Rich Tehrani

Cybersecurity Awareness Month came with a difficult backdrop: a succession of security disclosures involving familiar companies and the software and services businesses depend on. Railway. OpenCode. Binance. Polymarket. Fireworks AI. LiteLLM. Capcom. Cursor's extension marketplace. Customer information associated with Coinbase through an outside provider. The list reached across industries, while vulnerabilities in PHP created another urgent problem for organizations running affected software. These were different incidents with different consequences. Some involved stolen information or credentials. Others involved malicious software distribution, unauthorized transactions or precautionary service interruptions. Several investigations remained preliminary. Taken together, they illustrate a business problem that extends beyond any individual headline: your security depends partly on the access, software and providers connected to your organization. apextechservices.com/topics/…

When the comedians have more sense than most politicians - you know the west is heading towards a bad place.

A wealth-management client may be unable to access a portfolio statement minutes before a scheduled review. At the same time, a branch employee could be locked out of a lending application while an automated monitoring system opens several nearly identical alerts. A conventional queue records these as tickets; a financial-services helpdesk must distinguish their identities, regulatory implications, business impact, and appropriate escalation paths. That distinction is driving firms to reconsider how client support, internal information technology support, cybersecurity operations, and specialist teams work together. The objective is not merely faster closure. It is accurate resolution with a defensible record of who accessed information, what changed, and when the case moved between teams. Buyers should begin by mapping demand into service categories. Typical examples include password resets, multifactor-authentication failures, transaction inquiries, account-access problems, employee device incidents, suspicious-email reports, and requests involving personally identifiable information. Each category needs an explicit workflow. A multifactor-authentication failure, an unsuccessful attempt to verify a user through two or more credential types, might query Microsoft Entra ID, verify device enrollment through Microsoft Intune, and route suspected account compromise to the security operations team. A request to change client data may require identity verification, role-based approval, and a tamper-evident audit entry before an agent can act. The National Institute of Standards and Technology’s Digital Identity Guidelines provide current technical guidance for authentication and authenticator management. Ticket volume alone provides weak guidance. Buyers should also examine: insight.tmcnet.com/insight/h…

A software session border controller (SBC) is a virtualized or cloud-deployed system that secures and controls real-time voice and video sessions. Asia-Pacific service providers should compare options by interoperability, resilience, latency, security, operability, and total cost. Session border controllers once sat at a relatively clear boundary: the service provider network on one side and external Session Initiation Protocol (SIP) traffic on the other. That boundary is now distributed across public clouds, IP Multimedia Subsystem (IMS) cores, enterprise collaboration systems, Web Real-Time Communication (WebRTC) applications, contact centers, and regional interconnects. The Asia-Pacific telecom-cloud market generated approximately $14.6 billion in 2025 and is forecast by Grand View Research to grow at a 24.7% compound annual growth rate from 2026 through 2033. According to a GlobalData forecast, Asia-Pacific will reach 4.6 billion 5G subscriptions by 2030, up from 2.7 billion in 2025. This expansion changes the SBC buying conversation. Capacity remains relevant, but deployment flexibility, automation, policy control, and continuity across multiple network domains now require rigorous evaluation. The International Telecommunication Union reported that 5G networks covered 55% of the global population in 2025, with coverage varying substantially by region and income level. Reporting from Tech Wire Asia also found that Asia-Pacific accounted for 36% of commercial network-slicing offerings worldwide in 2025. Network slicing divides shared mobile infrastructure into policy-controlled logical networks, creating additional requirements for traffic separation, service assurance, and enforcement. insight.tmcnet.com/insight/c…

Oracle products can strengthen Los Angeles pharmacy operations by connecting dispensing, payer portals, prescriber outreach, patient calls, and clinical notes. This addresses rejected prescriptions whose medication is available while claim, authorization, and care records remain out of sync. The scale makes those handoffs consequential. The ncpa.org reports that independent pharmacies averaged 65,795 prescriptions per store in 2025, with generic products representing 81% of prescriptions. It also reports that independent pharmacies accounted for nearly 37% of U.S. retail pharmacies in 2026. Dispensing is only part of the workload. According to the same ncpa.org, 91% of surveyed independent pharmacies provided flu immunizations, 81% offered medication-therapy management, and 62% performed blood-pressure monitoring in 2025. Each service generates scheduling, consent, clinical-documentation, billing, inventory, and reporting data. For Los Angeles metro operators, the practical question is straightforward: Which records should remain in the pharmacy system, and which should flow into an Oracle environment for finance, analytics, workforce management, or clinical exchange? A buyer evaluating Oracle products should map actual transactions before comparing product demonstrations. The map should include an NCPDP SCRIPT prescription from the prescriber, an NCPDP telecommunications claim to the payer, an HL7 FHIR immunization record, a wholesaler purchase order, and a general-ledger entry. insight.tmcnet.com/insight/h…

Data breaches have become a routine operating risk rather than an occasional crisis. Privacy Rights Clearinghouse recorded 1,969 reported events affecting at least 343 million people in the first half of 2026. Hacking accounted for 58% of those incidents, reinforcing the extent to which external attacks remain a central concern for security teams. The pace follows an already active 2025. According to the Privacy Rights Clearinghouse, 4,080 distinct U.S. breach events affected at least 375 million people during that year. The totals do not mean that every affected person was unique, since individuals can appear in multiple incidents, but they still demonstrate the scale of data exposure facing businesses and consumers. Ransomware remains part of that picture. Source material reviewing 12,195 breaches found ransomware present in 44% of them. In some cases, stolen information may also have been released or offered through an online marketplace, adding extortion, fraud, and reputational damage to the disruption caused by encrypted systems. An organization does not have to be the original intrusion target to bear the consequences. Kroll found that third-party breaches accounted for 69% of affected individuals in its case data covering June 2025 through June 2026. Technology-sector breaches accounted for 60% of all individuals affected in the same dataset. Financial services represented 20% of the breaches Kroll handled, tying professional services for the highest sector share. insight.tmcnet.com/insight/p…

Arizona has attracted billions of dollars in data center investment, bringing cloud infrastructure, artificial intelligence capacity, construction spending, and long-term technology operations into the state. The expansion also presents a practical policy challenge: how can Arizona capture those benefits without shifting excessive power, water, and infrastructure costs to residents and other businesses? A blanket moratorium would offer a simple answer, but perhaps too simple. It could stop inefficient projects, yet it could also block facilities using closed-loop cooling, lower-water designs, cleaner electricity, and improved energy management. A more targeted approach would connect permits and utility approvals to measurable performance, transparent demand forecasts, and enforceable infrastructure commitments. The electricity issue is becoming harder to separate from economic development. According to the International Energy Agency, global data center electricity consumption rose 17% in 2025 and is expected to double by 2030. More than 85% of new capacity over the next decade is expected to be concentrated in the United States, China, and the EU, often around clusters where grids are already constrained. For Arizona, that outlook supports project-specific grid-impact studies rather than optimistic assumptions about future supply. Developers seeking large interconnections should provide credible load forecasts, explain when facilities will reach full capacity, and identify firm power arrangements. Utilities and regulators could also structure tariffs so that data center customers fund the transmission, substations, and generation capacity primarily built to serve them. Otherwise, households and smaller commercial users may carry part of the bill. A data center’s announced capacity is not the same as its real-time demand. Loads can ramp over several years, fluctuate with computing activity, or change as customers install denser AI hardware. That makes periodic reporting useful. It also gives utilities a better basis for planning than a one-time estimate submitted early in development. insight.tmcnet.com/insight/a…

NITAAC ended operations on October 30, 2026, retiring CIO-SP3, CIO-SP3 Small Business, and CIO-CS after determining that more than 90% of their scope overlapped with existing GSA and NASA information technology vehicles. The closure removes a familiar acquisition channel for agencies and contractors while accelerating a broader reorganization of federal technology procurement. The decision follows the White House’s March 2025 executive order directing agencies to consolidate purchasing. Rather than maintaining multiple vehicles with similar catalogs, labor categories, and eligible vendors, the government is moving spending toward fewer government-managed marketplaces. Agencies that previously relied on NITAAC can shift requirements to the General Services Administration, NASA, or other contracting offices, including those within the Department of Health and Human Services. That consolidation does not signal a retreat from governmentwide acquisition contracts. NASA SEWP VI issued 2,115 awards to 1,490 vendors across three contract categories. Each contract carries a $20 billion ceiling and can run through October 2036. The vehicle also expands SEWP beyond its traditional emphasis on technology products by adding services, giving agencies another path for assembling larger and more integrated requirements. Fewer contract vehicles do not necessarily mean simpler competition. Vendors may spend less time maintaining positions on overlapping contracts, but more suppliers can end up pursuing opportunities through the same marketplace. Winning a place on a multiple-award vehicle provides eligibility, not revenue. The consequential competition generally occurs later, when agencies issue task orders. Federal Acquisition Regulation Part 16 provides much of the structure for indefinite-delivery, indefinite-quantity contracting and subsequent order competitions. Those rules offer agencies flexibility when the exact timing or volume of purchases is uncertain, making task-order execution central to contractor strategy. Vendors must respond quickly, demonstrate relevant past performance, and price specific requirements effectively to maintain their market position. insight.tmcnet.com/insight/n…

Cognizant is expanding its U.S. talent pipeline as enterprise demand shifts from experimental artificial intelligence projects toward systems that can operate reliably inside day-to-day business processes. The IT-services provider plans to hire 1,500 U.S. college graduates in 2026 while growing a domestic workforce that currently includes approximately 32,000 employees. The hiring plan is only one part of the effort. According to Channel Dive, Cognizant also intends to develop 15,000 Frontier Certified Engineers and Frontier Business Operators. Those roles point to a delivery model in which technical specialists work more closely with business teams, rather than treating AI implementation as a conventional software deployment. That distinction matters. Enterprise customers are increasingly asking service providers to connect models with existing data, workflows, security controls, and industry requirements. A technically impressive prototype may have limited value if employees cannot use it, auditors cannot evaluate it, or business leaders cannot measure the result. Frontier-oriented roles appear designed to address that gap by combining engineering capabilities with operational context. Cognizant already has a sizable certification base. More than 45,000 associates hold nearly 100,000 AI-platform certifications, while more than 65,000 additional certifications are in progress. Through Google Cloud's Build with Gemini program, 55,000 Cognizant associates have received training, and Cognizant is targeting 200,000 Gemini-trained associates by year-end. The scale is striking, although certification totals alone do not show whether employees can translate classroom knowledge into production deployments. Enterprise buyers are likely to judge this strategy through project outcomes rather than training volume. Can newly trained teams redesign a claims process, improve supply-chain planning, modernize customer support, or help developers review code without introducing unacceptable risk? Partnerships with Google Cloud, Microsoft, and Palantir address this by providing access to widely used AI and cloud ecosystems, though the service provider must still integrate those technologies into each customer's operating environment. insight.tmcnet.com/insight/c…

Healthcare buyers should compare cloud communications by end-to-end patient workflow, not channel features alone. A rescheduling call can span a queue, clinic, referral record, nurse message, and video system; each product may function independently while the overall patient experience fails. Healthcare organizations have lived through several communication cycles: premises-based PBXs, early hosted voice, standalone video visits, and now broader cloud platforms. The recurring mistake is buying the channel rather than designing the workflow. Emetrotel addresses this challenge by unifying IP telephony, messaging, routing, and contact center solutions so patient-service operations can be managed as a connected environment. Any platform's suitability still depends on technical validation, local deployment needs, and healthcare-specific controls. Vendor selection does not replace the need for foundational workflow design. HL7 FHIR has become central because it provides an API-focused way to exchange clinical and administrative data. The Office of the National Coordinator for Health Information Technology’s Standardized API for Patient and Population Services test method defines certification expectations for standards-based API access, supporting more coordinated exchange among healthcare applications. The distinction between supporting APIs and supporting the clinical workflow matters. A platform might retrieve a patient record but still lack the context needed to route a call, launch an encounter, document consent, or return communication metadata to the EHR. insight.tmcnet.com/insight/e…

A customer starts a conversation in social messaging, continues through web chat, and eventually calls a store. The associate answers but cannot see the earlier exchanges, so the customer repeats the order number, delivery address, and product question. That familiar annoyance exposes the central problem facing retail communications buyers: channels may be available, yet their data remains separated. Cloud adoption itself is no longer novel. Metrigy reported that 34.0% of companies use Contact Center as a Service, while the global CCaaS market reached $8.4 billion in 2025. The harder decision is whether a platform can connect customer context across stores, contact centers, websites, mobile apps, and social channels. Buyers should document specific failure points before comparing vendors. Examples include calls transferred without CRM notes, store employees using personal messaging accounts, and web-chat transcripts that cannot be retrieved through an order ID. An effective requirements map links each problem to a system of record, like Salesforce, Microsoft Dynamics, SAP Commerce, or a custom PostgreSQL order database. A platform supporting voice, SMS, email, chat, and video may still create fragmented workflows. The evaluation should examine how those channels exchange identity, routing data, consent status, and conversation history. For voice, buyers can ask whether the platform supports standards-based SIP trunks and existing session border controllers. For browser and mobile interactions, WebRTC support can reduce dependence on locally installed softphone clients. REST APIs and webhooks should expose events such as call arrival, queue transfer, message delivery, and agent disposition so they can be written into CRM or order-management records. insight.tmcnet.com/insight/h…

Trillion-dollar technology companies are raising and spending hundreds of billions of dollars to construct artificial intelligence data centers, secure advanced chips and develop larger AI systems. That investment cycle is directing substantial demand toward Microsoft, Nvidia and CoreWeave, while also intensifying debate over whether commercial returns can catch up with infrastructure commitments. The concern is not that businesses have rejected AI. Quite the opposite. McKinsey's 2025 survey found that 88% of organizations used AI in at least one business function. Generative AI had become regular practice at 79% of surveyed organizations. Still, adoption is not the same thing as monetization. Only 39% of respondents reported any enterprise-level EBIT impact from AI, while roughly one-third had started scaling their programs. Just 7% had fully scaled AI across their organizations. Those figures expose the gap at the center of the current investment debate: companies are experimenting widely, but comparatively few have converted those experiments into durable, organization-wide financial results. While a pilot can demonstrate that an AI assistant summarizes documents or generates software code, scaling that pilot involves data preparation, security controls, workflow redesign, employee training, monitoring and integration with existing systems. The model may be the visible part, but it is rarely the entire project. insight.tmcnet.com/insight/m…

The wave of AI-use allegations involving authors in 2026 reflects an awkward timing problem for publishing. Many disputed books were acquired, edited, and prepared before publishers began experimenting more broadly with detection services such as Pangram. As those books reach the market, they are encountering scrutiny that was not built into the original acquisition process. That gap helps explain why allegations may become less common, even as generative AI becomes more accessible. Publishers now have greater awareness of the issue and more opportunities to discuss acceptable AI use before contracts are signed. Screening may also happen earlier. Yet the shift does not mean software can settle questions of authorship. Tools including GPTZero and Turnitin estimate whether linguistic patterns resemble machine-generated writing. They do not observe who wrote a passage, how it was revised, or whether an author used AI for brainstorming, translation, copy editing, or wholesale generation. That distinction matters commercially. A detector score can trigger reputational damage, contractual questions, retailer concern, and costly manual review. Treating that score as proof could expose publishers to a different set of risks, particularly when a book has passed through several editors and production systems. The evidence supports caution. A 2025 academic study listed by the Vrije Universiteit Brussel research portal found that human reviewers identified purely human text with only 17% accuracy and AI-generated text with 10% accuracy. Agreement between people and automated detectors was also extremely poor. insight.tmcnet.com/insight/p…

"America cannot afford to follow that path. Every call to overregulate AI, slow down data centers, or punish our builders is a step toward becoming the next Europe. President Trump understands this, and so should every policymaker in Washington."

To operationalize AI cybersecurity in financial services, organizations are using agentic AI (software that plans and executes approved multistep tasks) to correlate signals, assemble evidence, request authorization, and perform reversible actions under policy and human oversight. A suspicious payment rarely arrives with a convenient label. It may coincide with an unusual device fingerprint, an impossible-travel identity event, a privileged-account change, and outbound traffic to an unfamiliar domain. Those signals often live in separate fraud, identity, security information and event management (SIEM), and core banking systems. AI can correlate them faster than an analyst working across multiple consoles. Adoption reflects that potential. Deloitte reported that 67% of surveyed EMEA banks and 57% of insurers used AI models in 2025. Fraud detection was the most common use case, adopted by 58% of banks and 30% of insurers. The hard part is converting detection into a controlled response. A model may identify anomalous behavior, but blocking a card, disabling an account, or isolating a server carries customer, regulatory, and operational consequences. Buyers therefore need more than an accurate classifier. They need traceable evidence, role-based access control (RBAC), approval gates, and rollback procedures. Data quality is another constraint. A 2025 Gartner survey of finance leaders using AI found that anomaly and error detection was adopted by 34%. Data quality and technical skills were the leading adoption barriers, while 91% initially reported only low or moderate impact. Gartner’s finance-function survey differs in scope from Deloitte’s 2025 survey of EMEA banks and insurers, so their percentages should not be compared directly. Together, the findings should temper expectations that installing a model will immediately transform fraud operations. insight.tmcnet.com/insight/h…

An AI agent that summarizes documents is one thing. An agent that queries customer records, opens cloud tickets, changes firewall policy, and invokes a remediation script is effectively a non-human operator. It therefore needs a distinct identity, narrowly scoped permissions, behavioral monitoring, and a durable record of every action. Adoption is moving faster than those controls. ETR reported in its 2026 analysis that 37% of organizations had agents deployed or in active testing, but 20% had no agent-specific controls. Only 3% had broadly deployed dedicated security controls, while 57% cited poor visibility into the data agents access. For buyers, the problem is therefore larger than model security. It includes OAuth tokens stored in workflow engines, service accounts with standing privileges, unapproved Representational State Transfer (REST) API calls, and prompt content appearing in logs or vector databases, which store data as numerical representations for similarity-based retrieval. A practical product demonstration starts with one agent and traces its full execution path. Buyers can ask a vendor to show how the platform discovers the agent, binds it to an identity, authorizes a tool call, records retrieved data, and blocks an action that violates policy. Platforms such as Airrived can be considered within this broader evaluation category, alongside controls embedded in identity, API management, security operations, and cloud platforms. The relevant question is not how many agents a product claims to manage. It is whether the platform can correlate an agent instance with an OpenID Connect (OIDC) service principal, its model, its owner, and every API or Model Context Protocol (MCP) server it can reach. MCP is a standard for connecting AI applications to external tools and data sources. insight.tmcnet.com/insight/h…

eSentire is working with cybersecurity leaders to improve how organizations respond to ransomware attacks while building a broader defense-in-depth strategy. The focus reflects a practical shift in ransomware planning: prevention still matters, but the ability to detect, contain, and recover quickly can determine whether an intrusion becomes a manageable incident or a prolonged business crisis. According to Sophos incident-response data, ransomware attacks can progress from initial access to impact in as little as seven hours, leaving little room for alerts sitting in a queue until the next working day. In ransomware cases handled by Sophos, the median dwell time was four days, and 83% of payloads were deployed outside local business hours. This timing supports the case for 24/7 monitoring and response, one of the areas where managed detection and response providers can extend an internal security team's coverage. Purchasing additional defensive products does not automatically shorten response time. Organizations require clear escalation paths, authority to isolate systems, reliable asset information, and personnel who know what to do when an alert arrives at 2 a.m. Teams must know who can disconnect a critical server and how quickly that decision can be executed. Earlier intervention is achievable, as Sophos reported that 44% of organizations stopped ransomware before data encryption in 2025, marking the highest rate in six years. This finding suggests detection and containment controls are improving, although success depends heavily on how well endpoint, identity, network, and human response processes work together. insight.tmcnet.com/insight/e…

Brian Greene has brought an old philosophical puzzle into the center of the technology industry’s newest debate: whether a machine could possess subjective experience rather than merely simulate it. His discussion frames artificial intelligence as more than an engineering challenge. It is also a test of what scientists mean by consciousness in the first place. The distinction matters. OpenAI’s GPT models, Anthropic’s Claude, and Google’s Gemini can generate persuasive descriptions of fear, pleasure, identity, and self-awareness. Yet a model saying that it feels something is not evidence that an internal experience actually exists. As the World Science Festival discussion emphasizes, researchers have no broadly accepted “consciousness meter” that can settle the issue. Humans infer consciousness in other people through behavior, shared biology, and personal analogy. Those signals become less dependable when applied to software. A chatbot can produce a moving account of loneliness because its training and architecture support that output, not necessarily because loneliness is being experienced somewhere inside a data center. Outward behavior may still become remarkably convincing. That creates a practical problem even if today’s large language models have no subjective experience. Employees and customers could develop emotional attachments to assistants, interpret generated language as distress, or believe an AI system deserves trust because it appears reflective and empathetic. The scientific uncertainty is substantial. A 2025 survey of 582 AI researchers produced a median estimate of a 25% probability that AI with subjective experience will exist by 2034, rising to 70% by 2100 (source). A related survey involving 838 U.S. adults and the same number of AI researchers produced a median forecast of 50% for subjective-experience-capable AI by 2050. These are forecasts, not demonstrations that consciousness has already emerged. insight.tmcnet.com/insight/b…

Alphabet lost more than $500 billion in market value on October 30, turning a historically weak session for Google’s parent into a broader referendum on the economics of artificial intelligence. The scale of the decline matters beyond one stock. Alphabet is among the companies spending heavily on data centers, specialized chips, cloud capacity and foundation models. Investors have largely accepted those costs on the premise that AI will strengthen existing businesses and create substantial new ones. The selloff suggests that patience may be getting thinner. AI adoption is real. According to the Stanford HAI AI Index, corporate use of AI reached 78% in 2024, up from 55% in 2023. Global private investment in generative AI rose 18.7% to $33.9 billion, while AI infrastructure attracted another $37 billion (source). Those figures do not look like a market disappearing overnight. They do, however, expose the gap between adoption and monetization. A business can test an AI assistant, add a model to an internal workflow or run a limited pilot without committing to a large, recurring contract. The valuation question is whether experimentation becomes durable, high-margin revenue. Alphabet has particular exposure to that tension. Google Search remains central to the company’s advertising engine, but generative answers can change how users interact with search results. If users receive complete answers without clicking through to websites, advertising inventory and publisher traffic may shift. Adding AI responses also brings computing costs that traditional search queries did not carry at the same level. insight.tmcnet.com/insight/a…