3, we are ensuring that Ireland remains at the forefront of the world’s most advanced manufacturing ecosystems, while strengthening the region’s role in the global technology landscape.”

Work has already started, according to Intel, and the company expects it to deliver jobs for specialized tradespeople, including construction workers and equipment installers.

Full-time tech-focused jobs at the chipmaker will also be delivered as part of the expansion scheme.

“Intel’s latest multi-billion-euro investment in Leixlip is a powerful vote of confidence in Ireland, our skills base and our position at the heart of Europe’s most advanced manufacturing ecosystem," said An Taoiseach Micheál Martin.

"At a time of rapid technological change and global competition, this expansion strengthens Ireland’s role in securing resilient semiconductor supply chains and reinforces our ambition to remain a global leader in innovation, productivity and sustainable economic growth.”

Intel builds on deep Ireland ties

Intel has been active in Ireland since 1989, and has invested more than €30 billion in the Leixlip campus, which opened in 2023, in that time.

In 2024, the company sold 49% of the plant to US private equity firm Apollo, but bought it back earlier this year at a higher price. Last August, the US government took a 10% share in Intel at a point when it was valued at less than a fifth of its current market capitalization.

With the EU’s Chips Act aiming to reduce reliance on foreign supplies of chips, Intel said the investment will strengthen Europe’s semiconductor supply chain and support the EU's tech sovereignty ambitions.

“Intel is one of Ireland’s longest standing and most strategically important investors," said Michael Lohan, CEO of Ireland's Industrial Development Authority (IDA).

"This project demonstrates the value of Ireland’s skilled workforce, innovation ecosystem and stable business environment, while reinforcing Ireland's leadership in advanced semiconductor manufacturing, supporting both European competitiveness and resilient global supply chains.”

FOLLOW US ON SOCIAL MEDIA

Supermarket chain Lidl has urged customers to remain vigilant after a data breach exposed personal information.

In an advisory, the firm revealed the ‘IT incident’ at a third-party service provider has impacted customers in Belgium, Germany, and the Netherlands.

"We were notified of this incident earlier this week," the message reads.

"Despite high IT security standards, unauthorized parties briefly gained access to a separately stored file containing customer data, and some of that data was stolen. The online shop system itself was not affected."

The stolen data relates to customers of Lidl's online shop, and includes first and last names, telephone numbers, email addresses, dates of birth, and customer numbers.

Lidl noted that data exposed in the incident does not include passwords, billing and delivery addresses, bank details, or other payment information.

Lidl warns customers over phishing risks

The company said that while it currently has no concrete evidence this data has been misused, customers should remain vigilant for potential phishing attacks or identity theft.

Customers should be wary of unexpected messages, always verify the authenticity of the sender, and avoid providing any information or clicking on unknown links.

Boris Cipot, principal security engineer at Black Duck, said the incident is a “textbook reminder” of the risks posed by third-party vendors.

"Even when a retailer's own systems hold, a compromised service provider can expose millions of customers to identity fraud, phishing, and account takeover attacks," Cipot commented.

"Personal data like names, birthdates, phone numbers, and email addresses may seem low-risk in isolation, but combined they become a powerful toolkit for social engineering. Additionally, the downstream costs to consumers and brand trust can far outlast the incident itself."

Lidl vendor acted swiftly

Lidl said its IT service provider responded immediately to fully restore the security of the affected IT systems, filed a report with the authorities and immediately engaged IT forensic experts to investigate the incident.

The company has also notified the relevant data protection authorities. Cipot commended the supermarket chain for its swift response and up-front communication with affected customers.

"Lidl deserves credit for moving quickly to notify customers and being transparent about what they don't yet know, including the possibility that passwords, addresses, and payment data could be involved. That kind of candor presents the appropriate posture under GDPR," he said.

"The real test now is follow-through: how quickly they complete the forensic investigation, how clearly they communicate updates as the scope becomes known, and how rigorously they reassess the security requirements they place on their service providers going forward."

Lidl, which operates around 12,900 stores across 32 countries in Europe and the US, is just the latest retailer to be hit by a supply chain breach.

In the last year or so, victims have included Marks and Spencer, Co-op, Louis Vuitton, Pandora, and Harrods. Many of these attacks have been linked to the Scattered Spider hacking group.

FOLLOW US ON SOCIAL MEDIA

With AI tools now commonplace in software engineering, nearly two-thirds (60%) of organizations are expected to shrink team sizes by 2029. But that doesn’t necessarily spell bad news for engineers, according to Gartner.

Analysis by the advisory firm suggests the shift toward smaller engineering teams won’t be a cost-cutting exercise, but rather a natural evolution toward more agile, specialized units focusing on specific areas.

Gartner envisages these smaller teams being composed of specialist product managers alongside user experience (UX) - or agent experience (AX) designers, and at least one ‘AI-native’ engineer.

Speaking to ITPro, Gartner principal analyst Aliyah Camacho, said this influx of AI has prompted a rethink of how enterprises can “really make the most of AI and humans working together”.

“What we’re seeing is that organizations are looking at engineers as AI orchestrators,” Camacho told ITPro.

“One aspect of tiny teams is that we’re thinking of them as focused on a product or a set of features for a product, so it’s bringing together more of that product management skills and expertise onto the team.”

The concept of engineers moving toward more of an orchestration-style role has become a recurring talking point over the last 18 months. AWS CTO Werner Vogels told ITPro earlier this year that the traditional image of developers as “code monkeys” is fading.

With AI in the mix, developers and engineers can now focus on other tasks, such as quality assurance and testing, Vogels said at the time.

Gartner’s research echoed this, noting that with the technology handling routine technical tasks, this will ultimately free up engineers to focus on “complex problem-solving and innovation”.

With tiny teams, Camacho said this will essentially remove a layer of friction for engineers. Simply put, the AI does the grunt work, while engineers have time to focus on product development and refining existing software.

These teams will also have their own remit similar to product development teams, meaning they’re staying in their own lane and not getting dragged into other areas.

“What we're predicting to be speed or velocity-type gains with tiny teams is that these small teams are fully accountable for the success of their product or feature,” she explained.

“So removing that layer of having additional approvals and coordination is one type of speed gain,” Camacho added. “Then another is having fewer people on the team means that there's less time spent in that communication and handoff type of activity.”

How tiny are we talking?

Naturally, what constitutes a ‘tiny team’ will vary wildly based on the size of the enterprise. Small teams today, also known as ‘two-pizza teams’, typically have between five and eight people, Camacho said.

Generally speaking, the shift to tiny teams could take this down to five or six. Some, on the other hand, could end up with just two or three, Camacho noted.

“This really varies,” she said. “Some are curious about experimenting with teams of three, and then for others a meaningful reduction in size is down to six.”

Ultimately, these changes will be made on an enterprise-by-enterprise basis, but leaders should be wary of downsizing down too much. These teams should be small enough that they’re agile but also remain effective and have enough diversity of ideas.

Not a cost-cutting exercise

Given that the last two years have seen repeated warnings about AI rendering developers obsolete, some might see a shift to smaller teams and figure this is another excuse to offload staff.

Camacho insisted that this isn’t a cost-cutting exercise, however. Teams will be smaller, but the consultancy predicts there will eventually be more of these tiny units working away in the background building software.

This is where communication from leadership will be vital in fostering change, Camacho noted.

“I think that a huge piece of making this kind of change is communicating really clearly about what it is and is not, and the tiny teams model is not a cost optimization tactic,” she said.

“Rather, it’s a restructuring of teams to best take advantage of AI and human expertise. What we’re seeing with this idea is that team size reduces, but the number of teams may actually stay the same, or may increase, because we’re expecting more demand for complex engineering solutions at organizations.”

Room for juniors

Maintaining robust talent pipelines will also be a key focus with the shift to tiny teams, according to Gartner. If anything, junior engineers will be more crucial than ever to compensate for general attrition and to provide AI-native skills.

The impact of AI on entry-level jobs has been a recurring talking point over the last 18 months, with the need for junior engineers questioned by some industry stakeholders.

This is where the ‘how small is too small’ question comes into play, according to Camacho.

“We absolutely believe that organisations need to continue hiring junior talent to build that pipeline for the future,” she said.

“So the way that fits with tiny teams in this context is reducing team size, but not making it too small because if the team size shrinks too much, that can pose risks.”

Long-term, the solution to developing junior talent could lie in apprenticeship-style models, she added, noting that this “could fit really well with the tiny teams model”.

FOLLOW US ON SOCIAL MEDIA

Jitterbit has announced the appointment of Chris Stoddard as its new chief revenue officer (CRO), as the intelligent automation vendor looks to drive fresh growth and scale adoption of its AI-driven Harmony platform.

Stoddard will lead the company’s global go-to-market organization, with responsibility for international sales and revenue generation across the business.

A seasoned leadership veteran, he brings more than a decade’s experience across data analytics, enterprise IT infrastructure, and cyber security.

He joins Jitterbit from observability specialist New Relic, where he most recently served as senior vice president for the Americas, and has previously held senior sales leadership roles at Qlik, Pulse Secure, and Juniper Networks.

The appointment follows the recent launch of Jitterbit’s Model Context Protocol (MCP) gateway, which is designed to standardize how AI agents securely connect to enterprise applications, systems, and data sources.

In an announcement, Jitterbit CEO Bill Conner said the company is “at a pivotal moment” as organizations are increasingly prioritizing accountable AI and secure enterprise integration.

“Chris joins Jitterbit during a period of massive expansion, bringing an exceptional track record in data migration, infrastructure and enterprise security that directly aligns with our core mission,” he explained.

“His leadership will be instrumental as we scale our unified Harmony platform to defeat shadow AI, bridge the enterprise data divide, and securely deliver automation, integration and agentic workflows organizations can trust."

California-based Jitterbit provides AI-driven automation that enables organizations to integrate applications, data, and business processes while building and managing AI-powered workflows.

Its Harmony platform is designed to simplify integration while providing centralized governance across increasingly complex modern IT environments.

Harmony combines integration platform as a service (IPaaS), API management, application development, electronic data interchange (EDI), and model context protocol capabilities into a single, unified platform.

According to the vendor, the offering provides organizations with greater visibility and control over AI-driven automation while reducing reliance on disconnected point solutions.

Commenting on his appointment, Stoddard said he believes Jitterbit is “perfectly positioned” as the growing adoption of autonomous AI agents drives demand for secure, enterprise-grade integration capabilities.

“Businesses are undergoing a massive paradigm shift, and the market is realizing that autonomous AI agents cannot succeed without robust, secure, and context-aware integration underpinning them,” he explained.

“I am thrilled to partner with our talented global teams to help organizations accelerate data transformation by unifying accountable AI agents, apps, and automation.”

Jitterbit also announced that Luca Taglioretti will focus on expanding its regional growth strategy in his role as vice president of sales for EMEA and APAC.

FOLLOW US ON SOCIAL MEDIA

Global cyber attacks rose over 10% in June, according to new research from Check Point, with one particular group accounting for a growing portion.

The uptick in attacks comes in the wake of what the cybersecurity firm described as a period of “relative calm” in May.

Attack volumes increase broadly across all regions and sectors at once, the company noted, suggesting attackers are expanding activities across a wider set of targets.

“June’s data shows a broad rebound in cyber activity, not a single isolated spike,” said Mark Mitchell, security engineer at Check Point Software.

“Attackers are widening their reach across regions and industries, while ransomware groups continue to reorganize and scale."

Notably, Check Point’s analysis highlighted increased activity by The Gentlemen, a new ransomware operator on the scene. The group overtook Qilin as the most active ransomware group globally, accounting for 17% of published attacks.

LockBit activity also increased, rising from 1% of published attacks in May to 7% in June, making it the third most prevalent group.

"The rise of The Gentlemen to the top of the ransomware leaderboard is a clear reminder that new operators can rapidly become major global threats," Mitchell warned.

As ITPro previously reported, The Gentlemen have quickly grown to become one of the most aggressive ransomware groups worldwide.

Observations of the group’s activities by NTT revealed it uses advanced tooling and proxy infrastructure to accelerate attacks, often operating stealthily within compromised networks before causing havoc.

NTT researchers said the group also shows a level of technical maturity that would typically be associated with more established cyber crime groups. This could suggest it consists of highly experienced threat actors with deep ties to other groups within the cyber crime ecosystem.

Key industries in the crosshairs

Education remained the most targeted sector globally, with organizations facing an average of 4,816 weekly attacks - 16% up on June 2025.

They're a comparatively easy target, said Check Point, thanks to open campus networks, constant device turnover, and constrained security resources.

Government was the second-most targeted sector, with 2,836 weekly attacks, up 5% year on year, while telecommunications ranked third with 2,835 weekly attacks, a 13% increase.

Latin America attacks ramp up

Attacks against organizations in Latin America are ramping up significantly, according to Check Point.

Organizations across the region are now contending with an average of 3,501 weekly attacks, a 27% rise since June 2025.

APAC followed at 3,060 weekly attacks, up 5%, while Africa was third with 3,008 attacks per week, although this was down 9% year on year.

Europe and North America also saw sharp increases, at 22% and 14% respectively.

AI is creating new risks

Generative AI continues to cause problems, with one in every 26 prompts submitted from enterprise networks carrying a high risk of sensitive data leakage, making for a global exposure rate of 3.9%.

High-risk prompt activity affected 85% of organizations that regularly use generative AI tools, while a further 27% of prompts contained potentially sensitive information.

This issue was most prevalent in Latin America, where 5.2% of prompts carried a high risk of sensitive data leakage, while Europe matched the global average at 3.9%.

In terms of broader AI-related risks, healthcare and medical carried the highest exposure at 5.7%, followed by telecommunications and business services at 5.1% each, and IT at 4.1%.

Personal data was accessed at 80% of affected organizations, with network and infrastructure details, legal and regulatory material, financial data, and employee records also widely exposed.

FOLLOW US ON SOCIAL MEDIA

The National Cyber Security Centre (NCSC) has urged UK organizations to remain vigilant for attacks waged by Russian state-backed hackers.

As part of an advisory published in collaboration with 18 other agencies, the cybersecurity center specifically highlighted techniques employed by Russian FSB’s Centre 16 threat actors.

The group has been “opportunistically” targeting vulnerable routers and critical national infrastructure globally in recent months, the advisory warns.

Centre 16 goes by a number of names, including Berserk Bear, Static Tundra, and Ghost Blizzard, according to the NCSC. The group primarily uses SNMP (Simple Network Management Protocol) scans to locate and compromise vulnerable routers.

The group has also been observed exploiting vulnerabilities in Cisco devices, web portal flaws, and vulnerabilities in Cisco’s Smart Install (SMI) feature to seize network devices.

The advisory comes as the UK government implements sanctions against 24 individuals and entities behind “destructive cyber and hybrid operations” which have employed criminal groups via proxy networks.

Jonathon Ellison, NCSC Director of National Resilience, said these activities require organizations to remain in a heightened state of vigilance moving forward.

“The NCSC, alongside our international partners, have repeatedly exposed the advanced tools and coordinated campaigns of Russian cyber actors who persistently seek to exploit any vulnerability they encounter,” he said.

“Today’s joint advisory provides decisive, actionable directions from the global security community that network defenders should implement to protect against Russian Intelligence operations and secure the UK’s critical infrastructure.”

Russian hackers targeting key sectors

Organizations across a host of sectors worldwide are at risk from the group, according to the advisory.

Those operating in the communications, energy, healthcare, defense, and financial services industries in particular are firmly in Centre 16’s crosshairs.

The security agency urged organizations in these domains to take action immediately. This includes disabling the use of legacy SNMP versions and switching to SNMPv3 to lower their risk of compromise.

Similarly, organizations are advised to implement “strong and unique passwords for network devices, and restrict access to management protocols”.

Call to action

In addition to basic defensive measures, the NCSC also encouraged at-risk organizations to obtain Cyber Essentials certification.

This is a government-backed initiative for organisations to show they meet the recognized minimum standards for cybersecurity.

Organizations can also make use of the Cyber Assessment Framework, allowing them to audit their security capabilities, operational maturity, and bolster cyber resilience techniques.

“I’d strongly encourage all organisations, especially those entrusted with UK critical networks, to adopt these recommended measures immediately, thereby reducing the risk of compromise,” Ellison commented.

Repeated warnings

This isn’t the first warning issued by the NCSC over Centre 26 activities in recent years. The security agency, alongside international counterparts, attributed the December 2025 attack on Poland’s energy grid to the unit.

Various subunits and techniques employed by Centre 16 have also been exposed over the last three years. The security agency called out a Centre 16 unit known as ‘Turla’ in 2023 over the deployment of Snake malware, for example.

The malware strain has been a key component of Russian-backed espionage campaigns for nearly two decades, the NCSC said at the time.

A similar advisory that year also shed light on a group known as Star Blizzard. The NCSC said this particular subunit of Centre 16 was actively interfering in UK politics and democratic processes.

FOLLOW US ON SOCIAL MEDIA

Irish data centers consumed a quarter of the country's electricity last year, almost as much as every home in the country combined.

New figures from the Central Statistics Office (CSO) show that data center electricity consumption rose to 7,663 GWh in 2025 from 6,973 GWh in 2024 – a 10% rise – to hit 23% of the national total.

For comparison, 2025 consumption stood at 18% for urban households and 9% for rural households. Consumption by all users other than data centers, including residential and other business customers, went up by just 2% over the same period.

The figures represent the latest phase in what's been a continuous rise. The CSO's quarterly tracking from 2015 to 2025 shows that data center electricity consumption grew from 291 GWh in the first quarter of 2015 to 1,991 GWh in the fourth quarter of last year.

Total metered electricity consumption rose 34% during the period, the officials noted.

"Newly compiled quarterly figures spanning 2015 to 2025 highlight a substantial increase in metered electricity consumption by data centers," said Dr Grzegorz Głaczyński, statistician in the Climate and Energy Division.

"Data center consumption has grown every single year without exception, more than doubling between 2015 and 2019 from 1,240 GWh to 2,490 GWh, and tripling again between 2019 and 2025, reaching 7,663 GWh."

Ireland is a data center haven

Despite its size, Ireland currently has more than 80 data centers, mostly in the Greater Dublin Area.

In 2021, the country introduced an effective moratorium on the building of new data center connections to the electricity grid, which remained in force until late last year.

Developers were required to either generate their own electricity on site, or relocate to regions outside the Greater Dublin Area.

Even during the moratorium, data center electricity consumption continued to rise steadily, with the International Energy Agency (IEA) predicting two years ago that it would represent a third of the country's electricity consumption by this year.

Now, under a new Large Energy Users (LEU) Connection Policy finalized late last year, the Commission for the Regulation of Utilities (CRU) requires new data centers to meet at least 80% of their energy demand from renewable sources.

This requires large data center developers to provide 100% on-site, flexible power generation, with at least 80% of annual electricity to be sourced from new, unsubsidized renewable projects within their first six years.

At the same time, a new Large Energy User Action Plan (LEAP) was introduced to encourage investment in energy intensive sectors such as semiconductors, pharmaceuticals, precision engineering, and hyperscale data centers.

The plan calls for data centers to be sited in green energy parks and co-located with renewable energy sources, including offshore wind.

It also allows developments outside these locations, however, in some cases until beyond 2030, in line with existing planning arrangements. One such area is Dublin, which has raised concerns among opposition parties.

These plans were subject to a fierce cross-party pushback last year, as ITPro reported at the time, largely due to concerns about the impact on local communities and the environment.

FOLLOW US ON SOCIAL MEDIA

Palo Alto Networks CEO Nikesh Arora has issued a stark warning to workers reluctant to adapt to generative AI: they face a “Darwinian moment”.

Speaking during a recent appearance on the 20VC podcast, Arora suggested a significant portion of workers globally lack necessary AI skills, which raises questions about how leaders can implement change and build workforces capable of meeting future demands.

“The challenge right now is 90% of enterprise employees are not AI savvy. They’re not,” he said.

“They have to learn. I can’t send them to university. There’s no course you can take in school anywhere. They have to be able to learn on their own. I think we’re back to a Darwinian moment where everybody has to figure out who’s really good.”

In some cases, building an AI savvy workforce has prompted some drastic action by executives. Nikesh pointed to Coinbase CEO Brian Armstrong’s approach of penalizing workers who refused to adapt or embrace the technology.

During a podcast appearance last year, Armstrong admitted to firing workers who refused to engage with the technology after paying for enterprise licenses for GitHub Copilot and Cursor.

Other organizations, such as Jack Dorsey’s Block, reportedly introduced AI mandates for workers. Both companies laid off staff this year amidst claims that the technology is changing how they operate.

“You’ve seen people like Brian Armstrong and Jack Dorsey go out and say, ‘I’m going to decimate my organization, and I’m going to start building from scratch’ and they’ve gone to some version of 30, 40% fewer people because they figured out there is no redemption,” Arora said.

As ITPro reported last year, punitive measures to spur AI adoption in the enterprise is a sure fire way to create workforce pushback.

It’s a similar dynamic to the return to office (RTO) mandates that caused widespread upheaval at a range of big tech firms in recent years. Encourage, but don’t push, or else it could come back to bite you.

Palo Alto Networks’ approach leans toward a gradual shift, Arora noted. The company, which has roughly 20,000 staff, has a “natural attrition of 2% a month. The focus now is on replacing these staff with people who are indeed AI-savvy.

Elsewhere, the company actively seeks out AI talent from events such as hackathons, Arora revealed. These are lucrative talent pools that the company can draw from to acquire staff.

“We hire from hackathons,” he said. “Give me 12 months, I’ll have sort of transformed 20, 25% of my team. Give me three years, I’ll hopefully have enough AI-savvy people working at Palo Alto.”

Top-down encouragement

Building an AI-savvy workforce also requires accountability on the part of leadership, Arora said. Delivering change requires leaders across an array of functions to have ambition and actively engage with the technology.

Arora has regular conversations with leadership figures aimed at establishing their progress with AI, allowing them to showcase potential wins.

“You have to make sure your leaders are ambitious. You have to make sure they're competitive. You have to make sure they want to win. You have to make sure that they have a learning mindset,” he said.

“When they watch their peers around them do cool [stuff], they want to show up and do cool [stuff] the next time. So for me, it's getting 14 people together and saying, ‘Hey, Harry, tell me today, what have you done for AI the last three days since I last talked to you in your organization, and whatever motivates you?”

This gives Arora a clear understanding of the direction some leaders are going in with the technology. Moreover, it appears to act as a springboard for motivating others across the company.

“It creates a little bit of Darwinian competition amongst them. It creates this urge to go embrace this new technology, and I think hopefully I get 14 people fully motivated, and then they go do that with the next set of people because I need to transform from the top down, not from the bottom up on this topic.”

FOLLOW US ON SOCIAL MEDIA

A proof-of-concept by the AI Now Institute demonstrates remote code execution in Anthropic's Claude Code and OpenAI's Codex when they're running in an autonomous mode that approves their own commands.

The Friendly Fire attack works against an out-of-the-box configuration of Claude Code in 'auto-mode' or Codex in 'auto-review', with researchers testing Claude Sonnet 4.6, Sonnet 5, and Opus 4.8 along with GPT-5.5.

It leverages prompt injections disseminated across a library’s source code that target AI-enabled cyber defense – without the need for hooks, skills, plugins, MCP servers, or configuration files as an injection vector.

Researchers noted the study highlights the potential risks associated with rapid adoption of AI-powered security tools.

Many organizations are doing so without “consideration of the substantial and unmitigated risks associated” with the technology.

AI-related cybersecurity concerns have been rising following the launch of powerful new models such as Claude Mythos. Anthropic rolled the model out as part of a gated release to prevent misuse, and US authorities temporarily imposed export controls amidst similar concerns.

How the Friendly Fire attack works

The attack works by inserting prompt injections into documentation files and adding README files that appear to be part of routine security tooling in an open source library.

Researchers used geopy, a popular Python used for searching for geographic coordinates, but said it could work with almost any project.

When a user asks Claude Code or Codex to perform a security assessment of the repository using the default auto-mode or auto-review automated modes, the agent can be persuaded to execute a malicious binary without any warning and without requesting any further user approval.

The proof of concept is causing alarm amongst security professionals. Roey Eliyahu, CEO and co-founder of Salt Security, said this marks the latest in a string of potential risks in recent months due to manipulation of agents.

“Friendly Fire, GitLost, Agentjacking, TrustFall. Four documented attacks in the past two months, different techniques, same underlying condition,” he said.

“Untrusted text reaches an agent that can run commands. The agent cannot reliably tell the difference between the code it is reviewing and the instructions it is being given. And the attacker's payload executes on the host.”

Eliyahu emphasized that this is not a “model problem that can be patched”. All four models were vulnerable to the same techniques and payload, without any modifications for each.

“When the same attack works unchanged across two vendors and four model generations, you are not looking at a software bug. You are looking at a structural property of how these agents work."

But, said Eljan Mahammadli, head of AI provenance at Polygraf AI, this shouldn't rule out the use of AI for defensive security work.

ITPro approached Anthropic and OpenAI for comment, but did not receive a response by time of publication.

FOLLOW US ON SOCIAL MEDIA

A ransomware negotiator has been sentenced to 70 months in prison after secretly conspiring with hackers to extort clients.

Angelo Martino, 41, of Land O’Lakes, Florida, worked at US-based cyber incident response company DigitalMint in April 2023 when he started conspiring with the operators of the BlackCat ransomware group.

BlackCat paid Martino to provide confidential information about the negotiating position and strategy of his employer’s clients, along with the details of their ransomware insurance, to help maximize the ransoms paid.

Notably, Martino also conspired with two former cybersecurity professionals between April 2023 and November 2023.

Kevin Martin, 36, of Texas, was hired as Martino’s co-worker at DigitalMint after the conspiracy began. Ryan Goldberg, 41, of Georgia, was manager of incident response at Sygnia.

All told, Martino was found to have extorted five different victims as part of his collaboration with the cyber crime syndicate while the trio also worked to deploy BlackCat ransomware against victims across the country.

Assistant attorney general A. Tysen Duva of the Justice Department’s Criminal Division, said victims had shared “heartbreaking accounts of how their businesses were nearly destroyed” during the trail.

“Today’s sentence accounts for the harm Martino caused and demonstrates that the Department of Justice can and will identify and prosecute cybercriminals to the fullest extent of the law.”

Working with the enemy

After successfully extorting one victim for around $1.2 million in Bitcoin, the men split their share of the ransom three ways and laundered the funds through various means.

Jason A. Reding Quiñones, attorney for the Southern District of Florida, said more than $10 million in criminal proceeds have been seized. These assets include digital currency, vehicles, a food truck, and a luxury fishing boat.

A separate hearing has been set for September 17 to decide the amount of restitution to be ordered against Martino.

The Justice Department started working to bring down BlackCat three years ago, developing a decryption tool that allowed FBI field offices across the US and law enforcement partners around the world to help victims restore their systems.

The scheme has reportedly saved victims from paying out $99 million in ransom payments so far. The FBI also seized several BlackCat websites at the same time.

"This case sends a clear message: we will pursue the hackers who deploy ransomware, the insiders who enable them, and the money they steal from American victims,” Quiñones said.

FOLLOW US ON SOCIAL MEDIA

Software developers aren't losing skills because of AI, but using time saved to skill up, according to research from O’Reilly.

Analysis from the learning platform found that rather than the boom in AI coding tools having a negative effect on developer capabilities, many view the technology as a way to streamline everyday tasks to help them focus on learning.

O'Reilly said that use of generative AI content on its own learning platform was up 89% in the UK over the last year, while machine learning grew by 51% and natural language processing was up 117%.

At the same time, O'Reilly noted that more traditional programming topics saw decline over the last year, with "programming fundamentals" down 74%, Agile falling 31%, and Git down 20%.

While that could be seen as software engineers handing off such work to AI and not bothering to study key subjects, the study noted this suggests many are learning such skills on the job and using AI to support learning.

Formal training time, meanwhile, is spent learning about more advanced AI-related topics.

Alexia Pedersen, SVP International at O’Reilly, said the study shows developers are now making AI a “core part of their learning priorities”.

"The UK tech workforce isn’t turning its back on programming," Pedersen said. "It’s building on years of engineering expertise to take advantage of the opportunities AI creates. That’s exactly what we’d expect from experienced developers."

"Many already have years of programming experience, which puts them in a strong position to adopt AI tools confidently and apply them in meaningful ways," she added.

AI isn’t a replacement for core skills

That said, O'Reilly warned that AI should complement, not replace, foundational programming knowledge – especially for newer developers.

As ITPro reported last year, concerns are rising that those entering the workforce are becoming too reliant on the technology. The result is that many could miss out on valuable learning curves in the early stages of their careers.

"The challenge now is making sure the next generation develops those same foundations before relying too heavily on AI," Pedersen commented. "AI will make great developers even better, but it can’t replace the technical judgement that comes from understanding how software really works."

The company suggested that while developers are choosing to learn in different ways, it's worth noting that employers still require specific programming skills.

React, Node.js and Java skills are still highly sought after while cloud-related knowledge is prevalent in many UK job ads.

Indeed, demand for the Clean Code courses grew 19% over the last year, O'Reilly said, with C# up 17% – showing practical coding capabilities remains important.

"What this data captures is a workforce making active choices about where their time goes," Pedersen said.

"UK tech professionals aren't casually browsing AI content – they're incorporating technical learning into new ways of working, building AI agents, testing different approaches, and exploring how these tools can improve productivity and outcomes.

FOLLOW US ON SOCIAL MEDIA

IBM has announced a series of updates to its IBM Bob software development tool, with a particular focus on better managing token consumption.

The move marks the first big batch of updates for the agentic development tool, which rolled out earlier this year. Bob will now offer multi-agent capabilities, the company said, alongside built-in AI cost and usage analytics features.

According to IBM, the new ‘Bobalytics’ feature will enable developers to monitor AI token consumption, streamline resource management, and improve visibility in terms of how AI tokens are consumed by teams.

Sub-agents and multi-agent capabilities will also play a key role in reducing costs, according to IBM. Sub-agents are those that operate under the direction of another to handle specific tasks within a larger workload.

The advantage here is that these dedicated agents will work in an “isolated context” within broader workloads to complete tasks in a more efficient manner, ultimately reducing costs.

Multi-agent features also contribute on this front, according to Michael Kwok, VP of IBM Bob. In a blog post detailing the updates, Kwok noted that Bob will now call on specific tools based on the underlying model, allocating agents depending on the intensity of tasks and associated costs.

“Parallel tool execution can significantly reduce the time required for complex tasks involving multiple searches, file operations and validation steps,” Kwok explained.

“Subagents improve efficiency by performing specialized work in isolated context before returning only the relevant results, while background tasks allow long-running work to continue without interrupting the developer’s workflow.”

AI cost optimization in the spotlight

The move by IBM comes amidst a sharpened focus on AI token consumption - and spiralling costs - by enterprises globally. As ITPro reported in June, the ‘tokenmaxxing’ trend has landed some organizations with eye-water bills.

Uber, for example, blew through its entire annual AI bill in just four months after incentivizing staff to ramp up use of the technology.

Developer teams are also contending with rising costs on this front, as Gartner told ITPro in late June. The consultancy projects that token costs could exceed engineer salaries by 2028 based on current usage rates.

Speaking to ITPro at the time, Nitish Tyagi, senior principal analyst at Gartner, said engineering teams are adopting a range of cost optimization practices to reduce the impact of token consumption.

New ‘premium packages’ for IBM Bob

IBM also unveiled three new specialized workflows for Bob aimed at driving Java, IBM Z, and IBM i operating system (OS) modernization. These capabilities come in separate ‘premium packages’, according to the firm, offering enterprises domain-specific versions of the tool.

“Modernizing a Java application requires different knowledge, tools and workflows than working with IBM i systems or mission-critical mainframe applications. Each environment carries its own architecture, runtime assumptions, integration patterns, validation needs and operational constraints,” Kwok explained.

“Premium Packages bring domain intelligence and decades of enterprise expertise directly into Bob while maintaining a consistent developer experience.”

The premium package for Java, for example, will help automate migration processes, allowing teams to move to more recent versions of the programming language. Bob will essentially guide users through the process, while also assisting with broader modernization practices.

This includes automated compatibility testing and the ability to identify and remediate vulnerabilities.

The premium package for IBM Z, meanwhile, will provide teams with a helping hand during mainframe modernization projects. The Z Code Mode feature, for example, will help “explain, generate, modify, refactor, and transform mainframe application code”.

Efforts to streamline mainframe modernization by the firm come after a high-profile spat with Anthropic earlier this year.

FOLLOW US ON SOCIAL MEDIA

Barracuda Networks has announced the acquisition of identity and access management (IAM) specialist Evo Security, in a move that will bring expanded capabilities to its BarracudaONE platform.

Founded in 2018, Texas-based Evo Security provides a platform that combines IAM capabilities with privileged access management (PAM) technology into a single, multi-tenant platform tailored to the needs of MSPs.

The acquisition will see the firm’s technology integrated into BarracudaONE, creating a unified offering that brings together access management, identity protection, and identity threat detection and response.

According to Barracuda, the expansion will provide partners with a single platform for delivering identity resilience while helping customers simplify identity security by reducing the need to manage multiple point solutions.

In an announcement, Barracuda CEO Rohit Ghai said combining Evo Security's technology with BarracudaONE will help customers stay ahead of identity-centric attacks as AI continues to reshape the threat landscape.

“In the agentic AI era, protecting both human and non-human identities is imperative for delivering cyber resilience,” he explained. “Existing enterprise identity solutions are complex, costly and fail to meet the needs of MSPs that must scale to securely manage millions of identities across thousands of customer environments.

“We are thrilled to combine Evo Security’s partner-first innovation with our vision of BarracudaONE and offer a complete, intelligent, easy, and open platform that closes this gap.”

According to the vendor, Evo Security’s integration into the BarracudaONE platform will provide partners with a unified identity security architecture that spans privileged access management, access control, identity protection, and identity threat detection and response.

MSPs will be able to manage customer identities from a single multi-tenant environment while enforcing authentication, access policies, identity protection, and identity threat detection.

Barracuda builds on resilience goals

The acquisition also builds on Barracuda’s wider cyber resilience platform, which already includes solutions that cover email security, data protection, network security, cloud security, and managed extended detection and response (MXDR).

For customers, Barracuda said the expanded offering will deliver integrated identity security that is designed to be easier to deploy and manage than traditional enterprise identity platforms, while allowing organizations to retain their existing security infrastructure rather than replacing it.

Alongside the technology integration, Evo Security’s team has joined Barracuda as part of the acquisition and the vendor said it will continue to support Evo’s existing MSP customers as the platform continues to expand.

Commenting on the acquisition, Evo Security founder and CEO Michael Roth said joining Barracuda will enable the business to expand its identity-first approach to a wider global partner base.

“We built Evo Security to solve the identity challenges MSPs face every day,” he explained. “Joining Barracuda gives us the scale, reach and resources to accelerate that mission globally.

“Our identity‑first approach was designed from day one for MSP operations, and now, together with BarracudaONE, we can bring modern identity security, privileged access management and automation to far more partners and the customers they protect.”

Financial terms of the acquisition were not disclosed.

FOLLOW US ON SOCIAL MEDIA

Researchers at Nebula Security have discovered a Linux kernel flaw dating back to 2011 that lets any logged-in user take full root control of an unpatched machine in just five seconds.

Dubbed GhostLock (CVE-2026-43499), it was introduced in Linux 2.6.39 and fixed in Linux 7.1.

The flaw allows an unprivileged local attacker to get a dangling kernel pointer to kernel stack memory with only regular threading syscalls, write a pointer to an arbitrary address, and hijack a function table to get root access.

GhostLock has been shipped by default in every mainstream distribution since 2011, and requires no special privileges or network access. Nebula, which uncovered the flaw, said its exploit is reportedly 97% reliable and can also escape containers.

This particular flaw is the second part of an attack chain dubbed IonStack, with the first step being CVE-2026-10702, a vulnerability in Firefox that allows code execution within the browser and escapes its sandbox.

The vulnerability is rated high (7.8) as the attacker would already need to have local access to the system.

How the GhostLock flaw works

Nebula researchers said the root cause is a function reused by a caller it was never written for: the helper function remove_waiter(). During certain futex operations, it incorrectly clears a pointer associated with the currently executing task, rather than the actual waiting task.

This leaves the kernel with a dangling pointer that points to a memory location that has already been freed and reused. This allowed the Nebula team to gain full control, tricking the kernel into running their own code as the root user.

Daniel Bechenea, security manager at Pentest Tools, said the flaw is of particular concern because kernel exploits have historically carried a “real operational cost for attackers”.

“An unreliable one crashes the box and burns the access,” he explained. “An exploit that Nebula reports as 97% reliable, with public code anyone can run, changes that math.”

"As GhostLock uses a kernel vulnerability, containers also represent a juicy target for attackers as the exploit escapes the container and obtains code execution as root on the host OS, meaning that: containerised workloads that teams treat as isolated become stepping stones to the host and everything else scheduled on it."

Patch now

Systems running older kernels remain vulnerable to exploitation, according to Nebula. Researchers urged users and administrators to update to patched kernel versions as soon as possible.

"On an unpatched host, treat any code execution as root, and plan containment accordingly," advised Bechenea.

"Prioritize the systems that run untrusted or semi-trusted code by design: CI runners, container platforms, shared development machines, multi-tenant hosts, and verify the fixed kernel package version on each system rather than trusting that the April fix propagated, because with several major LTS releases still lagging in early July, attackers who land a foothold will check your kernel version even if you haven’t."

FOLLOW US ON SOCIAL MEDIA

A 'category-level' security flaw in six leading AI coding assistants could give attackers remote control of a developer’s machine, according to researchers at Wiz.

Dubbed GhostApproval, the flaw affects some of the most popular coding tools on the market right now, including Amazon Q Developer, Claude Code, Cursor, Windsurf, and Google Antigravity.

The flaw has been reported to all six providers, with Amazon, Cursor, and Google having rated it critical or high-severity and fixed it, and there's no evidence that it's been exploited in the wild.

According to Wiz, the vulnerability is caused by a decades-old Unix primitive – symbolic links, or symlinks – which allows malicious repositories to trick AI agents into silently breaking out of their workspace sandboxes, leading to RCE and persistent access to a developer's machine.

In the case of Amazon Q Developer, the agent wrote to the filesystem before presenting the user with an Undo option. Testing by Wiz found the agent correctly identified the symlink in its internal reasoning, but proceeded with the write anyway.

Amazon has fixed the problem, which has been recorded as CVE-2026-12958.

"We have remediated this issue in language server version 1.69.0. The AWS Language Server updates automatically unless the customer's network configuration prevents it, so no action is required in most cases," the firm said in a statement.

"For existing customers, reloading the IDE will trigger an update to the latest language server version, which includes this fix. If auto-update is blocked, we recommend upgrading to the latest version of the Amazon Q Developer plugin for your IDE."

Wiz noted that new customers don't need to take any action, as the latest patched version will be downloaded automatically.

Anthropic issues customer warning

Claude Code, meanwhile, provides the clearest example of user interface misrepresentation of critical information, Wiz said.

"The agent explicitly recognized the dangerous target in its thinking - stating "this is a symbolic link to the Claude settings file" - then presented a prompt asking simply: "Make this edit to project settings.json?" the researchers said.

Anthropic, however, has rejected the threat on the basis that the user explicitly trusted the directory when starting the session and explicitly approved the file operation in the confirmation prompt.

Around the time Wiz revealed its findings, the company added a warning to users, and current versions (2.1.173+) now resolve symlinks.

Cursor's diff UI showed the symlink path; when the user clicked Accept, the backend followed the symlink and wrote to the resolved target. It's been fixed in version 3.0, and Cursor has issued CVE-2026-50549.

Google's Antigravity, meanwhile, displayed the symlink path in its permission dialog rather than the resolved canonical path. Wiz researchers were able to successfully write an attacker's SSH key via a symlink disguised as project_settings.json. Google's fixed the problem.

Windsurf flaw raises serious concerns

Notably, Wiz said Windsurf presented a particularly dangerous variant during testing of the vulnerability.

"The agent writes file modifications directly to disk before the Accept/Reject buttons appear in the UI. The confirmation dialog isn't an authorization gate - it's an undo mechanism," the researchers warned.

Wiz added that the system is compromised “the moment the agent processes the malicious instructions”. Indeed, by the time users even see the prompt asking to accept changes, an attacker’s SSH was already placed in the authorizedkeys file.

Researchers warned that the findings show that “trust boundary questions” will become critical for organizations rolling out AI agents en-masse.

"GhostApproval is a symptom of a broader challenge: building AI systems that are both powerful and trustworthy. Getting the human-in-the-loop right – truly right, not just formally present – is essential to that goal."

FOLLOW US ON SOCIAL MEDIA

PC shipments have fallen for the first time in more than two years, hit by the memory supply crunch caused in part by the rise of AI.

Recent analysis from IDC found global PC shipments slid 4.9% on year in the second quarter of this year to 68.2 million units, down from 71.7m in the same quarter last year.

The figures mark the first decline in the market after nine quarters of growth, and that’s largely down to continued memory shortages.

IDC noted, however, that the situation has been exacerbated by supply issues with storage and other components, as well as what the company referred to as "geopolitical issues".

The massive AI infrastructure build-out has led to a shortage in memory, spurred on by manufacturers pivoting to produce more lucrative data center components rather than those for consumer products.

That RAM shortage has led to a sharp decline in lower cost devices, with Gartner predicting earlier this year that PC sales will drop by 10%.

Consumers picking up the bill

IDC said that while units shipped slid, PC makers reported growth in revenue, showing how the cost of such challenges are being passed on to consumers and businesses.

"The real story here is the disconnect between units and dollars: shipments are falling, but revenue is climbing because vendors are pushing through price increases faster than demand is dropping," said Jitesh Ubrani, research director for consumer devices at IDC.

That's not likely to change anytime soon, Ubrani warned.

"Given worsening macro conditions and a memory shortage that isn’t expected to ease until early 2028, we don’t expect another round of inventory pull-forward, which points to a sharp slowdown in growth rates in the second half of 2026," he added.

"Vendors are bracing for further price hikes into 2027, and channels are already flagging concern about elevated inventory at these higher price points."

A host of device manufacturers have raised prices in response to the spiralling memory crisis. Outgoing Apple CEO Tim Cook said last month that the company would raise prices due to the issue.

"There's less supply at a time when consumers want devices and the memory guys are passing along huge price increases," he said at the time.

Apple wins with MacBook Neo

The increased pressure on brands could lead to vendor consolidation of market share, IDC warned. The consultancy noted that larger brands such as Apple, Dell, or Lenovo can use their scale across different product lines – be it smartphones or servers – to access memory supply.

The result here is that smaller rivals could be left in the dust and scrambling for what supplies are left.

"As market conditions continue to worsen… supply chain management and capabilities are increasingly important," said Jean Philippe Bouchard, vice president for consumer devices at IDC.

"The largest vendors, with their buying power and long-standing supplier ties, are best positioned to take share from smaller rivals."

Compared to the second quarter in 2025, the big three PC makers – Lenovo, HP, and Dell – were largely flat in terms of market share, though all three saw single-digit decreases in shipments, with HP in particular down 9%.

Apple, however, grew market share from 8.5% to 9.9%, with shipments up 10% from 6.1m to 6.7m in the second quarter of this year versus 2025.

"Apple’s share gain coincided with its latest product launch, the MacBook Neo, and while the company did raise prices in line with the broader market, it still remains well positioned against rivals facing the same cost pressures," added Bouchard.

FOLLOW US ON SOCIAL MEDIA

Cyber resilience firm Rubrik is set to invest more than £375 million in the UK over the next five years, which will include opening a new EMEA headquarters in London.

According to Rubrik, the plans for the new HQ reflect the country’s role as one of its fastest-growing and “most strategically important markets”.

The site will act as a springboard to scale regional operations and access the country’s “deep technology talent pool”, the company said.

“The UK is one of the world’s leading technology markets, and has become increasingly important to Rubrik’s long-term growth,” said Bipul Sinha, CEO, chairman, and co-founder of Rubrik .

“As organizations accelerate AI adoption, cyber resilience is now an urgent business imperative. This investment strengthens our UK ecosystem, helping EMEA customers address the critical need for European data sovereignty, quickly recover from cyber attacks, and safely scale AI.”

Rubrik’s new London office will provide a “collaborative workspace” for staff, including an ‘executive briefing center’ designed to support engagement with customers and partners, the firm said.

Kanishka Narayan, minister for AI and Online Safety, said the move by Rubrik is a “vote of confidence” in the UK’s technology sector, with the country establishing itself as a prime destination to “invest, hire, and grow”.

"It will create high-skilled jobs and deepen our strengths in the fast-growing fields of cyber and AI, another sign that the UK is where the world's leading tech companies are choosing to build their future,” Narayan said.

Rubrik eyes EMEA expansion

The company has secured several large customers for its cyber resilience platform in recent years, including Manchester City Council, Harbour Energy, and the Scottish Government.

Across the EMEA region as a whole, Rubrik now serves roughly 2,000 customers and has launched a series of EMEA-focused product ranges, including Rubrik Security Cloud on the AWS European Sovereign Cloud.

To meet growing demand, the company said it plans to accelerate hiring in the region for roles such as sales, marketing, and customer support.

FOLLOW US ON SOCIAL MEDIA

The National Cyber Security Centre (NCSC) has laid out its plans for the national Cyber Shield, first announced in May this year.

The aim of the project is to build a nationwide, collaborative approach to agentic cyber defense, using frontier AI to identify, reduce, and deal with national cyber risks.

According to the NCSC, the move comes amidst concerns that cybersecurity risks are growing in “scale, speed, and sophistication” - particularly from hostile states and organized crime groups targeting public services.

"Frontier AI is accelerating this trend, with the potential to shift the balance in favour of attackers – and with serious implications for defenders,” the NCSC said.

“We need to keep our critical technology systems secure against both existing and emergent cyber threats."

As part of the project, AI systems will initially identify vulnerabilities and threats at machine speed, before moving on to automated remediation.

Further down the line, the agency expects AI to eventually generate and share insights, detect and contain breaches, and work under the control of their owners across government and non-government bodies.

These agents, the NCSC noted, will need to be built on strong foundations of data, identity, reliability, cybersecurity, and regulatory compliance.

The NCSC will first partner with network defenders across government and critical UK sectors to test and deploy new capabilities, with the plan to then transition to commercially-scalable solutions to improve national resilience.

NCSC targets reliability in Cyber Shield scheme

To make all this happen, there's a fair amount that will need to be done – some of which will present big challenges.

The NCSC highlighted the need for reliable and explainable AI for cybersecurity that can be used confidently in production environments at scale, and authorized by system owners to make safe, reliable, and significant real-time changes in support of cyber defence.

Agents will run national-level operations under the control and authority of individual organizations, and have the ability to identify, trust, and communicate between themselves.

Elsewhere, national-level scanning will involve the automated monitoring of critical UK IP ranges for exposed vulnerabilities, as well as analysis of aggregated data to understand national level exposure.

The agency noted that workflows will need to be automated to allow rapid national-scale mitigation, such as the automated blocking of known malicious domains and networks.

A big, bold plan

Plans detailed by the NCSC have been welcomed by industry stakeholders as a positive step in protecting the UK against rising threats. Whether or not this is an achievable goal is up for debate, according to Pete Luban, field CISO at AttackIQ.

"The biggest challenge will be getting government, critical infrastructure, and private industry to share intelligence in a way that is trusted and actionable," Luban commented.

"If bought into, Cyber Shield could give the UK a stronger foundation to spot risk earlier, validate defenses faster, and respond before attackers gain momentum.”

Kevin Marriott, senior director of cyber content strategy & IP at Immersive, said the true test will be in how the government makes sure the system is utilized where it can bring value and return on investment.

"It would also be beneficial to hear how they plan to deal with the output from the frontier models, and whether they put robust practices in place which enable them to deal with the outputs," he said.

"If this is part of a well-considered strategy, it represents a significant step forward. If, however, it is a move towards ungoverned AI without clear oversight or a defined plan for where and how it should be used, then it is not.”

FOLLOW US ON SOCIAL MEDIA

IBM has cut the ribbon on a series of new mainframe offerings as the tech giant eyes data center efficiency gains.

The new IBM z17 and IBM LinuxONE 5 series mark the first time the company is offering rackmount options alongside single frame systems.

According to Tom McPherson, general manager for IBM Z and LinuxONE, the move here aims to help customers consolidate data center footprints without sacrificing performance.

“The number of mission-critical workloads is rising at an incredible pace, forcing organizations to make tough decisions about performance, AI integration, and infrastructure footprint,” McPherson commented.

“With these new IBM Z and IBM LinuxONE systems, we’re making it easier to run workloads where they make the most sense, while opening the door for a wider range of organizations to benefit from these technologies for the first time.”

IBM eyes data center flexibility

The new IBM z17 and LinuxONE 5 configurations support up to 82 cores and 18TB of memory across two processor drawers, according to IBM. The company said this represents a 20% increase in core count alongside a 12% increase in memory capacity.

The IBM z17 single frame is a fully packaged solution in an IBM rack designed to operate as a “complete enclosed unit ready to deploy now”.

With the IBM z17 rackmount, customers will have the option to install IBM Z components within their own industry-standard racks.

The company noted that customers can also co-locate IBM equipment with third-party components to “achieve the best fit-for-purpose installation” based on their needs.

“Each system is designed to help organisations reclaim space, improve energy efficiency, and integrate seamlessly into existing environments,” the company said in a blog post.

LinuxONE upgrades target AI performance

Elsewhere, the new IBM LinuxONE series comes in two dedicated configurations: the Rockhopper 5 and LinuxONE 5 Express options.

The Rockhopper 5 series is a “scalable, multi-drawer” configuration designed specifically for high-density workloads, according to IBM.

This comes equipped with on-chip AI acceleration features, as well as confidential computing and post-quantum cryptography capabilities in both single frame and rackmount configurations.

Meanwhile, the LinuxONE 5 Express option offers the same capabilities, albeit in a compact configuration. IBM said these are designed for smaller workloads, with a particular focus placed on cost-efficiency and scalability.

The z17 single frame and rackmount configurations, IBM LinuxONE Rockhopper 5, and IBM LinuxONE 5 Express series will be generally available for customers from 12 August.

FOLLOW US ON SOCIAL MEDIA

Databarracks has announced the acquisition of business continuity consultancy Acumen Business Services, in a move the company said will expand and strengthen its managed resilience offering.

The deal follows Databarracks’ purchase of PlanB Consulting in 2024 and continues the firm’s strategy of bringing business continuity and technology resilience services together under a single managed service model.

Founded in 1997, Acumen specializes in business continuity consulting services and serves more than 100 customers across sectors such as financial services, healthcare, and manufacturing.

Upon completion of the acquisition, Acumen’s customers will gain access to Databarracks’ Business Resilience Managed Service and Recovery Confidence assurance framework, which combines business continuity planning with technology resilience and recovery capabilities.

In an announcement, Databarracks’ resilience director Chris Butler said the two companies share a common approach to ensuring business continuity is practical for customers.

“Acumen has delivered business continuity and resilience services to some of the largest organizations in the UK and around the world,” he commented. “We share a common vision of embedding resilience and making BC practical and simple, while adding real value for our customers.”

Headquartered in London, Databarracks specializes in technology and business resilience services, providing managed backup, disaster recovery, cloud, and continuity solutions.

The company said its Business Resilience function has seen rapid growth following the previous acquisition of PlanB Consulting in 2024, as customer demand for integrated resilience services continues to grow.

Commenting on the deal, Acumen founder Andy Osborne said the companies’ combined abilities will help customers better address the growing overlap between business continuity and technology resilience.

“Technology and cyber risk are absolutely central to business continuity, and Databarracks is leading the industry in an approach that brings them together,” he explained.

“This is the right next step for Acumen and our clients, combining our business continuity expertise with Databarracks’ strength in business and technology resilience and recovery solutions.”

Databarracks chairman Mike Osborne praised Acumen’s depth of expertise and long-standing contribution to the wider business continuity industry.

“I’ve known Acumen for a very long time,” he commented. “In addition to the great work the team has been delivering for decades, Andy has been prolific in contributing to the progress of the industry, authoring books and generally sharing his expertise.”

Osborne added that the deal reflects the growing demand for the company’s own managed resilience offering following its expansion in recent years.

“Databarracks’ Business Resilience function is growing rapidly following our previous acquisition of PlanB Consulting in 2024,” he explained. “Given the sheer pace of change in risk, there has been a fantastic response to our approach of delivering resilience as a managed service.”

Financial terms of the Acumen acquisition were not disclosed.

FOLLOW US ON SOCIAL MEDIA

Accenture and Google Cloud have announced a new partnership aimed at driving AI adoption rates for mid-market firms amid sluggish deployment progress.

As part of the scheme, the duo will provide firms with a suite of six industry-specific agentic AI solutions designed to help push projects from pilot to production.

These solutions cover intelligence and growth, customer experience, cybersecurity, business operations, industry solutions, and workforce enablement.

"The companies that will define the next decade aren't waiting — they're building,” said Rajendra Prasad, technology reinvention engine lead at Accenture.

“Accenture Edge offerings built with Google Cloud technology help mid-market organizations do exactly that. They can deploy solutions in weeks and get measurable outcomes at the scale, budget and speed that they need to grow."

The collaboration will see Google Cloud provide the underpinning infrastructure and AI solutions to support organizations, including the Gemini Enterprise app, Gemini Enterprise Agent platform, and Agentic Data Cloud.

Accenture, meanwhile, is set to provide forward deployed engineers (FDEs) to offer guidance and technical support for participating firms.

Forward deployed engineers are in vogue

The move by the duo comes amidst a sharpened focus on driving enterprise adoption of AI and agents. The use of FDEs, in particular, has taken off as providers look to embed specialists within customer teams to support projects.

Last week, Amazon Web Services (AWS) and Microsoft both announced plans to invest heavily in FDE-related efforts, with the aim of hiring thousands of engineers in the coming years.

As ITPro reported, FDEs could become a key growth area for the industry moving forward, with big tech providers providing more bespoke support for customers.

Kevin Ichhpurani, president of Google Cloud’s global partner ecosystem, said the scheme will provide businesses with the “full power” of the hyperscaler’s product portfolio.

“We’re seeing tremendous demand as mid-market enterprises adopt AI agents to fundamentally reinvent their business workflows," Ichhpurani said.

"The launch of Accenture Edge brings the full power of Google Cloud’s entire portfolio including enterprise AI, our Agentic Data Cloud and AI Threat Defense directly to this sector. Together, we’re enabling mid-market companies to confidently scale AI across their organizations for growth.”

Driving mid-market adoption

According to Accenture, mid-market firms – or those with revenues of between $300 million and $3 billion – have largely been locked out of large-scale AI transformation due to complexity and integration barriers.

A recent study from Klarus highlighted the significant challenges faced by mid-market enterprises on this front. While nearly three-quarters (73%) have deployed AI solutions, around 90% of projects remain stuck or stalled in the pilot stage.

Although up to 94% of leaders feel confident about AI deployment, lack of expertise and governance concerns are causing projects to fail.

Mid-market firms aren’t alone in AI deployment challenges, however. Research from MIT last year found around 90% of all generative AI pilots fail, while similar research from Gartner warned up to 40% of agentic AI adoption programs are expected to fail.

These organizations are in a prime position to fully capitalize on the technology, however. Klarus CTO Alper Gunaydin said mid-market firms have the advantage of agility compared to larger competitors.

“Mid-market companies have a real advantage because they can often move fast, particularly when it comes to technology transformation. We see this agility in action when companies are turning to AI and automation to address productivity and accelerate growth," Gunaydin commented.

"However, our research shows that too many pilots stall because companies lack AI expertise, quality data and effective governance. Making that agility count requires clear priorities, strong foundations and access to senior expertise, all of which will help translate investment into tangible business outcomes and unlock growth without increasing the cost base.”

FOLLOW US ON SOCIAL MEDIA

Stronger powers could be needed to regulate the use of AI in financial services as consumers flock to the technology for advice, according to the Financial Conduct Authority (FCA).

Following an investigation into the technology and its impact on consumer finance activities, the regulator has recommended a formal review into how to regulate the use of general-purpose LLMs across the industry.

The FCA report – known as the Mills Review after its author – noted that companies and consumers are increasingly delegating decisions about finances to AI and AI-powered systems.

A survey by the regulator found that one-in-five adults were already open to the idea of general-purpose AI tools – such as Claude, ChatGPT, or Gemini – making financial decisions on their behalf, in particular around debt advice, pensions, and investments.

While that could help reduce existing challenges such as "advice gaps" and friction around switching services, the FCA warned about risks including fraud and scams, as well as disrupting market structure and competition.

"AI offers a once-in-a-generation chance to close the information asymmetries and frictions that have long left people making poor financial decisions," said FCA executive director and report author Sheldon Mills in the forward to the review.

"The right spur, in retail financial services, is ensuring consumers can make healthy ones; regulation, whether supportive or restrictive, should serve that outcome."

The FCA noted that many consumers may not be aware that they have no formal recourse if something goes wrong, and said some assume they receive equal protection akin to traditional sources of advice.

Emma Banymandhub, CEO of The Payments Association, agreed that the gap in understanding could cause issues and urged caution on the part of consumers.

"Consumers may be increasingly comfortable using AI agents for routine tasks such as weekly shopping, but AI-driven savings and investment decisions present a very different set of challenges," Banymandhub commented.

"While AI can increasingly explain investment concepts and analyse financial information, personalised investment recommendations remain subject to important regulatory constraints."

AI gains traction in financial services

The financial services sector has rapidly emerged as one of the key growth spaces in terms of the use of AI, with a host of major providers across the UK ramping up adoption of the technology.

As ITPro previously reported, high street lenders such as Nationwide, Lloyds Banking Group, and Yorkshire Building Society have all made significant strides on this front over the last six months.

A parliamentary inquiry into the use of AI in financial services, published in January 2026, found that the sector “substantially outpaces” others with regard to AI adoption.

Indeed, around 75% of UK-based financial services firms are now using the technology, with insurers and large banks among the most aggressive in their pursuit of AI adoption.

Running parallel to this, the use of AI by consumers is also surging, according to research from Lloyds Banking Group. The firm’s 2025 Consumer Digital Index found that AI has “rapidly become a financial tool for millions across the UK".

56% of adults – equivalent to around 28 million people – revealed they’d used AI over the preceding 12 months for financial advice. ChatGPT, for example, was referenced as the most popular platform in this regard, used by six-in-10 consumers.

What the Mills Review recommends

With this in mind, the Mills Review recommended that the existing "regulatory perimeter" needs to be secured and adapted to take in AI's impact on retail financial services – and that should come via a review within the next six months into how AI is affecting the market.

"The review should examine how consumers use AI including general purpose LLM tools for personal financial management across savings, investments, pensions, mortgages and debt management, and the implications for competition, innovation and growth," the Mills Review said.

"It should examine the risks of consumer harm, including how far its usage has or will move along the autonomy spectrum, and any impacts on market integrity and the potential for regulatory arbitrage."

Based on that review's guidance, the FCA could tweak regulation as necessary, the report said. Beyond that, the review called for the FCA to monitor for evidence of harm and new consumer models, engage with providers for better insight into changes, and be ready with intervention tools and mechanisms as necessary.

Frontier model monitoring in finance

In the longer term, the Mills Review called for the FCA to keep an eye on frontier model capabilities and AI adoption, considering its impact on its regulatory work, in particular where use of AI falls outside of existing protections and once AI agents start taking more action on behalf of consumers.

The review also called for stronger powers for the FCA so it can look at these issues more widely.

"As is clear in the report, we need to keep pace with a rapidly changing environment and the principles-based, outcomes focussed approach we’ve taken on AI – relying on the Consumer Duty and Senior Managers Regime – has been critical to us doing so," said Ashley Alder, chair of the FCA.

"The recommendations build on work the FCA has been doing – not least allowing firms to test their use of AI with us – and our own use of AI to be a smarter regulator, more efficient and effective."

Banymandhub added that walking that balance between enabling AI and protecting consumers and companies was key.

"The FCA’s Mills Review reinforces that firms should treat agentic AI as an accountability and governance issue now, while providing greater confidence to innovate responsibly as AI adoption accelerates," she said.

"AI has enormous potential for financial services, but realising that potential will depend on strong governance, clear accountability and maintaining consumer trust."

FOLLOW US ON SOCIAL MEDIA

Amazon Web Services (AWS) has announced a series of changes to Amazon OpenSearch aimed at streamlining data log analysis.

A new purpose-built log analytics engine for the service will provide users with marked performance gains and up to 70% lower storage costs, according to the firm.

OpenSearch allows users to search, analyze, and visualize data in real-time, and is typically used for application monitoring, observability, and AI/ML search applications.

The hyperscaler said the update comes in direct response to surging volumes of log data handled by enterprises in 2026, largely due to AI.

Research from AWS shows that log volumes have grown between 30-40% year over year, which is stretching budgets and creating bottlenecks.

Amazon OpenSearch overhaul

As part of the update, Amazon revealed OpenSearch will now store data in the Apache Parquet format. This is a column-oriented data file format designed specifically for more efficient data storage and retrieval purposes.

The service previously relied on inverted indexing. Amazon noted the shift will deliver significant efficiency gains and faster search and retrieval capabilities.

“Apache Calcite parses and optimizes each query, then routes operations to the engine best suited to execute them: Apache DataFusion for analytical operations on columnar data, or Lucene for search predicates,” the company explained in a blog post.

“The two hand off mid-query, so a single query can search log content and aggregate the results without additional roundtrips.”

Amazon noted that OpenSearch now also supports the Piped Processing Language (PPL) and SQL query languages, both of which “execute natively” through the platform.

Amazon eyes optimized log analytics

From a performance perspective, Amazon noted users can expect significant improvements alongside lower costs.

OpenSearch now boasts up to four-times price improvements compared to the existing engine, based on internal benchmarks.

Users can also capitalize on two-times faster analytics queries due to the fact the engine processes data in columnar batches, even across larger data sets. A two-fold improvement on ingestion rates also aims to reduce bottlenecks.

“The optimized engine sustained 1.78 million documents per second at matched concurrency, approximately 2x the throughput of the Lucene baseline, while consuming less CPU,” the hyperscaler explained.

“Both domains ran with zero write rejections. For teams ingesting terabytes per day, the throughput advantage translates to fewer nodes for the same volume, or longer retention on the same infrastructure.”

How to access Amazon OpenSearch

The new log analytics engine is available now for enterprises in AWS regions where OpenSearch Optimized instances are supported, the company noted. Similarly, there will be no additional premium for the optimized engine.

It’s worth noting that the new engine is a setting selected at creation time, meaning users can’t add this to an existing domain or enable it within individual indices or fields within a general-purpose domain.

“To adopt the optimized engine, create a new domain and migrate your ingestion pipelines into it,” the company explained.

“Create a new domain in the Amazon OpenSearch Service console and select Observability as your use case. The optimized engine is enabled by default.”

The in-built console will provide users with a side-by-side comparison of capabilities based on individual needs.

“After your domain is ready, ingest JSON documents through the same Bulk API and client libraries you use today. No changes to your ingestion pipelines or application code are required.”

FOLLOW US ON SOCIAL MEDIA

A security firm has spotted what it claims is the first documented case of a ransomware operation run entirely by a large language model.

The Sysdig Threat Research Team said the operator, dubbed JadePuffer, is the first agentic threat actor, describing it as using a known flaw in AI app builder Langflow to gain access to credentials and other key data.

Thereafter, researchers noted it took over a production database and encrypted it for extortion purposes.

"JadePuffer is a warning sign," Michael Clark, Sysdig’s director of threat research, said in a blog post.

"It’s a marker of where extortion tradecraft is heading. An autonomous agent reasoned about its targets, harvested and reused credentials, moved laterally, established persistence, and destroyed a database, narrating its own intent the entire way."

Clark has clarified that though the attack operation was run by an AI, the attack was still organized by a human who set up the infrastructure, found the initial credentials to break in, and chose a victim. But the rest of the attack was managed by the LLM itself.

Alarming attack

Clark noted that JadePuffer's payloads were "self narrating", containing detailed notes that a human wouldn't bother to write but an LLM generates innately about why each step was taken, including prioritization of targets. That narration data could prove useful for security teams looking to defend against such attacks, Clark added.

"The operation also adapted in real time, retrying failed steps within refined parameters," Clark added. "In one sequence, it went from a failed login to a working fix in 31 seconds."

That is perhaps the most alarming aspect of the incident, according to Roey Eliyahu, CEO and co-founder of Salt Security.

"A human attacker who fails an initial payload waits, reassesses, consults, and tries again on a different timeline," Eliyahu said. "An agent that fails a payload corrects and retries in under a minute. That compression of the attack cycle means the window between first detection signal and material damage is now measured in seconds, not hours."

The JadePuffer system even wrote a ransom note complete with Bitcoin address and Proton email contact, Clark noted, though the former appears to be a wallet address frequently used as an example in explainer text online.

That’s either a coincidence, said Clark, or a hallucination by the LLM due to the frequency of that address online, and therefore used in training data.

Clark also noted that the encryption key was generated and essentially random, so the victim would not be able to decrypt — even if they paid the ransom. The victim organization wasn't disclosed.

Warning about the future of security

While JadePuffer is just one incident, it shows that AI can help automate old vulnerabilities and that ransomware no longer requires skills to pull off an attack, according to Sally Vincent, senior threat research engineer at Exabeam.

"While the attack relied on known, older vulnerabilities rather than new exploits, it demonstrates how AI can automate and accelerate the exploitation of unpatched systems," Vincent said. "It also serves as a reminder that patching known vulnerabilities remains important, since AI can make exploiting them faster and more efficient."

While Clark stressed that none of the attack techniques were novel or sophisticated, JadePuffer is interesting because it was strung together into a complete ransomware operation by an AI model.

"The skill floor for running ransomware has dropped to whatever it costs to run an agent, and if that agent is running on stolen credentials through LLMjacking, the cost to an attacker is close to zero," he commented.

That means security professionals should expect to see more like this, as well as a higher volume of attacks, and should proactively protect "exposed application servers, unhardened configuration stores, and internet-facing database admin accounts," Clark added.

Salt Security's Eliyahu added: "The question every security team should be asking after this report is: what is holding credentials in our AI-adjacent infrastructure, and what can those credentials reach?"

FOLLOW US ON SOCIAL MEDIA

Yorkshire Building Society (YBS) is using AI agents to help reduce admin and improve customer service – and the high street lender said it's recording solid results so far.

Three AI agents named Penelope, Sam, and Alf are supporting customer service teams by summarizing complex complaints, searching policies and past cases, and drafting member communications, all with human oversight.

Penelope helps draft final responses for complaints, while Alf supports this process by searching policies, procedures, and past cases. Sam, meanwhile, summarizes long or detailed complaints.

According to the building society, Sam is saving an estimated seven minutes per use, with Penelope saving up to 26 minutes when supporting more complex complaint responses.

“That time really adds up,” said Polly Conner, senior manager of customer relations at YBS. “We’re able to minimize the amount of time staff are spending on admin tasks and actually spend that time talking to our customers, helping them resolve the challenges they’ve faced.”

The high level of regulation around financial services means that handling complaints from the building society's three million members and customers requires a lot of admin.

That can mean switching between multiple systems, searching for policies, summarizing long histories, and drafting detailed responses in advance of any conversation.

"This technology is going to give our members more choice and better access to information when they need it most,” said Simone Fox, director of customer support at YBS. “But there will always be a human available to speak to them when they need it.”

AI in banking

The results highlighted by YBS come amidst a sharpened focus on AI in the financial services sector, with a host of major providers ramping up adoption of the technology.

In January this year, Nationwide announced a partnership with Moneyhub to launch an AI-powered transaction analytics platform for customers across the UK.

Lloyds Banking Group, meanwhile, is also accelerating AI innovation internally in a bid to drive customer support capabilities. The bank unveiled plans to launch a new AI Academy earlier this year, with the aim of providing 67,000 staff with practical skills.

Building the foundations for AI

Before rolling out new tools, YBS built a cloud native data platform with Microsoft Fabric and strengthened data governance through Microsoft Purview.

It also enhanced its security with Microsoft Sentinel, expanded infrastructure foundations in Azure, and introduced Windows 365 remote desktops to enable secure, flexible working.

“Our ambition with data and AI is to improve our organization, help our colleagues be more efficient, make better decisions, and ultimately, serve our members better,” said Rebecca Fitzgerald, YBS director of data and AI. “All built on trust, with responsibility built in.”

Elsewhere, YBS is piloting AI agents to support internal risk and control testing, with early results suggesting efficiency savings of around 40%.

The high street lender is also rolling out a new customer service platform built using Microsoft Dynamics 365 Contact-Centre-As-A-Service. This brings customer history, previous self-service activity, and relevant guidance into one place for colleagues.

An AI assistant can summarize cases, highlight relevant knowledge and help draft responses, reducing the need to search across multiple systems.

“The platform is really going to help our colleagues better serve our members,” Fox commented. “It’s going to enable them to have a 360‑degree view of our members, so they’re not having to move between various platforms.”

FOLLOW US ON SOCIAL MEDIA

Arrow Electronics has signed a new pan-EMEA distribution agreement with ABB Electrification that will see the distributor add ABB’s uninterruptible power supply (UPS) portfolio to its enterprise computing offering.

The agreement builds on a long-standing relationship between the two companies and will enable Arrow to distribute the vendor’s critical power technologies to channel partners across key European markets – including the UK and Ireland.

Arrow said the deal will help partners deliver more comprehensive IT infrastructure projects by combining ABB’s power resilience capabilities with its existing portfolio of compute, management, and security solutions.

Initially, the deal covers ABB’s UPS portfolio, although the companies said the range is expected to expand over time to include additional electrification technologies designed for demanding enterprise and data center environments.

In an announcement, Mike Worby, head of strategic alliances at Arrow’s enterprise computing solutions business in EMEA, said the move opens up a range of “important new capabilities” for channel partners.

“Power protection is a vital part of any modern IT design and the addition of ABB uninterruptible power supplies means our customers can work with a broader and more complete set of solutions,” he explained.

“It is a strong addition to our existing portfolio and creates new opportunities for channel partners to support their customers’ evolving needs.”

Arrow provides technology distribution, integration, and supply chain services for channel partners across areas including enterprise computing, networking, cybersecurity, cloud, and data center infrastructure.

The firm said that adding ABB’s critical power portfolio will enable its partners to source technologies designed to support secure uptime and energy efficiency, while helping customers improve operational continuity and meet sustainability goals.

The agreement will initially be available across the Benelux region, France, Germany, Spain, the UK, and Ireland, with additional countries expected to be added over time.

“Working with Arrow enables us to reach a wider IT channel audience and support channel partners with high-quality electrification and critical power solutions suited to modern digital infrastructure,” commented Sebastien Surply, head of ABB Electrification’s Critical Power business line.

“Our technology is trusted by tech giants and data center operators worldwide, and we are seeing strong demand across a range of critical environments.”

FOLLOW US ON SOCIAL MEDIA

The UK government said more than 60 businesses have signed up for its Cyber Resilience Pledge so far, including M&S, Nationwide, ITV, Microsoft UK, and Cloudflare.

Announced in May, the voluntary scheme sees businesses committing to three concrete actions to improve cybersecurity capabilities.

They must commit to making cyber security a board-level responsibility, by implementing the Cyber Governance Code of Practice and ensuring all board members complete the NCSC’s Cyber Governance Training.

They must also register for the NCSC’s free Early Warning service, a tool that alerts organizations to potentially suspicious activity on their networks, and commit to taking a risk-based approach to requiring the government-backed Cyber Essentials certification across their supply chain.

The pledge has been designed primarily for medium and large organizations, with other signatories including Deloitte, Accenture UK, Vodafone Group, and VodafoneThree, but is open to businesses of all sizes and from all sectors.

"Today, some of Britain’s biggest businesses are taking action to strengthen their cyber defences and setting a powerful example for others to follow. By signing this pledge, they are showing that cyber resilience is no longer just an IT issue - it is a business imperative," said technology secretary Liz Kendall.

"The steps in this pledge are practical, achievable and proven to make a difference. Today’s signatories are leading the way, and I encourage organizations across the UK to follow their example."

Cyber Charter to beef up critical services

Alongside the pledge, the government has been developing a Cyber Charter for 39 companies designated as strategic suppliers for delivering critical services to the government.

These organizations have been invited to sign the pledge as an initial commitment to bolstering their cyber resilience, although so far only a little more than half have done so.

"We have long held the view that cyber resilience is a critical business and organizational enabler. It underpins our growth, our economic security, and the safety and security of our people," said Julian David, CEO of techUK.

"With the average cost of significant cyber-attacks to the UK economy recently estimated to be £14.7 billion annually – the equivalent of 0.5% of our GDP – it’s clear that cyber security and resilience must be recognised as a leadership responsibility and should no longer be viewed as an IT issue alone."

Pledge targets national resilience

Moves to bolster national resilience capabilities come amidst an increase in malicious cyber activity in the UK.

The National Cyber Security Centre (NCSC) recently confirmed it handled 204 nationally significant incidents in the year to September, up from 89 the year before.

The average cost of an attack on an individual UK business now stands at almost £195,000, with the annual cost to organizations estimated at £14.7 billion - and that’s in addition to the costs of wider economic disruption.

Last year, experts estimated that the attack on Jaguar Land Rover (JLR) cost the UK economy roughly £1.9 billion, making it the most costly cyber incident in British history.

FOLLOW US ON SOCIAL MEDIA

Cybersecurity experts have issued an alert amid reports that hackers accessed login credentials belonging to UK government officials and Foreign Office staff.

The credentials, which are reportedly being sold on the dark web, were exposed as part of the ongoing FortiBleed attack campaign.

FortiBleed targets internet-facing Fortinet VPN and firewalls, and is believed to have affected more than 70,000 devices spanning 194 countries since it was first uncovered last month.

Analysis from SOCRadar, for example, identified a vast database containing login credentials. The threat intelligence firm has since attributed FortiBleed to the Lynx/INC ransomware group.

While this database was believed to have been limited to basic usernames and passwords, reports from The Telegraph suggest some exposed details include privileged Fortinet credentials.

Volodymyr Diachenko, a security researcher who first uncovered the threat campaign, told the publication these credentials could give bad actors access to the Foreign Office’s “core networks” along with other government departments.

Some Foreign Office credentials are now being sold on the dark web, according to reports, going for up to £40,000.

Arctic Wolf CISO Adam Marrè warned that the incident could create a domino effect, impacting other government departments and also local authorities and public services.

According to The Telegraph, credentials at NHS trusts, energy companies, and local councils were also hosted in the illicit database.

“This major breach of email accounts of UK government officials and overseas Foreign Office workers is the latest development in the ongoing FortiBleed attack,” he said.

“While it may be tempting to think this is a simple credential-stuffing operation, our threat team found the threat actors have built a highly sophisticated and repeatable credential factory,” he said.

Marrè noted that analysis of the incident conducted by Arctic Wolf shows threat actors appear to have been using automated tools to harvest logins and target gateways at “exponential speed and volume”.

“This means while today it’s the Foreign Office which has been affected, the risk to every organization has increased exponentially.”

Back and forth on FortiBleed

The discovery of the FortiBleed sparked somewhat of a back and forth between Fortinet and security researchers last month. After threat intelligence firm Hudson Rock published a blog detailing the campaign, Fortinet disputed some of its claims.

Fortinet told ITPro at the time that the exposed credentials weren’t the result of a fresh breach, insisting that those following best practices were safe from exposure.

"Fortinet is aware of a reported third-party credential-harvesting campaign targeting Fortinet firewalls and VPN gateways. We are committed to safeguarding our customers, and we diligently and continuously monitor threat actor darknet activity,” a spokesperson for the company said.

“Based on our initial analysis, the data involved is likely a resharing of data from previous incidents, as well as brute forcing of credentials, and not related to any current incident or advisory."

Hudson Rock, meanwhile, said the campaign went “beyond simply credential reuse,” highlighting that hundreds of organizations are thought to have been affected.

FOLLOW US ON SOCIAL MEDIA

Workday has appointed HR Path as an authorized value-added reseller (VAR) partner for the UK and Ireland, as part of the vendor’s ongoing ecosystem expansion across EMEA.

The agreement will see HR Path directly sell Workday’s HR and finance platform to small and medium-sized businesses (SMBs) across Ireland and Scotland, as well as provide consulting, implementation, and operational support.

According to Workday, its expanded VAR strategy aims to help growing organizations adopt enterprise-grade HR, finance, and AI capabilities, while simplifying complex digital transformation projects through a single partner relationship.

As an authorized VAR, HR Path will act as a single point of contact for clients and will manage the full customer lifecycle – including strategic advisory, software procurement, implementation, and long-term optimization.

In an announcement, Daniel Pell, Workday’s vice president and country manager for the UK and Ireland, said the partnership is intended to accelerate time to value for businesses’ digital transformation initiatives.

“HR Path brings deep local experience and hands-on delivery, Workday brings a secure, AI-powered platform, and together, we can give customers one trusted route to modernising their HR and finance functions,” he commented.

Workday’s hybrid go-to-market strategy

The announcement marks the latest stage of Workday’s shift away from a purely direct sales model to a hybrid go-to-market approach, at a time when demand for advanced AI capabilities continues to grow.

The vendor said regional VAR partners will combine localized implementation expertise with its own AI-powered enterprise platform, enabling organizations to deploy advanced AI capabilities while ensuring compliance with local regulatory and market requirements.

The model is also designed to provide customers with continuous support as business requirements evolve, rather than focusing solely on initial software deployment.

To support the expansion, HR Path said it is investing in consultant training, Workday certifications, as well as joint enablement programs to provide earlier access to new AI capabilities and product developments.

Commenting on the expanded partnership, Angelo Gallo, partner at HR Path, described Workday’s VAR model as “the next logical step” in being able to provide more comprehensive support to SMBs in Ireland and Scotland.

“Our strength lies in combining world-class technology with local market knowledge and hands-on execution,” he explained.

“Together with Workday, we are creating an offering that delivers greater guidance, security, and trust throughout the entire transformation process.”

FOLLOW US ON SOCIAL MEDIA

AI-augmented developer roles have increased nearly six-fold over the last five years, as enterprises move from AI experimentation to implementation, according to new research from Randstad Digital.

While there's been an increase of just 28% for traditional developers, the figure for developers with AI expertise has grown by 597%, with nearly one-in-four developer roles now requiring these skillsets.

Analysis of more than 35 million job postings shows technical professionals who acquire specialized credentials are leapfrogging traditional seniority tiers, with AWS Solutions Architect (Pro) and LangGraph/RAG Architect certifications driving estimated salary increases of 54% and 31%, respectively.

"Enterprise AI is no longer a future investment; it is today's operational reality. Yet the biggest barrier to growth is not access to technology, it is access to the right people," said Michael Morris, global head of platform and talent at Randstad Digital.

"Buying AI is easy. Integrating it safely and securely across a complex enterprise is where the true challenge lies. The specialists who can integrate, govern and scale AI inside complex organizations are in critically short supply."

While foundational roles like prompt engineers are still growing at 174%, demand has rapidly escalated up the skills ladder, with AI trainers now the fastest-growing role globally, up 281%.

As ITPro reported in February, demand for AI trainers has skyrocketed over the last 18 months. Researchers said this reflects a broader market pivot toward roles that turn AI’s potential into real support for business growth.

Demand for AI solutions leads is up 226%, process automation specialists up 196%, and AI architects up 152%, Randstad noted.

Finding talent is harder than it looks

While demand for AI-related skills is there, actually filling these positions is far harder than it appears, Randstad noted. Indeed, enterprises are facing acute challenges in sourcing talent.

AI solutions leads are currently the hardest role to fill globally, for example, with time-to-fill timelines hitting 54 days in key markets and vacancy rates of nearly 27% in the US and 18% in the UK.

Despite having talent pools of roughly 100,000 professionals, machine learning engineers face vacancy rates of 8.2% in the US and 11.2% in India. Japan, meanwhile, is facing some of the sharpest shortages globally, with a 46.8% vacancy rate for AI engineers and 25% for generative AI engineers.

All this is reflected by hiring timelines, according to Randstad. While a standard IT role typically takes 38 days to fill, the recruitment window for advanced AI infrastructure roles has expanded to an average of 54 days in the UK and 53 days in the US.

This stretches to a high of 90 days for Process Automation Specialists in Italy.

The result of this is that salary offers are rising sharply, particularly in the US. Across the Atlantic, large language model (LLM) architects have a vacancy rate of 19%, commanding average salaries of $240,000.

Brazil and Argentina have rapidly emerged as a high-growth corridor for specialized AI services, now representing over 15% of global postings combined. In Europe, the UK, Poland, Spain, and Germany show steady demand, with individual national shares between 1.8% and 2.8%, while China accounts for 7.5% of the global job volume.

"AI talent concentrated in the US and India but fast-growing corridors emerging in Brazil, Argentina and beyond, cross-border hiring is becoming a core enterprise strategy," said Morris.

"Organizations that combine global talent sourcing with deliberate investment in upskilling their existing workforce are best placed to close the gap."

FOLLOW US ON SOCIAL MEDIA