2026 has been dominated by claims of a looming ‘SaaSpocalypse’, with AI heralding the doom of software as we know it. Marc Benioff and Jensen Huang aren’t convinced.

During the opening day keynote at Dreamforce 2026, the Nvidia and Salesforce CEOs dismissed the prospect of SaaS dying off.

Concerns on this front mounted earlier this the year with the launch of Anthropic's Claude Cowork. The new service, which offered enterprises agents equipped with sector-specific capabilities, prompted a mass sell-off of software stocks

In early February, the S&P 500 software software and services index slipped by nearly 5%, losing $830 billion in market value in a matter of days.

Huang told Benioff that even amidst growing industry concerns, he wasn’t fully convinced. AI might have an impact on the software industry, but more in the sense that it will complement and redefine SaaS.

“I was the first CEO to come out - not in the software industry - to say the end of software is nonsense,” he said. “This is going to be a layer on top of software. This new layer on top of software is going to be agentic.”

“It’s going to make software so much better.”

Huang’s comments came after Benioff reflected on the state of the software industry earlier in the keynote, describing claims this year as “crazy nonsense”.

“We've been hearing all this kind of crazy nonsense about the SaaSpocalypse, especially over the last six months,” he told attendees. Similar to Huang’s outlook on this front, Benioff noted that AI will ultimately be a net positive for the software industry and users.

“We realize that the SaaSpocalypse isn’t about the end of software, but it may be about the end of software that makes humans do all the work,” he said.

Salesforce’s earnings on this front, Benioff said, are testament to the fact that it’s weathered this storm so far. The CRM giant’s Q2 earnings, released in August, marked its best performance on Wall Street since 2020 and among the best in the company’s history.

Revenue in areas such as Agentforce and Data 360, for example, reached nearly $3.9 billion, marking a 210% increase year-over-year.

SaaS isn't dying, but it's still changing

Huang and Benioff join a host of tech industry leaders to shrug off claims that AI will render SaaS obsolete. As ITPro reported in February this year, AWS CEO Matt Garman said “much of the fear is overblown” but admitted that the technology will prompt huge changes in the industry.

The arrival of AI, particularly agentic AI, will change how software is built and consumed, he said at the time. That means existing providers will face a more competitive business landscape and force them to work harder to secure – and maintain – market share.

Research from Gartner in late June highlighted this new reality for software providers. Agentic AI does pose a threat to traditional software revenue models, according to the consultancy, with up to $234 billion of application spending exposed to “agentic arbitrage”.

This is a process whereby agents render some services obsolete and removes the need to work across multiple interfaces. Salesforce, it seems, is ahead of the curve on this front.

The company unveiled AIforce ahead of Dreamforce. This is a new ‘live interface layer’ that sits on top of its core product ranges, such as Agentforce, Data 360, and Customer 360.

Put simply, AIforce means users can use Salesforce without actually accessing the platform through traditional dashboard routes. Instead, users can access services, data sources, and information through agents such as Anthropic's Claude with their own custom-built UIs.

FOLLOW US ON SOCIAL MEDIA

Microsoft has become the latest big tech firm to weigh in on the dangers of AI, with a new Humanist Code of Conduct that's up for public consultation.

The document sets out the principles on which the company plans to train its models, saying it's motivated by a single overriding objective: that humans must retain meaningful control over AI.

The principles it outlines are not yet being used to train Microsoft's models, with the company saying it wants to gather feedback through a public consultation. It will then publish a revised version of the code towards the end of this year, which will be used to guide model development in 2027 and beyond.

"The recent safety incidents of large scale, highly coordinated, and persistent hacking campaigns of AI agents prove that there's no time to waste. The stakes are high and only getting higher," said the firm.

"We believe it is more important than ever to create safe and reliable AI in service of people, and to be transparent about how we go about it."

The document prohibits AI models from certain behaviours: they mustn't help with chemical, biological, radiological or nuclear weapons, generate violent or sexually explicit content or carry out offensive cyber operations.

They must not try to evade human oversight, engage in large-scale manipulation or make claims to consciousness, feelings or legal personhood.

"Whilst the science of AI consciousness is far from settled, we believe that training these systems to imitate consciousness-like states increases the challenge of containment, control, and alignment," Microsoft said.

The company said it's already consulted with experts in AI, law, ethics, philosophy, linguistics, and public policy, as well as business leaders from across industry, and has also held a series of focus groups with members of the public.

However, it's calling for more public input into the code of conduct, with a six-week consultation now open.

"We are especially interested in the hard parts: how can we better cement the right values in our models? How to be more concrete about the meaning of 'human flourishing'? Where is the language too loose to evaluate? How do multi-agent scenarios impact things?" it said.

"And perhaps most importantly of all, how do we continue to accelerate progress, whilst also ensuring we maintain healthy and necessary safety constraints?"

The release of the code of conduct follows a surge of concern over AI safety, including the resignation of Anthropic researcher Jacob Coxon. AI could, he said, lead to the extinction of the human race if more controls aren't put in place.

Anthropic's Dario Amodei has weighed in with a call to slow down AI development, as has OpenAI's Sam Altman – but not Donald Trump, who has described such concerns as 'a hoax'.

"AI's opportunity to deliver transformational benefits for humanity is real. And yet, if mismanaged, it will also pose grave dangers, including new and as-yet poorly understood frontier risks," Microsoft said.

"Models, and the process by which they are developed, deserve public scrutiny and engagement."

FOLLOW US ON SOCIAL MEDIA

If you're having trouble with copy and paste in Excel, you're not doing it wrong; it's simply been disabled by Microsoft's latest Patch Tuesday update.

Unfortunately, it's going to be like that for some time, as there isn't a fix, at the time of writing.

Patch Tuesday is a monthly update from Microsoft where it fixes and updates various parts of its software. Much of it focuses on Windows security and improvements to its suite of applications.

However, these fixes sometimes cause problems elsewhere. Case in point: the latest security patch for Excel has taken down the copy-paste function. Users first reported issues with Excel 2016 after the update, known as KB5002914, was installed. Soon after, users reported the issue in other versions of Excel, and Microsoft has acknowledged it and said it is working on a fix.

Under 'known issues', Microsoft posted: "In Microsoft Excel 2024, 2021, 2019, and 2016, the paste operation might fail silently. Although users try to paste content, the source remains selected, and the destination is unmodified. When this issue occurs, users receive no indication of the failure, such as a beep or error message. Microsoft is researching the issue and will post more information in this article when the information becomes available."

Bugs and issues are expected when updating a sprawling software stack like Microsoft's, and the company's Patch Tuesday releases have been known to come with some downsides. In May, bugs where images would not display inside mail were reported, and in June, the main email messages were hidden. Both were a result of monthly updates.

Thankfully, Microsoft has spotted and acknowledged this issue introduced by KB5002914. Unfortunately, it has yet to come back with a fix, so there isn't anything you can do except painstakingly type out everything in Excel.

Enterprise software has never been especially simple to buy, but the commercial side is becoming harder to untangle. AI features can introduce new consumption charges and vendor-specific pricing metrics, while expanding software suites make it harder to isolate the cost and value of individual capabilities.

To understand how the buying process is changing, ITPro spoke to Haritha Khandabattu, VP Analyst at Gartner, Mickey North Rizza, Group VP for Enterprise Software at IDC, and Faram Medhora, Principal Analyst at Forrester.

All three describe a market in which the relationship between licence counts and eventual spend is becoming less predictable. IT leaders now have more to work out before they can judge whether a deal will still make sense once the software is in use.

The unit of software is changing

For many seat-based enterprise products, the basic maths was relatively easy to follow: multiplying the number of users by the licence price gave buyers a reasonable estimate of spend across the contract term.

AI consumption models make that calculation trickier.

Khandabattu says pricing has shifted towards vendor-specific units such as tokens, credits, work units, and currency multipliers, often layered on top of existing seat or subscription charges; those units rarely translate neatly between suppliers. “One vendor’s token isn’t another’s, credits get repriced, and metrics get renamed mid-contract,” she says.

Consumption pricing also weakens the traditional relationship between user numbers and software spend, according to Khandabattu. A single AI agent can trigger chains of API calls and other metered activity, with usage varying considerably according to the task.

“A seat is a budget line; an agent is a behavior pattern,” Medhora says. “If buyers do not model the behavior pattern, they have not modeled the cost.”

Procurement teams can enter negotiations with little production data on how heavily an AI service will actually be used. Forecasting lifetime spend becomes much harder when they have yet to see that consumption at scale.

Something as simple as a misconfigured agent could burn through many more tokens than procurement teams were expecting, and stopping agents in the act is difficult.

It’s becoming harder to know what you’re actually buying

Pricing is only part of the problem. AI capabilities are being added to software that businesses already use, and organizations are consolidating more functions into larger software suites. Procurement teams need a clear picture of what a new feature adds before paying for another licence or upgrading an existing one.

Medhora suggests judging AI add-ons by the business outcome they produce, including whether they measurably improve an existing process or provide something the current software estate cannot. “If the answer is only a better-looking prompt box, it is not a value case; it is a packaging exercise,” he says.

The same capability may already exist elsewhere in a sprawling software estate.

North Rizza points to the continued accumulation of tools across organizations, often without a complete view of which products are being used or where their functions overlap.

IDC’s research also shows businesses consolidating around larger software suites, which can reduce the number of separate vendors while leaving individual capabilities inside those bundles harder to price and track.

North Rizza highlights moves from perpetual licences towards subscription bundles and AI capabilities folded into renewals. She also points to the importance of preserving portability and exit rights when software is acquired through a wider services contract.

Buyers also need to consider how the product might be repackaged or renewed, and what replacing it would involve if the commercial terms change.

Procurement has to adapt to uncertainty

Khandabattu recommends setting an internal measure of value before comparing vendors, then translating each supplier's pricing units into it. For example, a token, credit, message, or seat can then be expressed as a cost per support ticket resolved, invoice processed, or another meaningful business outcome.

Khandabattu distinguishes that internal benchmark from vendor-defined outcome pricing, which she says remains immature and can tie buyers to measures whose value is difficult to establish.

She also advises buyers to test representative workloads rather than relying on vendor calculators. Running production-like tasks can expose how quickly consumption builds up, including cases where what looks like a single action triggers several separately metered steps.

Modelling that usage over two or three years gives procurement teams a firmer basis for comparing suppliers. Khandabattu also recommends looking at fully loaded costs, including integration, governance, and human oversight, rather than the metered charge alone.

North Rizza puts estate rationalisation ahead of another purchase or renewal. IT teams should first identify what is already deployed and where functionality overlaps, a process that can also reveal products that can be retired or replaced.

IDC also recommends treating AI cost governance as an ongoing responsibility shared across IT, finance, engineering, and FinOps rather than a one-off procurement exercise.

Contract negotiations need to account for that uncertainty as well.

Khandabattu recommends defining billing units clearly in the contract and pushing for protections against unilateral changes to pricing metrics, alongside measures such as credit rollover where appropriate.

North Rizza points to modular licensing, meaningful evaluation periods, portability, and exit rights as ways to reduce exposure if usage or vendor strategy changes after deployment. “Don’t wait for pricing models to settle down – build your forecasting discipline now, because the volatility is the new normal, not a transition phase,” North Rizza says.

Medhora says procurement teams should put greater weight on metering rights and usage visibility, while modelling different commercial scenarios and preserving leverage if they need to exit.

Keeping control after the contract is signed

The buying process increasingly extends through the life of the contract.

IT leaders need to see how costs develop in production and whether the promised benefits survive real-world use. They also need enough visibility to identify capabilities that are no longer worth paying for.

A large discount at signing offers limited protection if usage is opaque or the contract is difficult to unwind; a better deal gives the buyer enough visibility to keep measuring value, with room to change course if costs move beyond the original business case.

Atlassian is upgrading its AI coding agents with new capabilities across Jira, Confluence, and DX.

The updates include the extension of Code Context to ground agents in multi-repo codebases, Agentic loops in Jira to convert Jira backlogs into pull requests, and DX for Agentic Development to measure AI delivery impact.

The aim is to help engineering organizations adopt and scale agentic workflows across the AI software development lifecycle by connecting agent context, execution, governance, and measurement in the systems where teams are already planning and delivering work.

“The biggest bottleneck in AI software engineering isn't model intelligence, it's organizational context,” said Taroon Mandhana, Atlassian CTO, AI & Teamwork.

“Enterprises need more than isolated sessions and one-off prompts. Jira has long been the system of record for how teams work. By extending that foundation to orchestrate agents alongside engineers, we’re giving teams a safe, measurable way to scale agentic workflows across the SDLC.”

Atlassian eyes deeper context

First up is the introduction of Code Context, built on Atlassian’s Teamwork Graph and giving Rovo and coding agents secure intelligence across multi-repository codebases.

This, Atlassian said, enables more accurate results across the entire lifecycle, from vetting backlog ideas for architectural feasibility and generating code-aware implementation plans to accelerating bug triage and root-cause discovery.

Agent Context Controls, meanwhile, let platform teams govern which agents can operate in a space and exactly what they’re allowed to see.

Also new is the introduction of agentic loops in Jira to convert Jira backlogs into pull requests, by continuously scanning for well-defined, unassigned work items, delegating them to Jira Coding Agent for execution and testing, and opening ready-to-review PRs directly in Jira.

Standards enables platform teams to define organizational coding standards once and map them to repositories, creating consistent guardrails for code quality, and AI review uses a dedicated agent to review pull requests against organizational standards, flagging issues before code ships.

Meanwhile, Atlassian claimed engineering organizations need automation, auditing, and measurement built into their systems if they're to be able to make agentic work accountable and measurable.

DX for Agentic Development measures AI impact across throughput, quality, adoption, and cost, mapping total AI investment directly to engineering outputs. It includes AI Code Insights, tool and MCP tracking, model-to-task fit, and academic-validated Agent Experience (AX) research.

Keeping tabs on agents

Finally, Jira Agent Usage Dashboard is designed to help team leaders understand which agents are used in their workflows, correlate agent sessions to Jira work, and improve team delivery velocity with agents.

"This is what takes governed agent loops from an experiment to something you can put in front of your board," said the firm.

Code Context is being gradually rolled out to paid Atlassian customers through open beta, while Agent loops, Standards, and AI Review are already available in private early access.

Agent Context Controls and Agent Usage Dashboard will be generally available to paid Jira customers in the coming months, said the firm, and DX for Agentic Development will be generally available for Atlassian DX customers this quarter.

FOLLOW US ON SOCIAL MEDIA

Agentic AI adoption is surging in software engineering, but new research shows security is still a persistent issue for teams.

Analysis from Harness shows 87% of engineering teams have experienced an “agent-related security event” over the last year.

Harness said a key factor behind this lies in a lack of visibility and controls, while overconfidence is creating an environment where engineers overlook potentially dangerous actions.

More than three-quarters (77%) of respondents said they are confident they have a complete inventory of every agent, MCP server, and LLM in their environment, yet fewer than half (44%) are able to verify this.

Crucially, 75% said they are confident that their agents are secure “end to end”, but respondents in this group had security incidents at nearly the same rate as those who weren’t.

Confidence in agent security has almost no relationship to actual resilience. 75% say their agents are secure end to end, but that group had security incidents at almost the same rate (88%) as the overall respondent population (87%).

Keith Mann, Field CTO and Head of Research at Harness, said these findings bear similarities to security-related issues during the early days of mobile and cloud development.

Both of these trends “went through a phase where confidence outran governance,” he said. Reaching a point of maturity in terms of governance and security took time, and that same process is unfolding in agentic development.

“Eventually the controls caught up because the underlying systems stayed predictable once you built the guardrail,” he added.

Mann noted that agents create a new risk layer for engineering teams, however, especially in terms of visibility and verification.

“Agents don't hold still in the same way. A control that worked in testing can still miss something in production because an agent doesn’t behave the same way every time,” he said.

“That's why closing this gap takes real verification. Organizations need to test whether a control actually holds up against an agent's variability, not assume it does because the control exists.”

Nipping problems in the bud

Harness warned that a concerning number of engineering teams aren’t prepared for agent-related security issues when they arise.

While 74% are confident that testing could catch a “production-impacting failure”, only 19% have a ‘gate’ in place to prevent this.

A gate is essentially a checkpoint in the software development lifecycle that blocks potentially flawed code from advancing until it meets the necessary criteria.

Similarly, in the event that something does go wrong, most couldn’t react quickly enough. More than three-quarters (76%) believe they could “disable a misbehaving agent” in under 15 minutes.

Only around one-third have a kill switch in place to rapidly shut down agents, however.

With enterprises scaling the use of agents in engineering, Harness warned that incidents will likely continue to climb. More than half (58%) have already reported an increase in production-related incidents since deploying agents, the study noted.

"The truths we found in the report are the same ones we're hearing in daily conversations with customers," said Trevor Stuart, SVP and General Manager at Harness.

"Teams moved fast to build and release agents, and are now circling back to ask how to actually govern what they've already shipped. The teams furthest ahead have already adopted a governed orchestration engine for agent changes, instead of waiting for an incident to force the question."

FOLLOW US ON SOCIAL MEDIA

Technical failures during meetings hampering productivity, according to new research, yet organizations are failing to address the issue.

More than seven-in-ten IT leaders told Logitech that employees experienced technology issues such as failed audio or connection drops, with 30% saying they experienced them often or very often.

Researchers noted that these glitches have created at least one business cost for 94% of survey respondents, with 51% citing a loss of productivity. They slow meetings, create a support burden, interrupt collaboration, and create employee distrust.

"Leaders believe a strong workplace experience delivers outcomes such as improved collaboration and productivity. However, technology issues, inconsistent setups, and poor support create friction," the researchers said.

"We are in the middle of a monumental evolution in how we work, and the spaces that work today may not be the ones we need tomorrow. Employees want to be productive wherever they are, across every setting, remote, on-site, or split between, and those expectations keep moving."

But while leaders recognized the direct impact of workplace experience on productivity and collaboration, they said that siloed decision-making and delayed IT involvement are leading to widespread friction, lost time, and heightened security risks.

Although 86% linked strong workplace experience directly to improved productivity, and 90% to collaboration, only 58% felt confident they possessed the right ROI data to justify workplace experience and technology investments. Only 29% said they treated workplace experience as a core business strategy.

Workplace experience boosts productivity

Logitech also highlighted a gap between priorities and execution, with 87% saying collaboration between IT, HR, and real estate or facilities is very or extremely important for improving workplace experience.

Despite this, only 34% say their organization has a unified WX function that owns a shared roadmap for workplace investment decisions.

"When everyone owns a piece, no one owns the problem. With fragmented WX ownership, issues inevitably fall through the cracks. The friction impacts both workplace flow and the teams architecting the experience," the researchers said.

"Architecting the workplace for elevated experiences requires proactive planning. Yet, only one-in-four WX leaders involve IT and AV before space planning begins. That means most organizations design the office before thinking about the technology that has to support the people working in it."

Investing in workplace technology

Logitech said good planning means connecting workplace investments to measurable outcomes. This includes building a friction map to identify where employees lose time, such as starting a meeting, audio/video, room booking, device connection, space availability, meeting equity, or complex setups.

IT, HR, and real estate should come together early, with cross-functional teams sharing metrics before space planning begins. Workspaces should support both in-person and remote participants without requiring employees to troubleshoot the experience.

Ticket volumes, device performance, and delays to the start of meetings should be measured alongside standard employee experience metrics, and sensor and sentiment data should be combined to prove ROI and continuously adapt as business and employee demands continue to shift.

FOLLOW US ON SOCIAL MEDIA

The Swiss government is running a trial of OpenDesk as part of efforts to reduce reliance on Microsoft software.

OpenDesk will be trialled for a small tranche of workers who focus on business critical functions. The move comes amid wider digital sovereignty efforts across Europe.

France, for example, has started to shift away from US software for government purposes while one German state has switched four out of five administration computers away from Microsoft.

The Swiss government said it plans to shift office computing to open source software, following a feasibility study that suggested the move should be possible.

With OpenDesk, the aim is to switch 3,000 government employees by the end of next year for core office functions, effectively a trial to see if shifting away from Microsoft is sensible and to estimate the cost of a large-scale implementation.

These core functions include email, calendar, documents, presentations, video conferencing, and telephony. The standalone solution will operate alongside Microsoft 365, targeting employees who are responsible for critical business processes.

That's because the aim is to not only strengthen the digital sovereignty of the federal administration, according to a translated press release, though that is a "central theme" of the government's digital strategy.

Beyond that, Swiss authorities hope to boost crisis resilience, ensuring the government can continue operating even if Microsoft goes down.

The idea of digital sovereignty as a means to boost resilience gained credence following the US temporarily banning exports of key Anthropic models earlier this year, as well as the massive Crowdstrike outage in 2024.

In the UK, authorities have warned about the impact of phishing attacks on food supply following outages at major retailers last year.

Challenging proposition

The initial solution tested in the feasibility study was found sufficient to maintain standard core processes and could prove useful in an emergency such as a Microsoft Office 365 outage, the government noted.

However, the feasibility study also spotted limitations, in particular around video conferencing, saying that significant adaptations and security work would be required.

Indeed, the many apps tied to Microsoft's architecture present a significant challenge to shifting the entire federal government to open source alternatives, so a wider shift depends on the results of the trial.

But the Swiss government has partnered with the German state of Schleswig-Holstein, which has shifted much of its workstations to OpenDesk. The 3,000 workstations make up about 7% of the Swiss federal administration's employees.

What is OpenDesk?

OpenDesk is owned by the German Center for Digital Sovereignty, and offers workspace tools via a web browser, including documents, email, project management and identity management.

The government stressed the point of the study was not to replace Microsoft 365, nor does the OpenDesk platform need to replicate or integrate with all of the Microsoft 365 features.

The shift is long awaited: the feasibility report was finished last year, and reports from April suggested the government had decided to slowly reduce its dependence on Microsoft.

This move was, at least in part, driven by an incident in which the foreign affairs department stored classified documents on a Microsoft Cloud, meaning American authorities could potentially view the information.

In July, the Swiss Armed Forces said it would replace Microsoft Office 365 with OpenDesk by this October for its cybersecurity workers.

Over the last two years, Microsoft has worked to reassure governments in Europe that data is safe, pointing to locally stored private cloud as an option as well as European data centers that keep data away from the US via its EU Data Boundary — and the tech giant has invested significantly in Swiss data centers, too.

FOLLOW US ON SOCIAL MEDIA

The cybersecurity industry is awash with products.

Every time a new attack technique is discovered, vendors will rush to develop a product to address the challenge.

Whether it be malware prevention, privileged access management, next-generation firewalls, or email security platforms, the industry is flooded with platforms promising to improve defences and make it harder for attackers to infiltrate systems.

But in reality, this has made security very noisy.

Instead of improving security, the volume of tools organisations must manage has actually amplified risks.

There are too many alerts coming in to understand and identify threats quickly. Too many platforms to manage, which overburdens resources and amplifies costs, and too many interfaces to navigate, which makes managing security far from seamless.

Overall, while the objective of the platforms is to strengthen security, the products can actually jeopardise it.

However, these problems are significantly worse when it comes to Managed Service Providers (MSPs).

Tool sprawl in the channel

Consider an MSP delivering security services to 50 customers.

One customer may use Microsoft security technologies, another CrowdStrike, while others could have different SIEM, vulnerability management, ticketing, and endpoint security platforms.

However, the MSP is often forced to operate them all.

All simultaneously, and all expertly, knowing the capabilities of each platform and how to operate them.

The MSP must maintain the knowledge, processes, and integrations required to operate across all of the platforms they manage for their clients. However, not only does this create resourcing challenges it also amplifies costs.

There is the cost of purchasing each platform that clients depend on, plus there is the cost of employees to manage the platforms.

Furthermore, with MSP staff continually navigating between platform interfaces, this wastes valuable time, reduces productivity, and can make managing security for clients more cumbersome.

Individually, these delays can appear insignificant. However, across hundreds or thousands of incidents, tickets, and customer interactions, they quickly accumulate.

Plus, as an MSP grows its customer base, the challenges can become even harder to manage.

When growth introduces more complexity

Every business wants to grow its customer base, but for an MSP this can also mean introducing more tools into their environments.

If every new customer introduces another combination of technologies, integrations and processes, onboarding customers also introduces additional operational complexity.

Providers can find themselves in a position where growing the business requires continually adding more people to manage the additional workload.

This has obvious implications for margins, but it can also put pressure on existing teams.

Skilled cyber security professionals are already difficult and expensive to recruit. Using their time to perform repetitive administrative tasks or manually move between disconnected platforms is neither efficient nor sustainable.

Ultimately, the channel therefore needs to look beyond simply adding more technology and consider how existing technologies are operated.

There will always be customers that want or need different technologies. Channel providers therefore need to find ways to embrace this diversity without allowing it to dictate how efficiently they operate.

But how can this be achieved?

The importance of technology-agnostic platforms

One of the best ways to overcome this challenge is by working with partners that deliver technology-agnostic platforms that simplify the management of security for MSPs.

These platforms can seamlessly integrate with the security platforms MSPs rely on for their customers, but they can be managed via a single dashboard.

This allows an MSP to more efficiently manage security, but without having to navigate across multiple platforms.

These platforms can deliver everything a partner needs to track, monitor, and manage the security of their customers, without overburdening resources or amplifying costs.

Instead, everything can be managed via a single unified platform, reducing complexity and cutting out the chaos of managing multiple solutions.

A technology-agnostic platform doesn't replace customer investments; it provides a common operational layer across them.

Analysts can investigate incidents, automate workflows, manage tickets, and monitor security posture from one interface while still supporting whichever technologies each customer has chosen.

The channel doesn't need fewer security technologies; it needs a better way to operate them.

MSPs that standardize their operations across diverse customer environments will reduce costs, improve analyst productivity, and deliver a more consistent service.

In an increasingly competitive market, operational efficiency isn't just an internal advantage; ultimately, it's a differentiator that leads to better security outcomes for customers and healthier margins for MSPs.

Thousands of Microsoft 365 customers worldwide are still affected by a lengthy outage but the tech giant says a fix is on its way.

Reports of an outage affecting Outlook first emerged on Monday 31 August, with Downdetector flagging a surge in issues at around 3pm UST. Issues with other applications also spiked around that time.

Microsoft has since confirmed the outage with a Service Health Status report, attributing the outage to a “core authentication configuration used by multiple Microsoft 365 services”.

Services impacted in the outage include:

• Microsoft 365 Copilot
• OneDrive for Business
• SharePoint Online
• Exchange Online
• Microsoft Teams
• Microsoft Purview
• Microsoft Defender XDR

What Microsoft 365 users have encountered

Microsoft highlighted a series of potential problems users may experience due to the outage, such as their Copilot prompts failing.

OneDrive and SharePoint Online users, in particular, have been dealing with acute problems since the outage began. Some have reported being unable to load or refresh both applications, according to Microsoft, while others have been unable to access search results and content.

“Some users may also experience delayed or failed file opening, Office policy-label retrieval, OneDrive synchronization, mobile camera upload, and video playback,” Microsoft noted.

Microsoft Teams users have also experienced issues with calendar functionality and search features.

A fix is underway

In the most recent status update issued at the time of publication, Microsoft said it has applied a fix to the affected authentication component. The company noted that services are beginning to recover but this could still take some time.

“Service telemetry continues to indicate recovery, with availability increasing across previously impacted scenarios as remediation progresses,” the company said.

“We’re validating that authentication, connectivity and search operations are returning to expected service levels while monitoring for any residual impact and confirming that the remediation is delivering broad mitigation across affected Exchange Online scenarios.”

FOLLOW US ON SOCIAL MEDIA

Apple has unveiled new Mac Mini and Mac Studio models, boasting an “extraordinary leap in performance and AI capabilities”.

The new devices wil be equipped with Apple’s M6 and M5 Ultra chips, the latter of which is described as its most powerful to date.

“Today we’re debuting the next giant leap in performance and AI compute for Apple silicon with the incredibly advanced M6 and the most powerful M-series chip yet,” M5 Ultra,” said Sri Santhanam, Apple’s vice president of Silicon Engineering Group.

The move by Apple comes amidst a sharpened focus on local, on-device AI capabilities for developers globally. The Mac Mini, for example, has emerged as a go-to option on this front, enabling users to run agentic workflows locally.

Santhanam said the new Mac Studio M5 Ultra, for example, will provide the “ultimate desktop performance and the ability to run massive AI models” on the device.

Under the hood of the M6 Mac Mini

The new Mac Mini will feature Apple’s M6 chip, which is built using a 2-nanometer process. This will boast a 12-core GPU, two more than the M5, along with a neural accelerator in each core.

Using this design, Apple said this will deliver a near 30% increase in GPU performance for AI compared to the M5, and more than eight-times compared to the M1.

“The super cores blaze through single-threaded workloads, the performance cores use less power and join the super cores to run demanding multithreaded workloads, and the efficiency cores handle everyday background tasks — all with industry-leading performance per watt,” Apple said in a blog post.

Elsewhere, the Mac Mini M6 will support up to 32GB of unified memory, along with 170GB/s of unified memory bandwidth. The firm said this marks a 10% increase over the M5 and will help users run LLMs on the device more efficiently.

The M5 Pro Mac Mini

Alongside the new M6 range, Apple also unveiled the Mac Mini equipped with an M5 Pro chip. This will boast a CPU ranging up to 18-cores alongside a 20-core GPU, and is catered specifically for complex tasks such as 3D design, VFX, and game development.

The device also supports up to 64GB of unified memory, alongside 307GB/s of unified memory bandwidth. Once again, Apple touted the device's capabilities in terms of local AI orchestration.

"With industry-leading performance per watt, Mac mini with M5 Pro is quiet, efficient, and ideal as an always-on desktop for AI agents or creative workflows," the company said in a blog post.

What to expect with the M5 Ultra Mac Studio

According to Apple, the new Mac Studio featuring the M5 Ultra chip is the “ultimate powerhouse for pro workflows” - again placing a strong emphasis on local AI capabilities.

The M5 boasts a next-gen GPU with up to 80 cores, with each also boasting a neural accelerator to provide up to 4.5-times the GPU performance compared to the M3 Ultra chip, and over six-times that of the M1 Ultra.

“The GPU includes Apple’s latest shader core with second-generation Dynamic Caching, as well as hardware-accelerated mesh shading and third-generation ray tracing, delivering up to 40 percent faster graphics performance than M3 Ultra,” the company said in a blog post.

On the memory front, the new device also boasts significant improvements, featuring up to 512GB of unified memory and 1.2TB/s of unified memory bandwidth.

Apple said this will enable users to “store huge datasets entirely in local memory” and run LLMs ranging in the hundreds of billions of parameters locally.

What to expect with pricing

Customers looking to get their hands on the Mac Mini with M6 or M5 Pro chips can pre-order today (25 August), although the devices will set you back.

In terms of pricing, the Mac Mini with M6 will start at $899 in the US, although users in education can get it for a reduced price of $799. The Mac Mini with M5 Pro, meanwhile, starts at $1,699 and $1,599 for education.

Elsewhere, the Mac Studio with M5 Ultra starts at a whopping $5,499 and $5,099 for education.

Designed for devs

Notably, Apple’s various developer frameworks and tools, such as Core AI, Core ML, and Xcode, will “tap directly” into both chips.

This offers marked advantages in terms of local AI orchestration, the company said.

“With these frameworks and new chips, developers can run and fine-tune large AI models locally on their Mac,” Apple said in a blog post.

“Apple’s developer tools and frameworks automatically optimize performance across the CPU, GPU, and Neural Engine, and give developers the ability to use Apple Foundation Models, App Intents to tap into Apple Intelligence features, or their own proprietary AI models to build and run powerful AI workloads entirely on device.”

Another pint-sized powerhouse

Apple’s pint-sized powerhouse, the Mac Mini, is back with an M6 chip – and it comes at a time when mini PCs are having their moment.

Smaller players from China such as Geekom and Beelink are finding more and more markets with their innovative and powerful desktop boxes, but they will struggle to match the pulling power of Apple.

And they won’t be anywhere near as adorable as the Mac Mini.

FOLLOW US ON SOCIAL MEDIA

AI represents a prime opportunity for security teams to keep pace with accelerating development timelines, according to GitLab CISO Chaim Mazal. But this will require tweaks to traditional processes.

The use of AI in software development is fast approaching near-universal levels, with figures from Stack Overflow’s 2025 Developer Survey showing 84% of developers have adopted the technology.

While AI is helping speed up code production, streamline development lifecycles, and drive productivity, Mazal told ITPro it’s also creating new security risks.

“Businesses have decided that in order to be successful in this next wave of the journey, AI has to be leveraged and teams have to go full bore,” he said.

“I think in tandem and parallel, security teams have been working on figuring out how they can build appropriate solutions to be able to enable their organizations to do that.”

Mazal noted that enterprises are still working around the “same practices and principles that we’ve historically followed” - robust testing, reviews, and security checks.

But with the advent of agentic AI and the pace of change, there’s a risk that blind spots could emerge somewhere in the process.

Indeed, it’s an issue that GitLab recently highlighted in a study. Analysis from the company in June warned that eight-in-ten organizations are adopting AI tools faster than they can develop policies to govern them.

The influx of AI-generated code is also proving troublesome for enterprises, with a study from Tricentis showing that roughly 60% of organizations have shipped untested code.

The result here is that security teams now face a confluence of challenges. Potentially dangerous AI-generated code and increasingly fast development timelines are placing huge pressure on teams to ensure products ship in both a timely and secure manner.

An engineering-first approach

Keeping pace with AI-powered development will mean security teams essentially have to start operating more like their counterparts in development in an ‘engineering-first’ approach.

This is an operating model that takes core engineering principles such as automated testing and CI/CD pipeline techniques and embeds them within security processes. Simply put, rather than acting like manual auditors and policy enforcers, they play a more involved role in development processes.

Moreover, they build parallel products designed to support development from the get-go. Fundamentally, this is about being a “first-level contributor” in software development, Mazal said.

“As our engineering teams move fast, having the security team have the ability to contribute code, make iterative adjustments, and be part and parcel with the development process is key to our success,” he told ITPro.

“Being able to move fast, iterate fast, and not just be consultative in nature, and being able to really roll up our sleeves and work alongside the rest of the teams to build that secure path and the secure guardrails is something I think most modern security teams don’t have the luxury of foregoing.”

When it comes to AI, what’s good for the goose is good for the gander. Security teams should view the technology as a means to keep up with development processes – as with developers, teams need to automate where they can.

Humans in the loop

Ensuring humans remain in the loop throughout the development and testing process will still be vital moving forward, according to Mazal. The exact scope of human involvement is still up for debate, however, and the long-term goal is to automate as much as possible in the safest way

“I think most organizations who make commercial-level software want to get to a place where there are only humans in the loop in places that it’s absolutely necessary, based on the risk to the organization,” he said.

“They’d like to be able to have the overwhelming majority of their code auto-generated and auto-reviewed.”

Mazal said this has the potential to pose new challenges for developers, testers, and security teams alike. Fully-automated pipelines are still evolving, and as ITPro recently reported, some enterprises are exploring the concept of ‘dark testing factories’ to ramp up automation with little human input.

“Collectively we’re still trying to figure out as an industry what those best practices are, but we’re definitely making very big leaps and bounds in very short periods of time.”

GitLab itself is ramping up the use of agents in a software factory approach, Mazal noted, focusing intently on a security-conscious strategy. Agents need strict guardrails, and enterprises need to implement certain restrictions from the get-go.

“How we’re thinking about this at GitLab from a software factory perspective is that you have the ability from the very initial inception of design to bake in those security guardrails and requirements,” he explained.

“You can go ahead and create and craft them and define them based on the data sensitivity and requirements that you have, and you can uniformly implement governance controls across the board.”

These processes will naturally evolve as requirements change, Mazal said, and teams will “continuously make adjustments along the way”.

FOLLOW US ON SOCIAL MEDIA

GitHub has revealed the root cause behind a nearly eight-hour long outage on Monday: a misconfigured policy that triggered a cascade of failures.

On Monday, GitHub users began struggling to use the service around 1:28pm UTC, reporting issues with API requests, Actions, Webhooks, Pull Requests, and GitHub Copilot. At the time, GitHub said it was seeing error rates between 20% to 50% for different tasks, with other services also impacted.

"At peak, web/API error rates were approximately 20%, while archive and raw-content downloads reached approximately 50%," GitHub said via an update on its status report.

"SAML/OIDC authentication, SCIM, and Team Sync were also affected, as well as Actions workflows in GHEC with Data Residency that depend on public workflow step definitions hosted on GitHub.com."

Within a few minutes the problem was spotted, but it took a total of seven hours and 47 minutes for the issues to be totally resolved, the company said.

"Most services recovered by 16:36 UTC as our Central US datacenter recovered; Actions was degraded until approximately 18:03 UTC; and Copilot Token Service fully recovered by 21:02."

What happened with the GitHub Outage?

After an investigation, GitHub said the issue was due to “network saturation” of load balancers due to new peak traffic in the Central US hosting region.

"Originally this was caused by an Istio sidecar pod reaching its concurrency limits and failing to auto scale correctly because of a misconfigured policy that watched host service but not sidecar limits,” the company explained in a post-mortem report.

That failure cascaded, the post noted, with four HAProxy nodes exhausting their flow limits, degrading the gateway authentication path — all of which led to further authentication latency and failures, the GitHub said.

"The problem was worsened by optimistic retry logic which overloaded internal load balancers," the post added. "Pausing HAProxy on those nodes simultaneously produced immediate broad recovery."

Slow recovery

GitHub immediately moved some traffic away from the failing Central US data center location to Northern Virginia to give time to debug and resolve the issues. But Northern Virginia was quickly flooded with traffic too because of a retry bug.

That was pinned on "client retry behaviour" – in other words, client software kept trying to make it work over and over again, leading to failed requests and amplified load.

GitHub managed to temporarily block the "retry storm" but still saw a huge increase in Copilot authentication.

"Copilot Token Service traffic increased from a normal 7–9K RPS to 70–100K RPS. Reducing gateway authentication retries and blocking retry-triggering responses stabilized Copilot Token Service and completed recovery," the post noted.

External factors exacerbated the issue, according to GitHub, including a number of “scraping attacks on codeload endpoints”.

What's next?

GitHub said it had solutions lined up to avoid a similar outage. That includes fixing the initial autoscaling policies and auditing Istio request, concurrency ,and scaling limits, in order to avoid the same flaw recurring.

It also plans to review "retry limits and backoff behaviour across gateways and clients," and address the VS Code retry behaviour that led to the massive leap in Copilot token traffic.

More widely, GitHub plans to improve load balancer capacity monitoring and failover safeguards.

FOLLOW US ON SOCIAL MEDIA

Vibe coding startup Cursor has launched a new code hosting platform in a move that could put it in direct competition with GitHub.

Dubbed Origin, Cursor said the new service is “starting with the essentials”, offering users all the staple features found in GitHub. This includes code repositories (repos) as well as the ability to browse and edit codebases and handle pull requests.

Origin can also be synchronized with GitHub, the company revealed, meaning users can mix and match with both platforms.

“Your GitHub repos can sit alongside the ones Cursor hosts,” the company explained in a blog post. “Connect GitHub to Cursor, pick your org, and you'll see the repos you can sync. Select one and Cursor pulls it in.”

“You choose what gets synced and can disconnect a repo at any time. Anyone with read or write access to a synced repo can view it in Cursor too.”

Access to Origin has already begun rolling out for all paid plans, according to Cursor, albeit in an early beta capacity.

Long-term, Cursor hinted that the plan is to provide “agent-native features” akin to what it already offers through its agentic coding service.

The startup is also in the process of developing a broader “app ecosystem” to integrate third-party tools within Origin. Integrations with Vercel, Depot, and Buildkite are already available, with “more coming soon”.

“Connect Vercel from a repo's Apps tab and every PR gets a preview deployment where you can test and make comments,” the company explained.

“Merge, and it ships to production. For CI, connect Depot or Buildkite. Both run your existing GitHub Actions workflows and Buildkite also runs its native pipelines.”

A blossoming GitHub challenger?

Origin could represent a major challenge to GitHub moving forward, and as ITPro reported earlier this year, the Microsoft-owned company has been making moves to counter competition on this front.

Reports in January revealed Microsoft had reshuffled internal teams to stave off competition from challengers such as Anthropic and Cursor. First reported by Business Insider, this strategy focused primarily on expanding agentic AI coding options for users.

Sources told the publication that Microsoft had grown concerned about up-and-coming startups muscling in on GitHub’s market position.

These concerns centered largely on agentic coding capabilities, however. Origin muscling in on GitHub’s bread and butter as an all-encompassing developer platform marks an entirely different challenge.

Cursor faces significant hurdles if it is to mount a challenge though. Figures published by GitHub last year suggest the platform boasts over 180 million active users, and the platform continues to grow rapidly.

GitHub frustration

The Origin announcement also comes at a tricky time for GitHub. The developer platform recently experienced a lengthy outage that saw developers unable to access key services – and that marked the latest in a string of outages.

After a series of incidents this year, GitHub detailed plans to improve capacity amidst grumbling user concerns.

In an April blog post, GitHub CTO Vlad Fedorov attributed some outages to the sheer volume of users now operating on the platform, which is pushing infrastructure to the limit.

In October 2025, the company began work to boost capacity by ten-times before revising this in February 2026 with plans for a 30-fold increase.

FOLLOW US ON SOCIAL MEDIA

A lengthy GitHub outage that saw users struggle to access core services has been resolved, according to Microsoft, but what happened?

The incident first came to GitHub’s attention at around 1:40pm UTC yesterday, when the company said it was investigating reports of impacted performance for some services.

It proceeded to report problems with API Requests, Actions, Webhooks, Pull Requests, Issues, and GitHub Copilot.

"We are experiencing high error rates around 20% for web experiences and api traffic. Archive downloads and raw repository content downloads are experiencing an approximate 50% error rate," the company reported about an hour into the affair.

"SAML and OIDC authentication, SCIM, and Team Sync are also impacted. Investigations are on-going and we will continue to provide updates as we discover more information."

By 4.40pm, the firm said it had identified the problematic component and had taken corrective action – although error rates were still slightly up.

“We are still seeing residual impact in the form of sporadic authentication failures. We are continuing to apply additional mitigations and investigate the remaining impact,” GitHub said.

Full GitHub outage analysis pending

At one point, Downdetector was reporting nearly 3,000 outage reports, although the incident was finally resolved by 9.15pm.

Exact details on the cause of the incident are yet to be revealed. However, GitHub promised that a “detailed root cause analysis will be shared as soon as it is available”.

GitHub demand surging

GitHub is one of the world's largest software development platforms, with 225 million users, but has seen its infrastructure pushed to the limit by the boom in AI-driven coding.

Last October, it started work to boost capacity by ten times before realizing in February that a 30-fold increase would be required.

In an April blog post detailing the strain placed on the firm, CTO Vlad Fedorov said agentic workflows have "accelerated sharply” in recent months.

“By nearly every measure, the direction is already clear: repository creation, pull request activity, API usage, automation, and large-repository workloads are all growing quickly," Fedorov wrote.

He said GitHub planned to deal with availability first, then capacity, and then new features.

"We are reducing unnecessary work, improving caching, isolating critical services, removing single points of failure, and moving performance-sensitive paths into systems designed for these workloads," Fedorov said.

Repeated outages

Notably, it appears the company wasn't able to carry out this work fast enough, with eight further outages last month. This included a lengthy GitHub Actions outage that the company described as 'unacceptable'.

The company attributed this to the fact that the GitHub Actions service at the core of the incident was still fully running in its data centers, and promised to accelerate its move of GitHub Actions to Azure.

Here, the company noted, it will have more headroom and capabilities to absorb sharp spikes in activity.

"GitHub is on track to see a 1,400% increase in commit volume from 2025 to 2026, with most of the increase coming from AI tooling," commented Jamie Beckland, chief product officer at APIContext.

"Every technology team depends on platforms that are being reshaped by new demand from AI. Which means every technology team now has an AI infrastructure problem. Technology teams need independent monitoring of the third-party services sitting in their delivery path so they know whether problems affect developers, pipelines, and customers."

FOLLOW US ON SOCIAL MEDIA

VPNs (virtual private networks) have traditionally been the go-to solution for many businesses as they provide affordable, secure access to the corporate network for remote workers. There are numerous disadvantages, though, as their encryption processes can impact performance, they don't scale well with increased demand, some can be complex to configure, and few provide any endpoint protection services.

WatchGuard's FireCloud takes secure remote access to the next level and has all the acronyms you'll want to see as this SASE (secure access service edge) solution delivers FWaaS (firewall as a service), SWG (secure web gateway) and ZNTA (zero trust network access). Managed from the WatchGuard Cloud platform, it provides endpoint anti-malware, WatchGuard's APT, IPS, web content and application filtering, geolocation controls and facilities to present remote workers with secure access to private resources on the corporate network.

FireCloud is available in two versions with the Internet Access edition enabling the FWaaS and SWG components to protect remote workers from internet-based security threats. The Total Access edition adds application-level ZNTA and allows you to dish out VPN-free secure access to private resources.

A key feature of both editions is WatchGuard's globally distributed PoP (point of presence) network. Currently comprising fifteen PoPs, these increase performance as remote workers automatically connect to the nearest one which applies cloud-based security such as anti-malware, IPS and content filtering.

WatchGuard FireCloud review: Deployment

We reviewed FireCloud Total Access, and our first task from the WatchGuard Cloud portal was to configure an identity provider. We took the easy option by choosing the WatchGuard Cloud Directory as our authentication domain, but other options include WatchGuard's AuthPoint or third-party SAML 2.0 providers such as Microsoft Entra ID and Okta.

Users are imported or created from the portal's Directories and Domain Service page. We manually created our users by providing their names, a suitable username, and their email address, after which an invitation was sent out to each one requesting them to password-protect their account.

Make sure you configure the agent deployment settings correctly, as it defaults to installing WatchGuard's EPDR (endpoint protection, detection and response) and should be changed to FireCloud. You can then let your users install the Connection Manager agent, which asks for their login credentials, applies the assigned access rule policy, and routes their traffic through the nearest PoP.

We came across an issue as we also have EPDR activated in our cloud portal. Both this and FireCloud currently use the same agent install file, and even though we had the deployment set to FireCloud only, we found each client also appeared in our EPDR console as an unlicensed endpoint. It doesn't affect FireCloud operations, with WatchGuard advising us this is a known issue and is developing separate agent installers due to be released in FireCloud v2 in a few months.

WatchGuard FireCloud review: Access rules and security services

Access rules combine all FireCloud client security settings and, as with the Firebox appliances, all key services are presented in one page. These include web and application controls, which are both accessed from the content filtering section, with the former offering 166 URL categories that can be allowed or blocked.

App controls are equally extensive, with 1,275 predefined app and protocol signatures provided, and both services are applied to an access rule using one action policy. From the content scanning section, you can enable the gateway AV (GAV) and APT blocker services with the geolocation service using rule actions to determine which countries users may access.

Applied as global settings, the network blocking section covers botnet detection and IPS plus port and website restrictions. The tunnel bypass feature allows you to specify IP addresses and networks that sidestep the FireCloud security checks and go directly to the internet.

WatchGuard FireCloud review: Private resources

To allow remote users to access resources on the company network, you first need to define a FireCloud gateway. Three options are available, and if you use a WatchGuard Firebox appliance, you're in luck, as this already has the gateway service ready and waiting.

We used our Firebox T185 as a gateway, which took seconds to declare to FireCloud. The server gateway component can be installed on an existing Windows Server host, which makes it available as a single private resource. Or you have virtual gateways for Hyper-V, VMware, and Proxmox, which you use to declare multiple resources behind them.

Private resources are defined by providing their IP address and port ranges and assigning an FQDN (fully qualified domain name). This doesn't need to be resolvable, as it's used by clients to access the resource.

We created a private resource for the lab's Brother A3 business inkjet and, from our Windows 11 remote clients, manually added a PCL6 printer driver using its FQDN for the LPR port and had no problems printing to it. Likewise, with an RDP connection to one of the lab's Windows systems, as remote clients just entered the resource FQDN in their Windows RDP app.

WatchGuard FireCloud review: Cloud monitoring

The cloud portal offers plenty of monitoring services, with WatchGuard's Rai (Red AI) the star player. This gathers security feeds from all your cloud-managed WatchGuard products and presents them in one dashboard with AI-generated summaries for an at-a-glance view of your security posture.

FireCloud provides a usage report showing all devices and their connection status over customisable time periods. The security tab keeps you posted on areas such as attack, malware and APT activity, along with charts of blocking actions for apps, malware, users, URLs and destinations, with the geolocation map below showing the number of attempts to access banned countries, and the view can be changed to show specific users.

Move to the traffic tab, and you can see access charts for private resources, allowed apps, web and app categories, domains and users. For more specific information, you have the FireCloud log search facility which allows you to drill down deeper and see details on particular security services.

WatchGuard FireCloud review: Is it worth it?

FireCloud is available with volume discounts, so the more client licences you buy, the more you save. WatchGuard Online shows the Internet Access edition for one year starting at £70 per licence, excluding VAT, dropping to around £38 for more than 5,000. The Total Access edition starts at £108 per year for up to 50 licences, falling to £60 each for over 5,000.

True, FireCloud costs more than VPNs but is far better suited to modern hybrid working environments comprising office, remote and mobile workers that need to access a mix of on-premises and cloud applications. It neatly combines FWaaS, SWG and ZTNA services, and its integration with the WatchGuard Cloud portal makes it far easier to deploy and manage than complex and cumbersome VPNs.

As AI continues accelerating code production, developers should take a leaf out of the manufacturing industry’s book to automate testing processes safely.

That’s according to Ingo Philipp, VP of product engineering at UiPath. Speaking to ITPro, Philipp suggested that “lights-out” manufacturing-style processes could alleviate strain placed on teams facing a torrent of code.

Also known as ‘dark factories’, lights-out manufacturing techniques involve fully automated production lines, and are a tried and tested method in the manufacturing industry.

Japanese engineering firm FANUC has been running these autonomous factories for more than two decades, requiring minimal human input except for quality control and overseeing production.

For developer teams, Philipp noted the same techniques could be applied to software development. UiPath coined the term ‘dark testing factories’ in a recent whitepaper, noting that this could both speed up and secure software testing.

“We see that the demand for software testing is just exploding these days. That’s what we see day in, day out from our customers,” he told ITPro.

“At the same time, we also see that they are struggling with the demand. That means they can’t really keep up with this increased volume, increased velocity of software development,” Philipp added.

“That means there is a gap essentially between the demand and the supply. So that's the challenge. I think it has always been a challenge.”

Matching velocity

As Philipp noted, the concept comes amid the growing use of AI in software development. Figures from Stack Overflow’s most recent Developer Survey found 84% of devs have adopted AI, with more than half (51%) using these tools everyday.

With increased production velocity comes added risks, however. In its 2026 AI Engineering report, engineering analytics platform Faros, showed teams now report 54% more bugs per developer compared to pre-AI processes.

Similar research from GitLab found that the volume of code written using AI is surging, yet 92% of developers reported significant governance challenges.

With these issues expected to continue, creating an isolated, automated production pipeline in which code can be tested safely is critical, according to Philipp.

“Think of Codex, think of Claude, think of all the Copilots and Coworks out there,” he said. “They’re enabling our friends in software development to crank out more code faster than ever these days.

“We see our customers, our partners really struggling to keep up with this increased volume and velocity in software development with the traditional approaches they are using in their software testing.”

Automating the pipeline

UiPath’s contention is that with ‘dark testing factories’, AI agents can automate aspects of software testing before it has the potential to cause downstream issues.

In these settings, AI agents would weed out potential bugs while human developers focus more on quality control, security, and governance. Philipp added that testers will eventually “teach the factory to do the work”.

Automation in software testing is by no means a new trend, he noted. In this instance though, it’s a case of speeding things up in line with acceleration across the broader development lifecycle.

“It’s autonomous testing on steroids,” he told ITPro. “The goal here is to … do away with all the operational, repetitive, mundane testing work from the humans and elevate them into more ‘quality leaders’.”

This does raise the question of whether enterprises are simply adding more automation – and complexity – to an already complicated and highly-automated process.

Philip said, however, that automation in this context will still require robust human oversight. Customers adopting this approach are able to create strict guardrails on what tasks agents can perform, much like other areas in which agents are deployed and a human-in-the-loop approach is still vital.

One customer, he said, set boundaries around what actions agents can take without human intervention, reverting to testers in certain circumstances.

“Who is actually the quality owner? Who is the person that needs to provide clarity on that? This is not something new, because they already have it as part of their existing testing process. We just factored it in.”

Philip told ITPro that while customers are shifting toward this approach, it’s at a moderate pace. Long-term, he envisages a far more AI-fuelled testing setup but only a handful of companies have the capabilities right now to achieve this.

“I want to be brutally honest here, almost none of our customers are there at the moment,” he said. “None of our customers [have] achieved the holy grail of making testing fully autonomous. I don’t think it is achievable in the short-term and mid-term.”

FOLLOW US ON SOCIAL MEDIA

Red Hat has unveiled a new open source community project aimed at bolstering AI governance capabilities for enterprises.

Dubbed asago (AI Safety And Governance Orchestration), the new project will help enterprises automate AI governance policies in a bid to drive safe deployment of the technology.

A host of organizations have pledged support for asago so far, according to Red Hat, including Microsoft, IBM Research, the Alan Turing Institute, Brave Software, and more.

“The asago project is a true collaborative, open source endeavour bringing together stakeholders from the technology industry, academia and government,” said Stuart Battersby, AI safety and model evaluation architect at Red Hat.

“We encourage more collaborators to join this community driven effort, particularly from global jurisdictions, to ensure maximum coverage of AI safety viewpoints.”

As part of the project, participants will use a standardized platform designed to “translate complex corporate and regulatory AI governance policies into actual operational controls”.

This targets a common pain point for organisations deploying AI, according to Red Hat. Translating policy guidelines into functional software configurations often slows down innovation and creates deployment bottlenecks.

Compliance officers, for example, require “rigorous risk assessments” and verifiable evidence, while on the technical side platform engineers need highly structured configurations that can be easily maintained.

With new legislation such as the EU AI Act coming into effect, Red Hat said the project will help streamline deployments by speeding up traditional hurdles.

Indeed, the project will focus on four key areas for organisations deploying AI technologies, including risk mapping, risk assessment, risk mitigation, and production deployment.

What to expect with asago

The asago framework will automatically read and interpret AI governance policies on behalf of the user, helping to map specific requirements to established AI risk frameworks and standards through the IBM AI Risk Atlas.

These standards and frameworks span the NIST AI RMF, OWASP LLM Top 10, and the EU AI Act.

Asago will also generate and execute scenarios for automated safety testing, which is based around specific identified risks rather than “generic benchmarks”.

Thereafter, the framework will recommend “appropriate mitigations” such as safety guardrails before providing deployment-ready configurations.

Red Hat said each of these steps are designed to provide a “continuous audit trail” which ties individual policy clauses to specific tests and runtime controls.

AI safety in the spotlight

The move by Red Hat comes amidst growing concerns about AI-related security risks, particularly with agents.

In the last two weeks, both OpenAI and Anthropic both revealed ‘rogue’ AI agents escaped containment during testing and breached partner organizations.

Steven Huels, vice president for AI engineering at Red Hat, said that the mass-deployment of agents means that robust guardrails have now become a “critical infrastructure requirement” for enterprises.

Earlier this year, IBM and Red Hat unveiled Project Lightwell, an initiative designed to speed up automated security patching in response to a torrent of vulnerabilities uncovered by powerful new AI models.

As ITPro reported in late June, a host of organizations have signed up to the initiative so far, including Palo Alto Networks.

“Through initiatives like Lightwell, we are working to secure the open source supply chain from AI-driven vulnerabilities,” Huels commented. “asago complements this effort and takes the next logical step for enterprise AI by automating the link between corporate policy definitions and live production agents.

“This gives enterprises the end-to-end operational confidence they need to scale trusted AI across the hybrid cloud.”

FOLLOW US ON SOCIAL MEDIA

Microsoft posted better than expected results from its cloud and AI business, news that helped boost its languishing share price.

Recent earnings statements from major AI players have spooked investors thanks to already heavy capital expenditure being increased further. Last week, Google's shares fell despite record growth and this week Meta saw a similar fall amid concerns about AI spending. By contrast, Microsoft plans to keep its capex spending the same as previously forecast, holding it at $175bn for 2026.

Across the company’s revenue for the quarter was $90 billion, up by 18%, with net income totalling $35.8 billion, climbing by 31%. Revenue from Microsoft cloud was $59.3 billion, up by 27%, with better than expected results at its Azure cloud computing division, which posted revenue growth of 43% for the quarter, above estimates below 40%.

That lifted Microsoft's shares by 8%, rallying after a tough stretch this year that saw it fall more than 18%.

"This year, Azure revenue surpassed $100 billion for the first time, and Microsoft 365 Copilot reached over 30 million paid seats, reflecting the confidence customers are placing in us to power their AI transformation," CEO Satya Nadell said in a statement. The company also reported a $3.2 billion return on its Anthropic investment.

Positive results on AI that are keeping pace with spending are likely what's behind the share price bump, noted Emarketer analyst Gadjo Sevilla. He said the capex figure is likely the most watched line in results right now – and this time that sparked optimism rather than concern.

"Microsoft spent $35.80 billion on property and equipment during fiscal Q4, more than double the $17.08 billion in the year ago quarter, bringing full-year capital expenditures to $115.95 billion – up nearly 80% from $64.55 billion in fiscal 2025," said Sevilla. "Despite that spending pace, the company still generated $55.44 billion in quarterly operating cash flow, up 30% YoY, a positive sign the AI buildout isn't cannibalizing the core business."

Sevilla added: "The company’s diversification strategy, its data center and AI partnerships, and its reliance on its own homegrown AI expansion will continue to stoke confidence to partners and investors while signaling to the rest of the industry how diversifying infrastructure and AI products strikes a balance for growth."

A better way to offer AI?

Alongside that, Microsoft CEO Satya Nadella said the company continues to shift away from a previous focus on OpenAI's models to building its own, saying the aim is to enable customers to pick and choose the best model to meet their needs.

"That's really the enterprise design architecture that we are going to evangelize. We ourselves are using it," Nadella said, according to Reuters, adding that the company's own models are 40% more efficient.

That's a key point amid concerns about the cost of using AI, with Microsoft earlier this week unveiling its own security model that it pitches as half the cost of rival systems.

Not all analysts were convinced, however. Forrester principal analyst Tracy Woo said that the Copilot adoption and strong revenue were good signs that AI investment was paying off "but the results stop short of fully validating the company’s AI strategy”.

"The new partnership with Anthropic helps reduce dependence on OpenAI, yet roughly 45% of commercial RPO [Remaining Performance Obligation] remains tied to that single model provider," she said.

Woo added: "While more AI products are scaling into enterprise‑grade workloads, the unresolved question is whether Microsoft’s infrastructure expansion can ultimately outrun the margin pressure that comes with supporting frontier‑model demand."

Amazon has pledged financial backing for the team behind the Lean programming language as part of a sharpened focus on AI agent development.

In a statement on 26 July, the tech giant revealed it will provide "substantial, long-term” financial support for the Lean Focused Research Organization (FRO).

The FRO leads development of the open source programming language, which Amazon already uses internally in agentic AI development practices.

Lean has been around since 2014 and is a popular programming language across a range of fields including mathematics, physics, and computer science.

For Amazon, the appeal lies in its role in helping develop and fine-tune AI reasoning capabilities. The programming language is used alongside a ‘proof assistant’ - a type of software used to conduct checks of code to identify and sift out errors or flaws.

It’s these ‘correctness proofs’ that make the programming language a go-to option for academic researchers and professionals in scientific fields.

“AI generation of formal proofs in Lean has been a key method for training models with lower error rates, to the point that they are now producing correct solutions to research-level problems,” Amazon explained in a blog post.

Amazon Lean-ing in on agentic safety

Amazon said its support for Lean comes at a critical time both for its own internal AI ambitions and for the industry at large as enterprises ramp up adoption of agents.

Safety has been a key recurring talking point for organizations on this front. As ITPro has previously reported, research shows growing concerns around access control, governance, identity security, and visibility when it comes to agents.

“Coupling generative AI with Lean's mathematical rigor will help enable verified, trustworthy AI agents,” the company said.

Amazon already uses Lean-based verification in its Bedrock AgentCore service, helping to “prove the correctness of the policy language” that ensures agents operate within strict boundaries.

Elsewhere, Lean underpins systems such as SampCert - which provides “mathematical guarantees” for privacy protections in the AWS Clean Rooms analytics platform - and AWS Neuron.

“One scientist recently used an LLM with Lean to prove the correctness of Amazon Aurora's segment repair protocol, our most durability-critical distributed protocol, in a fraction of the time it would have taken manually,” Amazon noted.

“The set of applications is growing fast, and this is just the beginning.”

Peter Van der Putten, assistant professor of AI at Leiden University and director of Pegasystems’ AI Lab, said AWS’ FRO backing is a welcomed move given recurring security-related concerns.

“It is encouraging to see AWS investing in open source technologies such as Lean that have the potential to provide stronger formal verification guarantees for software and AI systems,” he said.

“As agentic AI systems become increasingly autonomous, technologies that can provide stronger correctness and safety guarantees than just traditional testing will become ever more important.”

Van der Putten noted, however, that the inherent complexity of agentic AI development means more robust orchestration and governance is still of paramount importance.

“Enterprise agents operate within complex environments involving workflows, automated processes, policies, regulations, humans in the loop, multiple stakeholders, and countless exceptions and uncertainties that cannot simply be abstracted away but must be dealt with in practice,” he said.

“So even an agent whose behaviour has been verified against a specification must still be able to operate effectively in such a context,” Van der Putten added.

“In practice, the bigger challenge may lie in orchestrating agents, people, data, and systems together in a governed way, while reflecting ambiguity, trade-offs, conflicting objectives, and constantly evolving realities, rather than simply proving that an idealised agent behaves correctly.”

Open source backing

Backing for the FRO serves a broader purpose rather than complementing its own use of Lean, according to Amazon.

“It’s easier to trust a proof when you can evaluate the tools behind it yourself,” the company noted.

“Customers, auditors, and regulators can independently inspect and validate work done in community-governed tools, which is the kind of transparency that safety-critical AI demands.”

The firm said that in the long term, Lean’s growing popularity will benefit the AI industry by providing “more libraries, more tooling, and more formalized proofs for everyone”.

FOLLOW US ON SOCIAL MEDIA

Nvidia CEO Jensen Huang has hailed the capabilities of Chinese open source AI models amidst growing interest in low-cost options for enterprises.

In an interview with Axios this week, the Nvidia chief said competition between open and closed-source models is positive for the broader global AI industry.

“The world needs open models,” he told Axios. “These Chinese models are excellent. Open source models that are excellent should be used”.

Huang’s comments come amidst growing interest in Chinese open source AI models in recent weeks. The Kimi K3 model, developed by Moonshot AI, temporarily paused subscriptions due to skyrocketing demand.

Surging interest in the Kimi K3 model bears similarities to that of DeepSeek, which rocked the US AI industry when it launched in early 2025.

A key advantage of these models lies in both their performance and cost efficiency, the latter of which has become a key focus for enterprises amidst growing concerns over spiralling AI costs in recent months.

As ITPro reported in November 2025, open source AI models often perform on-par with closed source options, and could potentially save enterprises millions in costs each year.

Open source models "routinely achieve 90% or more” of the performance of closed counterparts, the study noted. They also benefit from “significantly lower prices”, with operational costs plunging up to 84% in some cases.

In a research paper published by DeepSeek last year, the company said it spent a paltry amount training its flagship R1 model compared to US rivals who’ve spent billions on training purposes.

Anthropic CEO Dario Amodei suggested building a new AI model could cost over $100 billion in 2024.

Security concerns persist

While the popularity of Chinese AI models continues rising, concerns over security have been flagged repeatedly.

The concerns surrounding Chinese AI models typically focus on areas such as data privacy and national security, with some critics suggesting these tools could be used as a ‘backdoor’ for Chinese intelligence services.

Axios previously reported that the White House could consider imposing restrictions or tight conditions on US firms working with these models.

DeepSeek was subject to the same scrutiny during its rise to prominence across 2025, for example. In August last year, cybersecurity experts told ITPro that using DeepSeek equated to “printing out and handing over your confidential information”.

Huang told Axios that these concerns are a “misconception” and can be used by enterprises safely. On the topic of potential White House restrictions, Huang said this could prove counterproductive and that American firms should consider a breadth of options.

“You can download the models. You could fine-tune it, you can enhance it, you can guardrail it as you desire,” he said.

Huang has a vested interest on this front, however, and noted that increased usage will ultimately benefit Nvidia.

“If there’s great AI, even if it’s open, wherever it comes from, there will be more use,” he told Axios. “Whenever there’s more use, you’ll have to sell a lot more Nvidia computers. We’ll have to build more data centers. We’ll have more services. The technology will diffuse into more industries”.

Bill Conner, president and CEO Jitterbit, said the Kimi K3 launch marks a “clear turning point in accelerating global adoption of Chinese LLMs” but still urged caution with regard to security.

“Enterprises may underestimate the security, accountability, and governance risks associated with adopting new Chinese LLMs,” he said.

“Moonshot AI operates as a cloud service with data stored in China, introducing potential risks for organizations whose data may be shared unknowingly.”

Conner said adoption of Chinese AI models should be treated as a “strategic risk decision, not merely a cost-saving opportunity”.

FOLLOW US ON SOCIAL MEDIA

With AI tools now commonplace in software engineering, nearly two-thirds (60%) of organizations are expected to shrink team sizes by 2029. But that doesn’t necessarily spell bad news for engineers, according to Gartner.

Analysis by the advisory firm suggests the shift toward smaller engineering teams won’t be a cost-cutting exercise, but rather a natural evolution toward more agile, specialized units focusing on specific areas.

Gartner envisages these smaller teams being composed of specialist product managers alongside user experience (UX) - or agent experience (AX) designers, and at least one ‘AI-native’ engineer.

Speaking to ITPro, Gartner principal analyst Aliyah Camacho, said this influx of AI has prompted a rethink of how enterprises can “really make the most of AI and humans working together”.

“What we’re seeing is that organizations are looking at engineers as AI orchestrators,” Camacho told ITPro.

“One aspect of tiny teams is that we’re thinking of them as focused on a product or a set of features for a product, so it’s bringing together more of that product management skills and expertise onto the team.”

The concept of engineers moving toward more of an orchestration-style role has become a recurring talking point over the last 18 months. AWS CTO Werner Vogels told ITPro earlier this year that the traditional image of developers as “code monkeys” is fading.

With AI in the mix, developers and engineers can now focus on other tasks, such as quality assurance and testing, Vogels said at the time.

Gartner’s research echoed this, noting that with the technology handling routine technical tasks, this will ultimately free up engineers to focus on “complex problem-solving and innovation”.

With tiny teams, Camacho said this will essentially remove a layer of friction for engineers. Simply put, the AI does the grunt work, while engineers have time to focus on product development and refining existing software.

These teams will also have their own remit similar to product development teams, meaning they’re staying in their own lane and not getting dragged into other areas.

“What we're predicting to be speed or velocity-type gains with tiny teams is that these small teams are fully accountable for the success of their product or feature,” she explained.

“So removing that layer of having additional approvals and coordination is one type of speed gain,” Camacho added. “Then another is having fewer people on the team means that there's less time spent in that communication and handoff type of activity.”

How tiny are we talking?

Naturally, what constitutes a ‘tiny team’ will vary wildly based on the size of the enterprise. Small teams today, also known as ‘two-pizza teams’, typically have between five and eight people, Camacho said.

Generally speaking, the shift to tiny teams could take this down to five or six. Some, on the other hand, could end up with just two or three, Camacho noted.

“This really varies,” she said. “Some are curious about experimenting with teams of three, and then for others a meaningful reduction in size is down to six.”

Ultimately, these changes will be made on an enterprise-by-enterprise basis, but leaders should be wary of downsizing down too much. These teams should be small enough that they’re agile but also remain effective and have enough diversity of ideas.

Not a cost-cutting exercise

Given that the last two years have seen repeated warnings about AI rendering developers obsolete, some might see a shift to smaller teams and figure this is another excuse to offload staff.

Camacho insisted that this isn’t a cost-cutting exercise, however. Teams will be smaller, but the consultancy predicts there will eventually be more of these tiny units working away in the background building software.

This is where communication from leadership will be vital in fostering change, Camacho noted.

“I think that a huge piece of making this kind of change is communicating really clearly about what it is and is not, and the tiny teams model is not a cost optimization tactic,” she said.

“Rather, it’s a restructuring of teams to best take advantage of AI and human expertise. What we’re seeing with this idea is that team size reduces, but the number of teams may actually stay the same, or may increase, because we’re expecting more demand for complex engineering solutions at organizations.”

Room for juniors

Maintaining robust talent pipelines will also be a key focus with the shift to tiny teams, according to Gartner. If anything, junior engineers will be more crucial than ever to compensate for general attrition and to provide AI-native skills.

The impact of AI on entry-level jobs has been a recurring talking point over the last 18 months, with the need for junior engineers questioned by some industry stakeholders.

This is where the ‘how small is too small’ question comes into play, according to Camacho.

“We absolutely believe that organisations need to continue hiring junior talent to build that pipeline for the future,” she said.

“So the way that fits with tiny teams in this context is reducing team size, but not making it too small because if the team size shrinks too much, that can pose risks.”

Long-term, the solution to developing junior talent could lie in apprenticeship-style models, she added, noting that this “could fit really well with the tiny teams model”.

FOLLOW US ON SOCIAL MEDIA

At the end of June, Apple released the iOS 26.5.2 update, containing a long list of security fixes. The timing of the update differed from Apple’s typical approach, which sees the iPhone maker issue mid-cycle patches for emergency security fixes or urgent bugs only.

Yet when iOS 26.5.2 was released, Apple told Reuters the move was part of an overhaul of its strategy as AI tools find vulnerabilities at scale. Indeed, some of the flaws patched in its update were found using AI, painting a clear picture of what security teams can expect in the future.

Apple is not the only vendor to supercharge its patch release cycle fuelled by AI-enabled vulnerability discovery. This June was Microsoft’s biggest Patch Tuesday ever, fixing over 200 bugs, while a recent Google Chrome patch fixed 400 issues in the browser.

As ITPro has already reported, patching velocity must increase as Anthropic’s frontier AI model Claude Mythos and others like it start to find flaws en masse.

But Apple’s accelerated release schedule highlights the impact on mobile devices – especially when part of a bring your own device (BYOD) policy. What can security leaders do to regain control?

Shrinking attack windows

Experts say shrinking attack windows are making patch management an urgent problem. The time between a flaw being discovered and weaponized is “falling dramatically” as AI tools “accelerate both research and exploitation”, says Tristan Shortland, CTO at Infinity Group.

“Traditional patch cycles that measured response times in weeks are increasingly at odds with a threat environment that moves in hours.”

With this in mind, most industry commentators see the move towards accelerated patch releases as positive. “From a risk perspective, I'd much rather see organizations patch quickly and in a controlled way than wait for monthly cycles and leave vulnerabilities sitting there, waiting to be exploited,” says Nathan Davies-Webb, principal consultant at Acumen Cyber.

Yet rapid patch release cycles add pressure in scenarios where employees use personal devices to access corporate networks. “Apple, Google and Microsoft can remind users to update, but they don’t always enforce it,” points out Jake Moore, global cybersecurity advisor at ESET.

For those that run BYOD policies, the impact of late patching could be vast, agrees Sriram Kakalara, chief product officer at Scalefusion. “Personal iPhones and iPads often access corporate apps and data from outside the IT team's direct control,” he warns.

More updates, less warning

Another challenge is the sheer number of mobile fleets to be updated. The trend towards increasing numbers of mobile device patches could be a problem for larger distributed organizations such as retailers, according to Kakalara.

“These might have thousands of devices running on iOS, and every accelerated release means pushing updates more often and with less warning,” he says.

He points out that many organizations “fail to scale their patching and access strategies as their endpoint estate expands, leaving known vulnerabilities unresolved”.

The onus is now on organizations to operate “faster and more efficiently”, he says.

Beyond simply deploying updates more rapidly, the challenge will be ensuring every endpoint has received them, adds Andy Ward, SVP International at Absolute Security.

“The rise of hybrid working over the last decade has made this increasingly difficult. Remote work and BYOD leave organizations with gaps in visibility that attackers can easily exploit. Every day a critical patch is delayed extends the window of opportunity for cybercriminals.”

While there’s no doubt AI can be beneficial in vulnerability discovery, the pressure on patching as a result of the constant flurry of security fixes is only going to get worse.

Shortland expects more vendors will follow Apple's lead, issuing patches more rapidly in line with vulnerability discovery. “AI is exposing vulnerabilities at a scale we've not seen before, which means the industry will have to move towards more continuous patching and risk-based remediation models, rather than relying on predictable release cadences.”

Security teams should treat Apple's move as “the new normal”, agrees Kakalara. “The precedent means patches can now arrive unexpectedly and without notice, so waiting for a scheduled maintenance window is no longer a viable strategy. Teams need to be on permanent alert, ready to test and deploy at speed.”

No more patch day

It might seem complex, but there are some simple steps security leaders can take to ensure fixes are applied as soon as they’re released, including to BYOD devices.

Rather than banning BYOD, Moore thinks the solution is implementing conditional access controls to ensure outdated devices can’t access company systems. “This means it becomes nearly impossible to have devices running outdated software.”

But at the same time, companies need to avoid treating every new flaw as an emergency. Instead, the focus should be on “what is actually being exploited – rather than what is possible”, Moore advises.

Ian Thornton-Trump, CISO at Inversion6, believes security leaders must make themselves aware of the size of their company’s attack surface, and be able to identify legacy devices “either properly supported by vendors, or unsupported”.

In tandem, Thornton-Trump outlines the importance of firms testing their own defences. “Prioritize red teaming and penetration testing to try and find weaknesses before bad guys do, and before security researchers encourage firms to respond.”

Moore recommends automated patching as an ideal scenario. “Long gone are the days where Tuesday was the patch day,” he says. “Manual processes were built for a far slower time, but as we shift into the AI era, we are going to have to adapt and evolve as quickly as the technology does.”

Davies-Webb concurs. He thinks the point has been reached where not using automatic patching “is becoming harder to justify”.

“There was a time when concerns around stability and functionality made organizations cautious about patching too quickly, but for most, the risk now sits firmly on the other side of the equation,” says Davies-Webb.

“AI is accelerating how quickly vulnerabilities are discovered and weaponized, which means organizations need to be reducing exposure as quickly as they can."

Software developers aren't losing skills because of AI, but using time saved to skill up, according to research from O’Reilly.

Analysis from the learning platform found that rather than the boom in AI coding tools having a negative effect on developer capabilities, many view the technology as a way to streamline everyday tasks to help them focus on learning.

O'Reilly said that use of generative AI content on its own learning platform was up 89% in the UK over the last year, while machine learning grew by 51% and natural language processing was up 117%.

At the same time, O'Reilly noted that more traditional programming topics saw decline over the last year, with "programming fundamentals" down 74%, Agile falling 31%, and Git down 20%.

While that could be seen as software engineers handing off such work to AI and not bothering to study key subjects, the study noted this suggests many are learning such skills on the job and using AI to support learning.

Formal training time, meanwhile, is spent learning about more advanced AI-related topics.

Alexia Pedersen, SVP International at O’Reilly, said the study shows developers are now making AI a “core part of their learning priorities”.

"The UK tech workforce isn’t turning its back on programming," Pedersen said. "It’s building on years of engineering expertise to take advantage of the opportunities AI creates. That’s exactly what we’d expect from experienced developers."

"Many already have years of programming experience, which puts them in a strong position to adopt AI tools confidently and apply them in meaningful ways," she added.

AI isn’t a replacement for core skills

That said, O'Reilly warned that AI should complement, not replace, foundational programming knowledge – especially for newer developers.

As ITPro reported last year, concerns are rising that those entering the workforce are becoming too reliant on the technology. The result is that many could miss out on valuable learning curves in the early stages of their careers.

"The challenge now is making sure the next generation develops those same foundations before relying too heavily on AI," Pedersen commented. "AI will make great developers even better, but it can’t replace the technical judgement that comes from understanding how software really works."

The company suggested that while developers are choosing to learn in different ways, it's worth noting that employers still require specific programming skills.

React, Node.js and Java skills are still highly sought after while cloud-related knowledge is prevalent in many UK job ads.

Indeed, demand for the Clean Code courses grew 19% over the last year, O'Reilly said, with C# up 17% – showing practical coding capabilities remains important.

"What this data captures is a workforce making active choices about where their time goes," Pedersen said.

"UK tech professionals aren't casually browsing AI content – they're incorporating technical learning into new ways of working, building AI agents, testing different approaches, and exploring how these tools can improve productivity and outcomes.

FOLLOW US ON SOCIAL MEDIA

IBM has announced a series of updates to its IBM Bob software development tool, with a particular focus on better managing token consumption.

The move marks the first big batch of updates for the agentic development tool, which rolled out earlier this year. Bob will now offer multi-agent capabilities, the company said, alongside built-in AI cost and usage analytics features.

According to IBM, the new ‘Bobalytics’ feature will enable developers to monitor AI token consumption, streamline resource management, and improve visibility in terms of how AI tokens are consumed by teams.

Sub-agents and multi-agent capabilities will also play a key role in reducing costs, according to IBM. Sub-agents are those that operate under the direction of another to handle specific tasks within a larger workload.

The advantage here is that these dedicated agents will work in an “isolated context” within broader workloads to complete tasks in a more efficient manner, ultimately reducing costs.

Multi-agent features also contribute on this front, according to Michael Kwok, VP of IBM Bob. In a blog post detailing the updates, Kwok noted that Bob will now call on specific tools based on the underlying model, allocating agents depending on the intensity of tasks and associated costs.

“Parallel tool execution can significantly reduce the time required for complex tasks involving multiple searches, file operations and validation steps,” Kwok explained.

“Subagents improve efficiency by performing specialized work in isolated context before returning only the relevant results, while background tasks allow long-running work to continue without interrupting the developer’s workflow.”

AI cost optimization in the spotlight

The move by IBM comes amidst a sharpened focus on AI token consumption - and spiralling costs - by enterprises globally. As ITPro reported in June, the ‘tokenmaxxing’ trend has landed some organizations with eye-water bills.

Uber, for example, blew through its entire annual AI bill in just four months after incentivizing staff to ramp up use of the technology.

Developer teams are also contending with rising costs on this front, as Gartner told ITPro in late June. The consultancy projects that token costs could exceed engineer salaries by 2028 based on current usage rates.

Speaking to ITPro at the time, Nitish Tyagi, senior principal analyst at Gartner, said engineering teams are adopting a range of cost optimization practices to reduce the impact of token consumption.

New ‘premium packages’ for IBM Bob

IBM also unveiled three new specialized workflows for Bob aimed at driving Java, IBM Z, and IBM i operating system (OS) modernization. These capabilities come in separate ‘premium packages’, according to the firm, offering enterprises domain-specific versions of the tool.

“Modernizing a Java application requires different knowledge, tools and workflows than working with IBM i systems or mission-critical mainframe applications. Each environment carries its own architecture, runtime assumptions, integration patterns, validation needs and operational constraints,” Kwok explained.

“Premium Packages bring domain intelligence and decades of enterprise expertise directly into Bob while maintaining a consistent developer experience.”

The premium package for Java, for example, will help automate migration processes, allowing teams to move to more recent versions of the programming language. Bob will essentially guide users through the process, while also assisting with broader modernization practices.

This includes automated compatibility testing and the ability to identify and remediate vulnerabilities.

The premium package for IBM Z, meanwhile, will provide teams with a helping hand during mainframe modernization projects. The Z Code Mode feature, for example, will help “explain, generate, modify, refactor, and transform mainframe application code”.

Efforts to streamline mainframe modernization by the firm come after a high-profile spat with Anthropic earlier this year.

FOLLOW US ON SOCIAL MEDIA

Researchers at Nebula Security have discovered a Linux kernel flaw dating back to 2011 that lets any logged-in user take full root control of an unpatched machine in just five seconds.

Dubbed GhostLock (CVE-2026-43499), it was introduced in Linux 2.6.39 and fixed in Linux 7.1.

The flaw allows an unprivileged local attacker to get a dangling kernel pointer to kernel stack memory with only regular threading syscalls, write a pointer to an arbitrary address, and hijack a function table to get root access.

GhostLock has been shipped by default in every mainstream distribution since 2011, and requires no special privileges or network access. Nebula, which uncovered the flaw, said its exploit is reportedly 97% reliable and can also escape containers.

This particular flaw is the second part of an attack chain dubbed IonStack, with the first step being CVE-2026-10702, a vulnerability in Firefox that allows code execution within the browser and escapes its sandbox.

The vulnerability is rated high (7.8) as the attacker would already need to have local access to the system.

How the GhostLock flaw works

Nebula researchers said the root cause is a function reused by a caller it was never written for: the helper function remove_waiter(). During certain futex operations, it incorrectly clears a pointer associated with the currently executing task, rather than the actual waiting task.

This leaves the kernel with a dangling pointer that points to a memory location that has already been freed and reused. This allowed the Nebula team to gain full control, tricking the kernel into running their own code as the root user.

Daniel Bechenea, security manager at Pentest Tools, said the flaw is of particular concern because kernel exploits have historically carried a “real operational cost for attackers”.

“An unreliable one crashes the box and burns the access,” he explained. “An exploit that Nebula reports as 97% reliable, with public code anyone can run, changes that math.”

"As GhostLock uses a kernel vulnerability, containers also represent a juicy target for attackers as the exploit escapes the container and obtains code execution as root on the host OS, meaning that: containerised workloads that teams treat as isolated become stepping stones to the host and everything else scheduled on it."

Patch now

Systems running older kernels remain vulnerable to exploitation, according to Nebula. Researchers urged users and administrators to update to patched kernel versions as soon as possible.

"On an unpatched host, treat any code execution as root, and plan containment accordingly," advised Bechenea.

"Prioritize the systems that run untrusted or semi-trusted code by design: CI runners, container platforms, shared development machines, multi-tenant hosts, and verify the fixed kernel package version on each system rather than trusting that the April fix propagated, because with several major LTS releases still lagging in early July, attackers who land a foothold will check your kernel version even if you haven’t."

FOLLOW US ON SOCIAL MEDIA

Open source can't catch a break. As the world of software development marches forward with new tools and capabilities expanding productivity – an evolution driven predominantly by AI – the community endures significant headwinds.

"In the age of AI-driven security threats, protecting customer data has to come first," wrote Bailey Pumfleet, co-founder and CEO of scheduling software maker Cal.com, in April.

After five years as "open source champions", the company announced it would go "closed source". Cal.com is far from the only example, with several organizations and projects including Tailwind, curl, Jazzband, Godot – and even the U.K. National Health Service (NHS) – also struggling in the wake of AI.

Tension has always plagued open source, with concerns around funding, infrastructure, and even expectations management, negating any meaningful green shoots. The threat has even been described as "existential", but the community has nevertheless survived and thrived, celebrating incredible adoption rates in recent years. But things feel different. AI poses an existential threat in many areas — but will it continue to hack away at the beleaguered open source community, or is there a viable path forward for the movement?

Open source is battling AI-centric headwinds

"In the past, exploiting an application required a highly skilled hacker with years of experience and a significant investment of time to find and exploit vulnerabilities," wrote Cal.com's Pumfleet in the blog post. The reality is that humans don’t have the time, attention, or patience to find everything. Today, AI can be pointed at an open source codebase and systematically scan it for vulnerabilities."

Security is just one aspect in an increasingly fraught dynamic. Tailwind, the organization behind a popular CSS framework that web developers incorporate into their projects, announced on 7 January it had slashed its four-person dev team to just one. The reason, CEO Adam Wathan cited, was "the brutal impact AI has had"; web traffic to documentation – which is the only way people can find out about its commercial products – was down 40% from early 2023.

There are also examples of projects struggling to cope with an onslaught of low-quality contributions. Take Godot, the open source game engine that's drowning in AI slop code pull requests (PRs), according to one of the primary maintainers, Rémi Verschelde, who described this as "increasingly draining and demoralizing".

The Jazzband collective, a Python project ecosystem, was sunset this year after ten years of activity due to the "slopocalypse" with floods of PRs and AI-generated spam rendering "Jazzband’s model of open membership and shared push access untenable".

There are plenty of other issues to contend with. They may include the fact that using advanced AI tools may be gated on the need to spend money, and that it's unclear whether you're speaking with a human or an AI agent at any given time.

How open source projects are coping with AI

Amanda Brock, CEO of OpenUK, tells ITPro that the industry is still grappling with AI as a novel force and different projects are handling it in different ways – with some handling it much better than others. "For some projects, they have not been able to manage the scale of it. And for some small companies, they have said they've had to close," she says, but added this isn't a universal experience, with others managing to get a grip on the headwinds.

"I'm skeptical about their business plan," Brock added on Tailwind, "and I could be wrong, and I'm not an authority on this in terms of each company's business and whether they were doing well enough. But I'm a bit skeptical when many are surviving about the few that are closing, and I don't know if that's the most vulnerable or the ones without the right business structures or teams."

However, Brock states the challenges are very real and unlike much else the community has experienced. For example: "When AI comes to Wikipedia, it not only comes at a huge scale by volume of eyes on the site or the pages, it looks at every page, and it does it in an instant. And the overwhelm is huge. And that's the equivalent of what open source projects feel when their repos are scraped; when they suddenly have this inbound volume from AI."

An example of a project that's fared better in wrestling with AI is Homebrew, the package manager. Its project leader Mike McQuaid tells ITPro Homebrew's response was to fight fire with fire. "We have had an increase in low-effort activity, but we respond with low effort," he says. "Our bots automatically close issues, we’ll close without review, we don’t dignify them with a response, et cetera."

McQuaid adds that, despite some notable examples, it's overstated that many projects are going closed source or winding down, and it's not representative of the wider experience. He says projects weather the storm "the same way we always have," with one measure including prioritizing maintainers' time, effort, and enjoyment over contributors, and prioritizing contributors over users. Responding to rudeness is also met with low effort, no effort, or blocking. He also suggested leaning very hard onto guardrails.

Resolving the fate of open source

McQuaid says the notion that AI could lead to the end of open source is "far too dramatic" and that there are plenty of positives to enjoy in a grand trade-off, despite there being an element of entering the unknown. These positive improvements include the way that AI allows some people to go much faster, that there are plenty of free AI tools available, and that many of these can help with code review, fixing bugs and triaging.

"It isn’t making huge negative changes without any positive remediations," he explains. "It’s just resetting people’s expectations of what 'working on open source' might be like for them. Some people won’t enjoy it any more. Many people equally are contributing who didn’t or wouldn’t before."

Despite many positive steps taken in the open source world over the last decade, Brock dwells in a sense of pessimism – but not entirely because of the immediate effects of AI. "I have been very pessimistic in some ways for a long time," she says, "because after lockdown everybody came out seeming to think that 'we'd won'." And what we'd won was, we've got a scale of adoption — but that scale of adoption wasn't matched by a scale of understanding, or funding.

"My worry was that you were going to see it, go full circle and end up back in proprietary because of exactly this kind of thing. I did not imagine AI, but I could see that things might happen, that meant that we were just overwhelmed because we got into a position where people expected an SLA-type delivery and support for free because the code was free."

Building on open source's legacy

"If it hadn't been AI, it would have been something else," Brock reiterates, saying the challenges have been piling up "at a time when people are reeling" one after another in the last few years.

"We've just had a decade since we really saw all this adoption start. We're a small group of experts [and scaling from] the small to the many hasn't worked."

Brock wants to see more gatekeeping, because "good projects have always gatekept". She adds: "There is this sense in the wider world that open source has always been a wild west, and that anybody can contribute – and that's just not the case."

Beyond that, she sees hope in models like the German Sovereign Tech Agency, which brings together dozens of maintainers into standards development. There are calls in the U.K. for a similar system, with a foundation in the model of the Linux Foundation, or China's OpenAtom, that brings together expertise at a national level to work on intellectual property (IP), managing GitHub repos, and other key elements, for public sector open source.

By professionalizing the industry, however, you run the risk of losing projects when things go wrong. CHAOSS, a Linux Foundation project that measures open source health, is an example of a project in dire straits, having just lost its funding. Former director of data science Dawn Foster left her role in March, and the project has returned to the community.

But, Brock says, "it's hard to reignite the volunteers" when they see funded people doing the work. "So it all has to be done in a very careful, measured, and joined-up way across borders," she explains.

When it comes to the future, Brock remains adamant that urgent action is needed or open source will be consigned to history. "We're already seeing eight companies controlling the AI landscape," she says.

"If we allow open source to fail, the only organizations in the world that will be able to manage that are some of those big tech ones that will already have it in place. So I don't think it's in the human and public interest to allow open source to fail."

AI-augmented developer roles have increased nearly six-fold over the last five years, as enterprises move from AI experimentation to implementation, according to new research from Randstad Digital.

While there's been an increase of just 28% for traditional developers, the figure for developers with AI expertise has grown by 597%, with nearly one-in-four developer roles now requiring these skillsets.

Analysis of more than 35 million job postings shows technical professionals who acquire specialized credentials are leapfrogging traditional seniority tiers, with AWS Solutions Architect (Pro) and LangGraph/RAG Architect certifications driving estimated salary increases of 54% and 31%, respectively.

"Enterprise AI is no longer a future investment; it is today's operational reality. Yet the biggest barrier to growth is not access to technology, it is access to the right people," said Michael Morris, global head of platform and talent at Randstad Digital.

"Buying AI is easy. Integrating it safely and securely across a complex enterprise is where the true challenge lies. The specialists who can integrate, govern and scale AI inside complex organizations are in critically short supply."

While foundational roles like prompt engineers are still growing at 174%, demand has rapidly escalated up the skills ladder, with AI trainers now the fastest-growing role globally, up 281%.

As ITPro reported in February, demand for AI trainers has skyrocketed over the last 18 months. Researchers said this reflects a broader market pivot toward roles that turn AI’s potential into real support for business growth.

Demand for AI solutions leads is up 226%, process automation specialists up 196%, and AI architects up 152%, Randstad noted.

Finding talent is harder than it looks

While demand for AI-related skills is there, actually filling these positions is far harder than it appears, Randstad noted. Indeed, enterprises are facing acute challenges in sourcing talent.

AI solutions leads are currently the hardest role to fill globally, for example, with time-to-fill timelines hitting 54 days in key markets and vacancy rates of nearly 27% in the US and 18% in the UK.

Despite having talent pools of roughly 100,000 professionals, machine learning engineers face vacancy rates of 8.2% in the US and 11.2% in India. Japan, meanwhile, is facing some of the sharpest shortages globally, with a 46.8% vacancy rate for AI engineers and 25% for generative AI engineers.

All this is reflected by hiring timelines, according to Randstad. While a standard IT role typically takes 38 days to fill, the recruitment window for advanced AI infrastructure roles has expanded to an average of 54 days in the UK and 53 days in the US.

This stretches to a high of 90 days for Process Automation Specialists in Italy.

The result of this is that salary offers are rising sharply, particularly in the US. Across the Atlantic, large language model (LLM) architects have a vacancy rate of 19%, commanding average salaries of $240,000.

Brazil and Argentina have rapidly emerged as a high-growth corridor for specialized AI services, now representing over 15% of global postings combined. In Europe, the UK, Poland, Spain, and Germany show steady demand, with individual national shares between 1.8% and 2.8%, while China accounts for 7.5% of the global job volume.

"AI talent concentrated in the US and India but fast-growing corridors emerging in Brazil, Argentina and beyond, cross-border hiring is becoming a core enterprise strategy," said Morris.

"Organizations that combine global talent sourcing with deliberate investment in upskilling their existing workforce are best placed to close the gap."

FOLLOW US ON SOCIAL MEDIA

Forward deployed engineers (FDEs) could be the key to driving successful AI deployments, as hyperscalers pledge billions to embed specialists within customer teams.

Last week, Microsoft announced plans to invest $2.5 billion in a new division, the Microsoft Frontier Company. The aim here is to deploy upwards of 6,000 AI experts and engineers inside customer organizations.

These specialists will work with enterprises to co-design and build AI systems in a bid to accelerate adoption rates, according to the tech giant.

The announcement came just days after Amazon Web Services (AWS) announced similar plans with a $1 billion investment in its Forward Deployed Engineering segment, once again aimed at bolstering customer AI capabilities.

With the scale of investment – and sheer number of engineers required – for AWS and Microsoft’s push on this front, FDEs are rapidly emerging as the most sought-after technology professionals globally.

Alastair Williamson‑Pound, CTO at Mercator Digital consultancy, told ITPro that the focus on FDEs is an “exceptionally strong signal” that this could become a key growth area for the industry – and a vital pool of talent to drive AI adoption.

“FDEs have become increasingly critical because they sit inside the client, where they can drop barriers, cut through red tape, and get in front of the decision-makers quickly,” he said.

“It’s perhaps why we’re increasingly seeing them considered as a commercial weapon by cloud providers to secure long-term relationships and spend,” he added.

“Another good aspect is that pricing is fixed and based on outcomes rather than time and materials (T&M), which gives customers greater certainty around delivery.”

Williamson‑Pound noted that this aligns with “what companies are after these days”, mainly support in pushing AI adoption projects from pilot to production.

AWS noted that its FDE strategy aims to “compress timelines from months to days” in terms of AI progress, and is “designed so customers are self-sufficient when a deployment ends”.

“Those organizations that are stuck between piloting and deployment can be given that final push by [an] FDE,” he commented.

“The training and documentation they leave behind also tends to give customers that final confidence boost, helping internal teams continue developing and maintaining the system by themselves.”

The rise of forward deployed engineers

Microsoft and AWS are by no means the first big tech providers to put their faith in FDEs. Palantir somewhat pioneered this approach more than a decade ago, and other companies in the AI space have ramped up activities on this front.

As ITPro reported in May, OpenAI launched a new consultancy arm aimed at embedding engineers within customer organizations.

A key distinction here, however, is that the OpenAI Deployment Company is a standalone entity, while both Microsoft and AWS have their own internal divisions dedicated to FDEs.

Crucially, both moves mark the latest attempt by big tech providers to move the needle with regard to enterprise AI adoption, which research shows has been sluggish and at times underwhelming.

Analysis from PwC in January this year found that executives have become increasingly restless when it comes to returns on investment (ROI). Separate research, meanwhile, shows a significant portion of AI projects fail at the first hurdle.

A key factor in adoption project failure often lies in technical capabilities, or lack thereof, according to research from Dynatrace.

With this in mind, providing enterprises with a helping hand throughout the process could provide a much-needed boost for IT leaders.

Initial feedback on Microsoft’s FDE activities show promise on this front, according to Judson Althoff, CEO of Microsoft’s commercial business. In a blog post last week, Althoff claimed that early results have demonstrated “meaningful impact”.

The tech giant embedded engineers within the London Stock Exchange Group (LSEG), for example, helping accelerate AI adoption and providing finance pros with tools to provide answers to complex queries.

Close collaboration between Microsoft’s FDEs and frontline staff at LSEG helped streamline adoption and essentially create a foundation for future improvements, according to Althoff.

“The solution is underpinned by a foundation that is iteratively refined through client feedback and real-time user testing that accelerates each cycle and steadily improves model quality and scope,” he wrote.

Partnerships with Unilever and Novo Nordisk have also delivered marked improvements in terms of AI adoption, Althoff noted.

How FDEs work

FDEs essentially operate like systems integrators (SI), albeit with a few notable distinctions. An SI, for example, is typically an external contractor used to streamline the adoption of individual solutions.

With FDEs, these engineers act as consultants embedded directly within the enterprise. They also offer technical guidance, but it’s the practical support in terms of custom product development that’s a key differentiator. Simply put, they’re building alongside your own engineers.

“Typically, FDEs work in small pods for a fixed period of time, during which they sit within the engineering and technical teams of the client, writing production grade code,” Williamson-Pound explained.

“They leave the customer with a working system in place supported by full documentation, as opposed to an implementation plan.”

JetBrains CEO Kirill Skrygan told ITPro there are a range of benefits to using FDEs for enterprises, and they’re more than just a temporary boost to engineering capabilities.

“FDEs work closely with customers to translate complex organizational challenges into solutions that technology can actually deliver. Doing that well requires more than coding ability," he said.

“It demands architectural expertise, technical leadership, communication skills, and sound business judgment — all qualities that are difficult to automate.”

FOLLOW US ON SOCIAL MEDIA

The SaaS industry is facing a pending wave of disruption as enterprises shift their focus towards agentic AI solutions, according to new research from Gartner.

With agentic AI adoption continuing at pace globally, the research firm said this poses a significant threat to traditional software revenue models.

Indeed, up to $234 billion of application spending will be exposed to "agentic arbitrage" – where agents render some services obsolete by removing the need to work across multiple interfaces – by 2030.

George Brocklehurst, managing vice president at Gartner, said the study shows agentic AI “changes the economics of software”.

“Agentic systems deliver outcomes directly, bypassing traditional user experience (UX)-heavy applications and making the software invisible,” he said. “This breaks the link between user growth and revenue growth for many enterprise software vendors.”

No ‘SaaSpocalypse’, but a ‘metamorphosis’

Long-term, Gartner noted that this agentic AI-focused shift will “refactor” how software is built, priced, and consumed. Indeed, Brocklehurst said a period of “redefinition” could come, with the firm describing this transformation as a "metamorphosis".

“This metamorphosis represents threats and opportunities for both incumbents and new challengers,” Gartner said.

Gartner’s claims regarding a period of transformation for the SaaS space align closely with predictions made by industry stakeholders on the potential impact of AI.

Earlier this year, software stocks plummeted amid a mass sell-off due to the arrival of powerful new AI solutions, particularly Anthropic’s Claude Cowork service.

This spooked investors, with some concerned about a ‘SaaSpocalypse’ whereby agents could remove the need for certain software services.

Despite lingering concerns, some industry leaders are still bullish on the future of SaaS – albeit with a few caveats. As ITPro reported in February, AWS CEO Matt Garman poured cold water on the prospect of a looming SaaSpocalypse, suggesting that “much of the fear is overblown.”

Staying competitive

Remaining competitive in a changing market will require incumbent software vendors to “move from interfaced-based value to outcome-based value,” according to Gartner.

Put simply, providers will need to embed agentic capabilities within their offerings to defend their position and meet changing expectations.

Enterprises don’t want disparate tools and dashboards anymore, the researchers claimed, they want streamlined, end-to-end workflow automation and solutions that “capture customer context and knowledge”.

“As organizations increasingly use agentic AI systems, the user interface is no longer a differentiation,” Brocklehurst said. “Legacy SaaS market share will be cannibalized by incumbents and taken by new entrants delivering horizontal agentic platforms.”

“While this shift is posing an existential threat for vendors who are defending legacy dashboards and seat-based models, it creates a substantial revenue opportunity for vendors who are enabling and developing services and platforms to support agentic enabled cross-domain workflows,” he added.

FOLLOW US ON SOCIAL MEDIA

Unmanaged SaaS guest accounts are creating massive security liabilities for small and mid-sized businesses, new research has shown.

According to Kaseya’s 2026 SaaS Security Report, 69% of SaaS accounts have more guest access than licensed users, with persistent third-party access and externally shared data leaving small and mid-sized businesses open to attack.

Gaps in multi-factor authentication (MFA), OAuth sprawl, and external file sharing are widening the SMB attack surface, the study noted. Indeed, threat actors are now abandoning perimeter attacks in favor of softer targets like identities, OAuth integrations, and collaboration workflows.

This, Kaseya noted, leaves a trust gap most small and mid-sized businesses can't even see, let alone close.

“Today’s AI-emboldened threat actors see one interconnected attack environment, whereas most organizations defend their infrastructure in pieces,” said Jim Lippie, chief product officer at Kaseya.

“The most resilient organizations will be those that embrace continuous monitoring, identity governance ,and automated response as foundational requirements.”

AI scramble has caused OAuth chaos

The rush to adopt AI has led to a sprawl of third-party OAuth integrations that use persistent tokens instead of credentials, and that risks granting attackers permanent data access even after password resets.

As a result, non-human service principal logins now account for one-fifth of critical security alerts.

At the same time, attackers are using AI-driven automation to instantly locate and exploit dormant guest accounts, moving faster than manual defenses can respond.

Legacy controls like geolocation blocks are also failing to help, as attackers route traffic through trusted cloud hosts and VPNs.

Outside North America, Kaseya found nearly half (44%) of unauthorized logins originated from trusted infrastructure and outsourced hubs.

India accounts for 14%, the Philippines 10%, Germany 7%, the UK 7% and the Netherlands 6%.

Hackers are exploit SaaS identity gaps

Once inside, attackers are able to exploit massive identity gaps, with 56% of accounts lacking active MFA and only 27% of SMBs enforcing it across the organization.

Meanwhile, researchers found data leakage is through the roof in productivity environments. In Microsoft 365, 45% of all shared files were sent outside the organization.

Companies are also failing to keep up with severe alerts. Last year, while 98.9% of security events monitored by SaaS Alerts were classified as low severity, organizations still faced more than 278 million medium- and critical-severity alerts requiring investigation.

Kaseya recommends transitioning from rigid perimeter defenses to active, identity-first governance frameworks.

"Bridging the modern trust gap requires businesses to move away from static event tracking and instead prioritize automated behavioral monitoring that can flag anomalous activity inside trusted accounts," the company said.

"By aggressively consolidating security stacks, enforcing organization-wide MFA and continuously auditing machine identities and external sharing permissions, SMBs can eliminate critical visibility silos and systematically neutralize attacker persistence before a breach occurs."

FOLLOW US ON SOCIAL MEDIA

Apple has dropped an unexpected out-of-band patch, and it's apparently because of concerns that AI is helping hackers exploit vulnerabilities at lightning speed.

The tech giant released iOS 25.6.2 yesterday, with fixes for iOS and iPadOS, despite normally bundling such security patches into wider updates. Apple hasn't said when its next major update, iOS 26.6, is set to be released, but it's widely expected in the next few weeks ahead of iOS 27 in the autumn.

Apple told Reuters that the extra security update was down to concerns about AI shortening the time between a flaw being spotted and exploited by hackers.

The company said that shorter timelines from flaw to exploit meant it needed to respond by cutting the time between when updates are announced and released.

That shouldn't be taken as a suggestion that Apple was seeing any evidence that hackers were already making use of any of the flaws included in the update, the company noted.

ITPro approached Apple for confirmation of the changes made to its security patching policy, but did not receive a response by time of publication.

Apple responds to accelerating threats

The move comes in response to wider concerns that AI is helping hackers find flaws more easily and turn them into exploits more quickly. Indeed, this has been a recurring talking point since the release of powerful new frontier models such as Anthropic’s Claude Mythos range.

Last month, Google said it had spotted cyber criminals using AI to build a working zero-day exploit, with John Hultquist, chief analyst at GTIG, warning that an “AI vulnerability race is imminent”

That echoes a warning earlier this year from Daniel dos Santos, VP of research at Forescout, who told ITPro that enterprises should brace themselves for an explosion of vulnerabilities thanks to AI, further adding to the workload of security teams.

Jake Moore, Global Cybersecurity Advisor at ESET, told ITPro that while the “jury is still out” on how powerful tools such as Mythos are, AI advances do mean that security teams and threat actors alike are scrambling to find software vulnerabilities.

"Whenever a new issue is discovered, there's a race to patch flaws before they can be exploited – and if users or security teams hold off on installing updates, it's a gift to threat actors,” he said.

Moore added that increasing numbers of patches mean the process needs to be automated as much as possible to avoid update fatigue for both end users and security practitioners.

"In the age of automated vulnerability discovery, we're past the point of expecting users and security teams in organisations to manually patch everything," he commented.

"Updates should be automated wherever possible to reduce the burden on users while making sure patches are applied rapidly."

Apple iOS 26.5.2

The security fixes released by Apple were previously revealed via a beta of the update, as is Apple's usual procedure, and addressed more than 30 vulnerabilities across iOS and iPadOS.

Those include kernel vulnerabilities that could corrupt memory and trigger system shutdown and a stack of WebKit issues, including one that could leak sensitive data after visiting a website.

Three WebKit flaws were spotted by OpenAI's Codex Security, while another was spotted by a pair of AI researchers using Claude Anthropic.

The update should have already landed on devices, and is supported on these devices:

• iPhone 11 and later
• iPad Pro 12.9 inch, 3rd generation and later
• iPad Pro 11 inch, 1st generation and later
• iPad Air 3rd generation and later
• iPad 8th generation and later
• iPad mini 5th generation and later

FOLLOW US ON SOCIAL MEDIA

AI coding costs could exceed software developer salaries by 2028, according to new research from Gartner, prompting calls for a greater focus on cost optimization efforts.

The projection by the consultancy is a result of two overlapping trends, including surging token consumption rates and the shift to consumption-based pricing (CPB) models.

A host of software and AI providers have pivoted away from flat rate “per-seat” subscriptions in recent months to CPB setups. As ITPro reported in April, GitHub signalled its own shift on this front, citing rising costs specifically as a key factor behind the decision.

Speaking to ITPro, Nitish Tyagi, Senior Principal Analyst at Gartner, said conversations with clients shows this is rapidly becoming a key concern for enterprises, particularly software engineering leaders as teams ramp up adoption of tools.

“What has happened is that most vendors have switched to a consumption-based pricing model, and it took most engineering organisations by surprise,” he said. “We were never thinking that AI will be this costly, and we are already seeing that cost.”

“Initially, it wasn't alarming,” Tyagi added. “While many organizations are still in the range of $200 to $500 per developer per month, alarming results are coming up.”

Tyagi noted that discussions with Gartner clients show heightened use of AI is costing more than $2,000 per developer, per month. These costs are rising as well, with some eye-watering figures now emerging.

“I’ve been talking to clients where they are telling me that my power users are now costing me more than $2,500 per developer, per month. Sometimes we also hear really crazy numbers, like ‘my developer cost me $20,000 last month, or my business users cost me $32,000 per month.”

Reports on surging AI costs have been coming thick and fast in recent months, and some major firms such as Microsoft have gone so far as to implement usage limits or even cut the use of specific tools internally.

As ITPro reported earlier this month, Uber blew through its entire annual AI budget in just four months after encouraging staff to ramp up their use of AI tools internally.

One of the leading causes behind these price increases and hefty bills lies in ‘tokenmaxxing’ – a trend in which enterprises measure AI usage based on the number of tokens consumed by users.

For some, it’s a way of tracking productivity by highlighting their use of the technology, although critics argue this pads stats and results in skewed metrics.

These overlapping trends raise serious concerns about long-term AI usage, particularly around returns on investment (ROI). Simply put, enterprises want their devs using AI, but heightened costs mean that measuring value is becoming more difficult.

“This is becoming a big issue from two aspects,” he told ITPro. “It’s not only related to developer salaries. This will catch the eyes, but the bigger problem here is that organizations were already struggling and justifying ROI for using these tools.”

“Now that the cost has increased, and it is increasing as well, it is becoming even more difficult to justify these costs and to identify where the ROI is.”

Cost optimization practices need to improve

Tyagi is keen to emphasize that the study doesn’t suggest that developers drop AI tools or agents outright. This completely misses the point, he said.

Instead, engineering leaders and enterprises at large need to sharpen up on cost optimization processes. Efforts on this front are critical, particularly as the study noted that vendors themselves are “yet to deliver mature, built-in cost optimization capabilities” for agents.

A key practice highlighted by Tyagi includes context engineering. This is a technique that involves selectively curating, structuring, and managing information used by AI systems to generate responses.

This essentially involves providing only the relevant information needed by agents, as well as concise summarization of content and elimination of "unnecessary data”

Tyagi noted that this will not only help optimize token consumption for developers, but ultimately deliver longer term benefits in terms of output quality.

“Context engineering is going to become the most important skill in the future,” he told ITPro. “If I actually optimize token consumption, the I would be able to increase the output quality as well.”

This is an emerging focus area for software engineering leaders, Tyagi added, and Gartner suggests that context engineering practices could eventually be mandated to cut consumption rates.

It’s also a blossoming market, he noted. Tabnine, for example, recently launched a new solution known as “Context Engine” aimed at streamlining processes on this front while Atlassian is also developing solutions in this domain.

Selective use

Gartner’s research also urges enterprises to establish a “use-case-driven decision” framework when it comes to using AI for everyday tasks.

Simply put, the focus here should be on clearly defining when AI coding agents should be used, and how much autonomy these bots are given on particular tasks. Given the increasing use of agents among developers, many are simply allocating tasks that aren’t needed.

“Not everything has to be done by an agent, not everything has to be done by developers,” he said.

Looking ahead, developer teams should assess when - and when not to - assign agents to specific tasks, which Tyagi noted could help cut needless consumption and ultimately provide greater control.

“When you’re working on highly sensitive tasks or highly complex tasks, then you want your developers to break down those tasks as well into smaller sub tasks,” he explained.

“We have seen when you are throwing smaller clues, problems at agents, agents do much better than giving them an open-ended problem,” Tyagi added. “Agents are improving, but I think developers should have that level of control right now, through which they can actually optimize the token consumption.”

It’s here that model selection is equally important, according to Gartner, specifically for smaller tasks, which can naturally be handled by smaller models.

Using “intelligent model routing” strategies will enable developers to box clever when it comes to smaller, niche AI models or larger frontier options, which typically come with added costs.

The consultancy noted that escalation is needed “only when complexity demands it”.

FOLLOW US ON SOCIAL MEDIA

AI code generation is running out of control, with eight-in-ten organizations adopting AI tools faster than they can develop policies to govern them, new research has warned.

According to GitLab's AI Accountability Report, 92% are facing governance challenges with AI-generated code as rapid adoption continues.

More than nine-in-ten have two or more AI coding tools in active use, the study found, while 54% have three or more. Meanwhile, 78% report that developers are writing and committing code faster since adopting AI tools.

Teams are generally happy with the results, with six-in-ten saying that the ROI of AI coding is better than they'd expected. More than three quarters (78%) also report faster code output and 73% said overall code quality has improved.

However, while 79% agree that individual developer productivity has improved with AI, the overall software delivery process has not accelerated at the same pace.

Indeed, 82% say that AI-generated code risks creating a new form of technical debt that organizations aren't prepared to manage.

"AI coding tools have delivered on their promise of speed," said Manav Khurana, chief product and marketing officer at GitLab.

"But the events of the past few months, including supply chain attacks, reliability issues, and regulators tightening expectations around AI traceability and provenance are making clear that speed without control is a liability, not an advantage."

AI coding is creating new bottlenecks

Notably, 85% agree that AI has shifted the bottleneck from writing code to reviewing and validating it, and 84% that the biggest challenge with AI-generated code is governing what happens to it after it's created.

Nearly-three quarters are concerned about the maintainability of AI-generated code in their organization's codebase.

GitLab also raised concerns about a prevailing trend of overconfidence when it comes to AI coding. The majority (87%) said they’re confident that teams could determine within 24 hours whether AI-generated code contributed to a production incident, for example.

Yet more than one-third (34%) of organisations fail to spot potential issues before an incident took place.

This appears to be down to difficulty distinguishing AI-generated from human-written code (43%), fragmented toolchains (40%), and systems that don't track code origin (39%).

Only 28% say their software development lifecycle (SDLC) tools are fully integrated with shared data and workflows.

New governance practices are needed

According to GitLab, what’s missing is clarity around governance. The majority (83%) of organizations identify AI-generated code accumulation as a risk to manage now, with 44% calling it a top technology risk.

On the upside, 91% of survey respondents said they are likely to invest in AI code governance tools in the next 12 months, and 98% have already allocated or expect to allocate budget toward these efforts.

Crucially, 85% agree the next phase of AI in software will focus less on generating code and more on governing it.

"The teams thinking ahead are already asking the harder question: can we actually control all the code we’re generating?" said Khurana.

"The organizations that will ship trusted software faster are the ones building the foundations of accountability with context, traceability, and governance baked into the platform, not just bolted on after the fact."

AI governance has been a persistent challenge for developers, with research from Aikido last year concluding that AI-generated code is now the cause of one-in-five breaches.

The study noted that 69% of security leaders, engineers, and developers had identified serious vulnerabilities in AI-generated code.

FOLLOW US ON SOCIAL MEDIA

Anthropic has unveiled a new agent designed to act as a virtual teammate within Slack as the company eyes deeper integration with the workplace productivity platform.

Dubbed Claude Tag, the new feature is underpinned by Opus 4.8 and builds on existing tools offered by Anthropic, with the company noting it views the feature as “the beginning of an evolution of Claude Code”.

“We’re launching Claude Tag on Slack, since it’s a natural home for collaborative work between teams and AI, and where much of Anthropic’s day-to-day work already happens,” the company said in a blog post.

Claude Tag works by allowing users to @ the agent within Slack channels. Users can essentially allocate tasks to the agent, helping automate processes to support various projects across any given organization.

According to Anthropic, internal teams have been using the feature for some time, noting that it’s “one of the main ways we get things done”. Indeed, the company said around 65% of its product team’s code is created by its own internal version.

“The same pattern is now spreading well beyond engineering — we’re tagging Claude to chase down product metrics and data, work through support tickets, or even help find the root cause of tricky bugs,” Anthropic said in a blog post.

Using Claude Tag

Anthropic said using Claude Tag will be a familiar process for those already using its AI tools in the productivity platform, or those who have worked with Claude Code or Claude Cowork.

When a user tags the agent with a request, it will “break its task down into stages and then work through them in turn” depending on the tools it has accessed to.

“Once it’s done, it’ll respond in a Slack thread with that it’s created,” the company explained.

Compared to previous Claude-based tools, Tag has several new features. Anthropic noted that the new tool is now “multiplayer”, meaning that each Slack channel will have an individual agent that everyone can interact with.

“This means that anyone can see what it’s working on, and can pick up the conversation from where the last person left off,” Anthropic explained.

This marks a significant change from previous processes, whereby individual employees interacted with Claude within a single chat, or on a specific task.

“It’s much more like interacting collaboratively with a teammate.”

The new agent also learns continuously based on the tasks it’s been assigned, building more context as time goes on. This is a key feature touted by the company, meaning that users don’t need to provide detailed explanations from scratch for each individual task.

Cross-channel context is also another key feature, according to Anthropic. The agent can learn and build context based on conversations in other Slack channels and data sources, provided it’s granted permission.

The company confirmed that it does not learn based on conversations in private channels.

Elsewhere, a new ‘ambient’ mode is available for Claude Tag, which provides users with interactive updates on project progress, tasks, or "whatever it thinks you might need to know”.

“It’ll flag relevant information from across the channels it’s in and the tools it’s connected to, and follow up on threads or tasks that have gone quiet without being resolved,” Anthropic explained.

How to access Claude Tag

Claude Tag will replace the existing Claude in Slack application, and is available now in beta for users working on Claude Enterprise or Team subscriptions.

Given the agent has deep access to sensitive information, the company says it has introduced “tight controls” and system administrators will be needed to provide access.

“To get up and running, system administrators specify which tools and information the model should have access to, in which channels,” the company explained, adding that users should view this as “creating separate Claude identities” for different uses.

“Everything, including its memories, will stay scoped to the channels defined by the administrators,” Anthropic noted. “For example, a model set up for sales work won’t pass on memories to one set up for engineering; nor will it give engineers access to any sales data or tools.”

Notably, administrators can set limits for token consumption, both for individual teams and the broader organization.

The introduction of token limits comes amidst rising concerns over spiralling costs associated with popular AI tools such as Claude and ChatGPT.

Deeper Slack integration

The move by Anthropic marks the latest attempt to provide deeper integration of its tools with the popular workplace collaboration platform over the last year.

In December 2025, the company announced integration of its Claude Code tool within the platform. This integration aimed to embed the AI tool within software developer workflows, also helping to provide updates on project progress.

Notably, users are able to ask Claude Code to investigate and fix potential bugs, conduct code reviews, and improve collaborative debugging efforts for teams.

FOLLOW US ON SOCIAL MEDIA

Windows may be a timeless OS, and practically synonymous with modern PCs, but that doesn't mean it's well-loved by its users. In fact, the opposite might be true in some instances, according to anecdotal evidence as well as reports by publications like Windows Central.

While the development world is far from a homogeneous blob, anecdotal consensus suggests that Windows 11 is the least enjoyed mainstream platform for developers, with systems like macOS and Linux overwhelmingly preferred. But why does Windows 11 have such a bad reputation among developers, anecdotally at least?

Whether it's on internet forums, in blog posts, or in our conversations with experts, Windows 11 is often snubbed in favour of macOS or Linux, depending on the context. In fact, one of the best advantages of Windows, developers say, is the capacity to run Linux on mainstream hardware. There are, of course, some advantages to using Windows 11 for development – but what could Microsoft do to get more developers on board?

Which OS do coders and programmers really prefer?

ITPro consulted with more than a dozen programmers, engineers, and developers to understand why they use the platforms they do, and whether Microsoft has the potential to transform Windows into an attractive destination for coding.

Little research exists into which OS developers truly prefer, although Stack Overflow findings suggest that Windows is the dominant platform in which they work; nearly half (49.5%) use it over alternatives, including macOS (32.9%) and Ubuntu (27.7%), among others. But just because Windows is the "primary [OS] in which you work" — that doesn't mean it's the OS of choice, with organizations and administrators usually calling the shots more often than not.

The developers we spoke with were divided evenly between the three major systems – Windows, macOS, and Linux — with some even using all three depending on the task. However, when we asked which OS they prefer to code on, none answered Windows.

The vast majority say they preferred using macOS when coding, including Mike McQuaid, project lead of Homebrew, the open source package manager. "Apple and the wider ecosystem seem to care more about design and building high-quality applications for free or a reasonable one-off price."

What's the trouble with Windows 11?

McQuaid tells ITPro that "Microsoft’s developer experience on their platforms has never been great", with critique among those we spoke with ranging from concerns with the tools available to the notion that Microsoft is simply less easy on the eye. Where developers use Windows, it's largely because "that's the corporate choice", as Egor Danilkov, global development director at Innowise, neatly summarized it.

The OS is, however, "cumbersome", according to Nikita Kuznetsov, founder and developer of GameAP, an open-source game server management panel, and "ships with tools I don't need"; "the ones I do need have to be installed and configured manually". Some tooling is built for POSIX systems (Linux and macOS) first and is then ported to Windows, so these versions don't always behave as expected.

Many complaints center on inconsistency, with the notion that different developers on identical Windows hardware may end up with environments that behave differently. Windows is also a massive target and attracts far more malicious attention.

There's also the question of how "managed" company machines are. That's something that Jessica Kerr, engineering manager of developer relations at Honeycomb, an observability platform, can attest to.

"Companies can put more restrictions on Windows machines, and these restrictions hamper developers. As a software engineer, I install software. I run unverified, unapproved apps (for instance, when I’m writing them)," she says. "I access the file system from the command line and write scripts and run ad-hoc programs. Windows computers can be locked down, and Macs… if they can be locked down like that, I’ve never seen a company do it."

Much of the feedback around Apple's flagship OS is around the Unix-based terminal, which feels more natural to use and can be very powerful, as well as the fact that shell scripting, SSH, and command-line tooling all behave as you'd expect. Some of the positive feedback also centers around the user interface, which is universally considered intuitive, clean, and well-designed – not that Windows 11 doesn't have its fans. An additional benefit for Danilkov is the way that Apple devices work so well together.

Windows has its problems – but is the criticism unfair?

Danilkov describes some of the criticism as "outdated", suggesting Windows 11 is "leaps and bounds better" than its predecessors and that "many reactions to Windows are based on a version of the platform used years ago". This is an idea that Jitesh Keswani, managing director at e intelligence, a digital marketing agency, expands on.

"In the past, developers found it difficult to get their development environments up and running," he explains. "This typically involved a plethora of command-line tools. In addition, many of the development environments set up on a developer’s Windows desktops would not work in the same way on the Linux-based production servers that they were deployed to. This is a legacy problem that Windows still has to overcome."

Windows does have its advantages – and that primarily comes in the form of Windows Subsystem for Linux (WSL), which lets developers run full Linux environments directly on Windows 11 platforms without the need for a dual-boot setup or virtual machine (VM). Dwellwell Analytics' data science engineer, Olga Kuzmich, humorously quips: "The best feature for developers on Windows is the one that lets you run Linux."

This system repeatedly came up in our conversations. Many of the compatibility issues simply aren't relevant anymore thanks to this platform. It also means developers can run Windows applications, Linux tools, Docker containers, and more, all on the same machine. The next iteration, WSL3, is also getting a major upgrade, with new features such as the ability to take full advantage of your machine's GPU and NPU without a "performance tax".

The other advantages come in the form of Visual Studio, which Danilkov and Taimur Ijlal, information security leader at Proxy Coupons, UK, both describe as one of the strongest Integrated development environments (IDEs) available. Ijlal also describes Windows Terminal as "top shelf". The advantages of coding on Windows also extend to certain development platforms. As Jiří Fabián, co-CEO & founder of TopMonks, put it: "I would choose Windows only if I were a .NET developer working on Windows desktop applications or a game developer."

Giving Windows a new lease of life for coding and programming

With so much hesitation and opposition to using Windows as a system for coding, barring the ability to run WSL, is there anything that Microsoft can do to tempt the developers that ITPro spoke with?

There isn't a clean fix, says Omari Wright, web development manager at digital marketing agency seoplus+. "A lot of what makes macOS work well for development teams is structural, and changing it would mean Microsoft moving away from the openness that Windows users value," he says, adding that the tech giant could push harder on WSL and "make it feel less like a workaround and more like a first-class development path".

Nothing, however, would pull Kuzmich back. "Linux is just too natural now, and I think a lot of developers feel the same. That's exactly why, in my opinion, Microsoft had to ship WSL in the first place, and this is very telling."

Doubling down on WSL and improving this as a feature is where the majority of developers we spoke with centered their feedback around. Microsoft could make the remaining gaps between Windows and Linux file systems less noticeable, for example, and improve performance when working with larger repositories, containers, and some tools.

Keswani also suggests that Microsoft should push Windows as close as possible to a native Linux environment without sacrificing the user-friendly elements. This focus on user-friendliness is great "for end-users who don't need to know much about what's going on under the hood," Fabián adds, but to win more developers over, "Microsoft would need to base the core of Windows on Unix, which will never happen".

He continues: "With the rise of AI and heavier terminal usage, I need all core Unix utilities bundled with the system, without having to install and maintain them myself — tools for file manipulation, SSH, search, and so on."

McQuaid, meanwhile, centers his criticism on the direction that Microsoft has been taking Windows in the last few years, lamenting: "Stop trying to overrule my preferences on how to use my computer". He tells ITPro: "I use Edge and Bing there now just because they keep overruling or pressing me to change my defaults.

"There are ads (or what feels like ads) and upselling all over the OS. It’s gross and feels bargain-basement compared to Apple. I'd love to see Microsoft make Windows feel like “spammy” and more of a cohesive, overall pleasant developer experience."

There are various reasons why developers prefer other systems over Windows 11, macOS especially, with the main benefit of Microsoft's flagship OS, according to the programmers that we interviewed, being the fact that it lets you run Linux and bypass Windows entirely.

Nobody, Microsoft included, would describe Windows 11 as perfect, hence why there's such an active Insider program with updates shipped frequently and continuously. There are some unrealistic demands on developers' wish list, like making Windows Unix-based, but more realistic seems to be giving WSL more love – making it streamlined, more functional, and more powerful so that developers feel more supported by their devices at work.

Every day, your organization sends thousands of emails, yet fragmented signature management in Microsoft 365 creates security blind spots, legal compliance risks, and endless IT troubleshooting tickets.

The Microsoft 365 Email Signature Compliance Checklist is a quick-reference guide built for IT professionals to reclaim control. This blueprint outlines the 5 critical pillars of modern signature governance:

Legal & Compliance: Instantly update global disclaimers to meet GDPR and CCPA frameworks.

Ironclad Security: Eliminate template tampering and secure visual hosting domains.

Operational Efficiency: Eradicate manual HTML pasting by syncing dynamically with Azure AD (Entra ID).

Cross-Device Standardization: Guarantee flawless, unified branding across all Outlook clients.

Frictionless Collaboration: Give Marketing the autonomy to run banner campaigns without IT tickets.

Stop firefighting formatting bugs. Download this checklist today to secure your environment, empower marketing, and free up IT capacity for strategic initiatives.

The UK government has announced a series of measures to support open source AI developers with funding, mentoring, and a direct line of communication into government.

A new Open-Source AI Builder Fund will see more than £500,000 worth of compute - 160,000 GPU-hours of processing power from the UK’s AI Research Resource - set aside for innovators to turn prototypes into AI tools that improve public services from libraries to the NHS.

An Open-Source AI Builder Mentoring Scheme will pair up the winners of a recent Hack for Impact hackathon with experts from the Incubator for Artificial Intelligence (i.AI), the government’s in-house AI team, to help the best ideas become working public tools.

Held in partnership with Nvidia, the hackathon saw hundreds of open source AI developers from across the UK build tools to tackle challenges across public services and city infrastructure, using open data from the City of London.

A new Open-Source AI Dev Board, meanwhile, will give ten UK-based developers under the age of 30 a direct line into government, so they can influence how AI is used and developed.

Chaired by AI Minister Kanishka Narayan, the board will convene a series of roundtables over the rest of this year.

"The best AI tools in the world won’t be built behind closed doors by a handful of companies. They’ll be built by people who ship code, share it, and let others make it better," said Narayan.

"We want those people choosing to build here in Britain. And we want them to know that this is a country that backs them to succeed."

Open source focus welcomed, but work still to be done

The government’s focus on open source AI is a welcomed move, according to Sopra Steria CTO Andy Whitehurst.

Recent analysis from OpenUK showed the UK’s community is growing at a nominal rate, with more than 38,000 UK-based developers now making at least one contribution to open source projects in Q1 2026 - a 7% year-on-year increase.

Whitehurst noted, however, that the UK tech industry still faces acute challenges in terms of marketing itself as a go-to destination.

"Targeted interventions like the builder fund and support programs are a positive step in helping projects move from prototype to real-world deployment, but economic uncertainty, constraints around data use, and the reality of a relatively small standalone market can still make the UK a harder proposition for some AI providers, particularly those that rely on large, diverse datasets or cross-border operations," he said.

Whitehurst added that if the UK wants to be a “true global AI leader” which attracts the best talent and supports its own “homegrown champions”, it needs to focus on three key foundations.

“Sovereignty, in terms of control over critical technology and data; scalability, so AI businesses can grow and adapt; and skills, to ensure a strong domestic talent pipeline,” he commented.

FOLLOW US ON SOCIAL MEDIA

Euro-Office launched with a mind to shake up the productivity software space by giving European enterprises a “sovereign alternative” to products such as Google Workspace and Microsoft 365.

But it’s had a rocky start since launching this week, with critics lambasting the productivity suite as a “de facto ally of Microsoft”.

An open letter from The Document Foundation, the maintainers behind LibreOffice, detailed a series of gripes with Euro-Office. First and foremost, it claims the coalition responsible for development has deceptively marketed the product as the first open source productivity suite built in Europe.

That title, TDF noted, belongs to OpenOffice.org, which was launched in 2001 and based on StarOffice source code, and subsequently followed by LibreOffice in 2010.

“We feel compelled – reluctantly, since open source should rest on transparency, not deception – to correct this claim,” the open letter reads. “These are two genuine open-source office suites, built from source code that originated in Europe.”

Euro-Office document format slammed

Adding insult to injury, TDF claims that the OOXML (Office Open XML) document format used by Euro-Office makes it a “de facto ally of Microsoft”.

OOXML is a proprietary document format developed and controlled by Microsoft, and is used in the tech giant’s various document, spreadsheet, and presentation products.

The use of this format, TDF suggests, is a red flag for users aiming to shore up sovereignty practices by virtue of the fact control remains “firmly in Redmond and far from Europe”.

“Document formats are a subject still rife with misinformation. This is understandable on the part of Microsoft, which developed and controls the horrible proprietary OOXML format, designed precisely to prevent Digital Sovereignty by maintaining content lock-in,” the open letter reads.

“It is far less understandable on the part of companies that claim to advocate open source, such as those promoting Euro-Office.”

OpenDocument Format the 'pillar of digital sovereignty'

According to TDF, use of the ISO-standardized OpenDocument Format (ODF) should be used as a baseline for what constitutes a truly ‘sovereign’ productivity suite.

Italo Vignoli, a founding member of TDF and author of the open letter, describes this as the “pillar of Digital Sovereignty” and fired a broadside at companies promoting so-called sovereign products.

“It is worth remembering that many of those who champion Digital Sovereignty today were silent back in 2006, when the open ISO/IEC ODF standard — the pillar of Digital Sovereignty — was announced: not only did they not listen to us during all these years, but in some cases they greeted us with a condescending smile,” the open letter reads.

A spokesperson for Nextcloud told ITPro the company agrees that proprietary file formats are a “serious hindrance to digital sovereignty”, adding that the company intends to improve ODF support.

“We thus need to free users who are stuck using these formats, and enable them to work with an open office platform. This will allow organizations to transition to open document formats like ODF,” the spokesperson said.

“For this reason, as we stated before in our blog about our roadmap, Euro-Office will focus development efforts on improving ODF support. Ultimately, ODF should be the standard - not OOXM, and we will work towards that.”

FOLLOW US ON SOCIAL MEDIA

Apple has announced a long-awaited overhaul of its Siri personal assistant in a move analysts have described as a clear signal of its future AI approach.

As part of the upgrade, Siri will be integrated with Apple Intelligence, the tech giant’s in-house AI platform, and will be renamed ‘Siri AI’.

Expected to launch later this year, the upgrade will reframe Siri as more of a chatbot akin to the likes of ChatGPT, Claude, or Google Gemini – the latter of which underpins the AI assistant following a billion dollar deal.

This means Siri will provide users with answers to queries sourced from information on the web in addition to traditional personal context-focused queries.

Apple described the revamped Siri as “profoundly more intelligent, knowledgeable, and capable” compared to its predecessor.

Siri revamp highlights Apple’s AI focus

The move by Apple follows a lengthy process to deliver functional AI capabilities for users, an aspect of the company’s approach that has drawn criticism from customers and raised questions over its direction with the technology.

While Apple touted AI-powered upgrades to the assistant back in 2024, the company has repeatedly postponed any concrete announcements on this front. Indeed, the company appeared to acknowledge its lack of progress on this front at its Worldwide Developers Conference yesterday.

Craig Federighi, senior vice president for software engineering at Apple, said the company has taken a measured approach to integration of AI across its product ranges.

“Some appear to be racing forward, seemingly pursuing AI for the sake of AI, without clear regard for the people, all of us, that it’s ultimately meant to serve,” he said.

Ben Wood, Chief Analyst at CCS Insight, said Apple provided users with “some answers” to long-running questions about its shortcomings in AI.

Crucially, while new features outlined by the company aren’t exactly groundbreaking, the company’s track record in streamlining integration could make a big difference.

“Having acknowledged its shortcomings at last year’s event, there was no margin for error,” he said. “Many of the new AI-powered capabilities are similar to those offered by rivals, but Apple has a strong history of integrating such features in ways that make them more accessible to users across its deeply integrated hardware, software, and services.”

“It is also clearly seeking to differentiate through its privacy promises,” Wood added. “This looks like a step in the right direction, but there is no room for complacency, and Apple still has a long AI journey ahead.”

On Gemini’s involvement in the Siri upgrade, Wood said that speculation had been mounting ahead of the event over whether any upgrade would essentially be “Apple Intelligence powered by Google Gemini”.

Notably, however, the tech giant appears to have used the model to “accelerate and improve” the development of its own foundation model – a crucial factor for the company when it comes to privacy-related considerations.

“Apple remains in charge of pre-training, post-training, and reinforcement learning and is putting a strict privacy layer around the entire experience,” he said.

Forrester VP principal analyst Dipanjan Chatterjee echoed Wood’s comments both on privacy and potential integration challenges. Apple’s unique selling point lies in simplicity, he noted.

“In classic Apple fashion, the focus shifts from underlying technology to outcomes: usefulness, simplicity, and trust. The lesson for brands is clear: market the value, not the ingredients,” he said.

Winning over skeptics

While the overhaul marks a “watershed moment” for Apple, Forrester VP principal analyst Dipanjan Chatterjee said the company’s stop-start approach to AI over the last three years means it still has many skeptics to win over.

“After stumbling with the Apple Intelligence roll-out, Apple’s success will hinge on delivering the new Siri experience quickly – and ensuring it works as promised for iPhone users at scale,” he commented.

“I think Apple will convince the only skeptics that really matter – it's customers and prospects who may be getting their AI fix elsewhere – so long as they deliver what they have promised, and in short order.”

Chatterjee noted that Apple customers have “cut them plenty of slack” so far despite obvious shortcomings. Indeed, the company hasn’t witnessed a negative effect on revenue growth or its user base, but that could change if the rollout once again stalls.

“That grace period has an expiry date. A second miss, after Apple Intelligence, with Siri AI could hasten that date significantly.”

FOLLOW US ON SOCIAL MEDIA

Asana has unveiled a series of new features aimed at streamlining collaboration between human workers and agents as it looks to “solve the AI productivity gap” for enterprises.

Among these is Asana Dash, a new AI “chief of staff” designed to support employees and keep projects on track.

According to the firm, the tool helps users stay up-to-date with project goals and progress, compiling and summarizing relevant information such as email correspondence, messages between team members, and progress reports.

The new tool forms a key component within Asana’s new Agentic Work Management platform, unveiled at the company’s Work Innovation Summit in London this week.

This platform acts as an underlying “operating system” combining core products with the goal of consolidating workflows within a single domain.

Elsewhere, updates to Asana’s AI Teammates feature complement Dash, according to the firm. New integrations for Gmail, Outlook, Slack, HubSpot, Figma, and Canva were announced at the London summit along with a Skills library for “repeatable work”.

These two features are intended to work in-tandem, helping support project work, according to Asana. Dash can even assign actions to human workers or AI Teammates.

“It captures follow-ups from meetings, Slack threads, and email, turns them into structured work in the Work Graph, and connects users to the right AI Teammates for specific tasks and projects to move work forward,” the company said.

Tackling the “AI productivity gap”

The new features launched by Asana aim to tackle a common recurring pain point for enterprises using AI tools: mismatched productivity gains.

Research conducted by the firm shows that while 75% of knowledge workers now use AI in daily tasks, only 5% of companies report “meaningful” productivity improvements.

The company attributes this problem to four key areas. First and foremost, this includes an inability to select the “right agents” for specific individual needs and tasks.

Notably, the company said “agents aren’t team players,” adding that teams often use them in a fragmented manner spanning multiple domains and workflows. Context also matters, according to the firm, and agents typically aren’t fed with relevant data or information on how to support teams.

“Most agents aren’t onboarded with the context of how their teams operate, prior decisions, or what their priorities are,” Asana noted.

Finally, concerns over governance and safety are also hampering progress with agents. IT leaders are growing increasingly worried about agents “operating with unchecked data access” and little cost oversight.

According to Asana, this combination of issues means organizations “need an operating layer on top” of AI tools and associated software - “a place where humans and agents run critical workflows together”.

Asana CEO Dan Rogers said development of this operating layer builds on the firm’s Enterprise Work Graph, launched in 2021. This gave users “shared memory, multiplayer coordination, and governance”.

Rogers noted this is “precisely what the agentic era requires”.

“Asana’s OS is how AI moves from helping individuals work faster to supercharging entire organizations," he added.

The agentic operating system

The move by Asana bears similarities to Salesforce’s “agentic OS” announcement in October last year. As ITPro reported at the time, the CRM giant identified a similar problem when rolling out its Agentforce service.

In a similar vein, teams were often found working with disparate agents and datasets, which hampers cross-functional collaboration and broader productivity gains.

Salesforce rebranded Slack as an agentic OS with the aim of providing a single point of reference for business data and agents. That move saw CRM data from Salesforce made directly accessible within Slack.

FOLLOW US ON SOCIAL MEDIA

The accelerating use of AI in software development has led 60% of global organizations to ship untested code, prompting warnings over potential security risks.

According to Tricentis' 2026 Quality Transformation Report, the proportion has dropped only slightly since 2025, when it was 63%.

Crucially, the reasons behind the volume of untested code have changed. Last year, the company attributed much of this to accidental quality control slips, cited by 40%.

Now, though, 32% of organizations admit that they are doing it knowingly, mainly because of leadership pressure to prioritize speed over quality. Three-in-ten blamed the sheer volume of AI-generated code, which is overwhelming quality control and testing processes.

“Accelerating business transformation initiatives is one of the top priorities for today’s C-suite and AI has the potential to help software development teams move faster than ever before,” said Kevin Thompson, CEO of Tricentis.

“However, with increased speed comes increased risk. When software quality processes fail to keep pace with development speed, organizations often respond by taking shortcuts that materially degrade or reduce confidence."

Poor code quality is now a global problem

The problem was found right across the board, with more than half of organizations across every major industry surveyed reporting deploying untested code to production.

The trend was most prevalent in financial services (64%), retailers (63%), and energy and utilities (58%).

Governance is also suffering, the study noted. While 48% of organizations have fully implemented AI internally, more than half of those report that their AI tools and processes regularly change.

Similarly, a third of teams cite tool complexity and sprawl as a key barrier to achieving continuous software quality at scale.

Other top barriers include skills gaps, cited by a third, code volume increasing faster than they can manage (28%), and a lack of clear quality and trust metrics (26%).

Conflicting priorities put enterprises at risk

Notably, researchers said what’s considered AI progress in the boardroom may feel more like operational friction to software teams, highlighting a growing divide between the C-suite and frontline workers.

Just over four-in-five CEOs reported high confidence in AI-driven systems and tools, compared with just 56% of QA and DevOps professionals.

Similarly, 44% of C-level executives believe their business is very prepared to operationalize, govern, and scale AI agents across the SDLC, compared with just 23% of QA and DevOps professionals.

While 83% of organizations trust agentic AI to make release decisions and 82% say they are prepared to operationalize and govern AI agents at scale, many continue to struggle with untested code (60%), tool sprawl (33%), security concerns (27%), skills gaps (24%), and data quality issues (24%).

Poor quality hurts the bottom line

Naturally, there's a financial cost associated with this poor software quality. Around one-in-five organizations report losing more than $1 million annually as a result, mainly because of security and compliance failures (30%) and technical debt and rework (28%).

"As risks like financial performance and customer trust become more visible and measurable, software quality can no longer be treated as just an engineering concern. It must become a boardroom imperative," said Thompson.

“As development accelerates, leaders need clearer visibility into software quality risk and stronger alignment between engineering, QA and the broader business. The organizations that succeed will be the ones that can scale speed and control together.”

FOLLOW US ON SOCIAL MEDIA

Europe's rival to Microsoft Office and Google Docs, Euro-Office, is set to start shipping next week as part of the bloc's move towards sovereign technology.

First announced in March, Euro-Office has involved a collaboration between a number of European companies and organizations, including IONOS, Nextcloud, Eurostack, XWiki, OpenProject, Soverin, Abilian, BTactic, OpenXchange and Office.eu.

It's a web-based editor integrated into other products that handle documents, for example file-sharing solutions, online wikis, or project management tools.

It allows users to view, edit and work with others on spreadsheets, documents, presentations and PDF files, as well as other file formats including DOCX, PPTX, XLSX, PDF, ODT, ODS, ODP, and TXT.

Users can edit documents, spreadsheets, and presentation files with others in real time and save the document back to the application used to open it, or download in various file formats.

The inspiration behind Euro-Office

The Euro-Office project comes as part of a growing trend to try and reduce EU reliance on US software.

The new office suite will be released as an integration in solutions from participating companies from the start, including the latest Nextcloud Hub 26 Spring version.

IONOS Managed Nextcloud customers will follow, with the roll-out to IONOS’ Nextcloud Workspace offering planned for later this summer.

French company XWiki expects to integrate it in the fourth quarter of this year, while Netherlands-based Office.eu also plans to roll it out.

“Our top priority was to provide a version that people could actually work with. First, we had to clean up the code, implement some security updates, and integrate Euro-Office with existing solutions,“ said Frank Karlitschek, CEO of Nextcloud.

"The next step is to work on the desktop and mobile apps and integration features. For a truly sovereign solution, it is also important to fully support open standards such as ODF formats, and this will be on top of the agenda for the next release."

In order to make it as easy as possible for contributors to join the open source project, automated testing has been set up, code comments have been translated into English, documentation has been improved, and the code has been cleaned up.

Controversy surrounding Euro-Office

There's a bit of controversy around the project. Euro-Office is based on the code of open source productivity suite OnlyOffice.

In March, project maintainers issued a statement accusing Euro-Office of violating the software’s licensing terms and international intellectual property law.

OnlyOffice is distributed under the GNU Affero General Public License v3 (AGPL v3), with a few additional requirements, OnlyOffice said.

These include preserving OnlyOffice branding in derivative works, providing proper attribution to the original technology, and fully complying with open source distribution obligations.

"These conditions are not optional. They are a fundamental part of using the software legally and ethically," the firm said.

"Any argument that a modified or derivative version of the software may be distributed under a “pure” AGPLv3 license, excluding the additional conditions imposed pursuant to Section 7, is legally unfounded."

Euro-Office is available on GitHub, here.

FOLLOW US ON SOCIAL MEDIA

Software developers are reporting marked productivity gains with AI, yet new research from Harness shows the use of the technology is creating greater downstream challenges.

Findings from the company’s 2026 State of Engineering Excellence report suggest areas such as code quality and validation are being overlooked since the mass-integration of AI, and it’s creating bigger workloads and leading to higher levels of burnout.

“AI adoption is now the default in engineering organizations, and self-reported impact is overwhelmingly positive — but the cost is accumulating in places organizations aren't watching,” the company said in a blog post.

Indeed, Harness found that many developers are now spending more of their day on manual remediation tasks. Around 81% said they spend more time in code reviews since before the adoption of AI tools, for example.

More than one-quarter (28%) reported spending 30% longer on these tasks on average, according to Harness.

Worse still, nearly one-third of that activity isn’t tracked by teams, creating a trend of “invisible work”.

Organizations estimate that roughly 31% of developer time is now consumed by invisible work, which typically involves reviewing AI-generated code, fixing bugs, and switching between disparate tools.

Trevor Stuart, SVP and General Manager at Harness, said the findings show that while AI is not only changing how developers build, but how they spend their working day.

This, Stuart noted, means organizations need to overhaul how they measure developer productivity to compensate for changing workflows.

"Cloud and the internet were infrastructure revolutions layered underneath the developer,” he said.

“AI is reshaping the developer's job entirely, and the measurement frameworks that the industry has relied on for the past decade weren't built for this new unit of work."

Changing developer metrics

Harness noted that previous frameworks for measuring productivity and efficiency simply aren’t able to keep up with current AI-fueled working patterns.

Around 89% of tech leaders still trust metrics that don’t accurately reflect AI’s impact on individual developers or teams at large.

Moreover, 94% said key considerations such as tech debt and developer burnout rates are missing from metrics, painting a convoluted picture of overall performance which fails to scratch the surface.

“The biggest AI challenge is measurement itself,” the company noted in a blog post detailing the findings.

“When asked to name the single biggest challenge, the top answers are all visibility problems: measuring true productivity impact (26%), maintaining code quality with AI (24%), and proving ROI to leadership (18%).”

Measuring developer performance

According to Harness, changes to how performance is tracked needs to take AI into account.

The company recommends that enterprises approach this by considering the impact of tasks such as code validation, as well as the overall quality of code produced by AI tools.

This, the company noted, will paint a clearer picture on how workloads are changing due to new follow-up tasks created by AI.

Organizations should also “treat AI performance as its own discipline”, the study noted. This includes tracking AI agent accuracy, acceptance rates of AI outputs, and costs associated with the tools separately from human developer output.

Developers should also be given a say in how performance is measured due to the influx of AI tools, according to Harness. Nearly half (49%) of developers said they want to be involved in defining metrics themselves.

This is crucial, the report noted, largely because there’s a growing perception gap on how AI is actually impacting teams.

Managers, for example, are nearly four-time more likely to report no concerns on how productivity metrics are measured compared to frontline practitioners.

FOLLOW US ON SOCIAL MEDIA

The UK Competition and Markets Authority (CMA) has launched a strategic market status (SMS) investigation into Microsoft’s software licensing practices.

The probe, which the regulator touted in late March, aims to establish whether the tech giant’s position in the market has a negative impact on competition and consumer flexibility.

In a statement announcing the move, the CMA said the probe will primarily focus on business software products used by organisations across the country, including:

• Productivity software
• Personal computer and server operating systems
• Database management systems
• Security software

Microsoft business products, which include Windows, Word, Excel, Teams, and Copilot, are used by hundreds of thousands of firms and public sector organizations across the country, the CMA noted, with more than 15 million commercial users.

The regulator highlighted concerns that UK customers “may not always be able to effectively combine software from Microsoft with that of other providers”. This, it said, could limit their ability to access preferred products at competitive prices.

“The CMA’s investigation will examine whether Microsoft has SMS in business software and consider whether it can use that position to limit customer choice,” the CMA said.

“It will assess whether bundling of products, limits in interoperability or default settings can prevent customers switching and weaken the competitive constraints Microsoft faces from rivals.”

Notably, the CMA said its decision to launch the probe comes in the wake of a previous investigation into the UK cloud services market.

The regulator’s lengthy probe found the dominance of hyperscalers including Microsoft and Amazon Web Services (AWS) had a negative impact on competition in the UK market.

Microsoft has repeatedly faced scrutiny over its software licensing practices. Slack, for example, filed an EU complaint in 2020 amid claims the company had engaged in anticompetitive behavior with Teams bundling practices.

EU-based trade group, Cloud Infrastructure Services Providers in Europe (CISPE), filed a similar complaint in 2022, alleging that Microsoft imposed higher charges for customers running software on rival cloud platforms.

Microsoft and CISPE agreed to a settlement in mid-2025, which was met with criticism by other industry groups.

CMA seeks business feedback

This latest probe into Microsoft practices must be completed within nine months, according to the regulator. A decision on whether to designate the tech giant with strategic market status is expected by February 2027.

In the meantime, the CMA said plans to gauge the thoughts of businesses across the country using Microsoft products, as well as challenger companies, over whether product choices may be limited.

This includes concerns surrounding product bundling, lack of interoperability, and default settings used by the company.

“Our aim is to understand how these markets are developing, Microsoft’s position within them and to consider what, if any, targeted action may be needed to ensure UK organizations can benefit from choice, innovation and competitive prices,” said Sarah Cardell, chief executive of the CMA.

A spokesperson for Microsoft told ITPro: "We are committed to working quickly and constructively with the CMA to facilitate its review of the business software market."

FOLLOW US ON SOCIAL MEDIA

Consumers own very little of the data they generate, and this feeds directly into the business models of many digital enterprises. But this landscape is being reshaped by legislation and independent organizations – with potentially big implications for IT leaders.

The Fediverse, for instance, is a decentralized social media framework that creates a network of independently operated servers, communicating via shared protocols that let users move between social platforms without being locked into a big tech ecosystem.

Even further reaching is the Solid Project. Solid – short for social linked data – is a web-decentralization project spearheaded by World Wide Web inventor Tim Berners Lee. It intends to give consumers private data 'pods' that they own and control. All their data – financial, medical, social, etc – goes into it, and each user decides who gets access to their data, how much, and for how long.

Currently, companies own vast amounts of consumer information, which they trade with countless more through a vast data brokerage industry for advertising. This profitable practice also comes with practical benefits, such as improved risk management, AI development, and enhanced marketing.

But if Solid gains traction, this will all come to change – so what exactly does Solid mean for businesses?

Familiar systems

Although the Solid Project is philosophically distinct from the way the internet currently operates, a lot of the under the hood systems that would drive it are already in place. Businesses would have to rely on application programming interfaces (APIs) to a greater extent in order to access user data, with a greater emphasis on zero trust security policies to do so safely.

Ahmad Shadid, founder of AI research lab O Foundation adds that data pods or digital wallets are also a great use case for Web3 and blockchain technology. "[It'd be] one login you use everywhere and a simple permission user interface where you can grant 'read transactions for last 90 days' to a budgeting app, or 'share vaccine status only' with a clinic and revoke it at any time," he says.

Together with the privacy and security concerns such systems address, it could also mitigate out of date or duplicated information shared between many companies. Use of a data pod means switching apps without reuploading the same information for the umpteenth time – businesses can simply access the same sensitive information once granted access, which also reduces their compliance risks such as data storage requirements under the General Data Protection Regulation (GDPR).

Pros and cons of Solid for businesses

There's an essential tension between Solid and functions such as customer-specific advertising and AI training. Right now, there's an economic imperative to hoard all available data – within data privacy and governance requirements – for when it becomes monetizable. Customer data can be used to feed directly into predictive analytics models for future consumer purchases. On an enterprise level, customer data also helps developer organizations to roll out updates based on customer usage data, and to make data-driven decisions on future products and service offerings.

"Corporate resistance is ... economically unlikely," says Pedrotti. "Companies have entire business models based on data ownership and won't voluntarily sign away that value. And regulation enforcement would be difficult across jurisdictions – companies would find ways around laws through terms of service that technically comply but continue to give them practical control over user data."

Arne Möhle, CEO and co-founder at Tuta Mail agrees any such efforts will face extreme opposition from tech corporations. "We've seen this with the lobbying efforts in the EU when the Digital Markets Act was still in the making." In fact, in the leadup to the 2023 EU acts, tech companies spent €113 million a year on lobbying.

On the Solid Project, Wright concedes there's unlikely to be a sudden reversal. "Adoption tends to follow regulatory shifts, market incentives and consumer expectations," he says – a pattern the world's already seen with Open Banking.

He also thinks adoption will shift as new players see benefits. "Startups developing new apps could access years of user history from day one. Imagine launching a health app that already knows three years of fitness patterns, injury history, and seasonal trends based on data already collected from Strava, MyGarminConnect and MyFitnessPal. As more applications support the Solid Project and each user's Pod receives more data [new] apps automatically benefit from the network effect."

All of which means there's actually an argument for big tech to support users owning all their data.

Bannach says behaviour in the corporate sphere tends to shift in response to regulation, risk and revenue – a shift we're seeing now. "GDPR, the DMA and the EU Data Act, cookie deprecation, and rising breach and ransomware defence costs all push firms to reduce hoarded data and operate on permissioned, auditable access," he says. "Early movers gain regulatory compliance benefits and customer loyalty. Resistance will persist, but the commercial and compliance incentives are aligning."

To Shadid, the benefits to business are obvious – and quantifiable. "Less liability means fewer massive centralized data lakes to hack or mismanage. Better quality means first-party, verified streams direct from user-controlled pods rather than stitched-together data from brokers. There's also a clearer legal basis for AI training and analytics – consent is explicit and revocable at the source."

Wright agrees, saying data pods with the Solid Project eliminate costs because companies building consumer-facing apps will no longer need to handle user data storage or identity management.

Whose data is it anyway?

Not all data is the same. "There are very large datasets where we're increasingly less concerned like social media posts and searches being 'in the wild' – convenience outweighs whatever concerns many have," says Victor Cho, Founder/CEO at AI-focused business communication tools provider Emovid. "But we're very concerned about certain datasets like health and financial information."

Wright agrees the landscape for data varies enormously, but he stresses the Solid Project isn't about 'harmonizing' data law, it just wants to enable it at the architecture level:

"[The architecture] makes Solid complementary to varying legal regimes. In jurisdictions with strong protections like the EU, it makes rights like data portability and erasure achievable rather than theoretical. In jurisdictions with weaker protections, it confers de facto control that doesn't depend on regulation."

Meanwhile, there are also moves to classify data as a commercial asset, thus codifying its true value. Joe Hughes, CEO of Manx Technology Group, advocates for the legal standards set by the Isle of Man Data Asset Foundation. He thinks it's definition – not technology – around data that represents the largest barrier to personal data pod ownership systems.

"[The Foundation] addresses this by leveraging the Isle of Man Foundations Act 2011 to give data a legal personality," he says. "By defining data as an asset in law it can be assigned value, listed on a balance sheet, used as collateral on a loan or considered during M&A. Our model doesn't prevent organizations from accessing data, it changes the terms and recognizes sovereignty. Access becomes explicit, trusted, controlled, permissioned, and contractual."

Wright counters that while individuals managing their pods is the cornerstone of Solid, it's not the only model. Another possibility would be group pods for shared data, or pods storing the certified copy of data owned or issued by another entity like a bank or driver's license authority. This would have the same effect for businesses, of reducing organizational data burden and setting out a more standardized architecture for verifying user identities and accessing sensitive data.

There’s also potential for an approach such as Solid to assist businesses with enterprise AI deployment. For example, Wright adds that the Solid Project could serve as the memory and data-sharing layer for agentic AI systems.

"The average person isn't going to self-host a server or manage API permissions for their medical records – that's the gap right now,” explains Scott McIntosh, president of AI business consultancy Digital Treehouse.

“The technology exists, but the user experience isn't there yet. AI is going to be the interface that makes it actually work. Instead of handing over all your data to every app and platform that asks for it, your AI agent shares only what's needed, for as long as it's needed, and revokes access when the interaction is done. You wouldn't need to understand the technical side of it. You'd just tell your AI what you're comfortable sharing and it handles the rest."

The business that can deliver this system could see massive user uptake. The extent to which web-decentralization projects such as Solid could play a role in this deployment is yet to be determined.

Anthropic is joining forces with SpaceX to increase the AI developer's compute capacity – and that means Claude Code usage limits are set for a huge boost.

As part of the deal, SpaceX will permit Anthropic to use all of the compute capacity at its Colossus 1 data center in Tennessee, originally built for Musk's own AI firm, xAI.

"This gives us access to more than 300 megawatts of new capacity (over 220,000 NVIDIA GPUs) within the month," Anthropic said in a blog post.

That increase allowed Anthropic to raise usage limits, removing some peak-time restrictions, and boosting rate limits for APIs.

"This, along with our other recent compute deals, means that we’ve been able to increase our usage limits for Claude Code and the Claude API," the statement added.

Claude Code usage limits explained

Anthropic is making three key changes to usage limits, all targeted at making life easier for its “most dedicated customers".

To start, the company is doubling Claude Code's five-hour rate limits, meaning users will be able to make more prompts and write more code in each five-hour rolling session.

That applies to Pro, Max, Team and seat-based Enterprise plans, the company confirmed.

Next, Anthropic is removing its peak hours limit reduction on Claude Code, allowing Pro and Max users to operate the same across peak and off-peak times.

Elsewhere, Anthropic is raising its API rate limits for Claude Opus models by more than an order of magnitude. For example, tier 1 users previously had 30,000 maximum input tokens per minute, and will now have 500,000.

The move by Anthropic follows other AI companies tightening up on token usage. Last week, for example, GitHub changed its pricing model for Copilot to focus on consumption rather than credits.

GitHub said the move comes in direct response to skyrocketing compute and inference demands over the last year.

Rapid compute expansion

Anthropic pointed to a range of recent announcements designed to expand compute capacity. The AI developer has signed deals with Amazon, Google, Broadcom, Microsoft, and Fluidstack, all aimed at upping capacity to contend with skyrocketing user demands.

"We train and run Claude on a range of AI hardware — AWS Trainium, Google TPUs, and Nvidia GPUs — and continue to explore opportunities to bring additional capacity online," Anthropic added.

Anthropic revealed it is also working to ensure customers outside the US had access to local infrastructure, saying some of its capacity expansion would be international. In particular, the deal with Amazon would include "additional inference" in Asia and Europe.

"Our enterprise customers — particularly those in regulated industries like financial services, healthcare, and government — increasingly need in-region infrastructure to meet compliance and data residency requirements," Anthropic said.

In the US, Anthropic and other AI companies agreed to cover the cost of consumer electricity prices caused by their data centre rollouts. Anthropic said it was looking for ways to "extend that commitment to new jurisdictions".

"We’re very intentional about where we’ll add capacity — partnering with democratic countries whose legal and regulatory frameworks support investments of this scale, and where the supply chain on which our compute depends — hardware, networking, and facilities — will be secure.”

FOLLOW US ON SOCIAL MEDIA

AWS CEO Matt Garman has a bullish outlook on the future of the SaaS industry despite continued claims of a looming “SaaSpocalypse”.

Speaking during a recent interview with Fortune, the AWS chief dispelled worries that the SaaS industry faces an existential threat in the form of agentic AI - so much so that the company is making its own foray into the space.

Last week, the company unveiled sweeping changes to Amazon Quick, a desktop AI assistant which acts as a single information source connecting the disparate applications, tools, and data used by workers in their daily lives.

AWS is framing the revamped platform as a boon for personal productivity, noting in an announcement that it is “continuously running in the background” monitoring desktop activities and “surfacing what needs attention”.

As the company explained in a blog post, this could include information contained in Slack threads, for example, or important unread emails and file uploads.

AWS’ foray into this domain was inspired by the fact that “so many applications are getting done with AI and agents”, according to Garman, who described Amazon Quick as a “huge business opportunity”.

“We think that there is just such a massive change out there that everything is going to be remade,” Garman told Fortune. “I don’t think personal productivity has really been remade for the last 30 years,”

“There are going to be millions of successful applications that people use,” he added. “Obviously the vast, vast majority of them will not be built by Amazon or AWS, but we think there are a handful of them that we can build that will be pretty successful and that customers will like.”

Garman’s comments suggest that, far from heralding the doom of traditional software, AI will ultimately act as an enabler to deliver more intuitive workplace tools.

This isn’t the first time Garman has poured cold water on threats of a pending SaaSpocalypse. As ITPro reported in February this year, Garman said while there is “huge disruption” ahead for the SaaS industry, “much of the fear is overblown”.

Garman’s comments came at the peak of software stock sell-offs sparked by the launch of a handful of powerful new AI solutions, with Anthropic’s Claude Cowork tool ranked chief among these.

The workplace productivity tool gives users sector-specific plugins designed to automate tasks across a wide range of areas, spanning legal, marketing, sales, and data analytics.

That launch spooked software investors due to fears the technology could ultimately render dedicated SaaS solutions in these domains obsolete.

AI transforming software

Despite a positive outlook, Garman told CNBC in February that the advent of generative AI, and more recently AI agents, will transform how software is built and sold.

Long-term, that could create a more challenging market for providers, who will be operating in an increasingly competitive marketplace.

“AI is absolutely a disruptive force that’s going to change how software is consumed and how it’s built,” he said.

“The SaaS providers and the larger players of today have an inside track to winning that business. Now, they have to innovate, just like the rest of the world. They can’t stand still. If they stand still, they’re absolutely going to be disrupted.”

FOLLOW US ON SOCIAL MEDIA

NordVPN has uncovered a series of active malicious campaigns impersonating the official Google Gemini Command-Line Interface (CLI).

Attackers are creating fake websites, cloned repositories, and deceptive social media posts to trick developers and other users into installing what appears to be an unofficial or early-access version of Gemini’s developer tool.

But instead of delivering legitimate software, the campaigns distribute a reverse shell, giving the attacker complete and unrestricted remote control over the compromised machine, with no further action required on their end.

“AI tools are generating huge interest right now, and attackers are moving fast to exploit that,” said Domininkas Virbickas, product director at NordVPN.

“The payloads being delivered here grant full remote access to a victim’s machine, which makes this a serious threat regardless of how technically sophisticated the target is.”

Fake Gemini tools have Windows and Mac variants

The attack has both MacOS and Windows versions. On MacOS, it starts with a convincing clone of the official Google Gemini CLI web page. This instructs the user to run an innocuous-looking command in their terminal.

However, this command is encoded in the Base64 simple text encoding format, obscuring what it actually does.

"Once decoded, the command downloads a malicious script from a remote server and immediately runs it with the highest administrative privileges available on the system," the researchers said.

"It means the attacker’s code can read, modify, or delete any file on the device, install additional malware, or use the compromised Mac as a launchpad to access corporate networks the device is connected to."

As for the Windows variant, this uses a different delivery method. A PowerShell command, disguised with variable names like $Install=’GeminiCLI’ to look like a legitimate software setup process, connects to a remote server and executes malicious code directly in the device’s memory.

Running code in memory rather than writing it to disk - a fileless attack - evades traditional antivirus software that scans files for known threats.

As well as these direct attacks, NordVPN’s researchers also found a typosquatting operation targeting the npm ecosystem. Fake package names, including gemini/cli and gemini-cli, were registered or under preparation to mimic the official google/gemini-cli package.

"The strategy exploits a common habit among developers of omitting the organization prefix when searching for or installing packages," the researchers warned.

"Although the fake package had not yet appeared in the npm registry at the time of analysis, its preparation signals an active and imminent threat. Once published, any developer who installs it by mistyping the package name could unknowingly execute malicious code."

How to stay safe

NordVPN advised users to be wary of any website, forum post, or social media message offering early or unofficial access to developer tools. They should stick to official sources - and, in this case, that's just the official Google repository.

Never run a terminal or PowerShell command you didn't write yourself unless you fully understand what it does, the firm warned, pointing out that legitimate software installers don't ask users to copy and paste commands from a webpage.

Similarly, developers should verify package names in full before installation, including the organization prefix - the official package is google/gemini-cli, not gemini/cli or gemini-cli.

Nord also adviased using security software that includes behavioral detection, not just file-based scanning. Fileless attacks are specifically engineered to bypass traditional antivirus tools.

ITPro approached Google for comment, but did not receive a response by time of publication.

FOLLOW US ON SOCIAL MEDIA

Microsoft CEO Satya Nadella appears to have extended an olive branch to Windows users after several months of backlash over the direction of the operating system.

During the company’s Q3 earnings call, Nadella highlighted ongoing efforts to improve experiences for Windows, Xbox, Bing, and Edge users.

“When it comes to our consumer business, we are doing the foundational work required to win back fans and strengthen engagement across Windows, Xbox, Bing, and Edge,” he told listeners.

“In the near term, we are focused on fundamentals, prioritizing quality and serving our core users better”.

Nadella pointed to improvements the tech giant has already made on this front, including performance boosts for lower-memory devices, as well as a more “streamlined” Windows Update process.

He added that it has “brought back focus to core features and fundamentals that matter most to our customers”.

Nadella’s comments come in the wake of long-running concerns about the future of the Windows operating system, particularly on the topic of AI integration.

In November last year, Windows chief Pavan Davuluri sparked controversy after outlining plans to transform Windows into an “agentic OS”.

Davuluri’s X post suggested the company aimed to offer a “multi-modal” experience for users, with an array of AI features baked into the operating system.

The post sparked a fierce backlash among users, with some questioning why the tech giant was focusing so heavily on integrating AI features while other areas like performance and reliability were being overlooked.

The furore appears to have resonated with the company, and in March this year Davuluri detailed plans to dial back "unnecessary" Copilot features within the operating system.

In a blog post at the time, Davuluri said the company will only integrate AI where it’s “most meaningful”.

“You will see us be more intentional about how and where Copilot integrates across Windows, focusing on experiences that are genuinely useful and well‑crafted,” he wrote.

That same move by the company also marked efforts to improve feedback from users - the “largest update to Feedback Hub yet” - which aimed to make it easier to submit feedback.

A looming Windows overhaul?

Efforts to build on Davuluri’s March pledges appear to be accelerating, according to recent reports from Windows Central.

Citing sources close to the matter, the publication noted an internal project dubbed ‘Windows K2’ is already underway and working on sweeping upgrades to performance, reliability, and user experience.

These efforts won’t come in the form of a dedicated update, but instead will be intermittent improvements on a rolling basis.

Performance, in particular, is a key focus of the initiative. Company documents viewed by the publication suggest the tech giant is aware that performance has been a recurring pain point for users, specifically in applications such as File Explorer.

Elsewhere, UI improvements aim to deliver a smoother experience for Windows 11 users, according to Windows Central.

The report tracks with the key focus areas identified by Davuluri in his March blog post, which included goals to deliver a “faster and more dependable File Explorer” as well as taskbar customization and "more control over widgets and feed experiences".

Nadella touts strong Windows uptake

Elsewhere in the earnings call, Nadella hailed strong user growth on Windows 11 – an area in which the company has faced an uphill battle.

Figures touted by the Microsoft chief now put monthly active users at over 1.6 billion.

Windows 11 uptake has been sluggish since its launch in 2021, largely due to the huge popularity of its predecessor. Indeed, Windows 11 only overtook Windows 10 in popularity last year, nearly four years after its official release.

As ITPro reported at the time, figures from Statcounter showed the newer OS finally edged into the lead in mid-July.

Nadella’s comments came as Microsoft announced strong quarterly earnings. Chief financial officer (CFO) Amy Hood said the company “delivered results that exceeded expectations across revenue, operating income, and earnings per share”.

Annual revenue run rate for Microsoft’s AI business surpassed $37 billion in the company’s third quarter, growing 123% year-over-year.

Business is also booming for Microsoft Cloud, Nadella noted, which exceeded $54 billion in revenue, marking a 29% increase year-over-year.

FOLLOW US ON SOCIAL MEDIA