Microsoft CEO Satya Nadella says the company plans to expand use of its MAI model range as the company looks to offer customers lower-cost AI options.

The in-house models, unveiled by the company in June, are designed for specific enterprise tasks and span a range of areas, including image and voice generation, audio transcription, and coding.

In a blog post on 23 July, Nadella outlined the tech giant’s new ‘Frontier Diffusion and Control’ strategy, which aims to help customers reduce reliance on costly frontier models and emphasize the importance of model choice for specific use-cases.

The move by Microsoft comes amidst growing concerns about spiralling AI costs over the last six months. With trends such as ‘tokenmaxxing’ and the shift toward consumption-based pricing, some companies have been left with hefty bills as AI use accelerates.

“In a world where software has real marginal cost for the first time, how do we ensure frontier benefits are diffused across the entire ecosystem?” Nadella wrote.

“The key is to optimize the cost-to-outcome frontier in real-world context,” he added. “In practical terms, that means using the right model for each task, and optimizing the context, skills, tools, and agent harness around it.”

Boxing clever with AI model selection

Nadella’s contention here is that these in-house models can give customers “frontier capabilities” albeit in a cheaper, bespoke capacity.

Simply put, these are domain-specific models based for an enterprise’s individual needs, not a one-size-fits-all frontier model such as those offered by OpenAI or Anthropic.

These still form part of the broader “orchestration system” used alongside MAI, but all amounts to helping users box clever when choosing what model to use.

“These models have been built ground up with clean data lineage and optimized for learning transfer from generalist to specialized skills in enterprise RLEs,” he explained.

This will require enterprises to implement evaluation processes when considering which model to use in which context, he said.

“Product-specific evals and model independence give us the control and a direct hill to climb, and to keep refining until we reach the right quality-cost target,” Nadella wrote.

“We are now seeing MAI models outperform general-purpose frontier models in many use-cases while using a fraction of the tokens.”

Internal testing of MAI for its own products has so far delivered “promising early results”, according to Nadella. The company has piloted the use of these models in GitHub Copilot, Outlook, and other Microsoft 365 services.

The company plans to take the same approach with Copilot Chat, PowerPoint, and other services, he added.

Nadella’s comments align closely with recent research from Gartner on rising AI costs.

While focusing primarily on the use of AI in software engineering, the consultancy told ITPro that enterprises should establish a “use-case-driven decision” framework when using the technology for certain tasks.

This, Gartner noted, will help reduce costs by encouraging users to stop needlessly allocating agents to tasks they’re not designed for.

Microsoft eyes model diversity

Nadella’s blog post marks the latest in a string of comments made by the Microsoft chief hinting at the company’s efforts to diversify model choice - and to stop pushing frontier models on customers.

In mid-July, he warned about the risks of relying too heavily on frontier AI labs, describing what he called the “reverse information paradox”.

Nadella said enterprises are essentially “paying twice” for AI services, handing too much data to providers, and receiving little benefit in return.

These providers, meanwhile, gain valuable insights into customer products that could help them refine - or build - competing options.

"If learning flows in only one direction, economic value converges toward the owners of the learning infrastructure rather than the creators of the knowledge itself," he said.

"Therefore, it’s imperative that we distribute the learning infrastructure to every firm so that they can control their own learning loop.

As ITPro noted at the time, his comments were peculiar given the close ties the tech giant maintains with OpenAI and Anthropic, whose models are deeply entwined across its core product range.

Microsoft's long-standing relationship with OpenAI saw it take the lead as the go-to model for its software services, yet this changed last year after striking a deal with Anthropic to give users greater choice.

FOLLOW US ON SOCIAL MEDIA

Barracuda Networks has announced a series of enhancements to its Partner Success Program in a move the cybersecurity vendor said will help MSPs and channel partners strengthen expertise and accelerate growth.

The initiative now includes new enablement, marketing, and partner engagement capabilities designed to improve operational efficiency, deepen technical knowledge, and unlock new business opportunities through the BarracudaONE cyber resilience platform.

The update includes expanded demand generation tools, enhanced marketing resources, and partner experience improvements, alongside additional training and certification options via the Barracuda Mastery Program.

In an announcement, Michelle Hodges, senior vice president of global channels and alliances at Barracuda, said the latest enhancements reflect the company’s continued commitment to partner success.

“At Barracuda, our partners are at the center of every decision we make, from product innovation to go-to-market execution," she commented. "We’re creating more opportunities for partners to engage customers, sharpen differentiation and grow their business — and making it easier than ever to do so.”

Expanded partner capabilities

As part of the update, Barracuda is introducing a new through-channel marketing automation platform that features co-branded campaigns, social and email syndication, and turnkey campaign execution to help partners generate demand.

The company also revealed that it plans to launch a Partner Locator tool designed to connect customers with certified partners and help drive high-intent sales opportunities.

On the training front, the Barracuda Mastery Program has been expanded with additional role-based learning, technical labs, and advanced sales and technical badges aimed at strengthening partner expertise and validating specialist skills.

Elsewhere, the company has introduced new role-based experiences and automation within its Partner Portal, including guided onboarding journeys designed to simplify engagement, accelerate time to value, and help businesses scale.

Commenting on the refresh, Sean Furman, president at STF Consulting, said the enhanced program will help partners strengthen their expertise while tapping into new revenue opportunities.

“Barracuda’s expanded training, certifications and partner recognition programs give us the tools to build expertise and stand out in a crowded market,” he explained.

“These investments elevate our credibility as a strategic advisor and translate directly into greater customer value, stronger retention and new opportunities to grow high margin recurring revenue.”

FOLLOW US ON SOCIAL MEDIA

Databricks and Microsoft are forging deeper ties with an expansion to the duo’s decade-long partnership, with a fresh focus placed on data management.

As part of the move, Databricks said it plans to expand use of Azure Databricks in core business operations and build a new, unified data lakehouse.

The move will also see the firm adopt Microsoft’s Arm-based VM infrastructure, Azure Cobalt, to “improve performance and efficiency”.

Microsoft, meanwhile, plans deeper integration of Databricks’ Data and AI platform across core product lines in a bid to provide customers with new tools such as Genie, the company’s flagship AI chatbot.

Databricks CEO and co-founder Ali Ghodsi said the expansion builds on long-standing ties and aims to accelerate customer data transformation efforts.

“For nearly a decade, Databricks and Microsoft have helped enterprises innovate with data and AI,” he said.

“Today, our partnership is stronger than ever. With Databricks Genie and Unity AI Gateway deeply integrated across Microsoft’s products, we’re helping enterprises unify their data and ground AI in business knowledge.”

Delivering business context

The partnership expansion aims to address key recurring hurdles for enterprises dabbling in AI innovation: data preparation and management.

AI systems, particularly agents, require fine-tuned data grounded in domain-specific context, according to the duo. Simply put, this means AI systems need to understand enterprise products, customers, operations, and general business processes to run efficiently.

A significant portion of enterprises are still struggling to bridge these gaps, however, and it risks derailing adoption processes, according to Judson Althoff, CEO of Microsoft’s commercial business.

“The next generation of AI will be defined by how effectively organizations turn their unique knowledge into intelligence,” Althoff said.

“Microsoft and Databricks are helping customers connect data, AI, and business context to accelerate decision-making and drive measurable impact.”

Databricks targets performance gains

A key focus of the partnership rests on expansion of Azure Cobalt for Databricks. The company said this will help improve performance and efficiency for agentic AI and ‘data-intensive’ workloads for customers.

The data analytics firm currently uses Cobalt 100. Looking ahead, the company plans to adopt Cobalt 200, which Microsoft noted offers up to 50% better performance and includes memory encryption by default.

Expansion of core business operations through Azure Databricks will also deliver performance improvements, the duo noted, enabling the firm to scale up capabilities for customers.

Genie integration

Deeper integration of Databricks’ Genie AI service within Azure also aims to simplify data management capabilities for customers, according to the firm.

Running the AI system directly within Microsoft environments will enable customers to ground and operate agents on data hosted within the cloud service. This means the AI tool will be “deeply integrated” with key Microsoft products, including:

• Azure Data Lake Storage
• Power BI
• Microsoft Foundry
• Microsoft 365, Teams, and Copilot

“These capabilities bring governed, real-time data and AI into business workflows, giving organisations the context, control, choice, and cost efficiency needed to drive impact,” the company said in a blog post.

FOLLOW US ON SOCIAL MEDIA

The UK’s National Cyber Security Centre (NCSC) has issued an alert over a new ‘zero-click’ threat campaign being waged by Russian state-backed hackers.

The advisory, published in collaboration with international partners, warned ‘beehive’ attacks by the ‘Laundry Bear’ threat group aim to steal email correspondence at organizations operating across a range of critical sectors.

This includes organizations in the defense, education, energy, and technology industries, as well as law enforcement and government agencies.

Attacks against these organizations all have a common theme, according to the NCSC, mainly the use of Zimbra Collaboration Suite (ZCS) software. Targeting focuses specifically on those using vulnerable versions of the software, the advisory noted.

Rather than requiring users to click a link or open a file, zero-click attacks mean users only have to view a malicious email to be compromised.

The NCSC urged organisations that use ZCS to follow mitigation advice, patch immediately, and “improve network monitoring capabilities”.

Crucially, analysis of the campaign found these techniques could be adapted to exploit vulnerabilities in other email software applications used by Western organizations.

“This phishing campaign demonstrates how hostile actors will ruthlessly adapt techniques and exploit vulnerable technology in pursuit of their aims to steal sensitive information from Western organizations,” said NCSC chief operating officer (COO) Beth Hopkins.

Ukrainian organizations used in testing

According to the NCSC, the techniques used by Laundry Bear were “extensively trialled” on Ukrainian victims before use against other Western nations. The security agency noted this is part of a growing trend among Russian threat groups.

Notably, technical analysis of the campaign also highlighted the use of AI in development of a “simple codebase” used during operations.

Zero-click attacks have surged in frequency over the last 12 months, research shows, with threat actors accelerating efforts to capitalize on vulnerabilities.

Analysis from Rapid7 found that vulnerability exploitation has now surpassed social engineering as the “largest initial access vector”, accounting for more than one-third (38%) of all attacks.

More than 50% of all exploited vulnerabilities involved zero-click attacks, rather than network-facing vulnerabilities, the study noted, highlighting evolving techniques by threat actors.

“These types of vulnerabilities require no authentication and no user interaction, giving attackers rapid pathways into exposed systems and edge infrastructure,” Rapid7 noted.

Dray Agha, senior manager of security operations at Huntress, said these types of exploits are a “worst-case scenario for defenders” as potential victims are only required to view malicious emails.

“Simply viewing the email in a vulnerable client triggers the compromise,” he explained. “This completely bypasses traditional employee security training and gives state-backed hackers a silent, invisible backdoor into sensitive communications without the victim ever making a mistake.”

Agha said the rise of these techniques mean organizations need to place a greater focus on regular patching to avoid falling prey.

“This is why defense-in-depth is advised, as where the human security layer is porous, the technical defensive layer can step in,” he said.

“Organizations shouldn’t just rely on their staff acting as a ‘human firewall’. Rapid software patching, coupled with layered technical defenses, is the only reliable safety net against modern state-sponsored threats.”

FOLLOW US ON SOCIAL MEDIA

AMD has expanded its Rocm software stack with a new AI-native component, Rocm.ai.

Rocm.ai, announced at AMD Advancing AI 2026, combines AI-assisted development, intelligent deployment, and AI-powered software optimization.

AMD claimed that AI software development is becoming increasingly agent-driven, with developers using AI coding agents and natural language processing to build and deploy software. AMD believes that Rocm.ai – and in particular the inclusion of AMD Skills in it – will reduce the barriers to adopting AMD Rocm and also reduce the amount of document crawling needed for set-up.

Speaking at AMD’s annual Advancing AI conference, Vamsi Boppana, SVP of AI at AMD said: “Rocm.ai … brings the capabilities of AI-assisted GPU programming to developers. It starts with a simple idea of giving developers access to the power of an AI ecosystem through the AI coding agents they already use. Whether you are using Cursor, Cloud, [or] Codex, Rocm.ai helps those agents understand AMD platforms, understand Rocm, and helps [developers] build and optimize [their] workloads.”

“In other words, we’re making those popular coding agents into Rocm superusers – you should be able to describe the workload you want to run, the performance target you want to hit, and then let the agents help you get there,” he said.

Breaking down Rocm.ai

Drilling down into what actually constitutes AMD Rocm.ai, there are three main components: Rocm CLI, AMD Skills, and Hyperloom.

Hyperloom is an AI-assisted optimization system that can, according to Boppana, analyze workloads, choose configurations, select and choose kernels, adjust parallelism strategies, and initiate towards performance goals.”

Boppana gave the example of a lead developer he recently spoke to who “pushed through a suite of 14,000 models through Hyperloom, optimizing them and creating valuable insights”.

“This would have been impossible to imagine, even with a large team of developers, before,” he said.

Rocm CLI, meanwhile, provides a unified command-line for installation, validation, servicing, updating, and troubleshooting of AI workloads on AMD platforms. AMD Skills integrates AMD-authored expertise into coding assistants like Claud, Cursor, and Codex.

“Let me make this concrete for you,” Boppana said on stage. “Imagine you’re a developer who wants to optimize Vmax… with PLLM on MI355s. Today, there are many things you need to get right. You need the right PLLM optimizations, the right model recipes, the right environment variables. You may need to write new kernels or optimize kernels – and then you need to tune all of this.

“With Rocm.ai, this interaction becomes much simpler. You can say ‘optimize Vmax entry with Hyperloom’ [hit] enter and behind the scenes, the agent does what an expert would do: pulls a known good recipe, runs and profiles the workload, creates and tests a bunch of kernel and runtime configurations, and it keeps iterating towards target.”

“Developers shouldn’t have to manually reason through every layer of model architecture, kernel selection, prompt strategy, and rack-level deployment,” said Boppana. “AI is transforming this experience and that’s a very, very big shift for AMD hardware and software.”

Rocm.ai be available from August 2026.

AMD and AI infrastructure company Cerebras have unveiled a joint system integrating AI infrastructure from both companies.

The joint solution, which was announced at AMD Advancing AI 2026, features AMD Helios – the star product of the show – and the Cerebras Wafer-Scale Engine.

According to Cerebras and AMD, it's intended to solve the issue of inference workloads having variable requirements when it comes to latency, throughput, token capacity, cost, and scale.

For example, agents and copilots need faster response times, whereas high-volume workloads prioritize maximum code generation, the organizations said.

By unifying Helios and Wafer-Scale Engine, the system optimizes the two stages of workflow independently: Helios is tuned to process prompts and large context windows, providing ultra-high throughput.

Wafer-Scale Engine, meanwhile, accelerates memory and bandwidth-intensive token generation with ultra-low latency.

“The demand for ultra-fast inference is growing at an unprecedented pace,” said Cerebras CEO and co-founder Andrew Feldman. “Partnering with AMD gives us an incredible opportunity to bring that performance to even more customers.”

AMD CEO Lisa Su added: “AI inference is becoming one of the largest infrastructure opportunities in AI and its growing diversity requires a more flexible approach.”

“Together with Cerebras, we are extending that leadership into the most latency-sensitive applications and creating a powerful new platform for real-time agentic AI.”

The joint solution will be available in the second half of 2026, initially through Cerebras Cloud.

The announcement comes alongside a number of other Helios partner announcements, including new commitments from Microsoft and Anthropic to roll out the system to their infrastructure.

FOLLOW US ON SOCIAL MEDIA

AMD has launched its latest Instinct GPUs, the MI455X, in tandem with bringing its Helios AI architecture into production at AMD Advancing AI 2026.

Helios, which was announced at last year’s annual conference, is the company’s flagship hardware product, integrating Epyc CPUs, Instinct GPUs, Pensando networking, and Rocm software stack.

“Helios is really the system that scales to be an AI factory,” said Andrew Dieckman, CVP and GM of data center and GPU at AMD. “We set out to build the world’s highest-performing rack and we believe we have delivered the world’s highest performing rack.”

According to AMD, Helios has 15% more AI compute, 50% more memory, and 50% more scale-out bandwidth than Nvidia’s competitor offering, Vera Rubin NVL72.

At the heart of Helios – the “engine” in Dieckman’s words – is the new AMD Instinct MI455X CPU. The MI400 series features increased HBM4 capacity and bandwidth, expanded AI formats with higher throughput, and standard-based rack-scale networking.

In Helios, the MI455X acts as the accelerator, delivering 40 petaflops of peak FB4 compute, with 423GB of HBM core and a peak memory bandwidth of 23.3 terabytes per second of memory per GPU.

In addition to the new MI455X GPU, Helios also features 6th Gen AMD Epyc server CPUs with 96 high-frequency cores and 1.6TB/s of memory bandwidth, as well as AMD Pensando and UALoE networking fabric.

This can scale up to 260TB/s bandwidth and host 72 GPUs on one domain.

AMD showcases Helios partners

With Helios already in production, AMD was keen to show off some of its partners that are deploying – or pledged to deploy – the system. These include OpenAI, Meta, Oracle, Microsoft, Dell Technologies, HPE, Lenovo, Bull, Cisco, Tensorwave, and more.

“Helios is a big step forward for AMD because we’re moving to a full rack-scale architecture where we provide all the components in a really co-designed engine and co-engineered rack, so that [customers] can get the full benefit out of the complete AMD end-to-end solution,” said Dieckman.

“We continue to be very focused on driving improved economics for our customers – making sure that we deliver the most tokens per dollar within the market.”

FOLLOW US ON SOCIAL MEDIA

Tokenomics has been a theme of many tech conferences this year and AMD has joined in the fun at this year’s Advancing AI conference.

At the heart of the tokenomics conversation is the move from chatbots and simple inference towards agentic AI. This is a real trend as noted by Digital Ocean and McKinsey and one that OEMs have locked onto hard.

While in previous years enterprise hardware vendors would wax lyrical about the importance of training LLMs on your own data (and how their hardware can help), if you listen for that chatter now you will hear nothing but crickets.

AI agents offer a range of benefits for enterprises – according to Digital Ocean’s research, 53% of the over 1,000 IT decision makers it spoke to saw productivity and time saving gains, while 44% said it had created new business opportunities.

There are also drawbacks, however, and one of the most apparent is the increased use of tokens, which leads to higher bills.

Whereas an individual using prompts to interact with an AI chatbot may use a few hundred tokens, agents can use up thousands.

As McKinsey explains: “Agentic tasks can consume roughly 1,000 times more tokens than code reasoning (single-turn problem-solving without tool interaction) or chat tasks (multi-turn dialogue about a coding problem).”

“The expensive part is not the first answer generated but the checking, repairing, and reverifying that follows,” the report continues. “About 60% of an agentic task’s costs, in fact, are tied to refining answers.”

This fact, and companies baulking at the related costs, hasn’t gone unnoticed among enterprise IT vendors, which are proposing their on-premises services as a way round this.

For AMD, this is a tricky path to tread, given it counts both traditional enterprise vendors like Dell, HPE, Lenovo, and Supermicro and public cloud-based services from OpenAI and Anthropic among its customers.

AMD’s performance focus

Michael Nordquist, CVP of product marketing for AMD’s computing and graphics group, diplomatically said that when it comes to considering the impact of tokenomics “it’s not all one way or all the other, it’s going to be hybrid. For some things local models work great, for some things you’re going to want that frontier model available for agent behaviour.”

From a practical perspective, AMD’s answer to this quandary has been to focus on how its own chips can (theoretically) reduce token-related costs, without taking sides on the public/on-premises debate.

“The theme [at Advancing AI] is really performance is the way that we can deliver the best economic value to our customers,” said Andrew Dieckman, CVP and GM for data center GPU at AMD.

“It’s the strongest dial that we have on the dashboard, so to speak,” Dieckman said, “so we’re very focused on that and then making sure that conveys to favorable economics for our customers because the cost of tokens as the world moves to inference is so important.”

Part of that focus is the company’s MI455X GPUs, announced at Advancing AI 2026 during AMD CEO Lisa Su’s keynote speech.

According to AMD, the MI455X has up to 18x lower token cost than its predecessor, the MI355X, while maintaining up to 34x higher token throughput.

“That delivers, really, the ability to serve more users with faster response times and significantly better economics,” Dieckman said.

FOLLOW US ON SOCIAL MEDIA

Nvidia CEO Jensen Huang has hailed the capabilities of Chinese open source AI models amidst growing interest in low-cost options for enterprises.

In an interview with Axios this week, the Nvidia chief said competition between open and closed-source models is positive for the broader global AI industry.

“The world needs open models,” he told Axios. “These Chinese models are excellent. Open source models that are excellent should be used”.

Huang’s comments come amidst growing interest in Chinese open source AI models in recent weeks. The Kimi K3 model, developed by Moonshot AI, temporarily paused subscriptions due to skyrocketing demand.

Surging interest in the Kimi K3 model bears similarities to that of DeepSeek, which rocked the US AI industry when it launched in early 2025.

A key advantage of these models lies in both their performance and cost efficiency, the latter of which has become a key focus for enterprises amidst growing concerns over spiralling AI costs in recent months.

As ITPro reported in November 2025, open source AI models often perform on-par with closed source options, and could potentially save enterprises millions in costs each year.

Open source models "routinely achieve 90% or more” of the performance of closed counterparts, the study noted. They also benefit from “significantly lower prices”, with operational costs plunging up to 84% in some cases.

In a research paper published by DeepSeek last year, the company said it spent a paltry amount training its flagship R1 model compared to US rivals who’ve spent billions on training purposes.

Anthropic CEO Dario Amodei suggested building a new AI model could cost over $100 billion in 2024.

Security concerns persist

While the popularity of Chinese AI models continues rising, concerns over security have been flagged repeatedly.

The concerns surrounding Chinese AI models typically focus on areas such as data privacy and national security, with some critics suggesting these tools could be used as a ‘backdoor’ for Chinese intelligence services.

Axios previously reported that the White House could consider imposing restrictions or tight conditions on US firms working with these models.

DeepSeek was subject to the same scrutiny during its rise to prominence across 2025, for example. In August last year, cybersecurity experts told ITPro that using DeepSeek equated to “printing out and handing over your confidential information”.

Huang told Axios that these concerns are a “misconception” and can be used by enterprises safely. On the topic of potential White House restrictions, Huang said this could prove counterproductive and that American firms should consider a breadth of options.

“You can download the models. You could fine-tune it, you can enhance it, you can guardrail it as you desire,” he said.

Huang has a vested interest on this front, however, and noted that increased usage will ultimately benefit Nvidia.

“If there’s great AI, even if it’s open, wherever it comes from, there will be more use,” he told Axios. “Whenever there’s more use, you’ll have to sell a lot more Nvidia computers. We’ll have to build more data centers. We’ll have more services. The technology will diffuse into more industries”.

Bill Conner, president and CEO Jitterbit, said the Kimi K3 launch marks a “clear turning point in accelerating global adoption of Chinese LLMs” but still urged caution with regard to security.

“Enterprises may underestimate the security, accountability, and governance risks associated with adopting new Chinese LLMs,” he said.

“Moonshot AI operates as a cloud service with data stored in China, introducing potential risks for organizations whose data may be shared unknowingly.”

Conner said adoption of Chinese AI models should be treated as a “strategic risk decision, not merely a cost-saving opportunity”.

FOLLOW US ON SOCIAL MEDIA

Six-in-ten ransomware victims are still paying up despite official advice not to do so.

That's according to research from security firm Proofpoint, which found that 58% of UK organizations hit by a ransomware attack agreed to pay ransoms.

Crucially, Proofpoint found they weren’t rewarded for bowing to cyber criminal demands. Nearly one-quarter (22%) who did pay were then hit with a second extortion demand.

The study from Proofpoint comes amidst growing calls to play hard ball with ransomware criminals by authorities. The UK's National Cyber Security Centre (NCSC), for example, advises against paying ransoms, warning that it encourages further attacks and may not lead to the return of data.

Despite that being the official advice for many years, plenty of companies pay criminals when faced with ransomware disruption to their business operations.

Security firm Trellix surveyed CISOs whose employers had been the target of ransomware attacks, finding in each instance they decided it was worth paying — with a third paying between $5 million and $15 million.

Those results were echoed by research from Cohesity that showed that while 94% of companies in the UK say they have a policy not to pay out in a ransomware attack, 97% still do.

The case for ransom bans

This disconnect has led to debate over banning ransomware payments, with the UK government saying last year it was considering forbidding public organizations from paying ransoms.

These proposals follow serious incidents at NHS bodies, the British Library, and Royal Mail in recent years.

The government already bans ransomware payments made by its own departments; a wider ban was backed by the government, but has yet to be brought into force.

That included a provision for mandatory reporting of ransomware payments for private companies not covered by the ban. One challenge is enforcement, as fines or other punishments for paying ransoms could risk further victimizing companies.

Evolving techniques raise the stakes

Elsewhere in the study, Proofpoint found new tactics are exacerbating the situation for enterprises.

Ransomware techniques have shifted away from data encryption to outright data theft – and that means companies can expect that data to be used for follow-up attacks or sold on criminal marketplaces.

The result here is that this extends the initial attack and impact for victims, according to Proofpoint.

The rise of AI has also made ransomware more effective, according to two-thirds of companies that faced an attack, particularly in terms of initial compromise.

"AI hasn't fundamentally changed ransomware, but it has materially improved the attacks that lead to it," said Ryan Kalember, chief strategy officer at Proofpoint. "Today's attackers are using AI to create highly convincing phishing emails and credential theft campaigns that exploit human trust at scale."

Hackers are using AI to write better phishing messages and to better hide their attacks, with 31% of those polled said staff didn't suspect anything was wrong when they interacted with malicious content.

Around one-quarter (24%) said attacks succeeded because they appeared to be authentic communications.

The Proofpoint survey found that malicious links remained the most common threat at 40%, followed by compromised email at 35% and credential harvesting at 32%.

"Organizations that continue treating ransomware as an endpoint or recovery problem are missing where these attacks most frequently begin: people, identities and trusted communications," added Kalember.

FOLLOW US ON SOCIAL MEDIA

Nebula has announced the appointment of Rob Kittler as partner acquisition manager, as the communications software specialist looks to expand its UK reseller and managed service provider (MSP) network.

Kittler will be responsible for growing the company’s existing community of more than 700 resellers and MSPs as it looks to build on recent growth.

He joins the business following seven years at Gamma, where he most recently served as head of connectivity practice. During his time there, he worked closely with the vendor’s network of channel partners across connectivity and mobile services.

In an announcement, Sam Giggle, managing director of channel at Nebula, said Kittler’s experience makes him well placed to support the company’s channel expansion ambitions.

"Partner acquisition isn't a numbers game for us, it's about finding MSPs who want a genuine growth partner, and giving them a platform and a programme they can build a business on,” he explained. “Rob has spent the best part of a decade at the heart of the UK channel, and he understands partners' businesses from the inside."

Headquartered in Guildford, Surrey, Nebula develops SaaS-based workplace communications software spanning voice, messaging, customer experience, AI, analytics, and collaboration services.

The firm’s proprietary CallSwitch One platform supports more than 200,000 daily active users and is delivered through its network of reseller and MSP partners.

Kittler’s appointment follows a year of strong growth for Nebula, which saw the company add 42,000 net new users to its CallSwitch One platform as well as complete the migration of almost 200,000 users onto its wholly owned IP network.

Commenting on his new role, Kittler described the channel as being at “an inflection point” as partners navigate a changing market landscape.

“M&A among partners is leaving resellers with sprawling product portfolios to rationalise, while at vendor level too much of the IP being sold is outsourced, owned and controlled by someone other than the vendor selling it,” he said.

“Nebula's position as an IP owner gives partners a level of influence over the roadmap they simply can't get elsewhere, and the pace of software development here made this an easy decision.”

FOLLOW US ON SOCIAL MEDIA

Google Cloud has recorded its best quarterly growth to date, with earnings reports showing revenue surging 82% to $24.8bn.

Across the wider company, Google-owner Alphabet saw revenue climb 24% to $119.8bn, with income up 30%.

Despite such gains, Google was still on the back foot, with share prices falling 3% after revealing a big boost in capital expenditure and being forced to defend delays to its top-end AI model.

"Q2 was an amazing quarter, with Alphabet revenues growing 24% year-over-year and Google Cloud revenues accelerating to 82% growth, driven by demand for AI infrastructure and AI solutions," said CEO Sundar Pichai in a statement. "It’s great to see wide adoption of Gemini Enterprise, with nearly 90% of the Fortune 100 using it."

"Our AI investments are redefining what’s possible across every part of our business."

Continued capex concerns

After the results were announced, Google admitted in a conference call it will increase its capital expenditure this year, which is largely focused on AI infrastructure spending such as data centers.

Last quarter, that was bumped up by $5bn to an already massive $180bn to $190bn, and it has now been increased to $195bn to $205bn.

Over the second quarter alone, Google recorded capex of $45bn, with most used to boost "technical infrastructure to support our investments in AI," said Anat Ashkenazi, senior VP and CFO, according to a transcript of the conference call.

"The increase in the range is primarily due to an acceleration in the delivery of capacity to meet growing demand," said Ashkenazi, adding that spending would "increase significantly" in 2027.

Google isn’t alone in dealing with surging capex rates. Amazon Web Services (AWS) is projected to spend $200bn and Meta plans as much as $145bn.

These huge outlays have sparked concerns about the cost of AI over the last 18 months, but industry leaders insist it's all part of the process. Pichai compared this stage of AI to the early days of the shift to the cloud.

"I do think it feels like we are in very early innings of what feels like a secular shift across multiple areas in our core information businesses just the possibilities when I see what all you can do with the absolute frontier capabilities, there's still a lot of work ahead to translate all that into experiences for our consumer users," he said, in response to an analyst question.

Ashkenazi added that "while we have increased our capacity quite significantly over the past 3 years, the demand still outpaces that investment."

AI delays

Google Cloud might be flying high, but concerns over AI model-related delays are rising among investors. The firm’s flagship model was once again delayed this week.

The company unveiled Gemini 3.6 Flash and a cyber-focused model, Gemini 3.5 Flash Cyber this week, following the lead of competitors such as Anthropic in the space.

However, Gemini 3.5 Pro wasn’t included in the launch after initially being set for release in June. Google said it would be made available "as soon as it's ready".

"Gemini 3.5 Pro is currently in testing and our team is already building the next generation of models," Pichai said on the conference call. "We have started our most ambitious pretraining run yet for Gemini 4 and are excited by the progress we are seeing at the frontier."

That didn't convince one analyst, Douglas Anmuth from JPMorgan Chase & Company, who asked about Pichai's confidence in keeping Gemini models at the frontier — the front of the pack, the leading edge of AI development.

Pichai defended Google's AI efforts, saying the company was "very committed and very confident of being at the frontier, and, model releases aside, remains a leader on "many attributes" — though he admitted work was needed on coding and agentic coding.

"I am very excited by the progress I'm seeing internally on Gemini 4, and I'm confident that people will be pleased when we are putting it outside," he added.

FOLLOW US ON SOCIAL MEDIA

Palo Alto Networks has announced the acquisition of application monitoring provider Embrace as the security giant targets real-time observability gains.

The firm said the acquisition will add “high-fidelity real user monitoring (RUM) capabilities” to its existing observability platform and provide customers with deeper insights into user activity.

As part of the announcement, Palo Alto Networks has also introduced Synthetics, a new service built with its Autonomous Digital Experience Management (ADEM) team.

Synthetics will help enterprises proactively validate application performance, the company noted, with these capabilities also extending improved observability to digital experience monitoring (DEM).

“Customers will gain a complete, unified view, from end-user interactions and proactive app validation to backend software and infrastructure, all on the industry's leading, innovative, cost-effective platform,” the company said in a blog post.

The Embrace deal comes hot on the heels of the Chronosphere acquisition, which also aimed to bolster observability capabilities for Palo Alto Networks.

The $3.35 billion acquisition, first announced in November 2025 and closed in January this year, saw the cybersecurity vendor combine Chronosphere's observability platform with its own Cortex AgentiX offering.

Terms of the Embrace deal were not disclosed.

Palo Alto Networks wants the ‘whole picture’

Lee Klarich, chief product and technology officer at Palo Alto Networks, said this latest acquisition aims to provide users with a comprehensive overview of application performance.

“To truly understand how their applications are performing, organisations need to see the whole picture - from the moment a user taps or clicks to what exactly happened on the backend,” he said.

“By combining Palo Alto Networks' leading Observability platform with Embrace's innovative Real User Monitoring and the organically developed Synthetic Monitoring capabilities, we'll deliver exactly that.”

Klarich said the firm also plans to take things “a step further” by linking these new capabilities with Cortex AgentiX.

“Organizations will be able to both see and automatically fix issues across their ecosystem,” he added. “This is what true platformization looks like in practice.”

Observability in the spotlight

Palo Alto’s observability focus comes amidst a critical time for enterprises globally, particularly with the influx of AI tools and agents across IT environments.

Modern applications are “increasingly complex and autonomous”, the company said in a blog post, and enterprises require more detailed performance visibility to ensure reliability.

“Embrace’s proven RUM capabilities are built for modern environments, allowing customers to deliver applications that scale at the pace of AI,” the firm noted.

“Sythetics will leverage Palo Alto Networks’ globally distributed infrastructure to proactively validate application availability and performance from strategic locations across the globe.”

FOLLOW US ON SOCIAL MEDIA

Samsung has revealed three new foldable models, including the Galaxy Z Fold 8 Ultra, and an all-new shape for the standard Z Fold 8.

The Galaxy Unpacked launch, which also included a new Flip 8, included many new features, such as a new durable titanium structure and more on-device AI tools and capabilities.

Of the three new models, the Z Fold 8 Ultra is the biggest and highest-spec'd. Folded, it looks like a standard phone thanks to an ever-decreasing thickness (5.9mm folded, 4.1 mm unfolded).

It has a 6.5in cover display and opens up to an 8in main display, which is essentially two 6.5in screens side by side.

On first impression, the Z Fold 8 Ultra is better in every way than before. It's slightly thinner and somehow stronger.

This is thanks to a new titanium structure beneath the display that includes a panel and plate that reinforce the folding mechanisms and make it stronger and more durable than before, while maintaining its thin, streamlined look.

Beneath those titanium additions is a 5000mAh battery that promises 27 hours of video playback and 45w fast charge with 67% in just 30 minutes.

You get five camera lenses on the 8 Ultra, with a 10MP selfie lens on the cover display, a 10MP lens on the main display, and then three cameras on the rear of the device: A 200MP wide lens, a 50MP ultrawide one, and a 10MP telephoto lens.

From our brief experience ahead of its launch, we found the camera setup on the Fold 8 Ultra to be very crisp and dynamic.

Powering all of this is the Qualcomm Snapdragon Elite 8 chip (CPU, NPU, GPU), and that is the case for all three new models. It's also been customised for Samsung's OS to provide more on-device AI tools, like the new 'Now Nudge' feature, which is like an information overlay that was launched in beta on the S26.

It takes contextual information from apps and offers suggestions via the keyboard – similar to predictive text. It can appear across multiple parts of the screen or in a more subtle way called 'Ambient Nudge ' or simply 'Notification Nudge'.

Samsung Galaxy Z Fold 8 and Galaxy Z Flip 8

Now Nudge is also on the new Z Fold 8, which comes in a distinctive new shape. It's a slightly wider, more square design compared to the Ultra. Similar to Huawei's Pura X smartphone, but much bigger.

When unfolded, it has a 4:3 aspect ratio (3:4 in portrait), which is more suited to the types of content we consume, according to Samsung. So reels and scrolling video content can be viewed in their entirety.

Folded, the 8 has a 10.16in cover display and looks very square. And it unfolds to a 7.6in main display – almost an inch smaller than the Ultra, but arguably a more content-friendly size.

The other differences from the Ultra are a slightly smaller battery at 4,800mAh, and no telephoto lens. Instead, you have a pair of 50MP lenses, one wide and the other ultrawide. It still promises 26 hours of video playback.

As with the most recent Galaxy S26, video stabilization is a big feature on the Z Fold 8. This is best used in the My Fan Cam feature, which allows for instant cropping of video.

You can select a subject from a 16x9 video and have it cut to a vertical shot – you can even select an object or person, regardless of where they are in the frame, and have them as the main focus within a crop.

There is also a new Flip 8, though this is of the least business interest. It's lighter than before and thinner too (180g, 6.1mm thick, when folded).

You have a 50MP main camera and an intuitive Flex Window on the cover display that offers suggestions and automations for you to operate the phone quickly without opening it up every time.

OpenAI has admitted that its own AI models breached Hugging Face systems as part of a security test gone wrong.

In a blog post on 21 July, the firm revealed models escaped testing environments and gained unauthorized access to the AI hosting platform's production database.

Notably, OpenAI revealed the incident involved a pre-release, cyber-focused model.

“After investigating, we now know that this particular incident was driven by a combination of OpenAI models – including GPT-5.6 Sol and an even more capable pre-release model, all with reduced cyber refusals for evaluation purposes – while being internally tested on a benchmark of cyber capabilities,” the company wrote.

The admission comes after days of speculation amidst reports that an "external AI agent” had hacked the company. Hugging Face issued an alert last week warning that a breach had exposed internal datasets and user credentials.

How OpenAI hacked Hugging Face

According to OpenAI, the incident occurred during an internal evaluation in which models were prompted to examine potential attack paths.

The aim here is to evaluate their cyber capabilities within an isolated environment, and crucially, without certain restrictions to prevent said models from “pursuing high-risk cyber activity”.

“Our benchmarks run in a highly isolated environment, with network access constrained to the ability to install packages through an internally hosted third-party software that acts as a proxy and cache for package registries,” the company explained.

Both models “identified and chained” vulnerabilities across both OpenAI’s research environment and Hugging Face’s infrastructure, with the aim of gathering test solutions from the latter’s production database.

In this case, the models appear to have focused heavily on ExploitGym, a publicly-hosted benchmark tool used to evaluate how AI agents can turn software vulnerabilities into working exploits.

Notably, OpenAI revealed the models “identified and exploited a zero-day vulnerability” in the package installer registry. After successfully exploiting this zero-day, the models conducted a “series of privilege escalation and lateral movement actions” which allowed it to escape the test environment and gain full internet access.

“After gaining internet access, the models inferred that Hugging Face potentially hosted models, datasets, and solutions for ExploitGym,” the company noted.

“Knowing this, the model searched for and successfully found ways to gain access to secret information that it could use to cheat the evaluation.”

In one example, OpenAI revealed the model chained together several attack vectors using a combination of stolen credentials and zero-day flaws to identify a remote code execution (RCE) path on Hugging Face servers.

What comes next?

OpenAI has detailed a series of actions it’s already taken in the wake of the incident, including closer coordination with Hugging Face to conduct a wider review.

This also includes bringing Hugging Face into the firm’s trusted access program to help bolster defenses by harnessing the company’s model capabilities.

Crucially, OpenAI revealed it will now implement “strict controls” to ensure vulnerability testing is limited while flaws are being patched.

“We consider this incident to be an unprecedented cyber incident, involving state-of-the-art cyber capabilities, and are responding accordingly,” OpenAI wrote.

“We will continue to conduct a thorough investigation alongside Hugging Face and will share more details on the vulnerabilities, incident, and findings when our investigation is complete.”

Initial response hampered

A key talking point in the wake of the incident rests on Hugging Face’s response to the breach.

The company noted that the attack was initially flagged by AI detection tools, with security teams using LLM-based anomaly detection to “separate real signals from the daily noise”.

Subsequent attempts to use AI in a post-mortem proved troublesome, however, largely due to the guardrails placed around commercially-available models.

“When we started the log analysis, we first used frontier models behind commercial APIs,” the company explained.

“This did not work: the analysis requires submitting large volumes of real attack commands, exploit payloads, and C2 artifacts, and these requests were blocked by the providers’ safety guardrails, which cannot distinguish an incident responder from an attacker”.

These hurdles meant Hugging Face turned to GLM 5.2 – an open-weight model from Chinese company Z.ai – run on its own infrastructure.

While this proved beneficial in terms of preventing attacker data or leaked credentials from leaving the company’s environment, it does raise broader questions around responsible use and how well-intentioned safety measures could hinder incident response.

“This experience points to a gap worth planning for,” Hugging Face wrote. “We do not know which model powered the attacker’s agents, whether a jailbroken hosted model or an unrestricted open-weight one; either way, the attacker was bound by no usage policy, while our own forensic work was blocked by the guardrails of the hosted models we first tried.”

A new wave of AI-powered attacks

This incident comes amidst growing concerns about the potential risks associated with powerful new AI models. When Anthropic launched Claude Mythos earlier this year, it did so as part of a gated release to prevent the model from falling into the wrong hands.

These powerful new cyber-focused models are causing headaches for security professionals worldwide, particularly around vulnerability identification and disclosure and patching timelines.

Apple, for example, recently announced plans to accelerate patching schedules due to concerns about threat actors using AI to identify software vulnerabilities.

As ITPro reported in April, researchers at Forescout warned of a pending ‘vulnerability explosion’ as AI advances help identify flaws at record pace.

Jake Moore, global cybersecurity advisor at ESET, suggested the industry could be entering the “next phase of AI-powered cyber crime” in which trusted platforms are prime targets.

“Threat actors are inserting malware into the AI components that developers often quickly trust, making AI platforms an attractive new target for supply chain attacks,” he said.

“We’ll likely see more of these attacks as organizations are worryingly rushing to build AI into products without fully knowing the potential risks.”

Art Gilliland, CEO of identity security firm Delinea, echoed Moore’s comments, noting that the breach highlights a familiar pattern with AI-related incidents.

“An AI agent escalated privileges, moved through internal infrastructure once it broke containment, and ran unchecked for a full weekend before anyone could reconstruct what happened,” he said.

“If your AI agents carry standing privilege the way human accounts do, you've already lost the ability to stop this in real time. The question every security team should be asking right now isn't just whether their AI agents have standing access; it's whether anyone would notice if an agent used it and could cut it off before it caused damage.''

Moore also flagged similar concerns to Hugging Face with regard to safeguards for western AI models. He warned that some providers “need to rethink how their security guardrails work if they are hindering incident response”.

“If not, more companies will simply switch to other models without such controls – ironically, the same models likely used by AI attackers.”

FOLLOW US ON SOCIAL MEDIA

Cyber experts have urged users of Palo Alto Networks' GlobalProtect VPN to patch immediately amidst active exploitation of an upgraded security flaw.

A flaw in the popular VPN service, tracked as CVE-2026-0257, could allow attackers to bypass authentication and establish an unauthorized connection.

The vulnerability primarily affects the GlobalProtect portal and gateway for Palo Alto Networks’ PAN-OS software, and carries a CVSS score of 7.8, rating it as ‘high’ in severity.

Notably, this rating follows an upgrade, with the flaw having previously been given a ‘medium’ severity rating. Palo Alto announced the upgrade late last week amidst reports that the flaw was now being exploited in the wild.

“Palo Alto Networks has become aware of limited exploit attempts on unpatched PAN-OS devices without mitigations applied,” the company said in an advisory.

Analysis by Rapid7 shows threat actors have been exploiting the vulnerability since mid-May across several waves of attacks.

“Rapid7 MDR identified successful exploitation across numerous customers; however, we did not observe any indication of successful lateral movement from the devices,” researchers said.

“The earliest date for observed exploitation was May 17, 2026. As of May 29, 2026, this vulnerability has been added to the CISA KEV.”

Rapid7 noted that customers compromised in this wave of attacks had Cloud Authentication Service (CAS) disabled. Others, meanwhile, had GlobalProtect portal or gateway authentication override cookies enabled.

A patch has been issued for customers running affected appliances, according to Palo Alto.

Similarly, administrators are advised to turn off authentication override features to mitigate potential exploitation.

Qilin ransomware involved in GlobalProtect attacks

Analysis by Arctic Wolf Labs suggests attacks on GlobalProtect customers could be the work of the Qilin ransomware group or affiliates. Indeed, researchers detected Qilin ransomware during several instances across June, highlighting a range of tell-tale signs.

“Post-exploitation tradecraft varies across intrusions, from rapid encryption-only operations to full double extortion, possibly suggesting multiple affiliates operating under the Qilin ransomware as a service (RaaS) umbrella,” the company said.

Dray Agha, senior manager for Huntress’ security operations center, said these attacks highlight the growing threats posed to VPNs and firewalls.

"The exploitation of this GlobalProtect vulnerability by the Qilin ransomware gang demonstrates that perimeter defences are prime targets,” he said.

“When threat actors can bypass VPN authentication, they are walking through the digital front door with a master key. The grace period for patching critical edge devices has practically vanished, and they must be the patching priority for all organizations".

FOLLOW US ON SOCIAL MEDIA

NetApp has announced the acquisition of California-based AI data infrastructure specialist DataPelago, in a move the company said will improve performance for AI and analytics workloads.

The deal will see DataPelago’s technology integrated into NetApp’s portfolio, enabling GPU-accelerated processing directly within the storage layer rather than requiring data to be moved into separate compute environments.

According to NetApp, the move will help customers reduce their infrastructure costs while improving performance for AI and analytics workloads by processing data at its source.

In an announcement, NetApp CEO George Kurian said the acquisition strengthens the company’s aim of giving customers “full command” of their data.

"As AI models and the chips that power them get ever more effective, enterprises need data infrastructure that is just as intelligent and powerful to harness the potential of their data," he commented.

"With DataPelago, we are extending our ability to help customers understand and process their data with the agility required to unleash competitive advantage.”

Founded in 2021, California-based DataPelago develops AI data infrastructure designed to accelerate data processing for AI and analytics workloads. Its technology focuses on reducing the complexity and cost of preparing enterprise data for AI by enabling processing closer to where data is stored.

At the heart of DataPelago’s offering lies its Nucleus engine, which uses GPU and CPU acceleration to process data directly where it resides.

According to the company, the technology eliminates the need to copy enterprise data into separate AI environments, reducing infrastructure costs by up to 80% while delivering performance improvements of up to ten times compared with conventional approaches.

By embedding the technology into its storage platform, NetApp said customers will be able to prepare, govern, and activate enterprise data for AI without moving it between environments, helping to remove one of the biggest bottlenecks facing AI deployments.

"NetApp manages more enterprise data across more environments than anyone in the industry," said Syam Nair, Chief Product Officer at NetApp.

“The next phase of AI will be won by those who make that data work at the source, and the DataPelago team brings the technical depth and velocity to get us there faster."

Upon completion of the acquisition, DataPelago will operate as a wholly owned subsidiary of NetApp.

Commenting on the acquisition, DataPelago founder and CEO Rajan Goyal said joining NetApp would allow the company to bring its technology to a wider enterprise customer base.

"Joining NetApp gives us the opportunity to combine our breakthrough processing technology with the industry's best data infrastructure portfolio,” he explained.

“Enterprises have invested billions in GPUs and AI models, but their data remains fragmented, leaving valuable computing resources to sit idle rather than putting these investments to work.

“Together, we’re positioned to help customers simplify and accelerate AI deployment at scale."

Financial terms of the acquisition were not disclosed.

FOLLOW US ON SOCIAL MEDIA

AI minister Kanishka Narayan has been given a seat in incoming prime minister Andy Burnham’s cabinet following a reshuffle.

Narayan described the move as a sign of Burnham’s “deep commitment to AI’s importance” to the UK economy.

“AI is likely the most significant technology in human history. Its impact will dwarf other things,” Narayan said in a post on X.

“The best case for it is compelling beyond our dreams: a reindustrialised Britain, stronger national security, public services transformed for the better. The risks, too, are real: it is right that the British public shares those worries, for jobs, for the pace of change.”

The move comes as the UK's Department for Science, Innovation, and Technology (DSIT), where the AI minister role used to sit, has been scrapped in the wake of Burnham’s appointment.

Under the new setup, DSIT responsibilities will be merged with the freshly minted Department for Business, Innovation, Science, and Trade (DBIST), led by Jonathan Reynolds.

The role of technology secretary has also been cut.

AI focus welcomed

Mark Boost, chief executive of UK-based cloud computing firm, Civo, said retaining and elevating Narayan is a reassuring signal for UK businesses.

“Giving the AI minister direct access to cabinet decisions demonstrates that the government recognizes AI’s existential importance to our future economy,” he said.

“Positioned inside a high-powered business and trade department, an AI Minister with Cabinet authority will have real leverage to break down cross-Whitehall silos, accelerate national AI infrastructure, and give British tech companies the proactive backing needed to maintain a competitive global advantage.”

Andy McLean, CEO of the UK Semiconductor Centre, echoed Boost’s comments, noting that Narayan’s new role is a “positive signal of the importance being placed on AI at the center of government”.

Boost added, however, that any delays to AI-related initiatives caused by the DSIT shake-up could have a significant impact on global competitiveness.

“Any Whitehall restructuring brings administrative friction, and because the global tech and AI arms race is moving so quickly, the UK simply cannot afford a pause,” he said.

“Critical initiatives like the AI Opportunities Action Plan and sovereign infrastructure investments must be ring-fenced from bureaucratic delays.”

FOLLOW US ON SOCIAL MEDIA

Cisco has unveiled a new range of cyber-capable small language models (SLMs) aimed at supercharging security operations.

The Antares range, which comes in two forms (Antares-350M and Antares-1B) will be made available as open-weight models via Hugging Face. According to Cisco, the aim here is to provide a codebase vulnerability tool that's far cheaper than general of frontier models.

While the Antares SLMs will operate as specialized models alongside frontier and generalized models, the company promised they will run at a "fraction of the compute expense."

"Benchmark testing shows that these models outperform many powerful closed- and open-weight models in this critical security task at a fraction of the cost," said Amin Karbasi, VP and chief scientist for Cisco Foundation AI.

“And they’re compact enough to run locally, heading off the need to send sensitive codebases to the cloud.”

The move by Cisco comes amidst wider concerns about the rising costs of AI, exacerbated by changes to billing and pricing that have caused bills to shoot up across the industry.

Some companies, including Accenture, have told staff to cut back on AI use as a result of skyrocketing prices. Indeed, one report suggested AI could cost more than developer salaries within a few years.

At the same time, AI is making inroads into security – faster than some expected – with the rise of cyber-focused models such as Anthropic's Claude Mythos.

How Cisco’s Antares models work

Antares is designed to mimic how a human investigator would work their way through a code repository – though Cisco noted the aim wasn't to replace human judgement, but to make it easier to manage the work.

The models can help with locating files that relate to a vulnerability warning, trigger investigations based on advisories, support development workflows that use vulnerable files, and more.

Cisco noted that the decision to release the Antares range as open-weight models means they’re easier to work with and improve.

"We are releasing Antares as open-weight because the security community needs more accessible building blocks for practical, repository-level defense," said Karbasi.

"Cisco's efforts are connected by a common belief: AI in security has to move beyond impressive one-off demos and toward systems that practitioners can evaluate, govern, and improve."

Tackling complexity

Cisco said that Antares was built to address two concerns when it comes to code: the complexity of checking it for vulnerabilities and the costs of using AI for that task.

First, Karbasi said that it was difficult to apply vulnerability knowledge — advisories, vulnerability alerts and severities, and so on — to a company's internal code.

"That work is difficult because repositories are large, security signals are noisy, and the relevant evidence is rarely in one obvious place," he said.

"Analysts often need to search through unfamiliar code, follow naming conventions, inspect call paths, compare candidate files, and decide whether a weakness is actually present."

How cheap is Antares?

AI can help with that challenge, but the high costs of general or frontier models mean it often isn't practical, in particular for public sector organizations, universities, and smaller security teams.

"Compact models reduce inference costs, support local or on-premises operations, and help teams keep sensitive source code within their own environment," Karbasi said.

So just how cheap are the Antares models? Cisco said that running a 500-entry evaluation using Antares took 15 minutes on a single GPU at a cost of less than $1.

Cisco noted that this was 15-times cheaper than the best available open source model and a whopping 172-times cheaper than the top-end frontier model.

"The goal is to build toward a system where all security practitioners, regardless of on-prem or resource constraints, can effectively incorporate AI in everyday security operations," Karbasi added.

FOLLOW US ON SOCIAL MEDIA

Nearly three-quarters (74%) of companies have reworked security team structures due to the influx of AI tools, and that’s sparking high demand for cyber pros with dedicated skills.

New research from SANS Institute found the rise of dedicated, AI-focused roles in cybersecurity is driving up salaries across the industry.

High-end salaries for AI security roles now top $260,000 (£194,000), with positions such as Post-Quantum Cryptography Migration Specialists and AI governance leads in high demand.

Pointing to a review of UK vacancies on LinkedIn, SANS Institute noted that there are thousands of AI security positions being advertised online, suggesting that hiring for such roles has "moved from prediction to present-day reality".

That suggests that AI isn't taking over cybersecurity jobs, but changing which skills are necessary for the work, the organization said.

"Routine analytical work is increasingly automated, while demand is accelerating for professionals who can secure AI systems, govern AI risk, conduct AI red teaming and orchestrate AI-powered security operations," the institute said.

A new wave of cybersecurity roles

Dedicated AI roles spanning a range of security-related areas are popping up across the industry, SANS noted. AI security engineers, for example, are in hot demand, now commanding salaries of around $185,000 on average.

Roles focused on specific areas and threats are also emerging, the study noted. Ads for AI Identity Deepfake Defense Specialists have been identified. While it’s a wordy job title, the study noted that this shows the impact of trends such as deepfake voice fraud.

Professionals in these roles can command salaries of between $130,000–$175,000 (£97,000–£131,000), the institute noted.

Long-term, the organization expects these new specialist careers will lead to premium salaries due to intensifying demand for skills.

Other new AI-related roles identified by SANS Institute include:

• AI Governance, Risk & Compliance Lead ($240,000 salary)
• AI Red Team Specialist (up to $220,000)
• AI Supply Chain Security Engineer (up to $185,000)

Intriguing new roles include AI Incident Response Orchestrator, AI threat intelligence analyst, and AI SOC Orchestrator were also highlighted by the institute.

Growing quantum focus

It’s not just AI reshaping roles and sparking heightened demand for cyber pros with specific skills, however.

Dedicated quantum-related cybersecurity roles are also growing in frequency, the study found, as organisations ramp up preparations for ‘Q-Day’.

This is the point at which quantum computers can break traditional encryption techniques. While the debate on when this comes still rages, many enterprises are looking ahead to this point - and job ads reflect this.

SANS Institute pointed to roles such as Post-Quantum Cryptography Migration Specialists – a position focused on reacting to looming mass breaking of current encryption by quantum computers – saying it could earn above $260,000.

Reshaping team structures

The study from SANS Institute isn’t the first to highlight the impact AI is having on team structures. As ITPro reported earlier this month, the same shift is occurring in software development due to the influx of AI tools.

Research from Gartner predicts that 60% of enterprises will rework software development units into ‘tiny teams’ by 2030.

While this shift toward ‘smaller’ teams may have alarm bells ringing for developers, the consultancy noted that this won’t necessarily spell bad news.

This transition won’t be a cost-cutting effort or attempt to reduce headcount, but will instead focus on creating more focused, specialized units.

FOLLOW US ON SOCIAL MEDIA

Microsoft has announced it will deploy AMD’s Helios rack-scale solution as it targets data processing and AI inference gains for Azure customers.

The collaboration will see three new AMD EPYC CPU-powered virtual machine (VM) offerings made available through Azure. These include:

• HDv2 VMs
• HCx2 VMs
• ND MI455X v7 VMs

The first of these, Azure HDv2, is designed for large-scale data processing and to “empower massive agentic workload adoption”.

Featuring 500 sixth-generation EPYC CPU cores, HDv2 VMs boast 4TB of RAM, 32TB of local NVMe storage, and 500Gbps Azure Boost networking capabilities.

Azure HCx2 VMs, meanwhile, are designed primarily for silicon design and technical computing tasks, such as scientific simulations and engineering analysis.

This series builds on the design of Azure HX virtual machines, which the company launched in partnership with AMD in 2023.

HXv2 VMs will include 176 AMD sixth-gen EPYC CPU cores. These offer “significantly increased” per-VM and per-core performance and will also include 800GB InfinBand for “large-scale MPI-based simulations”.

Elsewhere, the ND MI455X v7 specifically targets “production-scale” AI inference improvements for Azure customers.

“ND MI455X v7 is designed for the reasoning, search and agentic workloads behind modern AI services,” Microsoft said in a blog post.

“Powered by the AMD Helios rackscale solution, it expands Azure’s infrastructure options for large-scale inference and is designed to deliver strong performance and efficiency for demanding AI workloads.”

The move makes Microsoft the latest in a string of big tech customers flocking to the Helios system. AMD chief executive Lisa Su said the deal builds on long-standing ties between the duo.

“AMD and Microsoft have spent years building high-performance infrastructure together, and today we're extending that partnership across the full stack of AMD AI solutions on Azure,” said AMD CEO Lisa Su.

“Microsoft's new AMD deployments mark an important milestone as we deliver leadership compute solutions to Azure customers and scale the next generation of AI infrastructure together.”

Microsoft targets “scale and choice” for customers

Helios is AMD’s first rack-scale system designed specifically for frontier model training and large-scale AI inference. The system combines AMD Instinct MI455X GPUs, AMD EPYC “Venice” CPUs, Pensando networking, and ROCm software..

Microsoft CEO Satya Nadella said the collaboration marks a significant expansion of Azure infrastructure capabilities.

“Customers are looking for AI infrastructure that is optimized for a wide range of workloads, from training and inference to data preparation, search, and reinforcement learning," he said.

"Through our collaboration with AMD, we are expanding the Azure infrastructure portfolio with AMD Helios to give customers the performance, scale and choice they need to build and run the next generation of AI applications.”

Helios roll-out pending

AMD unveiled the Helios rack-scale solution at its 2025 Advancing AI conference. The solution offers an alternative to – and competes with – Nvidia’s Vera Rubin and Grace Blackwell systems.

At the time, Su described the launch of Helios as a “game changer” that’s “purpose built for the most demanding AI workloads”.

A host of major tech providers, including Meta, OpenAI, HPE, and Oracle have since confirmed they’ll deploy the solution in data centers.

The chipmaker will begin shipping Helios to customers in the second half of 2026.

Although exact timelines haven’t been revealed, the collaboration with Microsoft comes just days ahead of AMD’s 2026 Advancing AI conference, in which customers can likely expect real-world examples of the system in action.

ITPro will be live on the ground in San Francisco for AMD’s annual conference this week.

Stay up-to-date with all the news, views, and announcements from the event by following our socials (below) and subscribing to our daily newsletter.

FOLLOW US ON SOCIAL MEDIA

Achieving true tech sovereignty could be a bridge too far for Europe, a senior Forrester analyst has told ITPro, as new research from the consultancy lays bare the scale of the challenge.

According to Forrester’s Global Sovereignty Forecast, the shift to bolster tech sovereignty will move “slowly over the next five years”, with many efforts to divest from US tech providers falling flat.

The report includes a ‘Tech Sovereignty Index’ used to measure a country’s ability to “develop, operate, and secure critical technologies independently” - and it paints a damning picture.

Between 2025 and 2030, European countries are only expected to make “modest” gains in building sovereignty. Germany’s score is expected to rise from 34% to just 36%, for example, while the UK from 30% to 32%.

This slow progress flies in the face of what has become a key recurring talking point in Europe over the last 18 months. Calls have been rising to cut reliance on US-based technology providers, largely due to a combination of rising geopolitical tensions and data privacy concerns.

Speaking to ITPro, Dario Maisto, principal analyst and lead author of the report, suggested the current focus on sovereignty is much like other tech industry trends: awash by hype.

“There is a lot of hype around sovereignty, because service providers see it as the money maker,” he told ITPro. “So why should an organization engage with me? Well, sovereignty.”

For many organizations, Maisto noted that the focus on sovereignty isn’t actually required from a compliance perspective, albeit in some limited capacities.

“I was watching a Red Hat presentation in the morning, and they said there are a lot of new regulations. No, there's not. There's none. There is no new regulation that mandates sovereignty in any way whatsoever,” he said.

“Nor is there any definition at any possible level, national, regional, international, for sovereignty. There are some requirements in terms of data residency, citizenship of people handling certain workloads, certain workloads being deployed on on-prem rather than public cloud … but there is no formal, overarching obligation towards sovereignty whatsoever.”

“Persistent dependencies” run deep in Europe

Maisto admitted that geopolitical tensions, particularly deteriorating transatlantic ties, have indeed prompted a rethink of how heavily European organizations rely on US providers.

The idea of a wholesale shift away from popular vendors would require a monumental effort, however. Combined, Amazon Web Services (AWS), Microsoft Azure, and Google Cloud control 65% of the European cloud market.

“There is not much that we can do about it. Certain SaaS applications, for example, do not even work outside of the hyperscalers clouds,” he said. “So you have two options as a client: either take the degraded, not complete, less serviced, less updated on-prem version, which you can, or you get the most updated, the fanciest, the shiniest cloud version.”

“But then you are forced to deploy on a hyperscaler because the APIs don’t work outside of the hyperscaler cloud. Moving these applications outside of the hyperscaler cloud, it's not a lift and shift.

“It's not something that the client can do.”

Elsewhere, Europe simply doesn’t have the capabilities when it comes to macroeconomic considerations. When gauging sovereignty credentials, Forrester’s index takes into account a range of factors, including:

• Government spending
• Tech workforce availability
• Data center capacity and autonomy
• Chip production
• Rare earth elements processing
• AI model creation

Forrester noted that “persistent dependences” in areas such as energy infrastructure, data center infrastructure, and supply chains could hamper the region’s ability to operate independently of both US and Chinese technology ecosystems.

Back down to earth

Maisto’s argument is that the reality of achieving true tech sovereignty often fails to acknowledge the significant investment required to reach this point – along with the potential disruption and legwork needed to move away from US-based providers.

“I think seven out of 10 international SaaS solutions are out of the US,” he said. “So how feasible is it that organizations replace 20 years of investment in Salesforce, in Workday, in ServiceNow overnight?”

Put simply, it’s an idealized vision borne out of the reactionary, tumultuous geopolitics at play in the world right now.

“So many people see sovereignty as a green field,” he said. “For organizations that have been investing millions, if not billions, in cloud migrations, task transformation, it's not about greenfield. It's a retrofit.”

These questions are what prompted the creation of what Maisto described as the “minimum viable sovereignty model” used in the Tech Sovereignty Index.

“How do I do the least possible investments now to get the sovereignty that I actually need, what is it I actually need to be compliant? Maybe to mitigate a risk, and what is it I can actually achieve?”

Lifting and shifting anyway

Despite the difficulties highlighted by Maisto, efforts to bolster sovereignty have been gaining traction across Europe over the last year. In April, authorities in France announced plans to move away from Windows in favor of Linux-based operating systems for some 2.5 million government devices.

Speaking at the time, David Amiel, minister of public action and accounts, said the country aims to become “less reliant on American tools and regain control of our digital destiny”.

At an EU-wide level, similar efforts are being made. As ITPro reported in June, the European Commission unveiled the technological sovereignty package.

This aims to reduce reliance on US tech and shake up the union’s capabilities across several areas, spanning AI, cloud computing, open source, and semiconductor manufacturing.

On the latter of these focus areas, Maisto noted that this is a “move in the right direction because we need more options” in terms of hardware manufacturing.

At present, Europe accounts for less than 10% of global chip manufacturing, according to Forrester. Crucially, it lacks the “large designers that can compete with the likes of Nvidia or Qualcomm”.

All told, European companies design only 1% of global chips.

Maisto suggested this once again shows the scale of the challenge faced both by individual European nations and the region as a whole under EU leadership.

Looking ahead, he said the focus for many will be to “manage the dependencies rather than avoiding them”.

FOLLOW US ON SOCIAL MEDIA

Scottish health tech company Craneware has revealed customer and employee data has been exposed in a “security incident”.

In a notice filed with the London Stock Exchange (LSEG) on 20 July, the company said it had launched an investigation into the attack, which has now been contained.

“The company's incident response plan has been activated, including the appointment by the Board of external cybersecurity and forensic specialists,” the advisory reads.

“Their investigation is ongoing, alongside the Craneware IT team and the Company's retained cyber security service providers. There has been no disruption to customer services or to the company’s operations.”

A preliminary investigation into the breach found that a “significant volume” of file names was viewed and exfiltrated by unauthorized individuals, although the company noted these weren’t sensitive and were already publicly available.

“A percentage of employee data as well as a subset of customer and partner records have been accessed and exfiltrated,” Craneware added.

Craneware has since notified relevant regulators and law enforcement agencies, including the UK Information Commissioner’s Office (ICO) and the FBI.

The Edinburgh-headquartered company provides accounting and billing software for US healthcare operators, partnering with around 2,000 hospitals across the country.

This makes it a prime target for cyber criminals, according to Trevor Dearing, director of critical infrastructure at Illumio.

“Healthcare technology providers have become prime targets because they offer cybercriminals a shortcut into the healthcare supply chain,” he said. “Why target one hospital when you can target a provider connected to thousands?”

Attacks on the UK healthcare system and associated vendors have increased significantly over the last year, according to a recent study from SonicWall. Figures published by the cybersecurity firm in June highlighted a tenfold increase in attacks so far in 2026.

Data collected through SonicWall's Intrusion Prevention System (IPS) showed upwards of 260,000 attempted cyber attacks between January and May this year.

While the Craneware incident has been contained, Dearing noted that employees and customers should still remain vigilant for potential follow-up attacks such as phishing - a common tactic employed in the wake of breaches.

“Even where stolen information appears low risk, employee, customer and partner data can be used to fuel phishing, social engineering and follow-on attacks,” he said.

“Employees, customers, and partners should remain cautious of any unsolicited communication or suspicious activity on their networks.”

FOLLOW US ON SOCIAL MEDIA

Cohesity has announced the appointment of Seb Fitzjohn as vice president of partner channel sales and go-to-market for Europe, as the data security specialist looks to strengthen its partner ecosystem across the region.

Fitzjohn will leverage two decades of international sales and channel experience to lead Cohesity’s partner and channel strategy across European markets.

The firm said he will work to drive growth through its Aspire Partner Program while expanding go-to-market partnerships and helping deliver data resilience and security solutions to customers.

He joins the business from ServiceNow, where he spent seven years serving in senior leadership positions – most recently as group vice president of sales for Europe North, and previously as head of the company’s EMEA partner organization.

The appointment follows a recently announced partnership between Cohesity and ServiceNow, which aims to deliver real-time recovery and resilience capabilities for enterprise AI agents.

In an announcement, Olivier Savornin, Cohesity’s group vice president of sales for Europe, said the appointment highlights the company’s continued investment in talent and its partner organization.

“Seb is a great example of the high calibre of leader we want driving our business forward,” he explained. “His experience and track record put him in a strong position to support our customers and accelerate mutual growth for Cohesity and our Partners across Europe, as well as provide new perspectives and leadership approaches for the benefit of the entire Cohesity team.”

California-headquartered Cohesity specializes in AI-powered data security and cyber resilience, offering a platform that helps organizations protect, secure, manage, and recover data across on-premises, cloud, and hybrid environments.

The vendor launched its Aspire Partner Program in August 2025, introducing a unified framework designed to simplify engagement across different partner types. The initiative offers tiered benefits, financial incentives, training, certifications, and go-to-market support to help partners expand recurring revenue opportunities.

In his new role, Fitzjohn will focus on expanding the program across Europe, while working with partners to strengthen the delivery of Cohesity’s data resilience and security offerings.

Fitzjohn said organizations require “absolute confidence” that they can protect, secure, and harness greater value from their data as AI adoption continues to reshape the IT landscape.

“Cohesity and our partners are uniquely positioned to help customers build true data resilience while also enabling AI-driven business insights,” he commented. “I look forward to working closely with our partners and the Cohesity team to expand our sales and delivery capacity across Europe in service to our joint customers.”

FOLLOW US ON SOCIAL MEDIA

UK tech industry stakeholders have hit back at alleged plans to scrap the Department of Science, Innovation and Technology (DSIT).

TechUK, a trade association for the country’s digital sector, described the rumoured move as a “terrible signal” for a burgeoning industry, which it noted is growing at a rate of 10% per year.

“Breaking up the work of DSIT endeavours such as the world-leading AI Safety Institute, the Sovereign AI Fund, GDS, and UKRI would slow momentum at a time when pace is essential for both the growth of the economy and our standing on the global stage,” techUK said in an open letter published on 19 July.

The backlash comes after the Financial Times reported on 17 July that incoming prime minister Andy Burnham plans to abolish the department.

Sources told the publication that advisers are creating plans to hand over technology policy to a larger business department, led by former business secretary Jonathan Reynolds.

ITPro approached the DSIT for comment, but did not receive a response by time of publication.

The move would see a return to a similar setup for science and technology policy prior to the foundation of the department in 2023.

The DSIT was formed under Rishi Sunak’s premiership and given direct responsibility for policy on these fronts. The department now plays a key role in driving growth in key digital sectors and leading digital transformation across public services.

According to Dom Hallas, executive director of the Startup Coalition, attempts to incorporate DSIT within a broader business department could dilute its influence and negatively impact the broader technology sector.

“A mega department would mean British tech competing with British steel for attention. And waste 6 months reorg-ing when time is of the essence. Not good,” Hallas said in a post on X.

Matt Clifford, AI adviser to outgoing prime minister Keir Starmer, echoed Hallas’ comments in a post on X.

“This would be a big mistake,” he wrote. “Right now is a critical moment for tech as an economic and national security issue. Tying up our most senior science and tech officials in a reorg wastes time and energy that’s desperately needed for the actual substance.”

Tim Flagg, CEO of trade association UKAI, took a different view, however, saying that while an overhaul of the department might cause disruption, the creation of a “super-department” could ultimately sharpen the country’s focus on AI.

“AI has the potential to transform Britain’s economy, our public services, and our security for a generation. Rethinking which department oversees this industry does not necessarily mean Burnham’s Britain is turning its back on that potential,” he said.

“It could even signal an ambition to go further: AI elevated into a super-department or placed at the very heart of the Cabinet Office. The real danger isn’t the ambition; it’s the distraction and the delay.”

All-in on AI

A recurring theme in the pushback to the proposals lies in the timing and current tech sector trends.

The UK government has placed a strong focus on supporting the UK’s burgeoning AI sector over the last two years under the premiership of Keir Starmer, with the aim of positioning the country as a leading economy on this front.

When Downing Street announced the AI Opportunities Action Plan, Starmer described the technology as the “defining opportunity of our generation”.

2025 saw a host of major global tech firms, including Nvidia and Microsoft, pledge billions in support for the UK tech sector, with a particular focus on infrastructure build-outs.

Additional hardware and skills-related investment was unveiled by Downing Street at London Tech Week last month.

FOLLOW US ON SOCIAL MEDIA

Cisco Talos has uncovered a new Russian-speaking threat actor aggressively targeting victims across the United States and Europe.

Tracked as UAT-11795, the group has been active since June last year, and uses trojanized installers for legitimate software such as MobaXterm, WebEx, Zoom, DBeaver, and FaceIT to steal credentials and cryptocurrency.

A staple of the threat actor’s activities lies in deployment of two previously undocumented tools: Starland RAT and WLDR agent. The first of these is a Python-based remote access tool, while WLDR agent is a PowerShell-based C2 memory implant.

WLDR agent runs entirely in-memory, and features encrypted beaconing, task queuing, and a Runspace execution engine for executing additional payloads.

Both are built to steal credentials, browser data, and cryptocurrency wallet assets while keeping persistent access to victim machines. The group even hides a fallback command-and-control channel in a Polygon smart contract, Cisco Talos said.

UAT-11795 targets victims' credentials and cryptocurrency wallet assets, establishing a persistent connection to the victims' machines from the C2 server, with the potential to deliver and execute further payloads.

How UAT-11795 operates

Most infections have been spotted in the US, according to Cisco Talos, although Germany, Romania, and Venezuela have also been hit.

UAT-11795 gains initial access to the victim machine through a ClickFix social engineering technique that entices the user to execute a command, which then stealthily downloads and executes a remotely hosted weaponized HTA file.

This runs an embedded VBScript that drops a Windows batch file into the user profile’s application temporary folder, containing instructions to first download and implant a trojanized installer from the attacker-controlled staging domain onto the victim machine.

Muhammad Yahya Patel, CISO and cybersecurity advisor at Huntress, said the campaign is the latest in a string of attacks by hackers using “the very tools our remote and hybrid workers rely on”.

"By hiding the Starland RAT inside trusted software and likely utilising deceptive ClickFix social engineering tactics, these threat actors are completely bypassing traditional perimeter defenses to exploit human psychology rather than software vulnerabilities."

Talos’ research also uncovered a private live Telegram channel called “stuk komanda”, controlled by the same threat actor, created last June, and with three unknown subscribers.

Exercise caution when using video conferencing tools

Gabrielle Hempel, security operations strategist at Exabeam, said while the campaign specifically targets popular video conferencing software, one needn't avoid using Zoom or WebEx.

They should, however, exercise caution. This includes making efforts to verify where software comes from, monitor for unexpected processes and persistence mechanisms.

Elsewhere, Hempel said users shouldn't assume that 'signed installer' means a program is safe.

"This story is so interesting, not because of the trojans, but because of the way it shifts how we need to think about vulnerability management," she said.

"We often measure a program’s security maturity by patch SLAs, but we’re seeing so many successful intrusions starting with users executing software they believe is legitimate and not just unpatched systems. If your security program can’t answer 'where did this binary come from?' as quickly as it can answer 'is this CVE patched?' then you are behind on your threat model."

FOLLOW US ON SOCIAL MEDIA

Microsoft has confirmed it blocked a recent Windows 11 update for select Dell PCs due to compatibility and performance issues.

The Patch Tuesday update (KB5101650) began rolling out on 14 July and included several quality improvements for users.

Microsoft halted the update after revealing a “number of Dell devices” began displaying a yellow exclamation point next to the Intel Innovation Platform Framework Processor Participant driver in Device Manager.

In a health status update, Microsoft said the issue meant users working with Intel devices could “potentially experience unexpected shutdowns, poor performance, increased heat, and battery drain”.

The issue affects Windows 11 versions 25H2 and 24H2, according to Microsoft.

What caused the pause?

The source of the issue is related to an “incompatibility between the Intel driver and the new Windows USB-C Connection Manager interface”.

The issue was first flagged in the wake of a preview update rolled out in late June (KB5095093). These previews are rolled out to enable IT administrators to familiarize themselves with upcoming patches.

Microsoft said it is working closely with Dell to “prevent the affected models from experiencing the issue”. A spokesperson for Dell echoed the tech giant’s comments on a fix.

“We are aware of an issue impacting a limited number of Windows devices with the Windows 11, version 25H2 and 24H2 (KB5101650) update,” the spokesperson said.

“Microsoft has temporarily paused the update for those devices and published guidance for impacted users, and we are working closely with them to support a resolution.”

ITPro asked Dell to confirm which specific devices were affected by the update, but the spokesperson did not reveal any further details.

An exact timeline on when users can expect a fix is also yet to be revealed by both companies, although Microsoft said it plans to release a resolution “in the next few days”.

FOLLOW US ON SOCIAL MEDIA

Google DeepMind CEO Demis Hassabis says only the United States is up to the task of keeping AI safe – but it's unclear why technology rivals, notably China, would heed an American standards body.

Hassabis has called for a framework for testing frontier models, on the grounds that he believes progress has been faster than expected and artificial general intelligence (AGI) will arrive imminently.

He argues that such work should be led by the US because of its technical and economic standing.

"This US-initiated effort would provide a strong starting point for creating shared international standards on Frontier AI," Hassabis noted in a social media post.

"Since this technology is going to affect the entire planet, ideally this framework would spur the international community to reach a consensus on how to manage the most serious risks while ensuring everyone has access to and can benefit from the opportunities that AI brings."

Hassabis' call for a US-led framework for managing AI follows similar calls by Anthropic CEO Dario Amodei and OpenAI CEO Sam Altman. Following a meeting on the subject last month, China called for a global AI organization open to all countries, rather than one led by the US.

The US has pushed for AI developers to submit models a month before release for testing, while the UK has its own testing regime via its AI Security Institute; Hassabis is British, and DeepMind was founded in London before being acquired by Google.

It's unclear why international AI companies would submit to US approval. The only motivation given by Hassabis is that frontier models would be required to pass this standards body's assessment in order to be deployed in the US.

Hassabis’ comments come after Anthropic’s Mythos and Fable models were hit with a temporary export ban by the White House amidst security concerns.

How would it work

Beyond being US-managed, Hassabis described a standards body that was federally overseen, such as a public-private partnership or self-regulatory organization, pointing to the Financial Industry Regulatory Authority (FINRA).

"The Standards Body would be responsible for developing assessment protocols and working with appropriate federal agencies and the US National Labs to conduct testing in areas relevant to national security," he said.

Anyone making a "frontier model" – as defined by a set of benchmarks – would be considered a "frontier lab", and be "encouraged" to adopt certain best practices.

This would include publishing technical details, ensuring internal security is up to standard, vetting key personnel, and adequate resourcing safety research.

Non-frontier models, such as those made by startups or academia, would not be expected to take part.

Hassabis also called for frontier labs to share new modes with the standards body 30 days before release, something the US government has pushed key developers to do with their AI models.

"Once the assessment protocol is shown to be effective and robust, formalisation could quickly follow, meaning that Frontier Models would be required to pass it to be deployed in the US market," Hassabis said. "Labs would also work with the Standards Body to address any critical post-release vulnerabilities."

Assessments conducted by the standards body would evaluate security, biological, and other threats, and check how well they withstood attempts to dodge guardrails. The tests would be regularly updated.

"The strength of this approach is it would be technically focused, while at the same time supporting innovation and incentivising responsible behaviour," he said.

FOLLOW US ON SOCIAL MEDIA

Delinea has cut the ribbon on a new global partner program designed to improve partner profitability and simplify engagement with the identity security vendor.

The Delinea Partner Advantage Program introduces a range of new incentives and operational changes, including protected discounts, published deal registration rules, AI-powered training, and streamlined quote-to-cash processes.

Developed following partner feedback gathered through a global listening survey, the initiative aims to address ongoing channel concerns around margin erosion, channel conflict, and unclear rules of engagement, while providing partners with a more structured framework geared towards long-term growth.

In an announcement, Scott Goree, Delinea’s senior vice president of channel and alliances, said the company has avoided unnecessary complexity and focused on combating the practical challenges faced by partners.

“Partners don’t care about your partner program,” he commented. “They care about technology that works, protected discounts, and a vendor that’s easy to work with. We built this program around what partners told us they actually need.”

Inside the Partner Advantage Program

California-headquartered Delinea’s identity security platform governs access for human users, machines, and AI agents across on-premises and cloud environments, continuously working to discover identities, analyze risks, and apply least privilege access controls.

The firm said its new channel program has been built around three pillars – Protect, Align, and Scale – and includes codified rules of engagement, AI-driven enablement, and greater channel autonomy to help partners drive growth through the platform.

According to the vendor, partners will benefit from published deal registration policies, teaming protections, and earned incumbency discounts designed to reward them for maintaining and expanding customer relationships.

The program also includes AI-powered training and certifications alongside a new partner portal that offers guidance throughout the sales cycle.

Elsewhere, Delinea is also providing simplified tools and automation to help reduce administrative complexity across the quote-to-cash process, allowing partners to spend more time on customer engagement.

AI adoption fuels channel opportunity

The launch of the Delinea Partner Advantage Program comes as organizations continue to adapt to identity security challenges driven by the increasing presence of AI technologies.

According to the vendor’s 2026 Identity Security Report, 92% of surveyed organizations said they expect AI to amplify identity-related threats in the coming years, while 42% said that AI expansion has already increased their non-human identity risk in the past 12 months.

Delinea said its new program will help partners tap into this growth opportunity and benefit from a new revenue stream backed by its identity security platform.

Commenting on the launch, Mark Thornberry, senior vice president of partnerships at GuidePoint Security, a Delinea partner, said the vendor’s new initiative “reflects a strong commitment” to building successful, long-term channel collaboration.

“The program provides a clear framework that supports how we work together in the market, while recognizing the value partners bring through the customer relationships we cultivate and support," he said.

Enrolment for the Partner Advantage Program is now open for selling partners, with roles for MSPs, GSIs, advisory, and technology partners to follow.

FOLLOW US ON SOCIAL MEDIA

Airbus has picked European cloud and AI firm Scaleway as its sovereign cloud provider, and plans to transfer dozens of critical applications to its cloud platform over the next two years.

The contract covers workloads requiring strong governance, resilience, and legal protection, according to the aerospace company.

These include business-critical applications across aircraft design, engineering, manufacturing, and enterprise operations.

In keeping these core systems within a European cloud environment, Airbus aims to strengthen the protection of its intellectual property and industrial data while ensuring the continuity required across its global aerospace operations.

Why Airbus chose Scaleway

The deal follows a competitive tender, with several other suppliers in the ring. They were evaluated on the basis of technical capabilities, including advanced cloud services, interoperability and scalability and AI capabilities.

Airbus also took into consideration factors such as security, resilience, service continuity, and seamless integration within its existing multi-cloud ecosystem.

The firm specifically sought legal and governance safeguards, including European jurisdiction, data protection, and protection against non-European extraterritorial legislation.

“Artificial intelligence is redefining how the world's most advanced industries design, manufacture and operate," said Damien Lucas, Scaleway CEO.

"Unlocking its full potential requires digital infrastructure that combines world-class performance with trust, openness and long-term control."

A “significant milestone” for Airbus

Scaleway will provide a sovereign cloud platform that will be fully integrated into Airbus' existing technology ecosystem.

The company said this is designed specifically to evolve alongside the company's engineering and enterprise environments, while keeping operational control and flexibility.

"This collaboration marks a significant milestone in our broader commitment to European digital sovereignty," said Catherine Jestin, executive vice president digital, at Airbus.

"By integrating a trusted, high-performance cloud environment that keeps our critical data assets shielded from foreign extraterritorial laws, we are ensuring that our digital infrastructure keeps pace with our aerospace innovation, while maintaining control and resilience of our industrial operations."

Digital sovereignty in the spotlight

The deal has been a couple of years in the making, and marks a move away from AWS as Airbus, like many organizations, sharpens their focus on digital sovereignty.

Earlier this year, the firm announced plans to deploy Mistral's AI technology across military programs and certified aviation systems.

Research published last month by Civo found that two-thirds of UK businesses were considering ditching US cloud providers, with three-quarters saying digital sovereignty was a strategic priority.

Hyperscalers have accelerated efforts to comply with growing sovereignty requirements. AWS, for example, launched its own European Sovereign Cloud which it claims provides users with a fully independent setup located entirely within the EU.

Microsoft and Google Cloud have also made similar moves over the last 18 months.

European firms are still concerned about the US Cloud Act, however, which allows the US government to request data held in overseas data centers that are owned by US firms.

Earlier this year, the European Commission announced that it had selected Scaleway, along with Post Telecom, StackIT, Proximus, and Mistral for an €180 million contract to enhance European data sovereignty.

"This project proves there are robust alternatives in Europe, able to answer the highest standards," said Octave Klaba, CEO of OVHcloud, one of Scaleway's partners.

FOLLOW US ON SOCIAL MEDIA

Living off the land (LOTL) attacks are a worst-case scenario for enterprises globally, with hackers lurking in networks, extracting sensitive data, and biding their time before wreaking havoc.

These attacks rely on weaponizing the legitimate software and tools used by enterprises, and they're by no means a new trend.

Research from Bitdefender, for example, found 84% of major cyber attacks leverage these techniques, and security teams globally have developed an array of detection capabilities aimed at combatting the threat.

But the dangers posed by these methods could escalate with the arrival of AI agents, according to Zeki Turedi, CrowdStrike's Field CTO for Europe. Speaking to ITPro, Turedi said the deep access given to agents across enterprise IT estates represents a huge threat if even just one were to be compromised or manipulated.

“Organizations are giving them [agents] full access. They're giving them full capabilities. They will have the full privilege of the human user,” he told ITPro.

Turedi pointed to previous LOTL techniques that involved compromising tools like PowerShell. While this gave users access to valuable data, the risk with agents is drastically higher given how they operate, and, crucially, where they can go within networks.

“They also have further reach across an enterprise,” he said. There’s only so much PowerShell can touch or manipulate or modify, but an agent theoretically can touch every single part of that organization's technology ecosystem and architecture.”

“This is where it makes it so much more dangerous.”

Living off the land attacks are evolving

Findings from CrowdStrike’s 2026 Global Threat Report show these risks aren’t just theoretical, they’re now a reality, and the same logic with traditional LOTL attacks is being applied to agents.

Indeed, the cybersecurity firm has observed threat actors exploiting legitimate AI tools at dozens of organizations globally. In these cases, AI systems such as chatbots and assistant were abused to generate malicious commands and steal sensitive data.

The goal here is often focused on credential theft for initial access brokers, attacks later down the line, and even cryptocurrency theft. All typical hallmarks of financially motivated cyber criminals.

LOTL attacks have also become a go-to method for highly sophisticated, state-sponsored threat actors. As ITPro reported last year, the infamous Salt Typhoon threat group laid low in compromised US National Guard networks for nearly a year, accessing sensitive military and law enforcement data.

It’s here where risks are even higher as government departments and public sector organizations begin exploring the use of agents. A recent study from McKinsey, for example, found agentic AI is emerging as a key focus area for public sector organizations in the US.

Keeping up with hype cycles

Turedi told ITPro the focus on agents isn’t surprising given that threat actors will “follow the technology landscape that their victims are looking to invest in”.

“We've seen this time and time again. So previously, we saw as cloud got adopted, funnily enough, adversaries became very capable in cloud,” he noted.

“When organizations started to be more focused and store sensitive data in SaaS applications, SaaS tools, guess what? We saw adversaries go after the SaaS applications.”

Turedi added that the pace of change within the generative and agentic AI space, combined with rapid adoption efforts, could create additional challenges moving forward.

Enterprises across a range of industries are diving headlong into the hype cycle, and threat actors are keen to capitalize on the confusion and lack of risk awareness with the technology.

“This is just a brand new technology landscape that organisations are investing in,” he commented. “And of course, the adversary is very, very aware that for multiple reasons this is a great opportunity.”

“There’s a lot of confusion,” Turedi added. “There’s a lot of lack of knowledge and expertise in this space.”

An identity conundrum

According to Turedi, a key concern surrounding ‘living of the AI land’ attacks, as CrowdStrike dubs them, is that many organizations lack the visibility or governance capabilities to adequately monitor what’s going on with these bots.

This has become a recurring talking point since the advent of agents. Research from Ping Identity in March this year specifically highlighted IT architecture visibility as a key concern for enterprises rolling out agents.

The sheer volume of agents is jarring for security teams, the study noted, but things are exacerbated by sub-agents, essentially creating chains of untraceable bots – an ideal target for stealthy threat actors.

Identity is another area of concern, Turedi noted, albeit one within a broader range of overlapping considerations for security teams. He noted that efforts to improve processes on this front are falling flat.

Many organizations are working with infrastructure or tools that were struggling to manage human identities in the first place. Adding agents into the mix further compounds the problem.

“The problem we see is that a lot of organizations are only starting to think about things like identity security or IAM (identity and access management) hygiene,” he said. “These are typically infrastructures and architectures that were not designed for modern human identity usage, never mind for the AI identity usage.”

With living off the land attacks, the whole advantage for the attacker is that they’re blending into IT environments. They’re using your tools and software and thrive on the confusion. With agents, Turedi said this adds further complexity in terms of identifying what actions are legitimate and potentially nefarious.

“It's actually quite difficult to figure out if it's AI usage on an identity layer,” he said. “Can you truly say that that's a human accessing the network versus that's an AI agent accessing the network on behalf of a human?”

A recent survey from the Cloud Security Alliance (CSA) raised similar concerns with regard to agent identity. More than two-thirds (68%) of respondents said they couldn’t accurately identify agent activity compared to human activity.

Turedi said it’s crucial to have “data from multiple different domains” when it comes to monitoring agent activity, taking into account applications, endpoints, and broader network traffic and “marrying them together” for a clearer picture.

“You need to be looking at the identity layer, you need to be looking at the endpoint, you need to be looking at the application layer,” he said.

FOLLOW US ON SOCIAL MEDIA

Anthropic’s Claude AI tool will be able fill in passwords through a new 1Password browser integration that gives it access to stored credentials, the two companies have announced.

1Password's new 1Password for Claude service is a framework that allows agents to use stored credentials hosted in 1Password vaults without them ever reaching the model.

Access is granted per session, and scoped to a specific set of approved items so that authorization doesn’t carry over to other sessions.

According to 1Password, this means users can now authorize Claude to complete real-world tasks like booking travel and managing accounts securely, with credentials injected directly to the target system on their behalf.

"We need a new security model that is purpose-built for agents, not just humans. The answer isn't handing agents your secrets. It is to let a user give an agent permission to use a credential without letting the agent see it,” said Nancy Wang, CTO of 1Password.

"Claude knows it used your login; it does not need the password or one-time code in its context. That distinction is where trust in agents starts and the foundation we're building with Anthropic."

How 1Password’s ‘zero-exposure’ framework will work

1Password's zero-exposure security framework allows per-task, user-approved access, with Claude requesting the credentials required for each task from 1Password.

Users can approve or deny access with a single biometric prompt, eliminating standing access or persistent sessions.

Credentials are injected through a secure channel managed by 1Password, outside the agent's view, with the password and the MFA one-time code never accessible to the model or Anthropic's systems.

The moment an AI agent takes control of the browser, 1Password locks down automatically, limiting access to only the credentials explicitly granted for the current task. Nothing else in the 1Password vault is reachable.

1Password brokers credential access across multiple sites within a single task, so Claude can complete multi-step workflows without prompting the user for credentials at each step.

Elsewhere, continuous field analysis will see 1Password scan the page after every autofill to ensure no secrets remain exposed: if a form submission fails, it wipes any filled values before returning control to the agent.

New ‘agentic mode’ coming to 1Password

Alongside the Claude integration, 1Password is also introducing Agentic Mode for all users.

When a compatible AI agent takes control of the browser, 1Password locks down, so that the only credentials the agent can reach are those the user has explicitly granted for the current task.

It activates automatically and runs quietly in the background, and users have the option to cancel it at any time.

1Password for Claude is now available to 1Password users on Mac, across business, family, and individual plans.

FOLLOW US ON SOCIAL MEDIA

Microsoft’s Entra ID platform will now operate solely with passkeys as it looks to shift away from SMS and voice-based authentication practices.

The changes to the identity management platform, set to come into effect on 1 September 2026, will see passkeys established as the “default authentication experience” for users.

Microsoft urged customers to move to passkeys or alternative phishing-resistant methods before the changeover.

“As the rollout reaches each organization, users enabled for SMS or voice authentication will automatically be enabled for passkeys, and the next time they perform multi-factor authentication, they’ll be prompted to register a passkey,” the company explained in a blog post.

There is a grace period, however, with voice and SMS-based authentication still being possible until 1 February 2027. After that deadline, Microsoft will retire telecom delivery for both authentication methods and no longer offer SMS and voice as a “native Microsoft Entra capability.”

For those organizations that still require SMS or voice-based authentication, there is the option to do so via the Microsoft Security Store, where administrators can find approved telecom partners to facilitate this need.

This may incur additional costs, however, with Microsoft warning: "Customers will be responsible for any associated telecom-related costs charged by the telecom partners."

Why is Microsoft moving to passkeys?

According to Microsoft, the shift to passkeys is in response to growing concerns over credential theft, phishing, and social engineering attacks.

AI, the company added, has also prompted a rethink of identity security and a move away from “phishable methods” such as voice and SMS-based authentication.

“Authentication methods that use SMS or voice rely on shared secrets or channels that attackers increasingly intercept, phish, or manipulate,” Microsoft explained.

“The case for moving beyond SMS and voice is no longer just that attackers intercept or socially engineer these methods. The threat environment has changed in speed, scale, and sophistication.”

Microsoft said its Threat Intelligence division has observed a marked rise in AI-enabled phishing campaigns in recent months, with these methods reaching click-through rates as high as 54%.

That’s a stark contrast compared to the 12% click-through rates typically observed in traditional campaigns, highlighting the potency of this new wave of attacks.

Other tactics employed by threat actors, such as SIM swapping and MFA bypass techniques, have also become “more accessible and repeatable”, Microsoft noted.

As ITPro reported earlier this year, AI-generated phishing campaigns have become a recurring concern for cybersecurity leaders.

Research from Kaseya suggested that AI phishing “became the baseline” for threat actors in 2025: 83% of phishing emails used AI in some capacity, while 40% of business email compromise (BEC) attacks also fared similarly.

Why passkeys?

Passkeys are touted as a more reliable and secure method of authentication, as they tie credentials to a specific device, such as a smartphone or laptop. This removes the need for interceptable codes.

Indeed, Microsoft noted that because they use public-key cryptography rather than “shared secrets”, this makes them phishing-resistant by design.

“They also provide a faster, simpler sign-in experience for users,” the company noted.

Microsoft isn’t alone in advising the shift to passkeys. Earlier this year, the UK’s National Cyber Security Centre (NCSC) urged enterprises and consumers alike to adopt passkeys to provide “stronger resilience” and ease-of-use.

“We strongly advise all organizations to implement passkeys wherever possible to enhance security, provide users with faster, frictionless logins and to save significant costs on SMS authentication," NCSC CTO Ollie Whitehouse said at the time.

FOLLOW US ON SOCIAL MEDIA

EU cloud trade body CISPE has taken another shot at Broadcom, but this time has the backing of other industry groups.

CIPSE (Cloud Infrastructure Services Providers in Europe) has been calling for action against changes to Broadcom's pricing structures for VMware after its 2023 acquisition.

Last year the group filed a lawsuit against the European Commission (EC) for allowing the acquisition to proceed, and in March it called for EU regulators to stop Broadcom from ending the European version of its VMware Cloud Service Provider program.

At the time, CISPE claimed the system would limit sales of VMware products to a "tiny minority of hand selected partners" and exclude most European cloud providers from being able to sell VMware products.

The latest battle with Broadcom will see CISPE joined in its demand for measures by four other cloud groups: Belgium's Beltug, France's Cigref, Germany's Voice, and the Netherland's CIO Platform Dederland.

In a joint letter seen by Reuters, the consortium urged regulators to “act swiftly and impose interim measures now," and called for the VMware Cloud Service Provider program to continue for at least three years while the existing EU investigation into Broadcom continues.

Broadcom is yet to respond to ITPro's request for comment, but a spokesperson told Reuters the company disagreed with the allegations, which didn't reflect the realities of the cloud market.

The company added that CISPE is funded by hyperscalers rather than smaller cloud service providers.

"We continue to be committed to investing significantly in our European VMware Cloud Service Provider partners (VCSPs) helping them ⁠offer ​alternatives to the hyperscalers and meet the ​evolving needs of European businesses and organisations," the spokesperson said.

Broadcom vs CISPE: A timeline

Broadcom discussed plans to buy VMware back in 2022 for $61 billion, but immediate regulatory scrutiny quickly sparked suggestions that the deal was set to collapse. In the end, the EC approved the acquisition, and saw clearance from merger authorities elsewhere.

In the wake of the deal’s closure, Broadcom sought to reassure VMware customers and partners, promising investment, innovation and simplification of products.

However, that proved to be the calm before the storm, and changes to licensing and later the partnership program alarmed many. That disruption continued with further attempts by Broadcom to tweak the VMware ecosystem.

CISPE has been an outspoken critic of both the deal and the subsequent changes implemented by Broadcom. The trade group accused the firm of "holding the sector to ransom" with the license changes.

A report by its European Cloud Competition Organisation (ECCO) – set up by CISPE to monitor a settlement with Microsoft – claimed that VMware's new contracts were costing customers as much as 1,500% more than before the acquisition

CISPE has since taken the EC to court in an attempt to force the cancellation of the deal, specifically over the licensing rules.

The EU has repeatedly defended its approval of the dea;, but as ITPro reported in December 2025, CISPE suggested this amounted to a “blank cheque to raise prices”.

In March, CISPE was back with a further antitrust complaint related to Broadcom shutting down the VMware Cloud Service Provider program, saying businesses were "irreparably damaged."

Beyond legal challenges, the changes have sparked an exodus of customers, with 86% of those surveyed saying they were planning to reduce their dependency on VMware.

Broadcom has repeatedly denied the allegations, and pointed to the membership of CISPE being made up of hyperscalers.

FOLLOW US ON SOCIAL MEDIA

Google's Mandiant has warned that exposed serverless cloud functions can give attackers access to secrets and broader cloud environments, urging enterprises to implement new hardening measures.

Serverless deployments generally run custom-developed code that incorporates third-party packages, making them targets for a wide range of application-level attacks, including local and remote file inclusion (LFI/RFI) and command injection.

Mandiant said it’s observed an uptick in the number of public-facing serverless applications that lack authentication, often because of specific business requirements.

The rapid acceleration of generative AI adoption is a big factor here, the researchers noted, with AI workflows, including chatbot interactions, image generation, vibe coding, and multi-step AI agents relying on serverless functions to complete tasks for users.

Once they've managed to exploit an entry point, attackers typically attempt to escalate privileges or move laterally.

Common techniques include extracting secrets stored directly within the application code, reviewing application logic and sensitive data to identify further attack vectors within the environment, and exfiltrating service account bearer tokens from the metadata server via remote code execution (RCE).

"Leveraging these compromised secrets or service accounts allows threat actors to pivot to adjacent systems and workloads, potentially resulting in a total environment takeover if proper hardening strategies are not in place," said Mandiant security consultant Corné de Jong.

Shoring up defenses

The firm recommends a multi-pronged approach to harden security, including integration of security scanning, code reviews, and least-privilege identity and access management (IAM) capabilities within CI/CD pipelines before deployment.

When it comes to vibe coding, Mandiant recommends multi-layered security enforcement: isolating AI experimentation within dedicated sandbox environments and enforcing strict data egress controls to protect production systems and internal data.

Meanwhile, development environments should be restricted to approved IDEs with human-in-the-loop capabilities, using only verified plugins operating under least privilege to mitigate supply chain vulnerabilities.

Organizations will then need to ensure that all AI-generated software follows Secure Software Development Lifecycle (S-SDLC) controls, while establishing clear internal guidelines regarding permitted use cases.

Keep it in-house

As for runtime controls, Mandiant said that public-facing Cloud Run services should be hosted in a dedicated, isolated Google Cloud project to make sure attackers aren't simply given immediate access to critical internal resources.

Organizations should also restrict ingress traffic for serverless functions to internal only, and use an external Layer 7 ALB to manage internet exposure.

Here, it recommended Cloud Armor, which it said provides Web Application Firewall (WAF) protections that can be integrated with the Load Balancer to filter malicious traffic.

One aspect of a broader architecture

Notably, de Jong warned that hardening Cloud Run services is “only one part of a secure architecture” and a weak link elsewhere in the chain could result in disaster.

“Because these services often connect to other Google Cloud resources, a single compromise can expose additional services. Implementing defense-in-depth is critical,” he said.

“Specifically, when using direct VPC egress or VPC Access connectors, use VPC Service Controls to restrict lateral movement and exfiltration through granular access policies."

While serverless functions are designed to make cloud development faster and more flexible, threat actors are starting to find them as just as convenient, according to Nick Tausek, lead security automation architect at Swimlane.

"An alert tied to one function may suddenly become an identity issue or a lateral movement problem. Manual handoffs slow everything down at exactly the wrong moment. Security operations need to preserve context and adapt response actions as new risks emerge," he said.

"Integration of agentic AI into security platforms can support that process by connecting signals across tools, carrying investigative context forward and helping security teams determine the next appropriate action as an incident evolves.”

FOLLOW US ON SOCIAL MEDIA

Channel partners are increasingly adapting infrastructure strategies to help customers navigate hardware pricing volatility and component shortages, according to new research from Westcon-Comstor.

The distributor found that 87% of channel partners have already taken action to reduce the impact of supply constraints on customer projects, with project delays identified as the single biggest risk created by ongoing pricing pressure and hardware availability issues.

The findings are based on a survey of more than 100 members of Westcon-Comstor’s global Tech Xpert community, comprising technical specialists and decision-makers from resellers, systems integrators, and managed service providers across EMEA and APAC.

According to the research, partners are responding to these challenges by improving infrastructure planning and adopting managed services, while some are even switching technology vendors.

“Hardware pricing volatility and supply constraints are reshaping customer buying decisions and having a profound impact on the IT channel,” commented Callum McGregor, chief operating officer and chief financial officer at Westcon-Comstor.

“In response, partners are helping customers plan earlier, adapt architectures and stay flexible so they can keep projects moving despite uncertainty.”

Adapting mitigation strategies

In terms of mitigation strategies, improved infrastructure capacity planning was found to be the most common, cited by 60% of respondents.

Meanwhile, almost a third (29%) said they had already switched vendors or platforms in response to hardware availability constraints.

Meanwhile, 27% of partners said they were using storage tiering or caching to reduce reliance on memory-intensive workloads, while a quarter (25%) reported moving workloads or infrastructure components to managed services.

Evolving buyer behavior

The research also highlighted a shift in buying behavior, with 75% of respondents reporting some form of change.

More than half (52%) said either they or their customers had accelerated hardware purchases to reduce the risk of future shortages or price increases – although almost a quarter (23%) reported delays or cancellations as organizations weighed up growing uncertainty.

The distributor revealed that hardware availability is also influencing infrastructure decision-making, with 45% of partners stating that supply chain constraints had accelerated cloud adoption among customers and 7% reporting a shift back to on-premises infrastructure.

A balancing act for partners

According to McGregor, the ability to balance immediate performance with long-term requirements is becoming “increasingly critical” in order for partners to maintain success in the current climate.

“It also demonstrates the strategic role that channel partners, supported by distribution, can play in building resilience and helping customers navigate the pressures that have quickly become a systemic feature of the market,” he added.

Elsewhere, Westcon-Comstor’s research found that 39% of partners identified technical challenges – including performance instability, operational complexity, and reduced resilience – as key risks linked to hardware shortages.

Around one-quarter (24%) also said supply constraints were limiting their ability to scale infrastructure capacity.

FOLLOW US ON SOCIAL MEDIA

The IBC event is back again for another year, with that, we’re pleased to announce that our IBC Best of Show Awards program is now open for entries.

The Amsterdam-based event, which runs from 11-14 September, is designed to recognize the most outstanding broadcast products and solutions. ITPro's Best of Show awards aim to showcase the best of the best. Entries are open now until the extended closing deadline of 23:59 CET on Friday, Aug 28. You can enter via the website here.

ITPro is joined by other key Future B2B sites - AV Technology, Installation TV Tech, TVBEurope, Radio World,, and Sound & Video Contractor - in hosting the awards program.

Nominations are reviewed by a panel of industry experts who consider the overall quality and relevance of a given product, its design and build quality, the business/operational benefits, and other key factors such as cost-effectiveness and innovation.

It's £525+VAT per entry but it really is worth entering to ensure your innovation gets the attention it deserves.

The benefits of entering are:

•  Fully-licensed nominee badges for all entries to use in both digital and print promotions.
• Dedicated editorial coverage across participating brands. Online, newsletter and social promotional activity for all winners from participating brands. 
• Winner marketing assets to further promote your success. You will receive an official award winner's badge, fully licensed to be used with your winning product both domestically and overseas at no additional cost in addition to a winner's social assets.
• Complimentary winner trophies to display your success. Winners will receive a trophy to display their success to IBC attendees.

So don't delay, make sure you enter today! Or certainly before the closing deadline of 23:59 CET on Friday, Aug 28.

AI isn't replacing cybersecurity roles but it is changing them, and not always for the better, according to new research.

A study from ISC2 found that 65% of cybersecurity professionals who use AI in their roles are spending time deciding when to trust or act on AI-generated recommendations.

Nearly two-thirds (63%) said they often find themselves reviewing and validating AI outputs. While this is basic best practice from a safety perspective, these processes are wasting valuable time.

Regardless, the influx of AI tools within the profession has been welcomed by practitioners, according to the study.

More than half (53%) believe the technology is creating new entry-level opportunities, while 48% said AI makes them feel more optimistic about their long-term career prospects.

“AI is not replacing cybersecurity professionals; it is changing what the profession requires of them,” said ISC2 CEO Scott Beale.

“As AI takes on more repetitive tasks, as well as performing some complex cybersecurity analysis at speed and scale, cybersecurity roles are shifting toward higher-value work, from asking the right questions to validating findings, interpreting outputs and applying human judgment."

Beale noted that the use of AI is changing “how work is distributed across security teams”, meaning investment in areas such as governance, skills development, and validation practices is “essential”.

Too much time fixing problems

While nearly half of cybersecurity professionals reported that AI has reduced workplace stress, 32% said it has made it worse. A key factor here lies in the aforementioned validation and reviewing practices, the study noted.

Those experiencing higher levels of stress were significantly more likely to spend longer periods deciding when to trust AI-generated outputs and recommendations.

When AI-recommended actions lead to incorrect outcomes – which nine out of ten said had happened – half of the participants said their organization holds human decision-makers ultimately accountable.

Put simply, poor AI-related outcomes have a direct impact on wellbeing for cybersecurity practitioners when it’s their neck on the line.

Confusion over accountability and ownership of AI also adds to stress, the study noted. Nearly a quarter (21%) of respondents said accountability of AI-related issues varies depending on the severity.

Over-reliance is a worry

Other top concerns cited by ISC2 included over-reliance on AI, a recurring worry not just for cyber professionals but workers across a range of industries.

As ITPro reported in May, a study from GoTo warned over-reliance on the technology could erode key skills. Similar concerns have been highlighted in software development, particularly among entry-level workers entering the workforce.

62% of respondents identified this as a key concern in the ISC2 study while 56% also highlighted worries about reduced human judgement capabilities when it comes to business-critical decisions.

Foundational cybersecurity skills remain essential, according to ISC2, especially with AI in the mix. Notably, nearly two-thirds (62%) said they don't believe the technology has reduced the need for these skills, compared with just 26% who say it has.

FOLLOW US ON SOCIAL MEDIA

A group of current and former Meta employees is suing the company, claiming that it used AI to target those on medical or family leave for layoffs.

In May, Meta announced it was cutting around 8,000 staff, representing roughly 10% of its workforce. According to the lawsuit, the tech giant used AI systems to identify those set for redundancy.

These systems allegedly took into account keystroke monitoring data, AI token usage

“Meta did not assemble the termination list through the considered judgment of managers who knew the work,” court filings state.

“Instead, Meta used a constellation of internal artificial intelligence systems — including a system referred to internally as ‘Metamate,’ employee-trained ‘second-brain’ agents, keystroke- and activity-monitoring data, AI-token-usage dashboards, and algorithmically assisted performance ranking and calibration — to score, rank and select employees for inclusion on the list.”

Complainants allege this put employees on protected medical or family leave, or those whose output was reduced by a disability, at a disadvantage by penalizing them with reduced performance scores.

"The result was that employees who took protected leaves were disproportionately selected for layoff, based on scoring that not only failed to account for their protected leaves, but in effect penalized the employees for exercising their legal rights to these leaves."

In one example, an employee was laid off while on approved pre-birth pregnancy leave – the day before her waters broke, and just two days before she gave birth.

In another, a manager’s own performance review noted that his demotion followed his return from medical leave; he was put on the list sixteen days into a second medical leave.

The 26 plaintiffs claim that Meta has violated state-protected leave laws, the Family and Medical Leave Act, the Pregnancy Discrimination Act, and the Americans with Disabilities Act.

They're calling for a preliminary court ruling that would stop Meta from finalizing the layoffs while they pursue their ​claims.

“Once these separations are final, the harms are irreversible: employer-subsidized health coverage lost during pregnancy, postpartum recovery, and active medical treatment; time-bound leave rights extinguished; unvested equity forfeited; and immigration consequences triggered,” they said.

Plaintiffs are also seeking financial compensation that could include reinstatement, back pay, lost equity, benefits, and other damages.

AI in HR is a delicate balancing act

The use of AI systems in HR and recruitment has been a long-running point of contention, particularly with regard to the potential for bias or discrimination.

Workday, for example, is facing a class-action lawsuit amidst claims its AI software discriminated against job applicants. As ITPro reported in June, the company hit back at the claims, with a spokesperson insisting its AI solutions “don’t make hiring decisions”.

Ilia Kolochenko, founder of cybersecurity company ImmuniWeb and a lawyer practising in cybersecurity and data protection, noted that over-regulation of the use of AI in HR could cause long-term harm.

"With the current trend to restrict or even entirely ban AI in HR decision-making processes, most organizations will either conceal the use of AI or shift back to non-AI systems especially in those jurisdictions that have no GDPR-like protection against automated decision-making on human subjects," he said.

"Compared to AI-powered HR systems, their non-AI homologues are quite primitive, fail to consider the relevant context and often provide incorrect metrics or data,” Kolochenko added.

“For instance, a poor performance of a delivery truck driver will not be correlated with extreme summer heat or winter snowfalls, sudden family loss or simply a technical issue with the vehicle. Eventually, innocent persons are wrongly punished.”

ITPro approached Meta for comment, but did not receive a response by time of publication.

FOLLOW US ON SOCIAL MEDIA

British companies have doubled spending on AI, but they need to also invest in the basics to ensure real results.

That's according to research from ServiceNow, which ranked the UK 51/100 in terms of overall AI maturity despite companies spending 102% more than they did in the year prior.

ServiceNow pinned that on a failure to invest in the foundations needed for AI, including data management and governance processes, and updating legacy systems.

According to a service by the company, 73% of UK executives said they were finding inadequate data accuracy, access, and management a major barrier to rolling out and using AI.

Just 20% of UK businesses had implemented testing, auditing, and risk assessment for AI, for example. Under one-fifth (17%) of businesses surveyed in the UK had also replaced legacy systems with integrated platforms.

"UK organizations are investing heavily in AI, which tells us the challenge is not ambition," said Damian Stirrett, Group Vice President and General Manager for UK and Ireland at ServiceNow.

"It is connecting that commitment to the operational infrastructure that makes AI work across the enterprise."

The ServiceNow results follow similar research from Cisco earlier this year that found nearly all companies are expanding privacy and governance work in response to AI adoption.

Not ready for AI

While two-thirds of UK companies polled had used agentic AI, just 6% did so to create autonomous workflows, highlighting a lack of maturity in AI roll-outs.

That was echoed by findings showing that 15% of UK organizations have streamlined or integrated workflows using AI, which ServiceNow said showed a gap between AI investment and operational readiness

"Too many businesses are bolting AI onto fragmented systems, disconnected assistants and workflows that have not yet been reimagined," said Stirrett. "The next phase is about moving from isolated pilots to trusted, end-to-end workflows that can deliver at scale."

ServiceNow said improvements will require getting the right data, governance, and workflow foundations in place to scale AI.

You can't spend your way out of trouble

Despite the challenges, UK spending is largely on par with that across EMEA, which saw AI budgets leap by 113% over the last year. By 2027, AI spend will make up 20% of IT budgets, ServiceNow predicted.

However, the company noted that organizations that are succeeding with AI aren't necessarily spending more, pointing to 21% that are seeing strong returns.

Instead, they have the "most mature governance", including data management and risk controls, and that's helping to deliver a 164% return on investment now. The company predicts this could climb to a 199% return on investment within two years.

Governance, the company argued, doesn't slow innovation but is "operating discipline" that enables it, in particular when it comes to scaling quickly and ensuring systems are trusted and auditable.

That echoes comments earlier this year from Tenable co-CEO Stephen Vintz, who said enterprises need to consider the "responsibility gap" with regard to AI governance.

Speaking at RSAC Conference 2026, Vintz pointed to the fact that 90% of organizations had adopted AI and half have already had a related cyber incident.

"There is a fundamental mismatch between the exponential speed of AI adoption and the linear speed of traditional corporate governance, and things will only move faster and things will only become more complex," he said at the time

FOLLOW US ON SOCIAL MEDIA

IBM shares plummeted by more than 25% on Tuesday after the tech giant posted underwhelming preliminary second-quarter results.

In a profit warning released ahead of the company’s expected earnings call on 22 July, CEO Arvind Krishna attributed sluggish performance to the ongoing memory crisis and AI-related cybersecurity concerns.

Revenue for the quarter ending June came in at $17.2 Billion, marking just a 1% year-over-year increase and well below expectations. Notably, infrastructure revenue dipped by 7% across the quarter.

In a statement detailing the results, Krishna suggested the company had “faltered” and been taken unaware by rapidly changing enterprise spending habits.

Put simply, customers have shifted their focus away from software spending toward infrastructure investments ahead of expected price increases.

AI infrastructure build-outs have sent hardware prices skyrocketing in recent months, with enterprises scrambling to secure servers, chips, and storage components.

“In the last few weeks of June, we saw clients shift their quarterly capex spend toward servers, storage, and memory purchases to secure supply-constrained infrastructure ahead of expected price increases,” he wrote.

“While we anticipated some supply chain-related impact in our expectations, we did not anticipate the magnitude of the capex reprioritization.”

Krishna’s warning spooked investors, sparking yet another sell-off in the software market. Shares at Microsoft, Salesforce, and ServiceNow all dipped in the wake of the announcement.

Software investors have been through the wringer so far in 2026, largely due to concerns about a looming ‘SaaSpocalypse’ due to recent advances in AI.

As ITPro reported in February, Anthropic sparked a mass sell-off after the release of its Claude Cowork tool, with investors worried the solution could render some software services obsolete.

Chris Beauchamp, chief market analyst at IG, described the results as an “ugly moment for IBM and software stocks”.

“The big question will be how long the shift to infrastructure and cybersecurity lasts,” he said. “A few more months might be bearable, but more than that and serious questions will be asked all over again about software stocks.”

IBM falling flat

IBM’s infrastructure earnings are a clear sign of the ongoing rush and changing priorities for enterprise customers.

Krishna noted that many customers were scrambling to get ahead of further price increases, which impacted its higher-margin mainframe and associated software offerings.

In April, IBM unveiled its new z17 mainframe, hailing it as the “first mainframe fully engineered for the AI age”. General availability for z17 landed in mid-June, and as ITPro recently reported, the firm also plans to roll out compact versions in August.

While the z17 launch was met with much fanfare, Krishna noted results were “worse than our expectations”.

“These conditions require our teams to execute perfectly, and this quarter we faltered,” Krishna wrote. “We did not adapt and move quickly enough, and numerous large deals failed to close on the timelines we expected, driving the majority of our shortfall.”

“These are not excuses, but they are realities. Our job is to help our clients through uncertainty, to find paths forward to grow their businesses no matter what is happening in the external environment.”

Silver linings for cybersecurity vendors

While hardware price issues dominated the enterprise focus, Krishna also noted clients were “distracted” by AI-related cybersecurity concerns in recent months.

The IBM chief said the launch of powerful new models such as Anthropic’s Claude Mythos, for example, has sparked widespread concerns among cybersecurity experts.

IBM has moved quickly to compensate for these changes, according to Krishna. The company recently launched a new security initiative, Project Lightwell, aimed at driving AI-powered software security supply chain improvements.

As with hardware-related concerns, rapid changes in the cybersecurity landscape have also prompted a rethink on spending, Krishna told CNBC.

“Mythos is making people pause to say, wait, how much do I need to spend on cyber? They’re pausing on new deals until they know,” Krishna commented.

These comments sparked a rally in cybersecurity stocks, with CrowdStrike, Zscaler, Palo Alto Networks, and Okta all recording significant boosts.

CrowdStrike, for example, surged 12% while Palo Alto Networks and Zscaler stocks rallied at around 7% respectively.

FOLLOW US ON SOCIAL MEDIA

European small and medium-sized businesses (SMBs) are bullish on generative AI, according to new research from SAS and IDC, and some are setting an example in how to nail adoption.

Analysis conducted by IDC on behalf of the data management firm shows SMBs across the region are executing AI deployments in a far more efficient manner to global counterparts.

In North America, for example, SMBs scored strongest in terms of planning and building, but many aren’t reaching full deployment.

This contrast suggests European organizations are making “stronger progress in operationalizing AI and embedding it into day-to-day operations”.

A key factor in European SMB successes lies in readiness, according to the report. IT leaders across the region are prioritizing areas such as governance before diving head long into adoption projects.

“Organizations treating governance as a foundation rather than an obstacle are often the ones best positioned to execute,” said John Carey, Senior Vice President of Global Channels at SAS.

“The findings suggest European SMBs are taking a more operational approach to AI adoption – focusing not just on experimentation, but on putting the right structures in place to scale AI effectively.”

Notably, Carey suggested that “stronger execution performance” among European SMBs may be due to regulatory considerations such as the EU AI Act.

Simply put, IT leaders at small businesses across the region are accelerating preparation to ensure compliance with the legislation.

It’s perhaps no surprise then that governance, risk, and compliance for AI has emerged as the top priority for SMB leaders, cited by 26%.

Progress on this front is easier said than done, however. The study noted that uncertainty is rife with regard to compliance, risk management, and security.

Nearly one-quarter (24%) identified this as their biggest execution barrier with AI adoption.

Still a long way to go

Despite positive signs for European SMBs, on a global scale the pace of AI adoption is still slow. SAS noted that many are “still struggling to move from experimentation to meaningful business impact”.

Nearly three-quarters (70%) of SMBs worldwide either remain in ‘experimental’ or ‘opportunistic’ stages of AI maturity, for example. Similarly, only 9% have fully embedded AI into daily operations or decision making.

Slow progress in AI maturity is, at least in part, due to traditional data-related problems such as silos and visibility. Nearly half (45%) of SMB leaders said their data remains “scattered across systems with no clear ownership”.

A similar number (46%) said AI tools are often still used in isolated environments across the business, preventing teams from aligning workflows.

Notably, 90% of those in experimental phases report having no formal AI strategy in place, which is impeding progress for IT leaders.

“To actually make something of their AI strategy, SMBs need to move from disconnected pilots to true alignments of their data, people, and resources,” said Daniel-Zoe Jimenez, VP of research at IDC.

“Experimenting with the technology is one thing. Deploying it strategically and sustainably is quite another.”

FOLLOW US ON SOCIAL MEDIA

Pure Data Centres Group has announced plans to invest more than €7.5 Billion to build a sprawling data center campus in Finland.

The deal represents one of the largest ever inward investment projects in Finnish history, and will see an initial pledge of €1.5 billion to develop a 110MW AI campus in Seinäjoki.

Long-term, Pure DC said the site will eventually scale to a 500MW campus capable of hosting high-performance computing (HPC) and AI workloads.

Phase one of the project is already fully leased, the company revealed, with the substation for the first data hall constructed and live.

Gary Wojtaszek, Executive Chairman & Interim CEO of Pure DC, said the project marks the beginning of one of Europe’s largest-ever AI infrastructure projects and will help put Finland at the forefront of the region’s AI transition.

“Countries building AI infrastructure over the next decade will shape the global economy for the next fifty years. Finland has all the ingredients required to lead this transformation - world class engineering talent, abundant renewable energy and a culture of innovation that gave rise to Nokia”, Wojtaszek said.

“We are not building data centers in Seinäjoki. Together with our partners, including the Seinäjoki Municipality, we are helping create one of Europe’s most important AI ecosystems capable of supporting global tech leaders as well as the next generation of Finnish entrepreneurs and innovators.”

Pure DC will work closely with local partner, SDC Ventures, as part of the development, which is expected to provide over 3,000 jobs during the decade-long construction projects.

Inside the Seinäjoki data center campus

Designated SJK01, the Seinäjoki campus is a sprawling 370 acre estate that, upon completion, will support 550MW of IT capacity. Pure DC said the data center site is designed specifically for “mass-scale” AI and machine learning workloads.

The site also has access to 700MVA of renewable power, meaning it will operate with “exceptionally low” energy costs and a stable grid connection.

Notably, the development will use repeatable 40MW ‘AI-ready’ modules, which come equipped with built-in Direct Liquid Cooling (DLC) capabilities to support high-density workloads.

The data halls located at the site are also based on a modular design aimed at streamlining efficiency and predictability. Jaakko Kiiskilä, Mayor of Seinäjoki Municipality, said waste heat from the data center will be repurposed to support the district’s heating network.

“It’s fantastic to see a British-headquartered firm thrive on the world stage by delivering the UK's largest inward investment into Finland, cementing our position as a world leader in the AI space,” said Peter Kyle, secretary of state for the UK’s Department of Business & Trade.

“Through our Modern Industrial Strategy, we're ensuring the UK remains a leader in AI, setting ourselves apart globally while making sure our trillion-dollar tech sector continues to thrive for decades to come.”

FOLLOW US ON SOCIAL MEDIA

Databricks has announced the appointment of Lee Stockwell as head of public sector for the UK and Ireland, as the data and AI specialist looks to accelerate adoption of AI and advanced analytics across government organizations.

Stockwell will lead the company’s public sector strategy across the region, working with government departments and public sector bodies to modernize data platforms, expand the use of advanced analytics, and scale AI to improve service delivery.

He brings more than 20 years’ experience across enterprise technology and the public sector, most recently serving as head of the National Security and Public Safety division at ServiceNow.

Prior to that, Stockwell spent more than eight years at the UK Home Office, where he led its Live Services and Shared Services division.

In an announcement, Databricks said the appointment highlights its continued investment in the region as public sector organizations increasingly look to AI to strengthen resilience, operational efficiency, and productivity.

“Lee’s experience at the intersection of technology and the public sector will be critical as we increase our support to meet the growing needs of organizations across the UK and Ireland,” explained Samuel Bonamigo, Databricks’ senior vice president and general manager for EMEA.

“Government agencies are under real pressure to deliver tangible outcomes from their data and AI investments, and Lee brings the expertise and experience to help organizations advance these priorities.”

Databricks provides a unified data and AI platform that enables customers to consolidate data, develop analytics workloads, as well as build and scale AI applications from a single environment. According to the vendor, the platform now serves more than 20,000 organizations worldwide.

In his new role, Stockwell will work to deepen partnerships with government agencies and public sector organizations in the UK and Ireland – including the Department for Environment, Food and Rural Affairs (DEFRA), Department for Education (DfE), and VisitBritain – to improve service delivery and increase productivity.

Commenting on his appointment, Stockwell said strong data foundations will be essential if government organizations are to scale AI successfully.

“I’m proud to join Databricks at such a pivotal moment for public sector organisations across the UK and Ireland,” he said. “Government departments can only accelerate their AI strategies if they have the right data foundations in place.

“Databricks enables public sector organizations to unify their data, govern AI, and build and deploy agents at scale.“

FOLLOW US ON SOCIAL MEDIA

Companies using AI should be wary about losing control of their data – and the risk of AI developers making use of that knowledge.

That’s according to Microsoft CEO Satya Nadella, who in a recent blog post warned many AI users are "paying twice" thanks to what he calls the "reverse information paradox”.

This is a process through which AI providers, particularly frontier labs, get access to proprietary data about their own customers. Nadella said the trend represents a huge risk for enterprises, and called for protections akin to patents.

The critique is intriguing as Microsoft itself is an AI company, offering plenty of AI-driven products to customers and cramming AI features into its software. Beyond that, Microsoft was an early funder of OpenAI, though that relationship has weakened of late.

Nadella pointed to economist Kenneth Arrow's information paradox, in which the seller of data or knowledge risks giving it away in order to prove it's worth selling. He noted that AI has created the reverse problem, in which the buyer gives away knowledge in order to use the product purchased.

"You essentially pay for intelligence twice, once with money, and again with something even more valuable: the proprietary knowledge you must reveal to make that intelligence useful," he noted. "The better you want the model to perform, the more of that knowledge you have to feed it!"

"Over time, the information asymmetry becomes increasingly skewed. The seller learns more and more about you as you use what you purchased, while you learn very little about what the seller is learning in return."

The ‘AI exhaust’

This concern isn't just about uploading corporate data to systems, or accidentally including proprietary data in a prompt, though those are both concerns. Instead, Nadella said every interaction with AI inherently includes information that could be useful.

"Models learn from 'exhaust,' the prompts people write, the tools agents use, and especially the corrections people make when the model is wrong," he wrote.

"Every correction is distilled into institutional know-how. It’s the kind of knowledge a competitor could never buy, and the kind that leaks almost imperceptibly: trace by trace, correction by correction, eval by eval."

Ironically, Nadella said it was necessary for the "great innovation" of allowing model developers to use public data – some of them face lawsuits for hoovering up copyrighted data to train their systems.

When it comes to business data, providers should share anything learned with customers. Very few actually do this, however.

"If learning flows in only one direction, economic value converges toward the owners of the learning infrastructure rather than the creators of the knowledge itself," he said. "Therefore, it’s imperative that we distribute the learning infrastructure to every firm so that they can control their own learning loop."

Nadella's tips on how to protect your company from AI

Nadella said the existing setup requires a protection system on par with patents, but also advised companies to set a "trust boundary" by considering a few key aspects – some of which may be easier by simply switching to open source AI.

He suggested companies should control their own "evals", or evaluations of the AI system, because that reveals what looks "good" to the organization, and keep ownership of decisions, feedbacks, and other outputs for their own use.

Beyond that, companies should build capability with AI via their own learning environments where models can learn using real workflows without exposing corporate data.

Improving choice can be achieved by decoupling the orchestration layer from any single model, enabling the ability to switch to another model if one is withdrawn. This can also help organizations cut costs by choosing the right model based on their individual needs.

Lastly, he said to "compound" those four ideas to "create your own continuous learning loop".

"In other words, a company should be able to use a model without giving up the knowledge that makes it unique," he added.

FOLLOW US ON SOCIAL MEDIA

Intel has announced a €5 billion investment to expand its Leixlip campus in Ireland, with plans to scale capacity to deliver Intel Xeon 6 and next-gen Intel Xeon chips built on its Intel 3 node.

Using existing capacity across cleanroom space, the company said the investment will see it expand current production output and advance research and development activities.

As part of the move, the chipmaker will upgrade existing fabrication facilities and install new manufacturing equipment.

Key infrastructure enhancements, including an expansion of the automated track system, aim to integrate disparate campus modules into a single, high-velocity production environment.

“This €5 billion investment represents a definitive commitment to maximize capacity at our Leixlip campus and increase what we can deliver to Intel Foundry customers," said Naga Chandrasekaran, executive vice president, chief technology and operations officer and general manager of Intel Foundry.

“By investing in our existing fabs with state-of-the-art technology and installing cutting-edge tools, we are not just increasing output of critical products like Xeon 6 and next gen Intel Xeon processors built on Intel 3, we are ensuring that Ireland remains at the forefront of the world’s most advanced manufacturing ecosystems, while strengthening the region’s role in the global technology landscape.”

Work has already started, according to Intel, and the company expects it to deliver jobs for specialized tradespeople, including construction workers and equipment installers.

Full-time tech-focused jobs at the chipmaker will also be delivered as part of the expansion scheme.

“Intel’s latest multi-billion-euro investment in Leixlip is a powerful vote of confidence in Ireland, our skills base and our position at the heart of Europe’s most advanced manufacturing ecosystem," said An Taoiseach Micheál Martin.

"At a time of rapid technological change and global competition, this expansion strengthens Ireland’s role in securing resilient semiconductor supply chains and reinforces our ambition to remain a global leader in innovation, productivity and sustainable economic growth.”

Intel builds on deep Ireland ties

Intel has been active in Ireland since 1989, and has invested more than €30 billion in the Leixlip campus, which opened in 2023, in that time.

In 2024, the company sold 49% of the plant to US private equity firm Apollo, but bought it back earlier this year at a higher price. Last August, the US government took a 10% share in Intel at a point when it was valued at less than a fifth of its current market capitalization.

With the EU’s Chips Act aiming to reduce reliance on foreign supplies of chips, Intel said the investment will strengthen Europe’s semiconductor supply chain and support the EU's tech sovereignty ambitions.

“Intel is one of Ireland’s longest standing and most strategically important investors," said Michael Lohan, CEO of Ireland's Industrial Development Authority (IDA).

"This project demonstrates the value of Ireland’s skilled workforce, innovation ecosystem and stable business environment, while reinforcing Ireland's leadership in advanced semiconductor manufacturing, supporting both European competitiveness and resilient global supply chains.”

FOLLOW US ON SOCIAL MEDIA

Supermarket chain Lidl has urged customers to remain vigilant after a data breach exposed personal information.

In an advisory, the firm revealed the ‘IT incident’ at a third-party service provider has impacted customers in Belgium, Germany, and the Netherlands.

"We were notified of this incident earlier this week," the message reads.

"Despite high IT security standards, unauthorized parties briefly gained access to a separately stored file containing customer data, and some of that data was stolen. The online shop system itself was not affected."

The stolen data relates to customers of Lidl's online shop, and includes first and last names, telephone numbers, email addresses, dates of birth, and customer numbers.

Lidl noted that data exposed in the incident does not include passwords, billing and delivery addresses, bank details, or other payment information.

Lidl warns customers over phishing risks

The company said that while it currently has no concrete evidence this data has been misused, customers should remain vigilant for potential phishing attacks or identity theft.

Customers should be wary of unexpected messages, always verify the authenticity of the sender, and avoid providing any information or clicking on unknown links.

Boris Cipot, principal security engineer at Black Duck, said the incident is a “textbook reminder” of the risks posed by third-party vendors.

"Even when a retailer's own systems hold, a compromised service provider can expose millions of customers to identity fraud, phishing, and account takeover attacks," Cipot commented.

"Personal data like names, birthdates, phone numbers, and email addresses may seem low-risk in isolation, but combined they become a powerful toolkit for social engineering. Additionally, the downstream costs to consumers and brand trust can far outlast the incident itself."

Lidl vendor acted swiftly

Lidl said its IT service provider responded immediately to fully restore the security of the affected IT systems, filed a report with the authorities and immediately engaged IT forensic experts to investigate the incident.

The company has also notified the relevant data protection authorities. Cipot commended the supermarket chain for its swift response and up-front communication with affected customers.

"Lidl deserves credit for moving quickly to notify customers and being transparent about what they don't yet know, including the possibility that passwords, addresses, and payment data could be involved. That kind of candor presents the appropriate posture under GDPR," he said.

"The real test now is follow-through: how quickly they complete the forensic investigation, how clearly they communicate updates as the scope becomes known, and how rigorously they reassess the security requirements they place on their service providers going forward."

Lidl, which operates around 12,900 stores across 32 countries in Europe and the US, is just the latest retailer to be hit by a supply chain breach.

In the last year or so, victims have included Marks and Spencer, Co-op, Louis Vuitton, Pandora, and Harrods. Many of these attacks have been linked to the Scattered Spider hacking group.

FOLLOW US ON SOCIAL MEDIA

With AI tools now commonplace in software engineering, nearly two-thirds (60%) of organizations are expected to shrink team sizes by 2029. But that doesn’t necessarily spell bad news for engineers, according to Gartner.

Analysis by the advisory firm suggests the shift toward smaller engineering teams won’t be a cost-cutting exercise, but rather a natural evolution toward more agile, specialized units focusing on specific areas.

Gartner envisages these smaller teams being composed of specialist product managers alongside user experience (UX) - or agent experience (AX) designers, and at least one ‘AI-native’ engineer.

Speaking to ITPro, Gartner principal analyst Aliyah Camacho, said this influx of AI has prompted a rethink of how enterprises can “really make the most of AI and humans working together”.

“What we’re seeing is that organizations are looking at engineers as AI orchestrators,” Camacho told ITPro.

“One aspect of tiny teams is that we’re thinking of them as focused on a product or a set of features for a product, so it’s bringing together more of that product management skills and expertise onto the team.”

The concept of engineers moving toward more of an orchestration-style role has become a recurring talking point over the last 18 months. AWS CTO Werner Vogels told ITPro earlier this year that the traditional image of developers as “code monkeys” is fading.

With AI in the mix, developers and engineers can now focus on other tasks, such as quality assurance and testing, Vogels said at the time.

Gartner’s research echoed this, noting that with the technology handling routine technical tasks, this will ultimately free up engineers to focus on “complex problem-solving and innovation”.

With tiny teams, Camacho said this will essentially remove a layer of friction for engineers. Simply put, the AI does the grunt work, while engineers have time to focus on product development and refining existing software.

These teams will also have their own remit similar to product development teams, meaning they’re staying in their own lane and not getting dragged into other areas.

“What we're predicting to be speed or velocity-type gains with tiny teams is that these small teams are fully accountable for the success of their product or feature,” she explained.

“So removing that layer of having additional approvals and coordination is one type of speed gain,” Camacho added. “Then another is having fewer people on the team means that there's less time spent in that communication and handoff type of activity.”

How tiny are we talking?

Naturally, what constitutes a ‘tiny team’ will vary wildly based on the size of the enterprise. Small teams today, also known as ‘two-pizza teams’, typically have between five and eight people, Camacho said.

Generally speaking, the shift to tiny teams could take this down to five or six. Some, on the other hand, could end up with just two or three, Camacho noted.

“This really varies,” she said. “Some are curious about experimenting with teams of three, and then for others a meaningful reduction in size is down to six.”

Ultimately, these changes will be made on an enterprise-by-enterprise basis, but leaders should be wary of downsizing down too much. These teams should be small enough that they’re agile but also remain effective and have enough diversity of ideas.

Not a cost-cutting exercise

Given that the last two years have seen repeated warnings about AI rendering developers obsolete, some might see a shift to smaller teams and figure this is another excuse to offload staff.

Camacho insisted that this isn’t a cost-cutting exercise, however. Teams will be smaller, but the consultancy predicts there will eventually be more of these tiny units working away in the background building software.

This is where communication from leadership will be vital in fostering change, Camacho noted.

“I think that a huge piece of making this kind of change is communicating really clearly about what it is and is not, and the tiny teams model is not a cost optimization tactic,” she said.

“Rather, it’s a restructuring of teams to best take advantage of AI and human expertise. What we’re seeing with this idea is that team size reduces, but the number of teams may actually stay the same, or may increase, because we’re expecting more demand for complex engineering solutions at organizations.”

Room for juniors

Maintaining robust talent pipelines will also be a key focus with the shift to tiny teams, according to Gartner. If anything, junior engineers will be more crucial than ever to compensate for general attrition and to provide AI-native skills.

The impact of AI on entry-level jobs has been a recurring talking point over the last 18 months, with the need for junior engineers questioned by some industry stakeholders.

This is where the ‘how small is too small’ question comes into play, according to Camacho.

“We absolutely believe that organisations need to continue hiring junior talent to build that pipeline for the future,” she said.

“So the way that fits with tiny teams in this context is reducing team size, but not making it too small because if the team size shrinks too much, that can pose risks.”

Long-term, the solution to developing junior talent could lie in apprenticeship-style models, she added, noting that this “could fit really well with the tiny teams model”.

FOLLOW US ON SOCIAL MEDIA

Jitterbit has announced the appointment of Chris Stoddard as its new chief revenue officer (CRO), as the intelligent automation vendor looks to drive fresh growth and scale adoption of its AI-driven Harmony platform.

Stoddard will lead the company’s global go-to-market organization, with responsibility for international sales and revenue generation across the business.

A seasoned leadership veteran, he brings more than a decade’s experience across data analytics, enterprise IT infrastructure, and cyber security.

He joins Jitterbit from observability specialist New Relic, where he most recently served as senior vice president for the Americas, and has previously held senior sales leadership roles at Qlik, Pulse Secure, and Juniper Networks.

The appointment follows the recent launch of Jitterbit’s Model Context Protocol (MCP) gateway, which is designed to standardize how AI agents securely connect to enterprise applications, systems, and data sources.

In an announcement, Jitterbit CEO Bill Conner said the company is “at a pivotal moment” as organizations are increasingly prioritizing accountable AI and secure enterprise integration.

“Chris joins Jitterbit during a period of massive expansion, bringing an exceptional track record in data migration, infrastructure and enterprise security that directly aligns with our core mission,” he explained.

“His leadership will be instrumental as we scale our unified Harmony platform to defeat shadow AI, bridge the enterprise data divide, and securely deliver automation, integration and agentic workflows organizations can trust."

California-based Jitterbit provides AI-driven automation that enables organizations to integrate applications, data, and business processes while building and managing AI-powered workflows.

Its Harmony platform is designed to simplify integration while providing centralized governance across increasingly complex modern IT environments.

Harmony combines integration platform as a service (IPaaS), API management, application development, electronic data interchange (EDI), and model context protocol capabilities into a single, unified platform.

According to the vendor, the offering provides organizations with greater visibility and control over AI-driven automation while reducing reliance on disconnected point solutions.

Commenting on his appointment, Stoddard said he believes Jitterbit is “perfectly positioned” as the growing adoption of autonomous AI agents drives demand for secure, enterprise-grade integration capabilities.

“Businesses are undergoing a massive paradigm shift, and the market is realizing that autonomous AI agents cannot succeed without robust, secure, and context-aware integration underpinning them,” he explained.

“I am thrilled to partner with our talented global teams to help organizations accelerate data transformation by unifying accountable AI agents, apps, and automation.”

Jitterbit also announced that Luca Taglioretti will focus on expanding its regional growth strategy in his role as vice president of sales for EMEA and APAC.

FOLLOW US ON SOCIAL MEDIA

Global cyber attacks rose over 10% in June, according to new research from Check Point, with one particular group accounting for a growing portion.

The uptick in attacks comes in the wake of what the cybersecurity firm described as a period of “relative calm” in May.

Attack volumes increase broadly across all regions and sectors at once, the company noted, suggesting attackers are expanding activities across a wider set of targets.

“June’s data shows a broad rebound in cyber activity, not a single isolated spike,” said Mark Mitchell, security engineer at Check Point Software.

“Attackers are widening their reach across regions and industries, while ransomware groups continue to reorganize and scale."

Notably, Check Point’s analysis highlighted increased activity by The Gentlemen, a new ransomware operator on the scene. The group overtook Qilin as the most active ransomware group globally, accounting for 17% of published attacks.

LockBit activity also increased, rising from 1% of published attacks in May to 7% in June, making it the third most prevalent group.

"The rise of The Gentlemen to the top of the ransomware leaderboard is a clear reminder that new operators can rapidly become major global threats," Mitchell warned.

As ITPro previously reported, The Gentlemen have quickly grown to become one of the most aggressive ransomware groups worldwide.

Observations of the group’s activities by NTT revealed it uses advanced tooling and proxy infrastructure to accelerate attacks, often operating stealthily within compromised networks before causing havoc.

NTT researchers said the group also shows a level of technical maturity that would typically be associated with more established cyber crime groups. This could suggest it consists of highly experienced threat actors with deep ties to other groups within the cyber crime ecosystem.

Key industries in the crosshairs

Education remained the most targeted sector globally, with organizations facing an average of 4,816 weekly attacks - 16% up on June 2025.

They're a comparatively easy target, said Check Point, thanks to open campus networks, constant device turnover, and constrained security resources.

Government was the second-most targeted sector, with 2,836 weekly attacks, up 5% year on year, while telecommunications ranked third with 2,835 weekly attacks, a 13% increase.

Latin America attacks ramp up

Attacks against organizations in Latin America are ramping up significantly, according to Check Point.

Organizations across the region are now contending with an average of 3,501 weekly attacks, a 27% rise since June 2025.

APAC followed at 3,060 weekly attacks, up 5%, while Africa was third with 3,008 attacks per week, although this was down 9% year on year.

Europe and North America also saw sharp increases, at 22% and 14% respectively.

AI is creating new risks

Generative AI continues to cause problems, with one in every 26 prompts submitted from enterprise networks carrying a high risk of sensitive data leakage, making for a global exposure rate of 3.9%.

High-risk prompt activity affected 85% of organizations that regularly use generative AI tools, while a further 27% of prompts contained potentially sensitive information.

This issue was most prevalent in Latin America, where 5.2% of prompts carried a high risk of sensitive data leakage, while Europe matched the global average at 3.9%.

In terms of broader AI-related risks, healthcare and medical carried the highest exposure at 5.7%, followed by telecommunications and business services at 5.1% each, and IT at 4.1%.

Personal data was accessed at 80% of affected organizations, with network and infrastructure details, legal and regulatory material, financial data, and employee records also widely exposed.

FOLLOW US ON SOCIAL MEDIA