Best of LinkedIn: ICT & Tech Insights CW 03/ 04

00:00:00: This episode is provided by Thomas Alguyer and Frenus based on the most relevant LinkedIn posts about ICT and tech insights from CW three and four.

00:00:08: Frenus supports ICT enterprises with market and competitive intelligence, decoding emerging technologies, customer insights, regulatory shifts, and competitor strategies.

00:00:18: So product teams and strategy leaders don't just react, but shape the future.

00:00:23: And, you know, shaping the future has never felt more critical.

00:00:27: We're looking at calendar weeks three and four of twenty twenty six and the.

00:00:31: the conversation out there was definitely intense.

00:00:33: It really was.

00:00:35: Welcome back to another deep dive.

00:00:37: We are closing out January and I have to say the whole vibe on LinkedIn has shifted.

00:00:42: It wasn't the usual New Year New Tech excitement.

00:00:45: It felt.

00:00:46: Heavier.

00:00:47: Heavier

00:00:47: is a good word.

00:00:48: I don't say it feels sober.

00:00:49: We sort of move past the hype cycle of, look at this amazing thing we can build and land it right in the middle of, okay, how do we keep this all from breaking?

00:00:56: Exactly.

00:00:57: It's less about dreaming up new features and more about operational resilience, you know, the actual nuts and bolts of survival.

00:01:03: It feels like everyone's finally looking at the messy wiring under the desk.

00:01:06: That's a perfect analogy.

00:01:08: We're seeing posts about execution, not just theory.

00:01:11: So today we're going to dig into three big clusters that really define the conversation these past two weeks.

00:01:17: Okay, let's lay them out.

00:01:18: First, there's this huge mindset shift in cybersecurity.

00:01:22: Then there's the heavy hammer of regulation, specifically the Cyber Resilience

00:01:26: Act.

00:01:27: And finally the rise of what's being called agentic AI and all the guardrails we desperately need to build around it.

00:01:34: Let's start with that mindset shift then.

00:01:36: Cyber security and resilience.

00:01:38: For what?

00:01:39: the last decade the whole pitch has been about building a higher wall.

00:01:42: right keep the bad guys out right.

00:01:45: prevention.

00:01:46: But looking at the insights from these past couple of weeks especially from someone like Emily Walters That whole narrative seems to be dead in the water.

00:01:54: Oh, it's not just dead It's become a dangerous way to think.

00:01:56: yeah Emily shared this takeaway from a session with a rubric that just perfectly captured the mood.

00:02:01: What was that?

00:02:02: She said the energy in the room completely changed when they stopped talking about prevention and pivoted to the much more uncomfortable question, which was, how long will it take us to recover?

00:02:13: That feels like admitting defeat, doesn't it?

00:02:15: Like, we know we can't stop them, so let's just get good at cleaning up the mess.

00:02:19: I see it more as realism.

00:02:21: I mean, if you assume you can stop a hundred percent of attacks, you're living in a fantasy.

00:02:25: But if you assume you will be breached, you start preparing in a totally different way.

00:02:29: And the scale of what needs to be recovered is just... it's mind-boggling.

00:02:35: Emily shared that stat from Grant Denning about data volume.

00:02:38: Oh, the forty hexabytes.

00:02:39: I'm still trying to wrap my head around that number.

00:02:41: I saw that.

00:02:42: It's one of those numbers that's so big it just becomes noise.

00:02:45: Well, Grant gave a visualization for it.

00:02:47: He said forty hexabytes is the same as playing four point five billion Dua Lipa songs on a loop.

00:02:52: for thirty-one thousand years.

00:02:55: Thirty-one

00:02:55: thousand years of Dua Lipa.

00:02:57: I like her music, but that sounds like a special kind of punishment.

00:03:01: It's a terrifying amount of pop music, but it's an even more terrifying amount of data to have to restore when you're under pressure.

00:03:08: And

00:03:08: the assumption has always been, well, if we get hit, we just go to the backups.

00:03:12: But that assumes the backups are even there, which

00:03:15: might not be the case.

00:03:15: Precisely.

00:03:16: And that's the dangerous assumption Nicholas C. pointed out.

00:03:20: This is the industry's sort of dirty secret.

00:03:23: Ransomware gangs know you have backups.

00:03:26: So what's the first thing they do?

00:03:27: They

00:03:27: hunt the backups.

00:03:29: Exactly.

00:03:29: They encrypt your safety net before they set fire to the main stage.

00:03:34: He highlighted that a lot of protected data just isn't recoverable when it really counts.

00:03:39: That is a CIO's nightmare.

00:03:41: You're watching the primary system burn, you turn to the backup server, and it's already a pile of

00:03:45: ash.

00:03:46: Which is why the whole conversation has moved to immutable backups.

00:03:49: It just means a copy of your data that cannot be changed or deleted.

00:03:53: It has to be truly isolated.

00:03:55: So it's not a backup if it's on the same network, it's just another target.

00:03:59: Exactly.

00:04:00: But it's not just a technical fix, is it?

00:04:02: There's the human element.

00:04:03: Kate Baker and Simon Linstead were talking about this on the Resilience Factor podcast.

00:04:07: Right.

00:04:07: And I loved how they framed it.

00:04:09: They said, planning for failure is a superpower.

00:04:12: It sounds wrong, but the idea is that when things inevitably break, you need the mental space to respond, not just react.

00:04:20: It's the difference between a pilot who's trained for an engine failure and a passenger just screaming.

00:04:25: Yes,

00:04:26: panic is a security vulnerability.

00:04:28: If you haven't planned for failure, you make bad decisions.

00:04:31: You pay ransoms, you shouldn't.

00:04:33: And that panic spreads.

00:04:35: Annette Newman highlighted the WEF Global Cybersecurity Outlook.

00:04:39: And the big point was that these incidents are now ecosystem problems.

00:04:42: They ripple outwards.

00:04:44: The blast radius is just so much bigger now, it's not.

00:04:46: My server is down, it's my supplier server is down, so now I can't build my product.

00:04:50: Francis West had a really grim real-world example of this with a London Council data breach.

00:04:55: The initial hack was bad enough, but what happened next was the real damage.

00:05:00: And the follow-up attacks.

00:05:01: Right.

00:05:02: Scammers used the stolen data to call residents, pretending to be from the council.

00:05:06: And because they had real information, people believed them.

00:05:09: The damage shifted from the institution to the individual.

00:05:12: That's insidious.

00:05:13: It is.

00:05:14: Which brings us back to what Bugragonku was saying.

00:05:16: You can't solve this with a better policy document.

00:05:20: Resilience is an architectural choice.

00:05:22: You need technology that isolates threats instantly.

00:05:25: Containment.

00:05:26: Exactly.

00:05:27: If you're waiting for a human to see a flashing red light, you've already lost.

00:05:31: And if that logic isn't enough to convince a company to spend the money, well, the government is about to do the convincing for them.

00:05:38: Which is the perfect segue to our second cluster.

00:05:41: Regulation.

00:05:42: The heavy stuff.

00:05:44: Now, usually when you say governance and compliance, I can feel listeners reaching for the skip button.

00:05:49: It sounds like paperwork.

00:05:50: It

00:05:50: does.

00:05:51: But this doesn't feel like paperwork.

00:05:52: This feels existential.

00:05:53: It absolutely is.

00:05:55: Aachen Friedland put it so bluntly when he was talking about the EU Cyber Resilience Act, the CRA.

00:06:00: He said, the CRA is not a compliance exercise.

00:06:03: It is an engineering audit.

00:06:05: An engineering audit.

00:06:06: Let's just pause on that phrase.

00:06:07: That sounds... Invasive and expensive.

00:06:11: It means you can't just write a policy that says we take security seriously.

00:06:14: Regulators want to look under the hood.

00:06:16: They want to see how the software is actually built and maintained.

00:06:19: You need proof, not promises.

00:06:21: And the timeline is way tighter than I think people realize.

00:06:24: Stenny broke it down.

00:06:26: By September, twenty twenty six, that's just months away.

00:06:29: Suppliers have to report exploited vulnerabilities within twenty four hours.

00:06:33: Twenty four hours.

00:06:35: I mean, in some big companies, it takes twenty-four hours just to schedule the meeting to discuss if something is a vulnerability.

00:06:41: Right.

00:06:41: This forces a total rewiring of incident response.

00:06:45: But the real cliff edge, Sten pointed out, is December twenty-twenty-seven.

00:06:50: After that date, you could only buy CRA-compliant products in the EU.

00:06:54: That's

00:06:54: the shakeout.

00:06:55: That's the seismic shift.

00:06:57: If you make cars... And one of your suppliers for a tiny piece of software decides the CRA is too much work, you legally cannot buy from them anymore.

00:07:04: So the non-compliant vendors just disappear from the market.

00:07:08: They'll have to.

00:07:09: Stan warned this is going to drive up prices and reduce options.

00:07:13: It's survival of the fittest, and fittest means being able to prove your engineering.

00:07:17: And the process of even creating these standards was chaotic.

00:07:21: Valerie Arora, who worked on them, said the whole thing relies on underpaid experts.

00:07:26: A fragile foundation for something so massive.

00:07:29: But the standards are done.

00:07:30: They're here.

00:07:31: So if you're a tech leader listening to this and starting to panic, where do you even start?

00:07:36: Dr.

00:07:36: Jesus Molina had a really clever way of thinking about it.

00:07:39: I love this.

00:07:40: He said, start backward.

00:07:42: Don't read the law first.

00:07:43: Start with the CE marking on your product's box.

00:07:46: The little stamp that says it's safe for Europe.

00:07:48: Right.

00:07:49: Can you explain in detail why your product deserves that mark?

00:07:54: If you can't trace the security from the code all the way to that stamp, you're in trouble.

00:07:58: So you work backward from the mark to the evidence to the architecture.

00:08:01: That's actually brilliant.

00:08:02: It turns a legal problem into an engineering one.

00:08:05: And this applies to NIS-II as well.

00:08:07: Antonio Gonzalez-Brigueño mentioned its impact on the auto sector.

00:08:10: Yes, and NIS-II is all about forcing a clean story on identity and access.

00:08:15: For year, factory security was based on trust.

00:08:18: You know, only Bob uses that terminal and Bob's a good guy.

00:08:21: Good guy defense.

00:08:22: Which

00:08:23: doesn't hold up.

00:08:24: Yes.

00:08:24: NIS-II demands you prove it, which exposes all these gaps.

00:08:27: It's forcing proper identity and access management into places that have never had it.

00:08:31: So again, it's engineering over intentions.

00:08:33: You have to build it in.

00:08:34: You can't just hope for it.

00:08:35: And if we think securing a factory full of humans is hard, Let's talk about securing systems full of AI.

00:08:41: That's where this identity problem gets truly wild.

00:08:45: Okay, let's move to theme three.

00:08:47: AI.

00:08:47: We're not talking about chat GPT writing poems anymore.

00:08:50: The conversation has shifted hard to agentic AI.

00:08:54: This is the critical distinction.

00:08:55: Generative AI makes content.

00:08:57: Agentic AI takes actions.

00:08:59: One tells you how to book a flight.

00:09:01: The other logs in with your credit card and actually books the flight.

00:09:04: And JoyDeepD said the biggest risk here isn't adoption, it's resilience.

00:09:08: These agents can create autonomous cascading failures that our current IT systems just can't handle.

00:09:14: It's the sorcerer's apprentice problem.

00:09:16: A normal script fails, it stops.

00:09:18: An agentic AI fails, it might try to fix the problem by, I don't know, accessing another system or retrying a thousand times.

00:09:26: It can execute mistakes at machine speed.

00:09:28: That is genuinely terrifying.

00:09:30: It's a bug with admin privileges and a caffeine addiction.

00:09:33: Joanna Myler argued this changes what secure even means.

00:09:38: The attack surface isn't a network port anymore.

00:09:40: It's the AI's decisions.

00:09:42: The new security is decision integrity.

00:09:44: Can you trust why it made that choice?

00:09:47: Exactly.

00:09:48: What can this AI identity access execute and approve.

00:09:52: We have to treat them less like software and more like new employees who need strict permissions.

00:09:56: Peter Holcomb got technical on this with the model context protocol, the MCP.

00:10:01: Why is that so important?

00:10:03: Think of it as the language these agents use to talk to our systems.

00:10:05: We're giving them digital doors to open.

00:10:07: And Peter's warning was that if we don't build proper authentication, who are you?

00:10:12: And authorization, what are you allowed to do into those doors?

00:10:15: We're leaving them wide open.

00:10:17: We are.

00:10:18: And developers are often good at the, who are you part, but terrible at the, what are you allowed to do part?

00:10:23: They give the marketing AI keys to the entire database.

00:10:27: But there is a flip side.

00:10:29: Francis Odom talked about using the same tech for defense, the AI SOC, using agents in the security operations center.

00:10:35: Right, this is the big shift in MDR.

00:10:37: Right now, a human analyst sees an alert and has to manually pivot between five different systems to investigate.

00:10:44: Protective

00:10:45: work.

00:10:45: It is.

00:10:46: But an AI agent can do all that deterministic work in milliseconds.

00:10:50: Francis says we're moving from humans pivoting to humans reviewing AI conclusions.

00:10:56: The human becomes the judge, not the detective.

00:10:58: It's the only way to keep up.

00:10:59: Shigen Olusanya applied this to aviation, calling it autonomous resilience.

00:11:03: When a flight system is attacked, you have milliseconds to respond.

00:11:06: You need AI defending against AI.

00:11:09: Autonomous resilience, that feels like the phrase of the year.

00:11:11: The system has to heal itself because we're too slow.

00:11:14: It's the new reality.

00:11:15: And speaking of things that can break our systems faster than we can fix them, we have to briefly touch on quantum.

00:11:21: Right, theme four, the quantum threat.

00:11:24: This always feels like science fiction, something for the twenty thirty five roadmap.

00:11:28: But Steve Suarez was basically screaming that post-quantum cryptography, PQC, is a problem for today.

00:11:34: It is because of one strategy.

00:11:36: Harvest now, decrypt later.

00:11:39: Attackers are stealing encrypted data right now.

00:11:41: They can't read it yet.

00:11:42: But they're storing it, waiting for a quantum computer powerful enough to crack it open.

00:11:46: So data that needs to be secret for the next ten years is already at risk.

00:11:50: It's already compromised, you just don't know it yet.

00:11:52: Steve said every twenty-twenty-six roadmap needs two things.

00:11:55: Crypto agility.

00:11:57: the ability to swap out your encryption easily and a migration plan.

00:12:00: Start now.

00:12:01: Philip Bintelora had a positive spin on it though.

00:12:03: He said, don't just see this as a cost.

00:12:06: See it as a chance to modernize ancient infrastructure.

00:12:08: Use the crisis to clean up your technical debt.

00:12:10: Okay, let's take a breath.

00:12:12: From thirty-one thousand years of Dua Lipa to engineering audits to AI agents with the keys to the kingdom.

00:12:18: What's the one through line here?

00:12:19: I think the common thread is the death of passive security.

00:12:22: The end of set it and forget it.

00:12:24: It's all active now.

00:12:25: It's hyperactive.

00:12:26: In twenty twenty six, you can't just buy a tool and walk away.

00:12:30: You have to actively engineer for recovery.

00:12:32: You have to engineer for compliance and you have to engineer your AI for decision integrity.

00:12:37: The black box era is over.

00:12:39: You have to be able to explain how it works and how

00:12:42: it recovers.

00:12:42: If you can't, you aren't resilient.

00:12:44: And in this market, if you aren't resilient, you might as well not exist.

00:12:47: That

00:12:47: is the takeaway.

00:12:48: Resilience isn't a feature.

00:12:50: It's the baseline for existence.

00:12:52: And it's a leadership issue now, not just an IT problem.

00:12:55: Absolutely.

00:12:55: Well,

00:12:56: that brings us to the end of this deep dive into the ICT landscape of early twenty-twenty-six.

00:13:02: If you enjoyed this episode, new episodes drop every two weeks.

00:13:05: Also, check out our other editions on cloud, defense tech, digital products and services, artificial intelligence, sustainability and green ICT, defense tech and health tech.

00:13:15: Thanks for listening, everyone.

00:13:16: Good luck out there.

00:13:17: Make sure to subscribe to stay ahead of the curve.

00:13:19: Goodbye.