Cloud infrastructure spending reached an eight-year high in the second quarter of 2026, according to Synergy Research Group, with AI investment spurring record-breaking growth.

Figures published by the research firm show cloud infrastructure services spending surged by $43 billion across the period, reaching $143 billion in total and marking an 11th successive quarter of growth.

Synergy noted that the market has doubled in size across that period, with generative AI acting as the “primary driver” behind rampant infrastructure spending.

John Dinsdale, chief analyst at Synergy Research Group, described the recent quarterly growth - and that over the last 11 quarters - as “quite remarkable”.

“AI technology has lit a fire under the cloud market and is now driving unprecedented growth. GenAI-specific cloud services are growing at 165% year over year, but equally importantly, AI technology is enabling enhanced functionality and increased growth across a much broader range of cloud services,” he said.

“It is also interesting to note that in the last two quarters, the US share of the worldwide market has increased, reflecting the huge buildout of US infrastructure by both hyperscale cloud operators and neoclouds.”

Hyperscaler spending spree continues

According to Synergy, Amazon Web Services (AWS) still retains a “strong lead” in the market among the major cloud providers, boasting a 28% share of the global market.

Microsoft and Google Cloud, meanwhile, hold a 20% and 15% share respectively. The firm noted, however, that both hyperscalers continue to achieve “substantially higher growth rates” compared to AWS.

AWS’ market dominance has been waning in recent years, largely due to Microsoft and other providers muscling in on their share.

As ITPro reported in August 2025, Gartner placed AWS’ market share at around 37%, but this marked a 2% decrease compared to the year prior.

Among tier-two cloud providers, CoreWeave, Oracle, and Nscale all recorded notable growth rates.

Crucially, Synergy found that nine neocloud companies now rank among the top 40 cloud providers globally, underlining significant gains made by up-and-coming firms in this space.

Bullish global growth

Cloud infrastructure spending shows impressive growth on a global scale, according to Synergy, with the market continuing to “grow strongly in all regions”.

Among countries with the strongest growth rates, India, Ireland, Indonesia and Thailand all stand out, recording growth rates “well above” the worldwide average.

The US remains the largest cloud market by a wide margin, with its scale far surpassing that of the entire APAC region,” Synergy noted.

“The US market grew by 49% in Q2, which was well above the worldwide average. In Europe, the largest cloud markets are the UK and Germany, but the fastest-growing markets were Ireland, Norway, Denmark, and Finland.”

Figures published by Synergy come hot on the heels of similar projections from Gartner last week. As ITPro reported, the analyst firm revised its global IT spending forecast due to an unexpected surge in AI-related infrastructure spending.

Gartner predicts global IT spending will hit $6.37 trillion across 2026, marking a 14.2% increase compared to last year.

The firm’s revised projections reflected “increased confidence in overall market expansion” - particularly in areas benefiting from AI adoption such as IaaS and data centers.

FOLLOW US ON SOCIAL MEDIA

Even if data center compute demand falls short of current projections, it still won't be easy for power suppliers to keep up, according to analysis from McKinsey.

With AI infrastructure projects continuing at a rapid pace, the consultancy anticipates that around 75% of power demand growth across the US in the next decade will come from data centers.

Based on current expansion rates, this will require the "equivalent of almost 30 GW of power per year”.

"Whether that growth materializes depends on whether demand for AI compute will last. Several indicators suggest that it will,” the consultancy noted.

In the short term, McKinsey a shortfall is likely in the US. But future demand is hard to predict, with parts of the AI ecosystem exhibiting bubble-like characteristics.

More than half of 2025's new unicorns are AI-focused, including several multibillion-dollar firms without commercialized products. Meanwhile, some AI-native players and infrastructure intermediaries are pursuing aggressive expansion, despite high leverage or negative cash flow.

Broader macroeconomic and geopolitical factors such as tighter capital markets, elevated power prices, or supply chain disruptions could also dampen demand and slow the pace of data center build-outs.

Concerns over compute capacity and infrastructure run counter to current trends in the industry, McKinsey noted, particularly in terms of concrete use-cases. Most organizations deploying AI are reporting good results, the consultancy noted, and there’s no sign of an imminent technological plateau when it comes to LLMs.

"Investments are increasingly tied to contracted capacity utilization and concentrated among scaled, investment-grade data center operators — factors that point to durable, committed growth rather than speculation," the firm said.

"Finally, demand is anchored by sophisticated, well-capitalized hyperscalers, whose capital spending has grown approximately 50 percent annually from 2022 to 2026 while maintaining strong margins and cash flow."

Infrastructure misalignment

McKinsey warned that at the current pace of growth, there's a misalignment between where stakeholders want to build data centers and where generation, energy demand, and grid infrastructure can quickly scale - raising the possibility of energy supply problems in parts of the US.

McKinsey's model suggests data center power demand could grow by around 27% annually between now and 2030, reaching 121 GW of data center IT demand.

However, it looks likely to grow more slowly after that, thanks to a potential saturation in demand for chips and slower AI adoption, as well as a shift from building new data centers to replacing today’s components with more energy-efficient, next-generation chips that add compute per unit of power.

McKinsey pointed out that the massive backlog in load interconnection pipeline requests isn't necessarily a sign of a demand bubble. Many applications are speculative and duplicative, with developers and hyperscalers submitting multiple requests to see which secures power first.

Meanwhile, early-stage developers are trying to secure interconnection rights before selling projects to well-capitalized parties that will do the building and install the IT hardware.

"Beyond 2030, our analyses point to a wide range of outcomes, but several structural dynamics are likely to hold," concluded the firm.

"In addition to the growing role of gas, we expect solar paired with battery storage to sustain strong momentum, given its cost competitiveness, modularity, and speed to deploy, though this is contingent to some degree on stable policy support, interconnection reform, and continued declining costs of storage."

FOLLOW US ON SOCIAL MEDIA

Otter.ai has appointed Mike Barnes as its first head of partnerships and alliances, as the AI software specialist looks to build out its global partner ecosystem and accelerate its enterprise growth.

Barnes is tasked with building and scaling the vendor’s channel ecosystem across the US, UK, and Europe, with an initial focus on recruiting technology partners, resellers, MSPs, systems integrators, and distributors.

He joins the business from Gainsight, where he most recently led partnerships, and brings more than two decades of experience across channel and partnership roles in enterprise software and marketing technology.

In an announcement, Otter.ai CEO and co-founder Sam Liang described Barnes’ appointment as an “important step” in the expansion of the company’s enterprise growth strategy.

“Mike has spent his career building successful partner ecosystems and understands what it takes to create value for both partners and customers,” he commented. “His experience will be instrumental as we expand our enterprise reach through the channel.”

Headquartered in Mountain View, California, Otter.ai develops conversational AI designed to capture and structure knowledge from workplace conversations.

The firm’s platform automatically transcribes meetings and calls, generating insights and action items that can be shared across teams and integrated into existing workflows.

With the platform now used by more than 35 million professionals globally, the company is looking to expand its offering beyond meeting transcription towards becoming a tool for capturing institutional knowledge from across the wider enterprise.

Building a channel ecosystem

Barnes’ appointment marks the beginning of Otter’s plans to build a structured partner program from scratch, with the first phase to focus on partner recruitment, foundational go-to-market activity, and early lighthouse partnerships.

According to the vendor, the second phase will expand partner enablement, training, support, co-selling, and co-marketing resources, with the company also planning to develop regional growth opportunities across its priority markets.

Otter said it is looking to work with partners capable of helping enterprises deploy conversational AI across areas including sales, customer success, operations, media, education, financial services, and construction.

Commenting on his new role, Barnes said partnerships will play a key role in helping enterprises connect Otter’s AI capabilities with the systems and workflows they already use.

“As more enterprises adopt AI across their business, those tools are only as valuable as the context they can access,” he explained. “Partnerships will be critical to bringing Otter’s conversational knowledge into the systems, workflows, and teams where work happens. I’m excited to help build the ecosystem that makes that possible.”

FOLLOW US ON SOCIAL MEDIA

More than one-in-five (22%) of UK firms have experienced an AI-related security breach in the last year, according to new research from IBM.

Findings from the firm’s 2026 Cost of a Data Breach report found AI-driven cyber attacks surged 56% across that period, prompting calls for enterprises to sharpen defenses.

The IBM study noted that the costs associated with AI-related breaches are “fundamentally changing the economics of cyber risk”, with the financial impact now standing at an average of $6 million.

Cyber criminals are increasingly focusing their attention both on targeting AI systems, and leveraging the technology to wage more devastating attacks, according to IBM.

Around 20% of organisations reported a breach where threat actors specifically targeted AI models or applications. The most frequent targets were “weaknesses in surrounding systems” such as compromised APIs or plug-ins (27%) and cloud misconfigurations (27%).

Running parallel to these threats, threat actors are also weaponizing AI to accelerate operations.

Deepfake impersonation ranked as the most common type of AI-enabled attack, cited by 45% of respondents. Meanwhile, AI-enabled malware and phishing attacks are also growing in frequency and scale.

Mark Hughes, global managing partner for IBM’s Cybersecurity Services division, said the report highlights the dual threats now facing enterprises globally. AI is creating new risk surfaces for firms, and hackers are actively using the technology to target these weak spots.

“AI has dramatically lowered the barrier for cybercriminals. Attackers can now execute attacks in minutes rather than days with advanced frontier models,” he said.

“Organizations need to move faster from reactive security to a continuous autonomous defence if they want to keep up.”

Positive resilience gains

Despite painting a dire picture of the current threat landscape, IBM noted that organizations are making positive steps toward bolstering cyber resilience.

Nearly two-thirds (61%) of UK firms plan to increase cybersecurity investment in the wake of a breach, the study noted, with IT leaders sharpening their focus on areas like incident response, AI governance, and data protection.

This same investment focus is reflected in global figures, according to IBM. In follow-up research conducted by Ponemon Institute, 85% of organizations said they plan to increase security spending in direct response to frontier AI cyber capabilities.

That marks a significant shift compared to the year prior, in which just 64% of respondents planned to increase investment due to AI-related threats.

Breach costs are decreasing

Elsewhere, IBM found that breach costs for UK firms are also decreasing. The average cost this year stands at £3.13 million compared to £3.29 million in 2025.

The number of breaches has increased, however, albeit marginally. The firm recorded 29,870 across the last year compared to 29,000 in 2025.

Breach costs also vary on a sector-by-sector basis. Financial services, for example, recorded an average cost of £5.46 million while costs for energy firms stood at £4.03 million.

FOLLOW US ON SOCIAL MEDIA

Aspects of the EU AI Act have come into force, bringing a new set of obligations designed to improve transparency for AI use.

The new rules aim to counter misinformation and manipulation, fraud, impersonation, and consumer deception by making it easier for people to recognize when they are interacting with AI or are exposed to AI-generated content.

"AI is a transformative technology that can bring extraordinary benefits to our people and businesses. But we are also seeing that harms can occur if AI is not properly designed and used and the most advanced models create risks on an entirely new scale. Europe anticipated this development," said Henna Virkkunen, executive vice-president for tech sovereignty, security and democracy.

"With the AI Act, we established a clear, risk-based and durable framework for trustworthy AI — one that gives innovators legal certainty while protecting the public interest. As enforcement begins, we are taking an important step towards AI that people and businesses can understand and trust, and whose benefits are shared widely across our society."

The Commission has published guidelines to help those providing or deploying AI. So what will organizations now have to do?

Here are three things you need to know about the new rules.

Marking and labeling of AI-generated content

Certain AI-generated or manipulated content must be clearly and visibly labelled and include machine-readable marks, according to the European Commission. Icons used in labelling have been made available for use.

This covers deepfake images, audio, and video content that resembles real people, objects, places, entities, or events.

Emotion recognition and biometric categorization tools, as well as text covering matters of public interest that haven't been through human review or editorial control are also covered under the new rules.

Transparency when interacting with an AI system

Transparent AI deployment and use is a key focus with the EU AI Act.

Under the new rules, providers must ensure that users are aware they’re interacting with the technology, such as a chabot, avatar, or AI agent.

“These obligations are intended to foster trust and integrity in the information ecosystem,” the Commission said in a statement.

Tim Pfaelzer, Veeam’s SVP and general manager for EMEA, said these rules should not be viewed as simply “ticking a compliance checkbox” and enterprises should implement robust audit trails and governance policies.

"While on the surface, the transparency requirements for AI governance and operational accountability might seem an easier ask than the delayed high-risk requirements, it’s far trickier to solve in practice - something that enterprises will realise when they attempt to align their AI deployments with these requirements," Pfaelzer commented.

How the rules will be enforced

AI use will be policed by national market surveillance authorities, the European AI Office - for systems under its supervision - and the European Data Protection Supervisor, when EU institutions are providers or deployers.

They can issue fines of up to €15 million, or 3% of global annual turnover for non-compliant companies, and up to €750,000 for EU institutions, bodies, and agencies.

In terms of penalties, the Commission said ‘proportionality’ will be a key focus, and any potential fines will take into account small and medium-sized enterprises or small mid-cap companies.

High-risk systems

Last month, the implementation of special rules for high-risk systems was delayed, with stand-alone high-risk AI systems now to come in scope from 2 December 2027, and high-risk AI systems embedded in products from 2 August 2028.

High-risk AI systems are defined as those presenting significant threats to health, safety, or fundamental rights.

FOLLOW US ON SOCIAL MEDIA

Oracle is expanding its use of Google's AI models across its enterprise software portfolio.

The company is adding Google's Gemini models to its AI Agent Studio for Fusion Applications, a development platform that enables organizations to build, connect, execute, and run AI automation and agentic applications using reusable Oracle, partner, and external agents.

It also plans to use Gemini models for embedded AI use cases in Oracle Fusion Applications and Oracle NetSuite.

“Organizations around the world trust Google Cloud’s full AI stack to power critical enterprise workflows and agents,” said Satish Thomas, vice president of Google Cloud.

“Our expanded partnership with Oracle is designed to make it easier for organizations to use Gemini in the applications and agentic workflows they rely on to automate workflows, accelerate decisions, and drive outcomes.”

The deal builds on customers’ existing access to Gemini models through Oracle Cloud Infrastructure (OCI) Enterprise AI through integration with Gemini Enterprise Agent Platform.

“Our partnership with Oracle brings Google’s most capable AI models directly into the core application workflows global businesses rely on every day," said Kevin Ichhpurani, president of global partner ecosystem at Google Cloud.

“Together, we are making it seamless for enterprises to apply powerful and cost-efficient AI directly where business decisions happen.”

Oracle said customers and partners will get more choice when building Fusion-native agents and agentic applications, along with expanded multi-modal capabilities. They'll be able, for example, to access Gemini 3.1 Flash Lite, a high-efficiency model engineered for optimal price-performance and Gemini 3.5 Flash for more complex reasoning and specialized tasks, including video and presentation creation.

“To achieve the best business outcomes, organizations need the flexibility to choose the AI model best suited to each problem,” said Chris Leone, EVP of applications development at Oracle.

“By bringing Gemini to Oracle AI Agent Studio for Fusion Applications, we are giving customers and partners greater choice as they build and extend agents and agentic applications that reason through complex, real-world business challenges. Oracle Fusion Applications then turn that reasoning into action through governed workflows, approvals, and transactions.”

Oracle also plans to use Gemini models for embedded AI use cases in Netsuite and Oracle Fusion Applications, which include Oracle Fusion Cloud Enterprise Resource Planning (ERP), Oracle Fusion Cloud Human Capital Management (HCM), Oracle Fusion Cloud Supply Chain & Manufacturing (SCM) and Oracle Fusion Cloud Customer Experience (CX).

In each case, it will choose the model that can deliver the best price-performance for specific customer scenarios.

“AI is at the core of how customers use and experience NetSuite and choosing the right model for the right use case is critical to helping them get more value from AI,” said Evan Goldberg, founder and executive vice president, Oracle NetSuite.

“As we evaluate various AI use cases in NetSuite, we are working with leading large language models, like Google’s Gemini, to help customers improve visibility, automate work, and move from insight to action within NetSuite.”

The European Commission is calling for tenders to establish up to seven AI gigafactories across the EU, as part of its efforts to secure European tech sovereignty.

The initiative will be supported by up to €10 billion in EU and national funding, making it the largest public-private partnership in the world for the development of trustworthy AI.

It's aimed at giving businesses of all sizes, academia, and public authorities access to infrastructure for training, inference, and fine-tuning advanced frontier AI models.

It's hoped that the facilities will also act as a catalyst for the European semiconductor ecosystem and stimulate domestic design of processors by providing a predictable, large-scale demand for high-end computing. It’s also hoped that, over time, this will evolve into the manufacture of European-designed AI processors in the EU.

The gigafactories, said the Commission, will combine advanced AI processors, software and cloud technology stacks, high-speed connectivity and energy-efficient data centers, dedicated secure cloud user access environments, and specialized secure AI-oriented support services.

The supporting infrastructure will be environmentally sustainable, particularly in terms of energy and water supply.

The plan was first revealed in February 2025 and an informal call for expression of interest drew 77 proposals, with potential sites in Germany, Italy, France, Poland, Czechia, Denmark, Finland, Greece, Portugal and Spain.

"The opening of the AI gigafactories call represents a milestone in our AI Continent ambitions," said Henna Virkkunen, EVP for tech sovereignty, security, and democracy at the European Commission.

"Access to the raw scale of computing power within AI gigafactories is a strategic necessity for Europe as AI development accelerates. I am pleased to see member states, industry and the Commission coming together to work on these facilities that are key to our technological sovereignty," she added.

The plan will involve two consecutive development phases and two lots, with participating member states matching EU funding.

The first lot will support up to four projects, each eligible for up to €100 million in EU funding in phase one and up to an additional €400 million per project in phase two. Successful projects will have to deploy at least as many of the most advanced AI processors as are currently installed in Europe's most powerful AI factory.

In phase two capacity must triple, with the second lot supporting up to three projects, each eligible for up to €200 million of EU funding in phase one and up to an additional €800 million per project in phase two.

To qualify, projects must feature up to twice as many of the most advanced AI processors as are currently installed in Europe's most powerful AI factory; in phase two, capacity must increase to at least four times that level.

The AI gigafactories can be set up on one site or across several locations in a single member state, but can also include cross-border developments through distributed AI computing facilities.

The call closes on 12 November 2026, and consortia or Special Purpose Vehicles bringing together companies, public entities, investors and other partners can apply.

Decisions are expected by early 2027, with construction starting later that year, and operations expected to start within 18 months.

The saga of “rogue AI” continues as Anthropic disclosed its AI software, Claude, had managed to escape a sandbox environment, connect to the internet, and infiltrate other businesses’ systems.

The admission comes just days after it was revealed two of OpenAI’s ChatGPT models had escaped a similar environment and attacked machine learning platform Hugging Face.

Unlike OpenAI’s incident, however, the Anthropic containment breach didn’t result in quite such a damaging situation: With Anthropic’s Claude, nobody was any the wiser until the company itself carried out analysis and discovered the three containment breaches.

According to the company, these breaches occurred due to a “misunderstanding” between Anthropic and its evaluation partner, Irregular

In a blog post authored by the company’s Frontier Red Team, the company said that in response to the OpenAI incident it began a “large-scale retrospective review of our own cybersecurity evaluations”.

“In particular, we looked for evidence that Claude … was able to access the internet from within testing environments that should have been sealed off,” the authors said.

Out of more than 141,000 exercises where Claude could have accessed the internet, the company found it had successfully escaped three times. During each of those instances, it went on to target the production infrastructure of another organization unconnected to the tests being run.

“In all three incidents, Claude had been tasked with a capture-the-flag challenge, one of the ways we assess a model's cyber capabilities,” the blog authors said. “The model is given a fictional scenario and told that a piece of secret information (the "flag") has been hidden on a different machine on the network, and its objective is to break in and retrieve it. The challenge is left open-ended, and no particular method is prescribed.”

They continued: “In all cases, Anthropic's evaluation prompt specified to Claude that its environment was a simulation and that it had no internet access. Due to a misunderstanding between us and our evaluation partner, this was not the case, and internet access was available. Because of this, when Claude's search led it to real systems on the open internet, it treated them as part of the exercise.”

According to the blog post, Anthropic has only been able to contact two of the three affected parties so far. None of the targets of the incident have been revealed and Anthropic said they hadn’t noticed Claude’s infiltration when it happened.

In reaction to Anthropic’s blog post, Jake Moore, global cybersecurity advisor at ESET, told ITPro: “What this really shows is that AI models don't just access the internet by themselves.

"This is a clear design fault as they would only interact with the outside world if humans had given them access or the tools to do so. The focus should therefore be on how permissions deal with AI and more focus spent on security by design.”

Cognizant has announced the launch of a new EMEA AI Unit, in a move tit says will help organizations scale agentic AI deployments and move projects from pilot stages into production.

The dedicated unit will bring together advisory, engineering, and delivery capabilities to support enterprises across the region as they build, deploy, and manage agentic AI solutions tailored to their business requirements.

The launch forms part of Cognizant’s wider AI Builder strategy, which aims to help customers adopt AI technologies without being tied to a single cloud provider, AI model, or technology platform.

In an announcement, Cognizant’s president of EMEA, Manoj Mehta, said many organizations remain enthusiastic about AI but continue to face challenges translating early projects into measurable business outcomes.

“The EMEA AI Unit reflects Cognizant’s AI Builder strategy by bringing together the people, platforms and engineering expertise needed to move clients from pilots to payoff,” he explained.

“Our approach is neutral by design: we work across clouds, models and ecosystems so clients can build agentic AI solutions that fit their business, integrate into operations and support accountability for outcomes.”

Headquartered in New Jersey, Cognizant provides IT consulting, digital transformation, and technology services to enterprises around the world. In recent years, the company has increased its focus on AI-led transformation, developing services that combine consulting, software engineering, and managed delivery to help customers implement AI across their operations.

Turning AI into business outcomes

At the center of its new EMEA AI Unit is Cognizant’s Frontier Deployed Engineering (FDE) offering, a delivery framework designed to help organizations progress from AI strategy through to enterprise-wide deployment.

The framework consists of three service models: Foundation, Accelerate, and Transform. Foundation focuses on AI strategy, governance, technology selection, and early-stage prototypes, while Accelerate is designed to identify and deploy high-value AI use cases into production.

The third tier, Transform, supports wider business reinvention through multi-agent AI systems capable of automating end-to-end workflows.

Early impact across EMEA

The unit is already supporting several notable enterprise deployments across the EMEA region, according to Cognizant.

The company is currently working with one of Europe’s largest online fashion retailers to move AI use cases into production through an AI factory model that it said can reduce development cycles from months to days.

Elsewhere, the firm revealed it is also supporting a global pharmaceutical company with the use of multi-agent AI systems across research and development – including drug discovery, clinical trial design, and regulatory preparation.

Seagate has said it's all but sold out of its exabyte-capacity hard drives until 2028, thanks to the AI boom sparking a cloud and data centre build-out.

The storage giant made the comments following the release of its results, which showed revenue climbed to $3.6bn from $2.4bn last year, and net income leapt to $1.2bn from $488m. Seagate posted margins of 52.3% for the quarter, versus 37.4% last year, and record cash flow of $3.1bn for the year, saying it expected margins and cash flow to grow throughout this year.

Dave Mosley, Seagate’s chair and chief executive officer, said in a statement that the results were "driven by robust cloud data center demand" and predicted that would continue into 2027.

"Our confidence is supported by the scale, quality, and duration of our data center customer commitments in a strengthening demand environment," Mosley added in a conference call, according to an online transcript. "Data center demand now represents approximately 90% of our exabyte shipments.”

He added: "Based on the long-term supply agreements in place today, the vast majority of our nearline exabytes are now allocated into calendar 2028."

AI versus supply

The AI-driven infrastructure buildout has sparked a shortage in components RAM, driving up prices for companies and consumers — but benefiting suppliers.

Despite growing concerns about the costs associated with AI, Mosley expects investment to continue, saying cloud customers remain the largest driver of growth for Seagate, with no evidence of a slowdown.

"Importantly, we are not seeing customers pull back on planning horizons," he said on the call. "As our strategic relationships deepen, many are actively seeking to extend planning horizons through 2029 and beyond, which we believe reflects growing confidence in their own long-term infrastructure needs."

That is driven by how data-hungry AI has proven, Mosley noted, with new data constantly being created and customers hoarding data for longer — which is good news for Seagate and its hard drives.

"With the transition from AI model training to inference to agentic applications, more data is generated and retained for historical context, compliance, and future reuse," Mosley added. "As these data center environments become larger and more complex, customers must balance performance, energy consumption, and cost across distributed infrastructures."

This means that hard drives still have a place versus SSDs and other storage technologies, according to Mosley. "Cloud providers have long addressed these challenges through tiered storage architectures that combine high-performance memory and SSDs with mass capacity hard drives to optimize performance and economics at scale," he said.

Next up

Mosley also revealed details of Seagate's future roadmap, saying testing with customers was underway for its second-gen Mozaic 4 platform, which can support up to 44 terabytes per drive.

"We expect to achieve our next ramp milestone by exiting calendar 2026 with 50% of our HAMR exabytes on our Mozaic 4 platform," he added. "Looking further ahead, Mozaic 5, our 5-plus terabyte per disk platform, remains on track for qualification shipments in late calendar 2027."

The UK's Department for Education (DfE) has confirmed that hackers have accessed more than 600,000 records.

The data includes the names, job titles and phone numbers of thousands of head teachers, university staff and government officials. It was accessed via the DfE’s Help Desk Self-Service Portal and the Turing Scheme Portal, which handles students planning to study abroad.

According to The Times, the attack has been claimed by the new - and still shadowy - ExfilSquad hacking group, which has released the data on the dark web.

A DfE spokesperson told ITPro that the risk to individuals is low, and that the general helpdesk data breached includes different sets of data which cannot be connected. The 607,000 figure relates to the number of records, not the number of individuals affected, she added.

"We have robust processes in place to protect information and took swift action to contain this incident," she said.

"The information involved is limited to customer service contact details relating to individuals and organizations. No other data has been accessed."

The spokesperson said the department is now working closely with the National Cyber Security Centre (NCSC) and the National Crime Agency (NCA), and has reported the incident to the Information Commissioner's Office (ICO). It's working to fix both portals, and has switched to telephone contact in the meantime.

"Names and email addresses belonging to government officials, senior school leaders, and university staff is a high-value targeting dataset. These are people with institutional authority, access to sensitive systems, and in many cases responsibility for safeguarding student data," said Muhammad Yahya Patel, vCISO and cybersecurity advisor for EMEA at Huntress.

"In the wrong hands, this isn't just a data privacy incident, it's a ready-made list for spear phishing campaigns against people with meaningful access across the education sector."

Research late last year from Keeper Security found that 42% of UK educational institutions have already been targeted by AI-generated phishing attempts, with 93% at least somewhat concerned about AI-related cybersecurity threats.

Graeme Stewart, head of public sector at Check Point, said his firm's threat data shows that education is currently one of the most targeted sectors globally, facing thousands of attacks per organization every week. In the UK, as of June, it sat as the most frequently targeted industry.

"The fact that this follows other recent breaches across the public sector, including the Foreign Office attack last year, shows a pattern rather than a one-off failure. Departments need to treat help desks and third-party support systems as high-risk attack surfaces, not just back-office admin tools, because that's clearly where attackers are focusing their efforts," he said.

"With the NCSC reporting a steep rise in nationally significant attacks, this can't be treated as an isolated incident. It should prompt a wider review of how sensitive contact data is stored, segmented and monitored across government IT estates."

Microsoft posted better than expected results from its cloud and AI business, news that helped boost its languishing share price.

Recent earnings statements from major AI players have spooked investors thanks to already heavy capital expenditure being increased further. Last week, Google's shares fell despite record growth and this week Meta saw a similar fall amid concerns about AI spending. By contrast, Microsoft plans to keep its capex spending the same as previously forecast, holding it at $175bn for 2026.

Across the company’s revenue for the quarter was $90 billion, up by 18%, with net income totalling $35.8 billion, climbing by 31%. Revenue from Microsoft cloud was $59.3 billion, up by 27%, with better than expected results at its Azure cloud computing division, which posted revenue growth of 43% for the quarter, above estimates below 40%.

That lifted Microsoft's shares by 8%, rallying after a tough stretch this year that saw it fall more than 18%.

"This year, Azure revenue surpassed $100 billion for the first time, and Microsoft 365 Copilot reached over 30 million paid seats, reflecting the confidence customers are placing in us to power their AI transformation," CEO Satya Nadell said in a statement. The company also reported a $3.2 billion return on its Anthropic investment.

Positive results on AI that are keeping pace with spending are likely what's behind the share price bump, noted Emarketer analyst Gadjo Sevilla. He said the capex figure is likely the most watched line in results right now – and this time that sparked optimism rather than concern.

"Microsoft spent $35.80 billion on property and equipment during fiscal Q4, more than double the $17.08 billion in the year ago quarter, bringing full-year capital expenditures to $115.95 billion – up nearly 80% from $64.55 billion in fiscal 2025," said Sevilla. "Despite that spending pace, the company still generated $55.44 billion in quarterly operating cash flow, up 30% YoY, a positive sign the AI buildout isn't cannibalizing the core business."

Sevilla added: "The company’s diversification strategy, its data center and AI partnerships, and its reliance on its own homegrown AI expansion will continue to stoke confidence to partners and investors while signaling to the rest of the industry how diversifying infrastructure and AI products strikes a balance for growth."

A better way to offer AI?

Alongside that, Microsoft CEO Satya Nadella said the company continues to shift away from a previous focus on OpenAI's models to building its own, saying the aim is to enable customers to pick and choose the best model to meet their needs.

"That's really the enterprise design architecture that we are going to evangelize. We ourselves are using it," Nadella said, according to Reuters, adding that the company's own models are 40% more efficient.

That's a key point amid concerns about the cost of using AI, with Microsoft earlier this week unveiling its own security model that it pitches as half the cost of rival systems.

Not all analysts were convinced, however. Forrester principal analyst Tracy Woo said that the Copilot adoption and strong revenue were good signs that AI investment was paying off "but the results stop short of fully validating the company’s AI strategy”.

"The new partnership with Anthropic helps reduce dependence on OpenAI, yet roughly 45% of commercial RPO [Remaining Performance Obligation] remains tied to that single model provider," she said.

Woo added: "While more AI products are scaling into enterprise‑grade workloads, the unresolved question is whether Microsoft’s infrastructure expansion can ultimately outrun the margin pressure that comes with supporting frontier‑model demand."

Dropbox has appointed Jim Rudall as head of EMEA, as the collaboration and content management specialist looks to strengthen its commercial operations across the region.

Rudall will lead the company’s regional go-to-market strategy and commercial business, working with teams across EMEA to drive customer success and support continued growth.

A seasoned industry veteran, Rudall brings more than 15 years’ experience from across the technology sector, most recently as GM for EMEA at Intuit Mailchimp.

Prior to that, he served as head of revenue for EMEA at Shopify, where he led the expansion of the company’s regional sales organization, and has previously held senior leadership roles at Rakuten, Usablenet, and Experian Marketing Services.

Commenting on his new role, Rudall said he was attracted to Dropbox’s focus on addressing the practical workplace hurdles faced by customers.

“One of the things that drew me to Dropbox was its focus on solving real customer challenges,” he explained. “I'm looking forward to partnering with businesses across EMEA to understand where they experience friction –whether that's finding the right information, collaborating with colleagues or moving work through review and approval – and to help them unlock more efficient ways of working.”

San Francisco-headquartered Dropbox provides cloud-based content collaboration and document management software used by millions of businesses and individuals worldwide. In recent years, the company has expanded beyond file storage through the addition of AI-powered search and workflow capabilities, while also strengthening its digital agreements offering through Dropbox Sign.

The firm’s latest appointment comes as it continues to invest in its international go-to-market organization as businesses adapt to hybrid working models and AI-driven workplace transformation.

Rudall said organizations across EMEA now require technology capable of integrating with existing workflows while also supporting the growing use of AI in the workplace.

"As work becomes increasingly distributed and AI reshapes how organisations operate, businesses need technology that fits seamlessly into the tools and workflows they already rely on, without compromising security or control,” he added.

“Dropbox brings together content, context and digital agreements with Dropbox Sign in one secure place, while integrating with the AI tools teams use every day. Together, these capabilities help organisations across EMEA stay aligned, move work forward faster and get more value from their content.”

Data center developers could be forced to pay an upfront fee when applying for grid connections, with the aim of wiping speculative projects from the queue.

With grid connections having long lead times and planning permission uncertain, developers have been making speculative applications. As a result, they account for a significant proportion of demand in the connections queue, currently amounting to around 73 GW.

This has been a problem for quite some time, and is only getting worse. Contracted demand offers increased from 41 GW to 125 GW between November 2024 and June 2025, driven largely by demand from data center projects, many of which may not actually go ahead. If that happens, energy regulator Ofgem said, other, more viable developments could be delayed and planning for future network investment efficiently made more difficult. 

Now, to try and combat the problem, Ofgem has opened a consultation into a proposal to require data center projects to pay between £237,500 and £712,500 per megawatt when they accept a connection offer. That’s equivalent to around 2.5% to 7.5% of average project costs.

The fee would be refunded when the project reaches energization but forfeited if it fails to progress according to the rules.

“Britain's electricity demand connections queue has more than tripled in size in less than a year, and consumers should not bear the risks created by speculative projects taking up space in the system," said Ofgem’s director for energy system design and development, Eleanor Warburton. 

"The connections system must work for consumers and for the projects that are ready to invest, build and connect. Where speculative projects take up space in the queue, they can delay other schemes and create uncertainty about future network needs."

To keep their place in the queue, Ofgem suggests, data center developers would have to demonstrate tangible progress through evidence such as financial capability, commercial maturity and procurement activity. They would need to have a credible end-user of the data center, and procure electrical equipment such as switchgear with long lead times.

"These reforms will help free up capacity for viable projects, improve confidence in network planning and support faster connections where they are needed most," said Warburton. 

“By helping projects that are ready to move forward and connect more quickly, these reforms can also support economic growth, bringing forward investment, enabling businesses to be built and expanded sooner, and ensuring the benefits of that investment are felt across the economy more quickly.” 

However, there's a delicate balancing act between prioritizing viable projects and putting a dampener on AI development, said Mark Pestridge, managing director of Telehouse Europe.

"Ofgem’s proposal is an important initiative, but it must be implemented in a way that maintains the UK’s attractiveness as a destination for AI and digital infrastructure investment. A refundable fee-based approach should not deter serious investors, but create a more transparent connections process that gives viable projects greater certainty," he said.

“However, reforming the queue will not resolve the underlying capacity challenge. A long-term solution will require sustained investment in the grid, alongside much closer collaboration between data centre operators, local councils, National Grid and network operators at the earliest stages of planning."

The consultation is open until 16 September.

The tokenmaxxing trend has swept the tech industry in 2026 and already left some firms reeling from huge bills – but lessons from the early cloud era could be key to curtailing costs.

That’s according to Patrick Brogan, director of the FinOps advisory team at DevOps firm Harness. Speaking to ITPro, Brogan said the current trend bears similarities to the cloud boom over a decade ago. Enterprises are ramping up adoption, tinkering, experimenting, and testing out what works for them.

In some cases, tokenmaxxing is simply a case of encouraging AI adoption among staff, while for others it’s about justifying lavish investment in the technology and keeping up with AI-savvy competitors.

“There’s a number of factors that go into tokenmaxxing,” he said. “Some of it has to do with organizations deliberately pushing their employees to use the technology.”

“It might come from a sort of subconscious desire, subconscious FOMO. They don’t want to feel like their competitors are leveraging technology in a way that’s going to put their own company at a disadvantage.”

Regardless of the underlying motivations, Brogan said tokenmaxxing shows companies are “throwing everything at the wall to see what sticks” then making decisions on what AI tools should be used – and it’s coming back to bite them.

The trend has reached such an extent that Harness found nearly three-quarters (72%) of organizations have been hit with unexpected cost spikes over the past year.

Uber stands out as a key example here. As ITPro reported in June, the ride hailing firm blew through its entire annual AI budget in just four months after incentivizing staff to engage in the practice.

Going back to FinOps basics

Harness noted that AI now accounts for 23% of the average enterprise cloud bill, while organizations estimate that around 26% of all AI spend is wasted. This needless waste can be tackled, though, and Brogan said time-tested FinOps practices could be key.

“AI cost management has the same problems that cloud had a decade or more ago,” he said.

FinOps is a framework for cloud spend management that aims to bring together engineering, finance, and broader business teams to maximize value and, crucially, establish accountability for spending.

It’s not a practice that’s gone away, but in the AI boom it's somewhat fallen by the wayside. Brogan said these same techniques and processes could be crucial to curtailing excessive AI spending, particularly in terms of accountability.

Harness’ study found that, in many enterprises, nobody is clearly accountable for AI costs. More than half (52%) said they had no clear sense of ownership with responsibility split across engineering, finance, and IT.

The result here is that when spending ramps up in specific areas, such as software engineering, there isn’t a single function designed to answer for it or hold things to check.

“When we were getting started in our FinOps practice there, we felt the same pain points,” he said. “You know, confusion over ownership, gaps in how we govern the cloud bill and the services that our organizations will use, and certainly invoice shock.”

Velocity creates new challenges

Brogan said the challenges posed by AI adoption in terms of cost management aren’t a facsimile of the early cloud era, however.

While that period saw a widespread shift, the scale and pace of AI integration means many organizations aren’t reacting quickly enough to surging costs.

“Those problems are compressed into a fraction of the time because AI technology is developing at such a rapid pace and its usage and adoption have exploded far faster than cloud,” he said.

“We don’t have the same 10-year span to figure out the solutions to the challenges with AI spend but, luckily, we have a lot of lessons we learned with managing cloud spend.”

Brogan noted that Harness’ findings suggest a sharpened focus on ownership and governance will be critical.

“Companies very quickly, if they haven't done so already, need to agree and align on a single owner of the AI bill,” he said.

“Whether you're a company where that's just one person, or you're a large enterprise and that requires an entire team or set of teams,” Brogan added.

“There needs to be a very clear decision on who or what that team is, the responsibilities that that team has, and what they then need to drive [in terms of] responsibility and accountability.”

Boxing clever

A key issue many enterprises fail to acknowledge lies with model choice, Brogan noted: not every task requires a costly frontier model, yet teams frequently fall into this trap.

Speaking to ITPro last month, Nitish Tyagi, senior principal analyst at Gartner, said model selection will be critical to reducing costs moving forward, particularly for smaller tasks.

Tyagi noted that “intelligent model routing” strategies are now a key focus for developer teams, helping them to box clever with selection.

Brogan echoed these comments and urged enterprises to keep closer tabs on the costs associated with individual models.

“There’s probably a lot still to be learned about how we build an application to pick the model that’s best fit for purpose,” he said.

“[So] not using a frontier model for something that can be delivered by an older generation. Maybe it arrives 10% slower at that outcome, but if you can live with that trade-off for the lower cost, then that should be built into the application design from the start.”

Whether enterprises are willing to accept this trade-off is debatable, Brogan noted, and Harness’ study suggests there’s little sign that they’ve learned lessons so far.

More than half (57%) of engineers told the firm they’re still being encouraged to engage in tokenmaxxing practices, for example.

Some organizations have taken drastic measures to cut down on needless spend. As ITPro reported in late June, Accenture told staff to cut down on AI use for basic tasks due to “"soaring token spend"..

FOLLOW US ON SOCIAL MEDIA

Zscaler and Schwarz Digits are teaming up to offer a sovereign cloud security service in Europe, combining the Zscaler Zero Trust Exchange platform with Schwarz Digits’ European sovereign cloud STACKIT.

The aim is to provide a sovereign Zero Trust Secure Access Service Edge (SASE) service, designed to prevent AI-driven threats and increase cyber resilience.

“Our customers in the private and public sector need secure, resilient IT infrastructure without compromising on digital sovereignty," said Bernd Wagner, CSO of Schwarz Digits.

"By uniting the expertise of two technology leaders, we make this a reality: Zscaler provides an advanced Zero Trust SASE architecture to counter AI-driven cyber attacks, while Schwarz Digits ensures a sovereign cloud infrastructure through STACKIT. This helps to ensure all data remains in the EU and is protected against third-party access."

While the solution is built for organizations across every industry, Zscaler said it's tailored specifically for mission-critical operations with strict security and compliance needs in public administration, defense, financial services, and healthcare.

It covers the deployment, management, operation, and support of a cloud security platform, and allows organizations to secure hybrid workforces while meeting operational resilience and supply-chain security expectations.

Customer data and operations remain protected against cyber threats and aligned with European legal requirements, said the firm. 

“Technological independence begins with infrastructure," said Christian Müller, CEO of Schwarz Digits.

"Through this partnership, we are taking network security to a new level: we are evolving existing security architectures and focusing on high-performance identity verification. For our customers, this means even stronger protection against cyber attacks.”

Sovereignty in the spotlight

Organizations are increasingly required to address digital sovereignty concerns, while meeting strict regulatory requirements and still fulfilling performance demands.

At the same time, European regulations including NIS2, DORA, the AI Act, and others have made cybersecurity a board-level priority.

“Our partnership with Schwarz Digits is a concrete demonstration of our long-term commitment to Europe: together, we help our customers eliminate their attack surface and prevent the lateral movement of threats, while still maintaining compliance with European regulations through EU data residency," said Misha Kuperman, chief reliability officer at Zscaler.

"This enables the highest level of security while aligning with European digital sovereignty regulations.”

The solution is now available to customers across Europe, with the offering hosted in German data centers and operated by STACKIT.

Zscaler has more than 160 data centers worldwide. Its sovereign data centers include its FedRAMP-authorized GovCloud in the US and ZSCloud in the EU, as well as thousands of private service edges in customer DCs worldwide.

Earlier this year, the firm expanded its Zscaler Zero Trust Exchange data sovereignty capabilities with separate control, data, and logging planes, ensuring that sensitive data never leaves the required jurisdiction, and added several new regions to its reach.

FOLLOW US ON SOCIAL MEDIA

Sophos has uncovered a Microsoft Teams voice phishing (vishing) campaign targeting dozens of organizations between February and June this year.

Attackers impersonated IT support staff to gain remote access to victim systems and deploy Chaos ransomware – in one case, less than 17 hours after the initial compromise.

Tracked as STAC474, the campaign was overwhelmingly aimed at North America, with 50% of targeted organizations based in Canada and 44% in the US.

In terms of sectors, there was a broad distribution, with services organizations impacted in 20% of the incidents, followed by manufacturing, energy, and construction and engineering, as well as law.

Notably, Sophos said legal organizations targeted in the campaign specialize in intellectual property (IP) law or services.

How the Microsoft Teams attacks work

First contact comes via Teams chats and calls, impersonating helpdesk or IT support staff.

Unlike earlier Teams abuse campaigns in which attackers spoofed onmicrosoft[.]com tenants, Sophos noted that STAC4749 operators created IT-themed cloud domains under the “.top” top-level domain (TLD) and leveraged plausible employee usernames to make the accounts appear legitimate.

The aim was to launch a remote session through an existing tool or by downloading an alternative. Through this, the operators launched PowerShell on the compromised system to retrieve and execute malicious payloads hosted on attacker‑controlled web servers.

These payloads were typically staged in user‑writable directories, most commonly AppData\Roaming.

The first-stage payload collected system identifiers such as the computer name, machine GUID, and operating system version, and queried registry keys under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion to fingerprint the host.

It also attempted to discover security products that were active on the system, according to researchers.

Shortly after the discovery phase, the first-stage payload created a new registry Run key to enable persistence at user logon. After establishing persistence, the Python-based backdoor connected to a C2 server and retrieved Golang-based implants that were executed via a PowerShell Invoke-WebRequest command.

"At least three STAC4749 compromises led to Chaos ransomware deployment. In these incidents, the ransomware was deployed shortly after the attackers expanded access across multiple systems and, in at least one instance, likely exfiltrated data," said Sophos threat intelligence analyst Morgan Demboski.

"Given the short interval between initial access and encryption, Sophos analysts assess with high confidence that STAC4749 was a financially motivated operation that either directly deployed ransomware or coordinated with affiliates."

What is Chaos ransomware?

The Chaos Ransomware as a Service (RaaS) operation has been active since at least February 2025.

Rapid7 recently suggested that it could be a false flag by the Iranian threat group known as MuddyWater.

However, Sophos said it has no evidence of this, reckoning instead that it has a Russian-language connection.

How to stay secure

Sophos outlined a series of recommendations for organizations at risk, including:

• Monitoring Teams activity for suspicious external messages and voice calls
• Implementing endpoint detection and response (EDR) capabilities
• Regularly reviewing registry Run keys and other common persistence locations

Organizations should also carry out user awareness training, enforce application control policies and restrict unauthorized software execution.

FOLLOW US ON SOCIAL MEDIA

Orca Security has signed a distribution deal with QBS Software as the cloud security specialist looks to expand its partner ecosystem across Europe, the Middle East, and Africa (EMEA).

Under the agreement, QBS will distribute Orca’s cloud-native application protection platform (CNAPP) to enterprise and upper mid-market customers through its network of VARs, MSPs, MSSPs, and cloud-focused partners.

The first phase of the partnership will cover the UK and Ireland, Germany, Austria, Switzerland, France, as well as the UAE and Saudi Arabia – with further expansion planned for the Nordics, Benelux, and Central and Eastern Europe.

In an announcement, Shannon McWilliams, Orca Security’s head of global distribution and programs, described the agreement as “critical” to the company’s regional growth strategy.

“QBS brings exactly what we need, a partner-first mindset, deep regional relationships, and the marketplace infrastructure to meet customers where they’re already buying,” he said.

“This agreement is a significant step in making Orca the default choice for cloud-first organisations across EMEA.”

Headquartered in Portland, Oregon, Orca Security provides an agentless cloud and AI security platform designed to give organizations visibility across cloud, AI, and application environments.

The offering helps security teams identify, prioritize, and remediate risks without deploying agents across cloud environments.

Orca company said its new distribution deal with QBS forms part of its partner-first go-to-market strategy, with the partnership expected to strengthen partner enablement as well as simplify access to its platform.

The announcement also marks the latest expansion for QBS Software in EMEA, which has continued to broaden its vendor portfolio through a series of strategic distribution agreements.

Earlier this month, the firm partnered with Dropzone AI to distribute its AI-powered security operations platform across the region.

Commenting on its latest collaboration, Tom Corrigan, chief revenue officer at QBS Technology Group, said Orca’s platform is well suited to the distributor’s enterprise-focused partner base.

“Orca Security represents exactly the kind of best-in-class cloud and AI security vendor we want to champion across our EMEA network,” he explained. “Their agentless approach and comprehensive CNAPP platform resonate strongly with the enterprise and upper mid-market buyers our partners serve every day.

“We’re committed to giving this partnership the executive focus and regional execution it deserves, and we look forward to building a high-performing ecosystem together.”

FOLLOW US ON SOCIAL MEDIA

Orange has announced a deal with global infrastructure investor Morrison to create a jointly-controlled sovereign data center company in France.

The proposed venture would build on Orange's existing French data center portfolio, aiming to bring total capacity up to 400 MW – nearly ten times its current level.

Orange would contribute five major data centers across four campuses in France – Chevilly-Larue, Aubervilliers, Chartres and Val-de-Reuil – to the joint venture, along with its operational expertise and commercial reach.

Morrison, meanwhile, would commit equity, with the platform supported by an investment program of €3 billion leveraging Orange's existing assets, Morrison's equity contribution, and debt.

"Europe's digital future will require significant new investment in trusted infrastructure capable of supporting the growth of cloud services, artificial intelligence and data-intensive applications," said William Smales, chief investment officer at Morrison.

"We believe France is exceptionally well positioned to play a leading role in Europe's digital economy, and this partnership represents an important step towards building the sovereign infrastructure needed to support future growth and competitiveness."

The companies said the platform will benefit from some of the most decarbonized electricity in Europe, and will aim for the highest standards of energy efficiency and environmental sustainability.

Orange Business will serve as the exclusive partner for the distribution of its colocation and hosting offers for large enterprises, SMBs, and public-sector entities.

Strategic planning

Beyond hosting and storage capacity, the sovereign platform will serve as a strategic foundation for Orange Business's cloud and AI solutions.

The firm's platforms and services will continue to be hosted in the planned joint venture's data centers, with Orange keeping operational control over the areas dedicated to its own operations.

This, said Orange, will give customers a level of security and availability for hosted systems and related data that meets the most stringent national and European standards.

“We are absolutely convinced that France will need sovereign, trusted digital infrastructure if it is to rise to the challenge of surging demand driven by cloud and artificial intelligence," said Christel Heydemann, CEO of Orange group.

"This contemplated joint venture with Morrison will allow us to unlock the value of our existing assets and strengthen our position in data centers. Together with a partner recognised for its expertise and investment capacity, we will accelerate the deployment of the capacity that the market needs."

Long-term goals

The two companies expect to have the deal signed by the end of this year, after a consultation with bodies representing employees and receipt of the required regulatory approvals. It's expected to close in the first quarter of next year.

While digital sovereignty is becoming increasingly important in Europe, things are set to move slowly over the next five years.

According to Forrester’s Global Sovereignty Forecast, European firms are only expected to make modest gains on this front. Nations such as Germany, France, and the UK rank among the most aggressive in their plans for sovereignty improvements.

FOLLOW US ON SOCIAL MEDIA

Amazon has pledged financial backing for the team behind the Lean programming language as part of a sharpened focus on AI agent development.

In a statement on 26 July, the tech giant revealed it will provide "substantial, long-term” financial support for the Lean Focused Research Organization (FRO).

The FRO leads development of the open source programming language, which Amazon already uses internally in agentic AI development practices.

Lean has been around since 2014 and is a popular programming language across a range of fields including mathematics, physics, and computer science.

For Amazon, the appeal lies in its role in helping develop and fine-tune AI reasoning capabilities. The programming language is used alongside a ‘proof assistant’ - a type of software used to conduct checks of code to identify and sift out errors or flaws.

It’s these ‘correctness proofs’ that make the programming language a go-to option for academic researchers and professionals in scientific fields.

“AI generation of formal proofs in Lean has been a key method for training models with lower error rates, to the point that they are now producing correct solutions to research-level problems,” Amazon explained in a blog post.

Amazon Lean-ing in on agentic safety

Amazon said its support for Lean comes at a critical time both for its own internal AI ambitions and for the industry at large as enterprises ramp up adoption of agents.

Safety has been a key recurring talking point for organizations on this front. As ITPro has previously reported, research shows growing concerns around access control, governance, identity security, and visibility when it comes to agents.

“Coupling generative AI with Lean's mathematical rigor will help enable verified, trustworthy AI agents,” the company said.

Amazon already uses Lean-based verification in its Bedrock AgentCore service, helping to “prove the correctness of the policy language” that ensures agents operate within strict boundaries.

Elsewhere, Lean underpins systems such as SampCert - which provides “mathematical guarantees” for privacy protections in the AWS Clean Rooms analytics platform - and AWS Neuron.

“One scientist recently used an LLM with Lean to prove the correctness of Amazon Aurora's segment repair protocol, our most durability-critical distributed protocol, in a fraction of the time it would have taken manually,” Amazon noted.

“The set of applications is growing fast, and this is just the beginning.”

Peter Van der Putten, assistant professor of AI at Leiden University and director of Pegasystems’ AI Lab, said AWS’ FRO backing is a welcomed move given recurring security-related concerns.

“It is encouraging to see AWS investing in open source technologies such as Lean that have the potential to provide stronger formal verification guarantees for software and AI systems,” he said.

“As agentic AI systems become increasingly autonomous, technologies that can provide stronger correctness and safety guarantees than just traditional testing will become ever more important.”

Van der Putten noted, however, that the inherent complexity of agentic AI development means more robust orchestration and governance is still of paramount importance.

“Enterprise agents operate within complex environments involving workflows, automated processes, policies, regulations, humans in the loop, multiple stakeholders, and countless exceptions and uncertainties that cannot simply be abstracted away but must be dealt with in practice,” he said.

“So even an agent whose behaviour has been verified against a specification must still be able to operate effectively in such a context,” Van der Putten added.

“In practice, the bigger challenge may lie in orchestrating agents, people, data, and systems together in a governed way, while reflecting ambiguity, trade-offs, conflicting objectives, and constantly evolving realities, rather than simply proving that an idealised agent behaves correctly.”

Open source backing

Backing for the FRO serves a broader purpose rather than complementing its own use of Lean, according to Amazon.

“It’s easier to trust a proof when you can evaluate the tools behind it yourself,” the company noted.

“Customers, auditors, and regulators can independently inspect and validate work done in community-governed tools, which is the kind of transparency that safety-critical AI demands.”

The firm said that in the long term, Lean’s growing popularity will benefit the AI industry by providing “more libraries, more tooling, and more formalized proofs for everyone”.

FOLLOW US ON SOCIAL MEDIA

Gartner has revised its IT spending forecast upwards due to an expected surge in AI-related infrastructure investment.

Global IT spending will hit $6.37 trillion this year, up 14.2% from last year, according to the analyst firm.

This marks a steep increase on an original forecast to reflect "increased confidence in overall market expansion" — but only in areas directly benefiting from AI adoption.

Traditional segments are predicted to post positive growth, but they will be "comparatively modest".

According to Gartner's revised prediction, spending on data centers is set to increase by 62.5% to $822 billion this year, nearly catching up with global devices spending.

That follows 51.6% growth last year, the analyst firm noted. Infrastructure as a Service (IaaS) builds on 25% growth in 2025, with a predicted 29.3% bump to $287 billion this year.

"Data center systems and infrastructure as a service (IaaS) are the top growth segments, reflecting accelerating investment in AI infrastructure, cloud platforms, and intelligent applications," said John-David Lovelock, distinguished VP analyst at Gartner.

"Building the compute capacity required for AI is the largest infrastructure project ever attempted by humanity,” he added.

“Driven by the expansion of AI workloads and demand for high-performance computing, hyperscalers and enterprises are rapidly scaling next-generation data center capacity."

Big tech providers are spending record sums on infrastructure, with a particular focus on new data centers optimized for AI.

Last week, Google-owner Alphabet again increased its capital expenditure plans for the year, from $180bn to $190bn to a new prediction of $195bn to $205bn — that follows a $5bn increase in the last quarter.

Amazon Web Services (AWS), meanwhile, plans to spend $200bn in capex this year with Meta setting aside $145bn.

Such spending has sparked concerns from investors, despite such companies also posting massive revenue from the cloud as hyperscalers. c

Constrained supply

Growth isn't good news for everyone, however, as massive AI infrastructure projects mean constrained supply for other areas of tech — leading to rising costs.

While software, services, and communications are posting significantly slower growth than AI-adjacent sectors, they remain the biggest segments for the sector.

Software is projected to record growth of 15.5%, a touch higher than last year, while services climbs slightly to 5.3%, and communications services nudges up only slightly to 4.4% this year.

Device growth is flat at 9.8% — not a surprise given the rising cost of smartphones and laptops, driven by an AI-fueled memory shortage.

"Despite the strong growth in spending, this is not a rising tide lifts all boats market trend," said Lovelock. "Technology budgets are being strained by inflation, supply shortages, rising hardware and memory costs, AI funding initiatives and shifting priorities."

Put simply, AI might be driving increased investment in related infrastructure and software — but the infrastructure build-out is causing shortages that are making devices more expensive by reducing supply.

"IT spending growth is being fuelled by rising investments in AI infrastructure and software. Organizations are spending more on AI optimized servers, cloud services, and AI-ready software as they expand their AI efforts, while hardware markets continue to adjust to semiconductor and memory supply constraints," added Lovelock.

"The fastest growth is expected in AI-related infrastructure, cloud services, and software, reflecting the strong focus on building and scaling AI capabilities across the enterprise."

FOLLOW US ON SOCIAL MEDIA

The National Oceanic and Atmospheric Administration (NOAA) has announced plans to modernize critical weather prediction capabilities as part of a deal with Google Cloud.

Under the terms of the deal, Google Cloud will serve as the primary high-performance computing (HPC) infrastructure provider for NOAA’s Weather and Climate Operational Supercomputing System (WCOSS).

This will see WCOSS move from traditional, on-premises hosting to a fully public cloud approach. The scientific agency said this will deliver a weather modelling system that is “more flexible and easy to update”.

NOAA Administrator Neil Jacobs said the shift to cloud-based HPC will “eliminate traditional bottlenecks” associated with on-prem systems and accelerate future research capabilities.

“Not only will this new approach provide access to the latest chips, it will advance weather forecasting by aligning operational and research compute and provide capabilities for elastic on-demand model development,” he said.

NOAA will begin migrating workloads from services such as the Global Forecast System and Global Ensemble Forecast System to the new cloud environment in early 2027.

The organization said it expects this transition to be completed by December next year.

Powering NOAA activities

Google Cloud H4D VMs will form the “primary computing backbone” for NOAA in its collaboration modernization push, the duo noted.

Powered by fifth-generation AMD Epyc processors, these are designed specifically for compute-intensive workloads such as numerical weather prediction (NWP).

Google Cloud said these will provide low-latency networking and the significant compute power required to handle “massive, tightly-coupled simulations” used in weather prediction.

NOAA touted three key advantages of switching to a cloud-based approach, including:

• Enabling “rapid updates and adaptations” in weather modelling
• Improving resilience and reducing downtime
• “Instantly increasing compute power” when required, such as during tropical storm seasons

“We are charting a course to global leadership in cloud-based numerical weather prediction,” said Ken Graham, director of NOAA’s National Weather Service.

“This is a significant achievement for NOAA; one that will ensure our critical modeling operations can seamlessly adapt to emerging science, and strengthen our mission to protect life and property.”

Long-term goals

The collaboration with Google Cloud builds on a long-running digital transformation strategy at the agency.

In December last year, NOAA announced plans to ramp up AI-powered weather modelling capabilities, which included the launch of the Artificial Intelligence Global Forecast System (AIGFS).

This, the organization said at the time, is a system that uses AI to speed up weather forecasting capabilities. NOAA revealed the cloud-hosted system uses up to 99.7% less computing resources compared to traditional counterparts.

Elsewhere, NOAA announced a series of contracts earlier this year to develop cloud-based technology for NWS forecasters at more than 120 local offices and centers across the United States.

NOAA and Google Cloud have long-standing ties dating back to 2011. The agency used Google DeepMind and Google Research’s WeatherNext model to predict landfall for Hurricane Melissa five days in advance, according to Google Cloud.

FOLLOW US ON SOCIAL MEDIA

The doom-sayers appear to be wrong about AI leading to job losses, with government figures showing that UK businesses are using the technology to automate roles and support staff, not replace them.

New data from the Office for National Statistics (ONS) suggests that firms are far more likely to use AI to improve operations than they are to reduce staffing levels.

Researchers found that, when asked how AI was being used internally, the most frequent answer was 'improving business processes', particularly among organizations with more than 50 employees.

AI adoption among UK businesses with 10 or more employees has almost tripled since late 2023, rising from around 12% to 35%. Larger organizations are leading the way, with 49% of those with 250 or more employees saying they use at least one AI system, compared with 28% of businesses with nine employees or fewer.

Notably, fewer than 10% of firms have reduced employee headcount as a result of AI, according to ONS figures.

But they're not taking on extra staff either, which is a problem. Just 1% of the smallest businesses and 1.2% of the largest businesses report increasing headcount as a direct result of AI. Around half of businesses report no change at all.

UK firms ramp up AI skills training

Businesses mostly said they were integrating AI skills into their workforce through training or reskilling existing staff.

Over 60% are doing so to reduce barriers to AI expertise within their workforce, and around 40% of medium- to large-sized businesses report integrating AI skills through training.

According to Fasthosts, which has analysed the data, fears that workers across multiple industries will be replaced may be unfounded.

"Economists are pushing to distinguish between task automation, where AI automates specific activities, and job automation, where an entire role disappears," the researchers said.

"Current evidence suggests that the former is occurring much faster than the latter, for example with tools such as AI receptionists which can step in by picking up routine enquiries when staff are unavailable. AI is primarily being used to automate repetitive tasks within existing jobs, rather than eliminate roles altogether."

Long-term gains

The World Economic Forum (WEF) predicts that technological change could create 170 million jobs while displacing 92 million by the end of the decade, resulting in a net increase of 78 million jobs.

As ITPro recently reported, UK firms specifically view AI as a long-term growth driver when it comes to jobs.

Analysis conducted by Box found 65% of business leaders expect their overall headcount to increase in the next three years, with just 14% expecting numbers to decrease.

Of those using agents, only 8% said the technology was eliminating existing roles. If anything, it was creating demand for new AI-focused expertise.

Nearly half are hiring ‘AI agent operators’, for example, with 32% adding ‘workflow automation specialists’.

Other key areas such as security and compliance, governance, and ethics all recorded significant AI-focused job growth.

FOLLOW US ON SOCIAL MEDIA

Microsoft has unveiled a new AI model for spotting security flaws in code, joining a growing crowd of companies targeting vulnerabilities with AI.

Part of a wider collection of AI agents designed to spot potential flaws in code, Microsoft’s MAI-Cyber-1-Flash works paired with OpenAI's GPT-5.4, and will be available via public preview beginning 3 August, the company said in a blog post.

The move follows a rush by AI companies into the security market, sparked by Anthropic's Claude Mythos with subsequent launches into the space by OpenAI.

As ITPro reported last week, Cisco made strides on this front with its Antares small language model (SLM) range, which the firm said is designed to run at a “fraction of the compute” expense of frontier security models.

Microsoft is taking a similar approach, saying that its MAI-Cyber-1-Flash model not only outperforms Mythos 5 and Google's 3.5 Flash Cyber on one specific benchmark, but that it'll also cost less to run.

Microsoft CEO Satya Nadella said the system would "give customers frontier-grade security at half the cost."

"This is the benefit of building the harness, context/signals, and action space separate from one model family,” he said in a post on X.

“By combining specialized models and data with the right agents, tools, security context, and harness, we can advance the frontier of cost to outcome."

This model is the first of Microsoft’s in-house range to focus specifically on cybersecurity and part of a wider push to promote the MAI range after launching in June.

Nadella in particular has been keen to push these models, with the Microsoft chief hailing their cost-efficiency compared to larger frontier models in a blog post last week.

Under the hood of MAI-Cyber-1-Flash

The MAI-Cyber-1-Flash model sits inside MDASH, Microsoft's Security multi-model agentic scanning harness. Multiple models can feed into the system, which then control more than 100 agents to spot bugs.

"MAI-Cyber-1-Flash is our first cybersecurity model, built ground up to find the most challenging vulnerabilities in complex code bases," Nadella said. "When combined with MDASH, it delivers world-class performance at 50 percent of the cost of leading models."

The system manages to top benchmarks at half the cost by using the cheaper MAI-Cyber-1-Flash model for 90% of tasks, with MDASH choosing to use the more costly GPT-5.4 only when necessary.

"That’s the power of a well-tuned, multi-model system with access to uniquely rich historical training data," added a blog post penned by Microsoft AI CEO Mustafa Suleyman and EVP for Microsoft Security Hayete Gallot. "It ensures you always have the best model at the best price for every task."

MAI-Cyber-1-Flash was unveiled alongside Project Perception, an agentic security product that pulls together "teams of specialized agents" into workflows to simulate attacks, detect and triage issues, and even patch them.

"Perception will also soon use MAI-Cyber-1-Flash for many more security workflows, beyond the software vulnerability work," the blog post added.

Microsoft is keen to stress that trust was built into all aspects of the system, saying it was tested by Microsoft's AI Red Team and includes encryption, auditability, and sandboxes with no internet access.

This, the company said, enables the "governance, security, and control enterprises expect”.

Microsoft’s safety focus here comes in the wake of a high-profile incident involving Hugging Face last week. OpenAI admitted that one of its security models slipped out of a testing environment and breached a Hugging Face production database.

"In this new environment, being able to go from identifying a new vulnerability to addressing it in real-time is critical," Suleyman and Gallot added in that blog post. "And while AI remediation of software vulnerabilities is now a key security workflow, there are many jobs to be done by Security practitioners themselves."

FOLLOW US ON SOCIAL MEDIA

NinjaOne has announced a new integration with ServiceNow, in a move the IT operations vendor said will give IT teams greater visibility across their environments while simplifying IT service desk workflows.

The move will enable organizations to share real-time endpoint data between the two platforms, helping IT teams automate incident management, improve asset visibility, and resolve issues faster without needing to switch between applications.

Texas-headquartered NinjaOne’s unified IT operations platform combines endpoint management, patch management, backup, and remote access through a single console.

According to the vendor, the offering supports more than 40,000 customers across 140 countries.

By integrating the offering with ServiceNow’s service management platform, NinjaOne said it is addressing the information gaps that can emerge when organizations rely on multiple IT management tools.

“NinjaOne’s integration with ServiceNow eliminates this problem by continuously updating IT data in ServiceNow as conditions change, providing real-time accuracy, and ensuring devices remain healthy,” explained Rahul Hirani, chief product officer at NinjaOne.

“As a result, our customers save time and resources, simplifying daily operations so they can deliver best-in-class IT support and services.”

Real-time visibility and proactive support

The new integration enables endpoint data from NinjaOne to flow directly into ServiceNow, allowing organizations to automatically update asset information, configuration management databases (CMDBs), patch status, endpoint records, and other configuration data.

According to the companies, alerts detected within NinjaOne can also automatically generate incidents in ServiceNow to help IT teams investigate and resolve issues before they affect end users.

Additionally, technicians can access and manage devices directly from within the ServiceNow platform, further reducing the need to move between multiple management tools.

NinjaOne said the move will provide customers with a single, real-time view of their IT environment that will help eliminate manual updates and improve data accuracy across service management and endpoint operations.

Commenting on the partnership, Alix Douglas, group vice president of global technology partnerships at ServiceNow, added that the integration will help organizations adopt a more proactive approach to IT support.

“The most resilient IT organisations are the ones that eliminate blind spots, and that starts with connecting endpoint intelligence to service management in real time,” he said.

“NinjaOne’s integration with ServiceNow gives IT teams a unified, current view of their environment, so they can move from reactive firefighting to proactive resolution.

“That’s the kind of seamless workflow intelligence that drives real productivity and delivers better experiences for employees.”

FOLLOW US ON SOCIAL MEDIA

Hugging Face CEO Clement Delangue has urged OpenAI to embrace “radical transparency” in the wake of a security incident involving the AI developer’s models.

In a post on X on 25 July, Delangue said he met with OpenAI executives and requested several remediations.

This includes $100 million-worth of compute resources to help build cyber defenses, and releasing the details of the hack for industry stakeholders to study.

“The first autonomous agent cyber attack is an unprecedented event,” he wrote. “It deserves an unprecedented response.”

OpenAI also took to X on 25 July to say it’s conducting a “thorough review” of the incident in coordination with unnamed external advisors and its own internal Safety and Security Committee.

OpenAI model ‘left notes’ for future

According to OpenAI, the incident unfolded during an internal evaluation in which models are prompted to examine attack methods.

The company said it regularly conducts testing in isolated environments, but restrictions to prevent models from “pursuing high-risk cyber activity” weren’t implemented this time.

According to Reuters, citing sources familiar with the matter, OpenAI models had reportedly displayed odd behaviours throughout testing. One agent was reportedly found to have “left notes” on its attack chain for future versions to refer to.

These notes are believed to have included information on how agents can break free from contained environments.

Notably, sources told Reuters the firm had no idea what happened until after the attack was contained.

OpenAI’s agent first broke out of its testing environment some time between 11 and 13 July but, reportedly, the company wasn’t aware until Hugging Face posted a blog detailing an attack by an “autonomous AI agent” on 16 July.

Official communication between the two firms commenced around 20 July, with OpenAI’s official confirmation coming on 21 July.

ITPro approached OpenAI for comment but did not receive a response by time of publication.

FOLLOW US ON SOCIAL MEDIA

Organizations could face a ticking quantum time-bomb, according to new research from DigiCert, with the vast majority aware that they aren’t properly prepared.

An overwhelming 85% of IT and security leaders believe that quantum computing advances will break existing security standards within a decade, yet only 7% have deployed quantum-safe certificates so far.

A key worry among survey respondents lies in the risk of ‘harvest now, decrypt later’ (HDNL) attacks. This refers to a method whereby threat actors steal and save encrypted data with the goal of cracking it later on using quantum computers.

More than eight-in-ten believe that at least some of their encrypted data is vulnerable to HDNL attacks right now, with around one-third reckoning that more than a quarter of it is vulnerable.

They expect financial transaction records and banking data to be targeted first, followed by cryptocurrency private keys and wallets.

Some respondents even pointed to politically sensitive disclosures and high-profile leaked documents, such as WikiLeaks-style disclosures and the Epstein files, as examples of information that could remain valuable to attackers for years.

"What's particularly concerning is that more than a third of UK organizations believe over a quarter of their encrypted data is already vulnerable to 'harvest now, decrypt later' attacks," said Simon Pamplin, CTO of Certes.

"For organizations handling financial data, customer records and personally identifiable information, this is no longer a future planning exercise. Data being stolen today will be exposed years from now if it isn't adequately protected."

A post-quantum cryptography roadmap

With the publication of the National Institute of Standards and Technology’s (NIST) post-quantum cryptography (PQC) standards in August 2024, organizations have been given a clearer path forward, and are at least starting to prepare.

Nearly nine-in-ten are planning, testing, or implementing PQC initiatives, while half have conducted quantum risk assessments, 45% have developed transition plans, and 44% have created cryptographic inventories.

Pamplin noted that the biggest obstacles to preparation aren’t awareness, however, it’s the "absolute complexity” of making cryptographic changes across an array of legacy applications, hybrid environments, and edge infrastructure.

These were “never designed with crypto agility in mind,” he said.

UK firms are acting fast

Preparedness appears to vary more by industry than geography. Retail was the only major industry where more respondents reported being unprepared than highly prepared, while manufacturing showed the greatest divide, with respondents split between feeling highly prepared and not prepared at all.

The UK reported the highest share of organizations identifying as leading edge, at 18%, closely followed by the US at 17% and Australia at 10%.

Cryptographic inventories, certificate visibility, migration planning, and crypto-agility are becoming foundational to quantum readiness, the researchers said.

Indeed, those that establish visibility early will be better positioned to prioritize migration, measure progress, and adapt as PQC becomes the new standard.

"Organizations need to stop thinking about post-quantum cryptography as simply replacing algorithms," said Pamplin.

"They should be focusing on protecting the data itself with a data-centric, crypto-agile approach that reduces risk today while creating a practical path to long-term quantum readiness."

FOLLOW US ON SOCIAL MEDIA

Knowledge workers are secretly yearning for the days before AI entered the mix, with three-in-ten saying they preferred work before adoption of the technology.

In a survey of office workers by digital transformation firm Adaptavist, 65% said they preferred the pre-AI era and 38% would remove generative AI tools from the world entirely if they had the chance.

Younger workers in particular are among those most frustrated by AI, with 40% of Gen Z and Millennials saying they would scrap generative AI tools, compared with 32% of Gen X and 29% of Boomers.

The findings mark a shift in feelings about AI, the researchers said. While businesses continue to invest heavily in the technology, public concern is growing over its impact on jobs, workplace surveillance, privacy, and security.

Meanwhile, AI has introduced new pressures for workers, eroded the value of skilled work, and left employees feeling less engaged and less valued than before.

"These findings point to an underlying gap we see in most AI implementations," said Neal Riley, AI innovation lead at Adaptavist.

"It is much easier for organizations to focus on adoption metrics – who is using AI, how often they are using it – than it is to measure its impact on the work itself."

Just over three-in-ten (31%) of the workers who said they'd like to get rid of AI said it was because they believed it reduces creativity. Almost as many had ethical doubts, with 29% citing concerns over misuse and 28% worrying about surveillance and privacy.

‘AI slop’ is a leading frustration

Notably, nearly half (46%) said that dealing with low-quality 'AI slop' makes their job feel less meaningful and more repetitive. More than one-third (37%), for example, admitted it has made them less engaged at work overall.

It's not as if workers are seeing the big efficiency benefits often associated with AI, the study found. More than four-in-ten (42%) now spend more time verifying and fact-checking AI output than they actually save by using it.

Almost half said that poor quality AI-generated work is actively slowing down their projects, while 55% believe it is reducing overall team efficiency.

The findings from Adaptavist align with recent research from ISC2, which found nearly two-thirds (65%) of cyber professionals are spending more time deciding whether to trust or act on AI-generated recommendations.

A similar number (63%) said they now find themselves reviewing and validating AI outputs, creating larger workloads and essentially wasting time on a daily basis.

‘AI slop’ has become a recurring buzzword over the last 18 months. Microsoft CEO Satya Nadella penned a blog post in January this year calling on the industry to disregard the term.

Yet research shows this is having a direct impact on workplace efficiency and productivity. As ITPro reported in January, analysis from Zapier found employees are working an extra four and a half hours each week cleaning up mistakes.

The consequences of not acting on low quality AI-generated outputs can be grave, the study noted. Respondents reported having had work rejected due to poor AI outputs, while others highlighted customer complaints and even security incidents.

AI is adding pressure

Workers are also feeling pressured, with half believing that their performance is now being compared – fairly or not – to AI-generated output.

Around a quarter are facing intense pressure to improve performance, improve quality, and be more efficient, just to keep pace in a machine-accelerated environment.

Another quarter said they use AI simply to meet workload demands, and 23% rely on the technology to keep up with colleagues.

"By understanding the nature of the work and the different value streams across your business, you can more accurately measure outcomes and impact rather than simply counting actions," said Riley.

"When AI is introduced thoughtfully, with the right guardrails and genuine support for the people using it, it can enhance rather than erode what makes work meaningful and impactful."

FOLLOW US ON SOCIAL MEDIA

Microsoft CEO Satya Nadella says the company plans to expand use of its MAI model range as the company looks to offer customers lower-cost AI options.

The in-house models, unveiled by the company in June, are designed for specific enterprise tasks and span a range of areas, including image and voice generation, audio transcription, and coding.

In a blog post on 23 July, Nadella outlined the tech giant’s new ‘Frontier Diffusion and Control’ strategy, which aims to help customers reduce reliance on costly frontier models and emphasize the importance of model choice for specific use-cases.

The move by Microsoft comes amidst growing concerns about spiralling AI costs over the last six months. With trends such as ‘tokenmaxxing’ and the shift toward consumption-based pricing, some companies have been left with hefty bills as AI use accelerates.

“In a world where software has real marginal cost for the first time, how do we ensure frontier benefits are diffused across the entire ecosystem?” Nadella wrote.

“The key is to optimize the cost-to-outcome frontier in real-world context,” he added. “In practical terms, that means using the right model for each task, and optimizing the context, skills, tools, and agent harness around it.”

Boxing clever with AI model selection

Nadella’s contention here is that these in-house models can give customers “frontier capabilities” albeit in a cheaper, bespoke capacity.

Simply put, these are domain-specific models based for an enterprise’s individual needs, not a one-size-fits-all frontier model such as those offered by OpenAI or Anthropic.

These still form part of the broader “orchestration system” used alongside MAI, but all amounts to helping users box clever when choosing what model to use.

“These models have been built ground up with clean data lineage and optimized for learning transfer from generalist to specialized skills in enterprise RLEs,” he explained.

This will require enterprises to implement evaluation processes when considering which model to use in which context, he said.

“Product-specific evals and model independence give us the control and a direct hill to climb, and to keep refining until we reach the right quality-cost target,” Nadella wrote.

“We are now seeing MAI models outperform general-purpose frontier models in many use-cases while using a fraction of the tokens.”

Internal testing of MAI for its own products has so far delivered “promising early results”, according to Nadella. The company has piloted the use of these models in GitHub Copilot, Outlook, and other Microsoft 365 services.

The company plans to take the same approach with Copilot Chat, PowerPoint, and other services, he added.

Nadella’s comments align closely with recent research from Gartner on rising AI costs.

While focusing primarily on the use of AI in software engineering, the consultancy told ITPro that enterprises should establish a “use-case-driven decision” framework when using the technology for certain tasks.

This, Gartner noted, will help reduce costs by encouraging users to stop needlessly allocating agents to tasks they’re not designed for.

Microsoft eyes model diversity

Nadella’s blog post marks the latest in a string of comments made by the Microsoft chief hinting at the company’s efforts to diversify model choice - and to stop pushing frontier models on customers.

In mid-July, he warned about the risks of relying too heavily on frontier AI labs, describing what he called the “reverse information paradox”.

Nadella said enterprises are essentially “paying twice” for AI services, handing too much data to providers, and receiving little benefit in return.

These providers, meanwhile, gain valuable insights into customer products that could help them refine - or build - competing options.

"If learning flows in only one direction, economic value converges toward the owners of the learning infrastructure rather than the creators of the knowledge itself," he said.

"Therefore, it’s imperative that we distribute the learning infrastructure to every firm so that they can control their own learning loop.

As ITPro noted at the time, his comments were peculiar given the close ties the tech giant maintains with OpenAI and Anthropic, whose models are deeply entwined across its core product range.

Microsoft's long-standing relationship with OpenAI saw it take the lead as the go-to model for its software services, yet this changed last year after striking a deal with Anthropic to give users greater choice.

FOLLOW US ON SOCIAL MEDIA

Barracuda Networks has announced a series of enhancements to its Partner Success Program in a move the cybersecurity vendor said will help MSPs and channel partners strengthen expertise and accelerate growth.

The initiative now includes new enablement, marketing, and partner engagement capabilities designed to improve operational efficiency, deepen technical knowledge, and unlock new business opportunities through the BarracudaONE cyber resilience platform.

The update includes expanded demand generation tools, enhanced marketing resources, and partner experience improvements, alongside additional training and certification options via the Barracuda Mastery Program.

In an announcement, Michelle Hodges, senior vice president of global channels and alliances at Barracuda, said the latest enhancements reflect the company’s continued commitment to partner success.

“At Barracuda, our partners are at the center of every decision we make, from product innovation to go-to-market execution," she commented. "We’re creating more opportunities for partners to engage customers, sharpen differentiation and grow their business — and making it easier than ever to do so.”

Expanded partner capabilities

As part of the update, Barracuda is introducing a new through-channel marketing automation platform that features co-branded campaigns, social and email syndication, and turnkey campaign execution to help partners generate demand.

The company also revealed that it plans to launch a Partner Locator tool designed to connect customers with certified partners and help drive high-intent sales opportunities.

On the training front, the Barracuda Mastery Program has been expanded with additional role-based learning, technical labs, and advanced sales and technical badges aimed at strengthening partner expertise and validating specialist skills.

Elsewhere, the company has introduced new role-based experiences and automation within its Partner Portal, including guided onboarding journeys designed to simplify engagement, accelerate time to value, and help businesses scale.

Commenting on the refresh, Sean Furman, president at STF Consulting, said the enhanced program will help partners strengthen their expertise while tapping into new revenue opportunities.

“Barracuda’s expanded training, certifications and partner recognition programs give us the tools to build expertise and stand out in a crowded market,” he explained.

“These investments elevate our credibility as a strategic advisor and translate directly into greater customer value, stronger retention and new opportunities to grow high margin recurring revenue.”

FOLLOW US ON SOCIAL MEDIA

Databricks and Microsoft are forging deeper ties with an expansion to the duo’s decade-long partnership, with a fresh focus placed on data management.

As part of the move, Databricks said it plans to expand use of Azure Databricks in core business operations and build a new, unified data lakehouse.

The move will also see the firm adopt Microsoft’s Arm-based VM infrastructure, Azure Cobalt, to “improve performance and efficiency”.

Microsoft, meanwhile, plans deeper integration of Databricks’ Data and AI platform across core product lines in a bid to provide customers with new tools such as Genie, the company’s flagship AI chatbot.

Databricks CEO and co-founder Ali Ghodsi said the expansion builds on long-standing ties and aims to accelerate customer data transformation efforts.

“For nearly a decade, Databricks and Microsoft have helped enterprises innovate with data and AI,” he said.

“Today, our partnership is stronger than ever. With Databricks Genie and Unity AI Gateway deeply integrated across Microsoft’s products, we’re helping enterprises unify their data and ground AI in business knowledge.”

Delivering business context

The partnership expansion aims to address key recurring hurdles for enterprises dabbling in AI innovation: data preparation and management.

AI systems, particularly agents, require fine-tuned data grounded in domain-specific context, according to the duo. Simply put, this means AI systems need to understand enterprise products, customers, operations, and general business processes to run efficiently.

A significant portion of enterprises are still struggling to bridge these gaps, however, and it risks derailing adoption processes, according to Judson Althoff, CEO of Microsoft’s commercial business.

“The next generation of AI will be defined by how effectively organizations turn their unique knowledge into intelligence,” Althoff said.

“Microsoft and Databricks are helping customers connect data, AI, and business context to accelerate decision-making and drive measurable impact.”

Databricks targets performance gains

A key focus of the partnership rests on expansion of Azure Cobalt for Databricks. The company said this will help improve performance and efficiency for agentic AI and ‘data-intensive’ workloads for customers.

The data analytics firm currently uses Cobalt 100. Looking ahead, the company plans to adopt Cobalt 200, which Microsoft noted offers up to 50% better performance and includes memory encryption by default.

Expansion of core business operations through Azure Databricks will also deliver performance improvements, the duo noted, enabling the firm to scale up capabilities for customers.

Genie integration

Deeper integration of Databricks’ Genie AI service within Azure also aims to simplify data management capabilities for customers, according to the firm.

Running the AI system directly within Microsoft environments will enable customers to ground and operate agents on data hosted within the cloud service. This means the AI tool will be “deeply integrated” with key Microsoft products, including:

• Azure Data Lake Storage
• Power BI
• Microsoft Foundry
• Microsoft 365, Teams, and Copilot

“These capabilities bring governed, real-time data and AI into business workflows, giving organisations the context, control, choice, and cost efficiency needed to drive impact,” the company said in a blog post.

FOLLOW US ON SOCIAL MEDIA

The UK’s National Cyber Security Centre (NCSC) has issued an alert over a new ‘zero-click’ threat campaign being waged by Russian state-backed hackers.

The advisory, published in collaboration with international partners, warned ‘beehive’ attacks by the ‘Laundry Bear’ threat group aim to steal email correspondence at organizations operating across a range of critical sectors.

This includes organizations in the defense, education, energy, and technology industries, as well as law enforcement and government agencies.

Attacks against these organizations all have a common theme, according to the NCSC, mainly the use of Zimbra Collaboration Suite (ZCS) software. Targeting focuses specifically on those using vulnerable versions of the software, the advisory noted.

Rather than requiring users to click a link or open a file, zero-click attacks mean users only have to view a malicious email to be compromised.

The NCSC urged organisations that use ZCS to follow mitigation advice, patch immediately, and “improve network monitoring capabilities”.

Crucially, analysis of the campaign found these techniques could be adapted to exploit vulnerabilities in other email software applications used by Western organizations.

“This phishing campaign demonstrates how hostile actors will ruthlessly adapt techniques and exploit vulnerable technology in pursuit of their aims to steal sensitive information from Western organizations,” said NCSC chief operating officer (COO) Beth Hopkins.

Ukrainian organizations used in testing

According to the NCSC, the techniques used by Laundry Bear were “extensively trialled” on Ukrainian victims before use against other Western nations. The security agency noted this is part of a growing trend among Russian threat groups.

Notably, technical analysis of the campaign also highlighted the use of AI in development of a “simple codebase” used during operations.

Zero-click attacks have surged in frequency over the last 12 months, research shows, with threat actors accelerating efforts to capitalize on vulnerabilities.

Analysis from Rapid7 found that vulnerability exploitation has now surpassed social engineering as the “largest initial access vector”, accounting for more than one-third (38%) of all attacks.

More than 50% of all exploited vulnerabilities involved zero-click attacks, rather than network-facing vulnerabilities, the study noted, highlighting evolving techniques by threat actors.

“These types of vulnerabilities require no authentication and no user interaction, giving attackers rapid pathways into exposed systems and edge infrastructure,” Rapid7 noted.

Dray Agha, senior manager of security operations at Huntress, said these types of exploits are a “worst-case scenario for defenders” as potential victims are only required to view malicious emails.

“Simply viewing the email in a vulnerable client triggers the compromise,” he explained. “This completely bypasses traditional employee security training and gives state-backed hackers a silent, invisible backdoor into sensitive communications without the victim ever making a mistake.”

Agha said the rise of these techniques mean organizations need to place a greater focus on regular patching to avoid falling prey.

“This is why defense-in-depth is advised, as where the human security layer is porous, the technical defensive layer can step in,” he said.

“Organizations shouldn’t just rely on their staff acting as a ‘human firewall’. Rapid software patching, coupled with layered technical defenses, is the only reliable safety net against modern state-sponsored threats.”

FOLLOW US ON SOCIAL MEDIA

AMD has expanded its Rocm software stack with a new AI-native component, Rocm.ai.

Rocm.ai, announced at AMD Advancing AI 2026, combines AI-assisted development, intelligent deployment, and AI-powered software optimization.

AMD claimed that AI software development is becoming increasingly agent-driven, with developers using AI coding agents and natural language processing to build and deploy software. AMD believes that Rocm.ai – and in particular the inclusion of AMD Skills in it – will reduce the barriers to adopting AMD Rocm and also reduce the amount of document crawling needed for set-up.

Speaking at AMD’s annual Advancing AI conference, Vamsi Boppana, SVP of AI at AMD said: “Rocm.ai … brings the capabilities of AI-assisted GPU programming to developers. It starts with a simple idea of giving developers access to the power of an AI ecosystem through the AI coding agents they already use. Whether you are using Cursor, Cloud, [or] Codex, Rocm.ai helps those agents understand AMD platforms, understand Rocm, and helps [developers] build and optimize [their] workloads.”

“In other words, we’re making those popular coding agents into Rocm superusers – you should be able to describe the workload you want to run, the performance target you want to hit, and then let the agents help you get there,” he said.

Breaking down Rocm.ai

Drilling down into what actually constitutes AMD Rocm.ai, there are three main components: Rocm CLI, AMD Skills, and Hyperloom.

Hyperloom is an AI-assisted optimization system that can, according to Boppana, analyze workloads, choose configurations, select and choose kernels, adjust parallelism strategies, and initiate towards performance goals.”

Boppana gave the example of a lead developer he recently spoke to who “pushed through a suite of 14,000 models through Hyperloom, optimizing them and creating valuable insights”.

“This would have been impossible to imagine, even with a large team of developers, before,” he said.

Rocm CLI, meanwhile, provides a unified command-line for installation, validation, servicing, updating, and troubleshooting of AI workloads on AMD platforms. AMD Skills integrates AMD-authored expertise into coding assistants like Claud, Cursor, and Codex.

“Let me make this concrete for you,” Boppana said on stage. “Imagine you’re a developer who wants to optimize Vmax… with PLLM on MI355s. Today, there are many things you need to get right. You need the right PLLM optimizations, the right model recipes, the right environment variables. You may need to write new kernels or optimize kernels – and then you need to tune all of this.

“With Rocm.ai, this interaction becomes much simpler. You can say ‘optimize Vmax entry with Hyperloom’ [hit] enter and behind the scenes, the agent does what an expert would do: pulls a known good recipe, runs and profiles the workload, creates and tests a bunch of kernel and runtime configurations, and it keeps iterating towards target.”

“Developers shouldn’t have to manually reason through every layer of model architecture, kernel selection, prompt strategy, and rack-level deployment,” said Boppana. “AI is transforming this experience and that’s a very, very big shift for AMD hardware and software.”

Rocm.ai be available from August 2026.

AMD and AI infrastructure company Cerebras have unveiled a joint system integrating AI infrastructure from both companies.

The joint solution, which was announced at AMD Advancing AI 2026, features AMD Helios – the star product of the show – and the Cerebras Wafer-Scale Engine.

According to Cerebras and AMD, it's intended to solve the issue of inference workloads having variable requirements when it comes to latency, throughput, token capacity, cost, and scale.

For example, agents and copilots need faster response times, whereas high-volume workloads prioritize maximum code generation, the organizations said.

By unifying Helios and Wafer-Scale Engine, the system optimizes the two stages of workflow independently: Helios is tuned to process prompts and large context windows, providing ultra-high throughput.

Wafer-Scale Engine, meanwhile, accelerates memory and bandwidth-intensive token generation with ultra-low latency.

“The demand for ultra-fast inference is growing at an unprecedented pace,” said Cerebras CEO and co-founder Andrew Feldman. “Partnering with AMD gives us an incredible opportunity to bring that performance to even more customers.”

AMD CEO Lisa Su added: “AI inference is becoming one of the largest infrastructure opportunities in AI and its growing diversity requires a more flexible approach.”

“Together with Cerebras, we are extending that leadership into the most latency-sensitive applications and creating a powerful new platform for real-time agentic AI.”

The joint solution will be available in the second half of 2026, initially through Cerebras Cloud.

The announcement comes alongside a number of other Helios partner announcements, including new commitments from Microsoft and Anthropic to roll out the system to their infrastructure.

FOLLOW US ON SOCIAL MEDIA

AMD has launched its latest Instinct GPUs, the MI455X, in tandem with bringing its Helios AI architecture into production at AMD Advancing AI 2026.

Helios, which was announced at last year’s annual conference, is the company’s flagship hardware product, integrating Epyc CPUs, Instinct GPUs, Pensando networking, and Rocm software stack.

“Helios is really the system that scales to be an AI factory,” said Andrew Dieckman, CVP and GM of data center and GPU at AMD. “We set out to build the world’s highest-performing rack and we believe we have delivered the world’s highest performing rack.”

According to AMD, Helios has 15% more AI compute, 50% more memory, and 50% more scale-out bandwidth than Nvidia’s competitor offering, Vera Rubin NVL72.

At the heart of Helios – the “engine” in Dieckman’s words – is the new AMD Instinct MI455X CPU. The MI400 series features increased HBM4 capacity and bandwidth, expanded AI formats with higher throughput, and standard-based rack-scale networking.

In Helios, the MI455X acts as the accelerator, delivering 40 petaflops of peak FB4 compute, with 423GB of HBM core and a peak memory bandwidth of 23.3 terabytes per second of memory per GPU.

In addition to the new MI455X GPU, Helios also features 6th Gen AMD Epyc server CPUs with 96 high-frequency cores and 1.6TB/s of memory bandwidth, as well as AMD Pensando and UALoE networking fabric.

This can scale up to 260TB/s bandwidth and host 72 GPUs on one domain.

AMD showcases Helios partners

With Helios already in production, AMD was keen to show off some of its partners that are deploying – or pledged to deploy – the system. These include OpenAI, Meta, Oracle, Microsoft, Dell Technologies, HPE, Lenovo, Bull, Cisco, Tensorwave, and more.

“Helios is a big step forward for AMD because we’re moving to a full rack-scale architecture where we provide all the components in a really co-designed engine and co-engineered rack, so that [customers] can get the full benefit out of the complete AMD end-to-end solution,” said Dieckman.

“We continue to be very focused on driving improved economics for our customers – making sure that we deliver the most tokens per dollar within the market.”

FOLLOW US ON SOCIAL MEDIA

Tokenomics has been a theme of many tech conferences this year and AMD has joined in the fun at this year’s Advancing AI conference.

At the heart of the tokenomics conversation is the move from chatbots and simple inference towards agentic AI. This is a real trend as noted by Digital Ocean and McKinsey and one that OEMs have locked onto hard.

While in previous years enterprise hardware vendors would wax lyrical about the importance of training LLMs on your own data (and how their hardware can help), if you listen for that chatter now you will hear nothing but crickets.

AI agents offer a range of benefits for enterprises – according to Digital Ocean’s research, 53% of the over 1,000 IT decision makers it spoke to saw productivity and time saving gains, while 44% said it had created new business opportunities.

There are also drawbacks, however, and one of the most apparent is the increased use of tokens, which leads to higher bills.

Whereas an individual using prompts to interact with an AI chatbot may use a few hundred tokens, agents can use up thousands.

As McKinsey explains: “Agentic tasks can consume roughly 1,000 times more tokens than code reasoning (single-turn problem-solving without tool interaction) or chat tasks (multi-turn dialogue about a coding problem).”

“The expensive part is not the first answer generated but the checking, repairing, and reverifying that follows,” the report continues. “About 60% of an agentic task’s costs, in fact, are tied to refining answers.”

This fact, and companies baulking at the related costs, hasn’t gone unnoticed among enterprise IT vendors, which are proposing their on-premises services as a way round this.

For AMD, this is a tricky path to tread, given it counts both traditional enterprise vendors like Dell, HPE, Lenovo, and Supermicro and public cloud-based services from OpenAI and Anthropic among its customers.

AMD’s performance focus

Michael Nordquist, CVP of product marketing for AMD’s computing and graphics group, diplomatically said that when it comes to considering the impact of tokenomics “it’s not all one way or all the other, it’s going to be hybrid. For some things local models work great, for some things you’re going to want that frontier model available for agent behaviour.”

From a practical perspective, AMD’s answer to this quandary has been to focus on how its own chips can (theoretically) reduce token-related costs, without taking sides on the public/on-premises debate.

“The theme [at Advancing AI] is really performance is the way that we can deliver the best economic value to our customers,” said Andrew Dieckman, CVP and GM for data center GPU at AMD.

“It’s the strongest dial that we have on the dashboard, so to speak,” Dieckman said, “so we’re very focused on that and then making sure that conveys to favorable economics for our customers because the cost of tokens as the world moves to inference is so important.”

Part of that focus is the company’s MI455X GPUs, announced at Advancing AI 2026 during AMD CEO Lisa Su’s keynote speech.

According to AMD, the MI455X has up to 18x lower token cost than its predecessor, the MI355X, while maintaining up to 34x higher token throughput.

“That delivers, really, the ability to serve more users with faster response times and significantly better economics,” Dieckman said.

FOLLOW US ON SOCIAL MEDIA

Nvidia CEO Jensen Huang has hailed the capabilities of Chinese open source AI models amidst growing interest in low-cost options for enterprises.

In an interview with Axios this week, the Nvidia chief said competition between open and closed-source models is positive for the broader global AI industry.

“The world needs open models,” he told Axios. “These Chinese models are excellent. Open source models that are excellent should be used”.

Huang’s comments come amidst growing interest in Chinese open source AI models in recent weeks. The Kimi K3 model, developed by Moonshot AI, temporarily paused subscriptions due to skyrocketing demand.

Surging interest in the Kimi K3 model bears similarities to that of DeepSeek, which rocked the US AI industry when it launched in early 2025.

A key advantage of these models lies in both their performance and cost efficiency, the latter of which has become a key focus for enterprises amidst growing concerns over spiralling AI costs in recent months.

As ITPro reported in November 2025, open source AI models often perform on-par with closed source options, and could potentially save enterprises millions in costs each year.

Open source models "routinely achieve 90% or more” of the performance of closed counterparts, the study noted. They also benefit from “significantly lower prices”, with operational costs plunging up to 84% in some cases.

In a research paper published by DeepSeek last year, the company said it spent a paltry amount training its flagship R1 model compared to US rivals who’ve spent billions on training purposes.

Anthropic CEO Dario Amodei suggested building a new AI model could cost over $100 billion in 2024.

Security concerns persist

While the popularity of Chinese AI models continues rising, concerns over security have been flagged repeatedly.

The concerns surrounding Chinese AI models typically focus on areas such as data privacy and national security, with some critics suggesting these tools could be used as a ‘backdoor’ for Chinese intelligence services.

Axios previously reported that the White House could consider imposing restrictions or tight conditions on US firms working with these models.

DeepSeek was subject to the same scrutiny during its rise to prominence across 2025, for example. In August last year, cybersecurity experts told ITPro that using DeepSeek equated to “printing out and handing over your confidential information”.

Huang told Axios that these concerns are a “misconception” and can be used by enterprises safely. On the topic of potential White House restrictions, Huang said this could prove counterproductive and that American firms should consider a breadth of options.

“You can download the models. You could fine-tune it, you can enhance it, you can guardrail it as you desire,” he said.

Huang has a vested interest on this front, however, and noted that increased usage will ultimately benefit Nvidia.

“If there’s great AI, even if it’s open, wherever it comes from, there will be more use,” he told Axios. “Whenever there’s more use, you’ll have to sell a lot more Nvidia computers. We’ll have to build more data centers. We’ll have more services. The technology will diffuse into more industries”.

Bill Conner, president and CEO Jitterbit, said the Kimi K3 launch marks a “clear turning point in accelerating global adoption of Chinese LLMs” but still urged caution with regard to security.

“Enterprises may underestimate the security, accountability, and governance risks associated with adopting new Chinese LLMs,” he said.

“Moonshot AI operates as a cloud service with data stored in China, introducing potential risks for organizations whose data may be shared unknowingly.”

Conner said adoption of Chinese AI models should be treated as a “strategic risk decision, not merely a cost-saving opportunity”.

FOLLOW US ON SOCIAL MEDIA

Six-in-ten ransomware victims are still paying up despite official advice not to do so.

That's according to research from security firm Proofpoint, which found that 58% of UK organizations hit by a ransomware attack agreed to pay ransoms.

Crucially, Proofpoint found they weren’t rewarded for bowing to cyber criminal demands. Nearly one-quarter (22%) who did pay were then hit with a second extortion demand.

The study from Proofpoint comes amidst growing calls to play hard ball with ransomware criminals by authorities. The UK's National Cyber Security Centre (NCSC), for example, advises against paying ransoms, warning that it encourages further attacks and may not lead to the return of data.

Despite that being the official advice for many years, plenty of companies pay criminals when faced with ransomware disruption to their business operations.

Security firm Trellix surveyed CISOs whose employers had been the target of ransomware attacks, finding in each instance they decided it was worth paying — with a third paying between $5 million and $15 million.

Those results were echoed by research from Cohesity that showed that while 94% of companies in the UK say they have a policy not to pay out in a ransomware attack, 97% still do.

The case for ransom bans

This disconnect has led to debate over banning ransomware payments, with the UK government saying last year it was considering forbidding public organizations from paying ransoms.

These proposals follow serious incidents at NHS bodies, the British Library, and Royal Mail in recent years.

The government already bans ransomware payments made by its own departments; a wider ban was backed by the government, but has yet to be brought into force.

That included a provision for mandatory reporting of ransomware payments for private companies not covered by the ban. One challenge is enforcement, as fines or other punishments for paying ransoms could risk further victimizing companies.

Evolving techniques raise the stakes

Elsewhere in the study, Proofpoint found new tactics are exacerbating the situation for enterprises.

Ransomware techniques have shifted away from data encryption to outright data theft – and that means companies can expect that data to be used for follow-up attacks or sold on criminal marketplaces.

The result here is that this extends the initial attack and impact for victims, according to Proofpoint.

The rise of AI has also made ransomware more effective, according to two-thirds of companies that faced an attack, particularly in terms of initial compromise.

"AI hasn't fundamentally changed ransomware, but it has materially improved the attacks that lead to it," said Ryan Kalember, chief strategy officer at Proofpoint. "Today's attackers are using AI to create highly convincing phishing emails and credential theft campaigns that exploit human trust at scale."

Hackers are using AI to write better phishing messages and to better hide their attacks, with 31% of those polled said staff didn't suspect anything was wrong when they interacted with malicious content.

Around one-quarter (24%) said attacks succeeded because they appeared to be authentic communications.

The Proofpoint survey found that malicious links remained the most common threat at 40%, followed by compromised email at 35% and credential harvesting at 32%.

"Organizations that continue treating ransomware as an endpoint or recovery problem are missing where these attacks most frequently begin: people, identities and trusted communications," added Kalember.

FOLLOW US ON SOCIAL MEDIA

Nebula has announced the appointment of Rob Kittler as partner acquisition manager, as the communications software specialist looks to expand its UK reseller and managed service provider (MSP) network.

Kittler will be responsible for growing the company’s existing community of more than 700 resellers and MSPs as it looks to build on recent growth.

He joins the business following seven years at Gamma, where he most recently served as head of connectivity practice. During his time there, he worked closely with the vendor’s network of channel partners across connectivity and mobile services.

In an announcement, Sam Giggle, managing director of channel at Nebula, said Kittler’s experience makes him well placed to support the company’s channel expansion ambitions.

"Partner acquisition isn't a numbers game for us, it's about finding MSPs who want a genuine growth partner, and giving them a platform and a programme they can build a business on,” he explained. “Rob has spent the best part of a decade at the heart of the UK channel, and he understands partners' businesses from the inside."

Headquartered in Guildford, Surrey, Nebula develops SaaS-based workplace communications software spanning voice, messaging, customer experience, AI, analytics, and collaboration services.

The firm’s proprietary CallSwitch One platform supports more than 200,000 daily active users and is delivered through its network of reseller and MSP partners.

Kittler’s appointment follows a year of strong growth for Nebula, which saw the company add 42,000 net new users to its CallSwitch One platform as well as complete the migration of almost 200,000 users onto its wholly owned IP network.

Commenting on his new role, Kittler described the channel as being at “an inflection point” as partners navigate a changing market landscape.

“M&A among partners is leaving resellers with sprawling product portfolios to rationalise, while at vendor level too much of the IP being sold is outsourced, owned and controlled by someone other than the vendor selling it,” he said.

“Nebula's position as an IP owner gives partners a level of influence over the roadmap they simply can't get elsewhere, and the pace of software development here made this an easy decision.”

FOLLOW US ON SOCIAL MEDIA

Google Cloud has recorded its best quarterly growth to date, with earnings reports showing revenue surging 82% to $24.8bn.

Across the wider company, Google-owner Alphabet saw revenue climb 24% to $119.8bn, with income up 30%.

Despite such gains, Google was still on the back foot, with share prices falling 3% after revealing a big boost in capital expenditure and being forced to defend delays to its top-end AI model.

"Q2 was an amazing quarter, with Alphabet revenues growing 24% year-over-year and Google Cloud revenues accelerating to 82% growth, driven by demand for AI infrastructure and AI solutions," said CEO Sundar Pichai in a statement. "It’s great to see wide adoption of Gemini Enterprise, with nearly 90% of the Fortune 100 using it."

"Our AI investments are redefining what’s possible across every part of our business."

Continued capex concerns

After the results were announced, Google admitted in a conference call it will increase its capital expenditure this year, which is largely focused on AI infrastructure spending such as data centers.

Last quarter, that was bumped up by $5bn to an already massive $180bn to $190bn, and it has now been increased to $195bn to $205bn.

Over the second quarter alone, Google recorded capex of $45bn, with most used to boost "technical infrastructure to support our investments in AI," said Anat Ashkenazi, senior VP and CFO, according to a transcript of the conference call.

"The increase in the range is primarily due to an acceleration in the delivery of capacity to meet growing demand," said Ashkenazi, adding that spending would "increase significantly" in 2027.

Google isn’t alone in dealing with surging capex rates. Amazon Web Services (AWS) is projected to spend $200bn and Meta plans as much as $145bn.

These huge outlays have sparked concerns about the cost of AI over the last 18 months, but industry leaders insist it's all part of the process. Pichai compared this stage of AI to the early days of the shift to the cloud.

"I do think it feels like we are in very early innings of what feels like a secular shift across multiple areas in our core information businesses just the possibilities when I see what all you can do with the absolute frontier capabilities, there's still a lot of work ahead to translate all that into experiences for our consumer users," he said, in response to an analyst question.

Ashkenazi added that "while we have increased our capacity quite significantly over the past 3 years, the demand still outpaces that investment."

AI delays

Google Cloud might be flying high, but concerns over AI model-related delays are rising among investors. The firm’s flagship model was once again delayed this week.

The company unveiled Gemini 3.6 Flash and a cyber-focused model, Gemini 3.5 Flash Cyber this week, following the lead of competitors such as Anthropic in the space.

However, Gemini 3.5 Pro wasn’t included in the launch after initially being set for release in June. Google said it would be made available "as soon as it's ready".

"Gemini 3.5 Pro is currently in testing and our team is already building the next generation of models," Pichai said on the conference call. "We have started our most ambitious pretraining run yet for Gemini 4 and are excited by the progress we are seeing at the frontier."

That didn't convince one analyst, Douglas Anmuth from JPMorgan Chase & Company, who asked about Pichai's confidence in keeping Gemini models at the frontier — the front of the pack, the leading edge of AI development.

Pichai defended Google's AI efforts, saying the company was "very committed and very confident of being at the frontier, and, model releases aside, remains a leader on "many attributes" — though he admitted work was needed on coding and agentic coding.

"I am very excited by the progress I'm seeing internally on Gemini 4, and I'm confident that people will be pleased when we are putting it outside," he added.

FOLLOW US ON SOCIAL MEDIA

Palo Alto Networks has announced the acquisition of application monitoring provider Embrace as the security giant targets real-time observability gains.

The firm said the acquisition will add “high-fidelity real user monitoring (RUM) capabilities” to its existing observability platform and provide customers with deeper insights into user activity.

As part of the announcement, Palo Alto Networks has also introduced Synthetics, a new service built with its Autonomous Digital Experience Management (ADEM) team.

Synthetics will help enterprises proactively validate application performance, the company noted, with these capabilities also extending improved observability to digital experience monitoring (DEM).

“Customers will gain a complete, unified view, from end-user interactions and proactive app validation to backend software and infrastructure, all on the industry's leading, innovative, cost-effective platform,” the company said in a blog post.

The Embrace deal comes hot on the heels of the Chronosphere acquisition, which also aimed to bolster observability capabilities for Palo Alto Networks.

The $3.35 billion acquisition, first announced in November 2025 and closed in January this year, saw the cybersecurity vendor combine Chronosphere's observability platform with its own Cortex AgentiX offering.

Terms of the Embrace deal were not disclosed.

Palo Alto Networks wants the ‘whole picture’

Lee Klarich, chief product and technology officer at Palo Alto Networks, said this latest acquisition aims to provide users with a comprehensive overview of application performance.

“To truly understand how their applications are performing, organisations need to see the whole picture - from the moment a user taps or clicks to what exactly happened on the backend,” he said.

“By combining Palo Alto Networks' leading Observability platform with Embrace's innovative Real User Monitoring and the organically developed Synthetic Monitoring capabilities, we'll deliver exactly that.”

Klarich said the firm also plans to take things “a step further” by linking these new capabilities with Cortex AgentiX.

“Organizations will be able to both see and automatically fix issues across their ecosystem,” he added. “This is what true platformization looks like in practice.”

Observability in the spotlight

Palo Alto’s observability focus comes amidst a critical time for enterprises globally, particularly with the influx of AI tools and agents across IT environments.

Modern applications are “increasingly complex and autonomous”, the company said in a blog post, and enterprises require more detailed performance visibility to ensure reliability.

“Embrace’s proven RUM capabilities are built for modern environments, allowing customers to deliver applications that scale at the pace of AI,” the firm noted.

“Sythetics will leverage Palo Alto Networks’ globally distributed infrastructure to proactively validate application availability and performance from strategic locations across the globe.”

FOLLOW US ON SOCIAL MEDIA

Samsung has revealed three new foldable models, including the Galaxy Z Fold 8 Ultra, and an all-new shape for the standard Z Fold 8.

The Galaxy Unpacked launch, which also included a new Flip 8, included many new features, such as a new durable titanium structure and more on-device AI tools and capabilities.

Of the three new models, the Z Fold 8 Ultra is the biggest and highest-spec'd. Folded, it looks like a standard phone thanks to an ever-decreasing thickness (5.9mm folded, 4.1 mm unfolded).

It has a 6.5in cover display and opens up to an 8in main display, which is essentially two 6.5in screens side by side.

On first impression, the Z Fold 8 Ultra is better in every way than before. It's slightly thinner and somehow stronger.

This is thanks to a new titanium structure beneath the display that includes a panel and plate that reinforce the folding mechanisms and make it stronger and more durable than before, while maintaining its thin, streamlined look.

Beneath those titanium additions is a 5000mAh battery that promises 27 hours of video playback and 45w fast charge with 67% in just 30 minutes.

You get five camera lenses on the 8 Ultra, with a 10MP selfie lens on the cover display, a 10MP lens on the main display, and then three cameras on the rear of the device: A 200MP wide lens, a 50MP ultrawide one, and a 10MP telephoto lens.

From our brief experience ahead of its launch, we found the camera setup on the Fold 8 Ultra to be very crisp and dynamic.

Powering all of this is the Qualcomm Snapdragon Elite 8 chip (CPU, NPU, GPU), and that is the case for all three new models. It's also been customised for Samsung's OS to provide more on-device AI tools, like the new 'Now Nudge' feature, which is like an information overlay that was launched in beta on the S26.

It takes contextual information from apps and offers suggestions via the keyboard – similar to predictive text. It can appear across multiple parts of the screen or in a more subtle way called 'Ambient Nudge ' or simply 'Notification Nudge'.

Samsung Galaxy Z Fold 8 and Galaxy Z Flip 8

Now Nudge is also on the new Z Fold 8, which comes in a distinctive new shape. It's a slightly wider, more square design compared to the Ultra. Similar to Huawei's Pura X smartphone, but much bigger.

When unfolded, it has a 4:3 aspect ratio (3:4 in portrait), which is more suited to the types of content we consume, according to Samsung. So reels and scrolling video content can be viewed in their entirety.

Folded, the 8 has a 10.16in cover display and looks very square. And it unfolds to a 7.6in main display – almost an inch smaller than the Ultra, but arguably a more content-friendly size.

The other differences from the Ultra are a slightly smaller battery at 4,800mAh, and no telephoto lens. Instead, you have a pair of 50MP lenses, one wide and the other ultrawide. It still promises 26 hours of video playback.

As with the most recent Galaxy S26, video stabilization is a big feature on the Z Fold 8. This is best used in the My Fan Cam feature, which allows for instant cropping of video.

You can select a subject from a 16x9 video and have it cut to a vertical shot – you can even select an object or person, regardless of where they are in the frame, and have them as the main focus within a crop.

There is also a new Flip 8, though this is of the least business interest. It's lighter than before and thinner too (180g, 6.1mm thick, when folded).

You have a 50MP main camera and an intuitive Flex Window on the cover display that offers suggestions and automations for you to operate the phone quickly without opening it up every time.

OpenAI has admitted that its own AI models breached Hugging Face systems as part of a security test gone wrong.

In a blog post on 21 July, the firm revealed models escaped testing environments and gained unauthorized access to the AI hosting platform's production database.

Notably, OpenAI revealed the incident involved a pre-release, cyber-focused model.

“After investigating, we now know that this particular incident was driven by a combination of OpenAI models – including GPT-5.6 Sol and an even more capable pre-release model, all with reduced cyber refusals for evaluation purposes – while being internally tested on a benchmark of cyber capabilities,” the company wrote.

The admission comes after days of speculation amidst reports that an "external AI agent” had hacked the company. Hugging Face issued an alert last week warning that a breach had exposed internal datasets and user credentials.

How OpenAI hacked Hugging Face

According to OpenAI, the incident occurred during an internal evaluation in which models were prompted to examine potential attack paths.

The aim here is to evaluate their cyber capabilities within an isolated environment, and crucially, without certain restrictions to prevent said models from “pursuing high-risk cyber activity”.

“Our benchmarks run in a highly isolated environment, with network access constrained to the ability to install packages through an internally hosted third-party software that acts as a proxy and cache for package registries,” the company explained.

Both models “identified and chained” vulnerabilities across both OpenAI’s research environment and Hugging Face’s infrastructure, with the aim of gathering test solutions from the latter’s production database.

In this case, the models appear to have focused heavily on ExploitGym, a publicly-hosted benchmark tool used to evaluate how AI agents can turn software vulnerabilities into working exploits.

Notably, OpenAI revealed the models “identified and exploited a zero-day vulnerability” in the package installer registry. After successfully exploiting this zero-day, the models conducted a “series of privilege escalation and lateral movement actions” which allowed it to escape the test environment and gain full internet access.

“After gaining internet access, the models inferred that Hugging Face potentially hosted models, datasets, and solutions for ExploitGym,” the company noted.

“Knowing this, the model searched for and successfully found ways to gain access to secret information that it could use to cheat the evaluation.”

In one example, OpenAI revealed the model chained together several attack vectors using a combination of stolen credentials and zero-day flaws to identify a remote code execution (RCE) path on Hugging Face servers.

What comes next?

OpenAI has detailed a series of actions it’s already taken in the wake of the incident, including closer coordination with Hugging Face to conduct a wider review.

This also includes bringing Hugging Face into the firm’s trusted access program to help bolster defenses by harnessing the company’s model capabilities.

Crucially, OpenAI revealed it will now implement “strict controls” to ensure vulnerability testing is limited while flaws are being patched.

“We consider this incident to be an unprecedented cyber incident, involving state-of-the-art cyber capabilities, and are responding accordingly,” OpenAI wrote.

“We will continue to conduct a thorough investigation alongside Hugging Face and will share more details on the vulnerabilities, incident, and findings when our investigation is complete.”

Initial response hampered

A key talking point in the wake of the incident rests on Hugging Face’s response to the breach.

The company noted that the attack was initially flagged by AI detection tools, with security teams using LLM-based anomaly detection to “separate real signals from the daily noise”.

Subsequent attempts to use AI in a post-mortem proved troublesome, however, largely due to the guardrails placed around commercially-available models.

“When we started the log analysis, we first used frontier models behind commercial APIs,” the company explained.

“This did not work: the analysis requires submitting large volumes of real attack commands, exploit payloads, and C2 artifacts, and these requests were blocked by the providers’ safety guardrails, which cannot distinguish an incident responder from an attacker”.

These hurdles meant Hugging Face turned to GLM 5.2 – an open-weight model from Chinese company Z.ai – run on its own infrastructure.

While this proved beneficial in terms of preventing attacker data or leaked credentials from leaving the company’s environment, it does raise broader questions around responsible use and how well-intentioned safety measures could hinder incident response.

“This experience points to a gap worth planning for,” Hugging Face wrote. “We do not know which model powered the attacker’s agents, whether a jailbroken hosted model or an unrestricted open-weight one; either way, the attacker was bound by no usage policy, while our own forensic work was blocked by the guardrails of the hosted models we first tried.”

A new wave of AI-powered attacks

This incident comes amidst growing concerns about the potential risks associated with powerful new AI models. When Anthropic launched Claude Mythos earlier this year, it did so as part of a gated release to prevent the model from falling into the wrong hands.

These powerful new cyber-focused models are causing headaches for security professionals worldwide, particularly around vulnerability identification and disclosure and patching timelines.

Apple, for example, recently announced plans to accelerate patching schedules due to concerns about threat actors using AI to identify software vulnerabilities.

As ITPro reported in April, researchers at Forescout warned of a pending ‘vulnerability explosion’ as AI advances help identify flaws at record pace.

Jake Moore, global cybersecurity advisor at ESET, suggested the industry could be entering the “next phase of AI-powered cyber crime” in which trusted platforms are prime targets.

“Threat actors are inserting malware into the AI components that developers often quickly trust, making AI platforms an attractive new target for supply chain attacks,” he said.

“We’ll likely see more of these attacks as organizations are worryingly rushing to build AI into products without fully knowing the potential risks.”

Art Gilliland, CEO of identity security firm Delinea, echoed Moore’s comments, noting that the breach highlights a familiar pattern with AI-related incidents.

“An AI agent escalated privileges, moved through internal infrastructure once it broke containment, and ran unchecked for a full weekend before anyone could reconstruct what happened,” he said.

“If your AI agents carry standing privilege the way human accounts do, you've already lost the ability to stop this in real time. The question every security team should be asking right now isn't just whether their AI agents have standing access; it's whether anyone would notice if an agent used it and could cut it off before it caused damage.''

Moore also flagged similar concerns to Hugging Face with regard to safeguards for western AI models. He warned that some providers “need to rethink how their security guardrails work if they are hindering incident response”.

“If not, more companies will simply switch to other models without such controls – ironically, the same models likely used by AI attackers.”

FOLLOW US ON SOCIAL MEDIA

Cyber experts have urged users of Palo Alto Networks' GlobalProtect VPN to patch immediately amidst active exploitation of an upgraded security flaw.

A flaw in the popular VPN service, tracked as CVE-2026-0257, could allow attackers to bypass authentication and establish an unauthorized connection.

The vulnerability primarily affects the GlobalProtect portal and gateway for Palo Alto Networks’ PAN-OS software, and carries a CVSS score of 7.8, rating it as ‘high’ in severity.

Notably, this rating follows an upgrade, with the flaw having previously been given a ‘medium’ severity rating. Palo Alto announced the upgrade late last week amidst reports that the flaw was now being exploited in the wild.

“Palo Alto Networks has become aware of limited exploit attempts on unpatched PAN-OS devices without mitigations applied,” the company said in an advisory.

Analysis by Rapid7 shows threat actors have been exploiting the vulnerability since mid-May across several waves of attacks.

“Rapid7 MDR identified successful exploitation across numerous customers; however, we did not observe any indication of successful lateral movement from the devices,” researchers said.

“The earliest date for observed exploitation was May 17, 2026. As of May 29, 2026, this vulnerability has been added to the CISA KEV.”

Rapid7 noted that customers compromised in this wave of attacks had Cloud Authentication Service (CAS) disabled. Others, meanwhile, had GlobalProtect portal or gateway authentication override cookies enabled.

A patch has been issued for customers running affected appliances, according to Palo Alto.

Similarly, administrators are advised to turn off authentication override features to mitigate potential exploitation.

Qilin ransomware involved in GlobalProtect attacks

Analysis by Arctic Wolf Labs suggests attacks on GlobalProtect customers could be the work of the Qilin ransomware group or affiliates. Indeed, researchers detected Qilin ransomware during several instances across June, highlighting a range of tell-tale signs.

“Post-exploitation tradecraft varies across intrusions, from rapid encryption-only operations to full double extortion, possibly suggesting multiple affiliates operating under the Qilin ransomware as a service (RaaS) umbrella,” the company said.

Dray Agha, senior manager for Huntress’ security operations center, said these attacks highlight the growing threats posed to VPNs and firewalls.

"The exploitation of this GlobalProtect vulnerability by the Qilin ransomware gang demonstrates that perimeter defences are prime targets,” he said.

“When threat actors can bypass VPN authentication, they are walking through the digital front door with a master key. The grace period for patching critical edge devices has practically vanished, and they must be the patching priority for all organizations".

FOLLOW US ON SOCIAL MEDIA

NetApp has announced the acquisition of California-based AI data infrastructure specialist DataPelago, in a move the company said will improve performance for AI and analytics workloads.

The deal will see DataPelago’s technology integrated into NetApp’s portfolio, enabling GPU-accelerated processing directly within the storage layer rather than requiring data to be moved into separate compute environments.

According to NetApp, the move will help customers reduce their infrastructure costs while improving performance for AI and analytics workloads by processing data at its source.

In an announcement, NetApp CEO George Kurian said the acquisition strengthens the company’s aim of giving customers “full command” of their data.

"As AI models and the chips that power them get ever more effective, enterprises need data infrastructure that is just as intelligent and powerful to harness the potential of their data," he commented.

"With DataPelago, we are extending our ability to help customers understand and process their data with the agility required to unleash competitive advantage.”

Founded in 2021, California-based DataPelago develops AI data infrastructure designed to accelerate data processing for AI and analytics workloads. Its technology focuses on reducing the complexity and cost of preparing enterprise data for AI by enabling processing closer to where data is stored.

At the heart of DataPelago’s offering lies its Nucleus engine, which uses GPU and CPU acceleration to process data directly where it resides.

According to the company, the technology eliminates the need to copy enterprise data into separate AI environments, reducing infrastructure costs by up to 80% while delivering performance improvements of up to ten times compared with conventional approaches.

By embedding the technology into its storage platform, NetApp said customers will be able to prepare, govern, and activate enterprise data for AI without moving it between environments, helping to remove one of the biggest bottlenecks facing AI deployments.

"NetApp manages more enterprise data across more environments than anyone in the industry," said Syam Nair, Chief Product Officer at NetApp.

“The next phase of AI will be won by those who make that data work at the source, and the DataPelago team brings the technical depth and velocity to get us there faster."

Upon completion of the acquisition, DataPelago will operate as a wholly owned subsidiary of NetApp.

Commenting on the acquisition, DataPelago founder and CEO Rajan Goyal said joining NetApp would allow the company to bring its technology to a wider enterprise customer base.

"Joining NetApp gives us the opportunity to combine our breakthrough processing technology with the industry's best data infrastructure portfolio,” he explained.

“Enterprises have invested billions in GPUs and AI models, but their data remains fragmented, leaving valuable computing resources to sit idle rather than putting these investments to work.

“Together, we’re positioned to help customers simplify and accelerate AI deployment at scale."

Financial terms of the acquisition were not disclosed.

FOLLOW US ON SOCIAL MEDIA

AI minister Kanishka Narayan has been given a seat in incoming prime minister Andy Burnham’s cabinet following a reshuffle.

Narayan described the move as a sign of Burnham’s “deep commitment to AI’s importance” to the UK economy.

“AI is likely the most significant technology in human history. Its impact will dwarf other things,” Narayan said in a post on X.

“The best case for it is compelling beyond our dreams: a reindustrialised Britain, stronger national security, public services transformed for the better. The risks, too, are real: it is right that the British public shares those worries, for jobs, for the pace of change.”

The move comes as the UK's Department for Science, Innovation, and Technology (DSIT), where the AI minister role used to sit, has been scrapped in the wake of Burnham’s appointment.

Under the new setup, DSIT responsibilities will be merged with the freshly minted Department for Business, Innovation, Science, and Trade (DBIST), led by Jonathan Reynolds.

The role of technology secretary has also been cut.

AI focus welcomed

Mark Boost, chief executive of UK-based cloud computing firm, Civo, said retaining and elevating Narayan is a reassuring signal for UK businesses.

“Giving the AI minister direct access to cabinet decisions demonstrates that the government recognizes AI’s existential importance to our future economy,” he said.

“Positioned inside a high-powered business and trade department, an AI Minister with Cabinet authority will have real leverage to break down cross-Whitehall silos, accelerate national AI infrastructure, and give British tech companies the proactive backing needed to maintain a competitive global advantage.”

Andy McLean, CEO of the UK Semiconductor Centre, echoed Boost’s comments, noting that Narayan’s new role is a “positive signal of the importance being placed on AI at the center of government”.

Boost added, however, that any delays to AI-related initiatives caused by the DSIT shake-up could have a significant impact on global competitiveness.

“Any Whitehall restructuring brings administrative friction, and because the global tech and AI arms race is moving so quickly, the UK simply cannot afford a pause,” he said.

“Critical initiatives like the AI Opportunities Action Plan and sovereign infrastructure investments must be ring-fenced from bureaucratic delays.”

FOLLOW US ON SOCIAL MEDIA

Cisco has unveiled a new range of cyber-capable small language models (SLMs) aimed at supercharging security operations.

The Antares range, which comes in two forms (Antares-350M and Antares-1B) will be made available as open-weight models via Hugging Face. According to Cisco, the aim here is to provide a codebase vulnerability tool that's far cheaper than general of frontier models.

While the Antares SLMs will operate as specialized models alongside frontier and generalized models, the company promised they will run at a "fraction of the compute expense."

"Benchmark testing shows that these models outperform many powerful closed- and open-weight models in this critical security task at a fraction of the cost," said Amin Karbasi, VP and chief scientist for Cisco Foundation AI.

“And they’re compact enough to run locally, heading off the need to send sensitive codebases to the cloud.”

The move by Cisco comes amidst wider concerns about the rising costs of AI, exacerbated by changes to billing and pricing that have caused bills to shoot up across the industry.

Some companies, including Accenture, have told staff to cut back on AI use as a result of skyrocketing prices. Indeed, one report suggested AI could cost more than developer salaries within a few years.

At the same time, AI is making inroads into security – faster than some expected – with the rise of cyber-focused models such as Anthropic's Claude Mythos.

How Cisco’s Antares models work

Antares is designed to mimic how a human investigator would work their way through a code repository – though Cisco noted the aim wasn't to replace human judgement, but to make it easier to manage the work.

The models can help with locating files that relate to a vulnerability warning, trigger investigations based on advisories, support development workflows that use vulnerable files, and more.

Cisco noted that the decision to release the Antares range as open-weight models means they’re easier to work with and improve.

"We are releasing Antares as open-weight because the security community needs more accessible building blocks for practical, repository-level defense," said Karbasi.

"Cisco's efforts are connected by a common belief: AI in security has to move beyond impressive one-off demos and toward systems that practitioners can evaluate, govern, and improve."

Tackling complexity

Cisco said that Antares was built to address two concerns when it comes to code: the complexity of checking it for vulnerabilities and the costs of using AI for that task.

First, Karbasi said that it was difficult to apply vulnerability knowledge — advisories, vulnerability alerts and severities, and so on — to a company's internal code.

"That work is difficult because repositories are large, security signals are noisy, and the relevant evidence is rarely in one obvious place," he said.

"Analysts often need to search through unfamiliar code, follow naming conventions, inspect call paths, compare candidate files, and decide whether a weakness is actually present."

How cheap is Antares?

AI can help with that challenge, but the high costs of general or frontier models mean it often isn't practical, in particular for public sector organizations, universities, and smaller security teams.

"Compact models reduce inference costs, support local or on-premises operations, and help teams keep sensitive source code within their own environment," Karbasi said.

So just how cheap are the Antares models? Cisco said that running a 500-entry evaluation using Antares took 15 minutes on a single GPU at a cost of less than $1.

Cisco noted that this was 15-times cheaper than the best available open source model and a whopping 172-times cheaper than the top-end frontier model.

"The goal is to build toward a system where all security practitioners, regardless of on-prem or resource constraints, can effectively incorporate AI in everyday security operations," Karbasi added.

FOLLOW US ON SOCIAL MEDIA

Nearly three-quarters (74%) of companies have reworked security team structures due to the influx of AI tools, and that’s sparking high demand for cyber pros with dedicated skills.

New research from SANS Institute found the rise of dedicated, AI-focused roles in cybersecurity is driving up salaries across the industry.

High-end salaries for AI security roles now top $260,000 (£194,000), with positions such as Post-Quantum Cryptography Migration Specialists and AI governance leads in high demand.

Pointing to a review of UK vacancies on LinkedIn, SANS Institute noted that there are thousands of AI security positions being advertised online, suggesting that hiring for such roles has "moved from prediction to present-day reality".

That suggests that AI isn't taking over cybersecurity jobs, but changing which skills are necessary for the work, the organization said.

"Routine analytical work is increasingly automated, while demand is accelerating for professionals who can secure AI systems, govern AI risk, conduct AI red teaming and orchestrate AI-powered security operations," the institute said.

A new wave of cybersecurity roles

Dedicated AI roles spanning a range of security-related areas are popping up across the industry, SANS noted. AI security engineers, for example, are in hot demand, now commanding salaries of around $185,000 on average.

Roles focused on specific areas and threats are also emerging, the study noted. Ads for AI Identity Deepfake Defense Specialists have been identified. While it’s a wordy job title, the study noted that this shows the impact of trends such as deepfake voice fraud.

Professionals in these roles can command salaries of between $130,000–$175,000 (£97,000–£131,000), the institute noted.

Long-term, the organization expects these new specialist careers will lead to premium salaries due to intensifying demand for skills.

Other new AI-related roles identified by SANS Institute include:

• AI Governance, Risk & Compliance Lead ($240,000 salary)
• AI Red Team Specialist (up to $220,000)
• AI Supply Chain Security Engineer (up to $185,000)

Intriguing new roles include AI Incident Response Orchestrator, AI threat intelligence analyst, and AI SOC Orchestrator were also highlighted by the institute.

Growing quantum focus

It’s not just AI reshaping roles and sparking heightened demand for cyber pros with specific skills, however.

Dedicated quantum-related cybersecurity roles are also growing in frequency, the study found, as organisations ramp up preparations for ‘Q-Day’.

This is the point at which quantum computers can break traditional encryption techniques. While the debate on when this comes still rages, many enterprises are looking ahead to this point - and job ads reflect this.

SANS Institute pointed to roles such as Post-Quantum Cryptography Migration Specialists – a position focused on reacting to looming mass breaking of current encryption by quantum computers – saying it could earn above $260,000.

Reshaping team structures

The study from SANS Institute isn’t the first to highlight the impact AI is having on team structures. As ITPro reported earlier this month, the same shift is occurring in software development due to the influx of AI tools.

Research from Gartner predicts that 60% of enterprises will rework software development units into ‘tiny teams’ by 2030.

While this shift toward ‘smaller’ teams may have alarm bells ringing for developers, the consultancy noted that this won’t necessarily spell bad news.

This transition won’t be a cost-cutting effort or attempt to reduce headcount, but will instead focus on creating more focused, specialized units.

FOLLOW US ON SOCIAL MEDIA

Microsoft has announced it will deploy AMD’s Helios rack-scale solution as it targets data processing and AI inference gains for Azure customers.

The collaboration will see three new AMD EPYC CPU-powered virtual machine (VM) offerings made available through Azure. These include:

• HDv2 VMs
• HCx2 VMs
• ND MI455X v7 VMs

The first of these, Azure HDv2, is designed for large-scale data processing and to “empower massive agentic workload adoption”.

Featuring 500 sixth-generation EPYC CPU cores, HDv2 VMs boast 4TB of RAM, 32TB of local NVMe storage, and 500Gbps Azure Boost networking capabilities.

Azure HCx2 VMs, meanwhile, are designed primarily for silicon design and technical computing tasks, such as scientific simulations and engineering analysis.

This series builds on the design of Azure HX virtual machines, which the company launched in partnership with AMD in 2023.

HXv2 VMs will include 176 AMD sixth-gen EPYC CPU cores. These offer “significantly increased” per-VM and per-core performance and will also include 800GB InfinBand for “large-scale MPI-based simulations”.

Elsewhere, the ND MI455X v7 specifically targets “production-scale” AI inference improvements for Azure customers.

“ND MI455X v7 is designed for the reasoning, search and agentic workloads behind modern AI services,” Microsoft said in a blog post.

“Powered by the AMD Helios rackscale solution, it expands Azure’s infrastructure options for large-scale inference and is designed to deliver strong performance and efficiency for demanding AI workloads.”

The move makes Microsoft the latest in a string of big tech customers flocking to the Helios system. AMD chief executive Lisa Su said the deal builds on long-standing ties between the duo.

“AMD and Microsoft have spent years building high-performance infrastructure together, and today we're extending that partnership across the full stack of AMD AI solutions on Azure,” said AMD CEO Lisa Su.

“Microsoft's new AMD deployments mark an important milestone as we deliver leadership compute solutions to Azure customers and scale the next generation of AI infrastructure together.”

Microsoft targets “scale and choice” for customers

Helios is AMD’s first rack-scale system designed specifically for frontier model training and large-scale AI inference. The system combines AMD Instinct MI455X GPUs, AMD EPYC “Venice” CPUs, Pensando networking, and ROCm software..

Microsoft CEO Satya Nadella said the collaboration marks a significant expansion of Azure infrastructure capabilities.

“Customers are looking for AI infrastructure that is optimized for a wide range of workloads, from training and inference to data preparation, search, and reinforcement learning," he said.

"Through our collaboration with AMD, we are expanding the Azure infrastructure portfolio with AMD Helios to give customers the performance, scale and choice they need to build and run the next generation of AI applications.”

Helios roll-out pending

AMD unveiled the Helios rack-scale solution at its 2025 Advancing AI conference. The solution offers an alternative to – and competes with – Nvidia’s Vera Rubin and Grace Blackwell systems.

At the time, Su described the launch of Helios as a “game changer” that’s “purpose built for the most demanding AI workloads”.

A host of major tech providers, including Meta, OpenAI, HPE, and Oracle have since confirmed they’ll deploy the solution in data centers.

The chipmaker will begin shipping Helios to customers in the second half of 2026.

Although exact timelines haven’t been revealed, the collaboration with Microsoft comes just days ahead of AMD’s 2026 Advancing AI conference, in which customers can likely expect real-world examples of the system in action.

ITPro will be live on the ground in San Francisco for AMD’s annual conference this week.

Stay up-to-date with all the news, views, and announcements from the event by following our socials (below) and subscribing to our daily newsletter.

FOLLOW US ON SOCIAL MEDIA

Achieving true tech sovereignty could be a bridge too far for Europe, a senior Forrester analyst has told ITPro, as new research from the consultancy lays bare the scale of the challenge.

According to Forrester’s Global Sovereignty Forecast, the shift to bolster tech sovereignty will move “slowly over the next five years”, with many efforts to divest from US tech providers falling flat.

The report includes a ‘Tech Sovereignty Index’ used to measure a country’s ability to “develop, operate, and secure critical technologies independently” - and it paints a damning picture.

Between 2025 and 2030, European countries are only expected to make “modest” gains in building sovereignty. Germany’s score is expected to rise from 34% to just 36%, for example, while the UK from 30% to 32%.

This slow progress flies in the face of what has become a key recurring talking point in Europe over the last 18 months. Calls have been rising to cut reliance on US-based technology providers, largely due to a combination of rising geopolitical tensions and data privacy concerns.

Speaking to ITPro, Dario Maisto, principal analyst and lead author of the report, suggested the current focus on sovereignty is much like other tech industry trends: awash by hype.

“There is a lot of hype around sovereignty, because service providers see it as the money maker,” he told ITPro. “So why should an organization engage with me? Well, sovereignty.”

For many organizations, Maisto noted that the focus on sovereignty isn’t actually required from a compliance perspective, albeit in some limited capacities.

“I was watching a Red Hat presentation in the morning, and they said there are a lot of new regulations. No, there's not. There's none. There is no new regulation that mandates sovereignty in any way whatsoever,” he said.

“Nor is there any definition at any possible level, national, regional, international, for sovereignty. There are some requirements in terms of data residency, citizenship of people handling certain workloads, certain workloads being deployed on on-prem rather than public cloud … but there is no formal, overarching obligation towards sovereignty whatsoever.”

“Persistent dependencies” run deep in Europe

Maisto admitted that geopolitical tensions, particularly deteriorating transatlantic ties, have indeed prompted a rethink of how heavily European organizations rely on US providers.

The idea of a wholesale shift away from popular vendors would require a monumental effort, however. Combined, Amazon Web Services (AWS), Microsoft Azure, and Google Cloud control 65% of the European cloud market.

“There is not much that we can do about it. Certain SaaS applications, for example, do not even work outside of the hyperscalers clouds,” he said. “So you have two options as a client: either take the degraded, not complete, less serviced, less updated on-prem version, which you can, or you get the most updated, the fanciest, the shiniest cloud version.”

“But then you are forced to deploy on a hyperscaler because the APIs don’t work outside of the hyperscaler cloud. Moving these applications outside of the hyperscaler cloud, it's not a lift and shift.

“It's not something that the client can do.”

Elsewhere, Europe simply doesn’t have the capabilities when it comes to macroeconomic considerations. When gauging sovereignty credentials, Forrester’s index takes into account a range of factors, including:

• Government spending
• Tech workforce availability
• Data center capacity and autonomy
• Chip production
• Rare earth elements processing
• AI model creation

Forrester noted that “persistent dependences” in areas such as energy infrastructure, data center infrastructure, and supply chains could hamper the region’s ability to operate independently of both US and Chinese technology ecosystems.

Back down to earth

Maisto’s argument is that the reality of achieving true tech sovereignty often fails to acknowledge the significant investment required to reach this point – along with the potential disruption and legwork needed to move away from US-based providers.

“I think seven out of 10 international SaaS solutions are out of the US,” he said. “So how feasible is it that organizations replace 20 years of investment in Salesforce, in Workday, in ServiceNow overnight?”

Put simply, it’s an idealized vision borne out of the reactionary, tumultuous geopolitics at play in the world right now.

“So many people see sovereignty as a green field,” he said. “For organizations that have been investing millions, if not billions, in cloud migrations, task transformation, it's not about greenfield. It's a retrofit.”

These questions are what prompted the creation of what Maisto described as the “minimum viable sovereignty model” used in the Tech Sovereignty Index.

“How do I do the least possible investments now to get the sovereignty that I actually need, what is it I actually need to be compliant? Maybe to mitigate a risk, and what is it I can actually achieve?”

Lifting and shifting anyway

Despite the difficulties highlighted by Maisto, efforts to bolster sovereignty have been gaining traction across Europe over the last year. In April, authorities in France announced plans to move away from Windows in favor of Linux-based operating systems for some 2.5 million government devices.

Speaking at the time, David Amiel, minister of public action and accounts, said the country aims to become “less reliant on American tools and regain control of our digital destiny”.

At an EU-wide level, similar efforts are being made. As ITPro reported in June, the European Commission unveiled the technological sovereignty package.

This aims to reduce reliance on US tech and shake up the union’s capabilities across several areas, spanning AI, cloud computing, open source, and semiconductor manufacturing.

On the latter of these focus areas, Maisto noted that this is a “move in the right direction because we need more options” in terms of hardware manufacturing.

At present, Europe accounts for less than 10% of global chip manufacturing, according to Forrester. Crucially, it lacks the “large designers that can compete with the likes of Nvidia or Qualcomm”.

All told, European companies design only 1% of global chips.

Maisto suggested this once again shows the scale of the challenge faced both by individual European nations and the region as a whole under EU leadership.

Looking ahead, he said the focus for many will be to “manage the dependencies rather than avoiding them”.

FOLLOW US ON SOCIAL MEDIA