Rushing AI to Market Creates Dangerous Security Gaps | Tech Field Day News Rundown: January 21, 2026
A critical ServiceNow vulnerability shows how quickly deployed AI features can turn into major security risks. By rushing agentic AI into production without proper authentication, authorization, and safeguards, organizations are creating new attack paths that bypass traditional defenses. Experts warn that AI agents need zero-trust controls, least-privilege access, and lifecycle management—or enterprises risk turning productivity tools into security liabilities. This and more on the Tech Field Day News Rundown with Tom Hollingsworth and Alastair Cooke.
Time Stamps:
0:00 – Cold Open
0:25 – Welcome to the Tech Field Day News Rundown
1:07 – Snowflake to Acquire Observe to Strengthen AI Observability
4:25 – Firewall Prices May Rise as Memory Shortages Hit Cybersecurity Hardware
8:17 – IBM Introduces Sovereign Core Platform Built on Red Hat OpenShift
11:48 – Delinea Acquires StrongDM to Strengthen Infrastructure Access Security
15:04 – Cloudflare Buys Human Native to Reinvent How Creators Get Paid in the AI Era
18:31 – FCC Approves Higher-Power Wi-Fi Devices in 6 GHz Band
22:50 – OpenAI Locks in Massive Compute Deal with Cerebras to Meet Surging AI Demand
26:35 – Rushing AI to Market Is Creating Dangerous Security Gaps
34:58 – The Weeks Ahead: Upcoming Events
38:02 – Thanks for Watching the Tech Field Day News Rundown
Transcript
Observing snowflakes hitting a memory wall. Sovereign OpenShift Delineate gets strong. CloudFlare goes native.
FCC is pumping up the power open. AI is getting with s and are we rushing ourselves into an insecure AI future? All that and more in this episode of the Tech Field Day rundown.
Hello everyone. Welcome to the Tech Field Day rundown. It is January the 21st, and we hope that you are appreciating the fine little furry creatures that are probably packing way acorns because it is squirrel appreciation day.
And, uh, who better to talk about squirrels than your friendly co-host Tom Hollingsworth, captain A DHD himself. But joining me, thankfully, is someone to keep me a little grounded and not quite so nutty. Alistair Cook.
Alex, good to see you again. Did you say squirrel? Whip, whip, honestly, squirrel.
But it is of course also national granola day, another day that, uh, the squirrels will be taking all of the nuts outta your granola today as we get into some kernels of stories in the, uh, tech field Day rundown. Yeah, I can't wait. We've got a packed day of news and we're gonna kick off with some big news.
Because Snowflake is planning to acquire AI driven SRE program, observe to significantly strengthen its observability and AI ops capabilities as enterprises push from AI pilots into AI production by combining observes telemetry logs and trace analytics with snowflake's AI and data cloud. The company aims to give CIO's unified visibility across data pipelines, models and infrastructure, while also reducing the high cost associated with traditional observability tools like Splunk and Datadog. Analysts say that the move positions Snowflake as a scalable cost efficient control plane for running production AI reliably.
Al, do you think Snowflake made the right move by picking up observe? Absolutely. I think there are some real challenges dealing with the volume and types of, uh, interactions that we're seeing is, uh, data's being fed into ag agentic AI systems, and if we thought the DevOps inspired microservices led to fragmentation of, of knowledge and fragmentation of awareness of what's actually making our applications work, agenda AI is gonna make that way worse, or it's already from many customers.
And so this idea of, of improving observability and particularly moving away from tools that are really logo oriented and towards true observability tools is, is something that's really strong. I saw this quite strongly at KU Con, uh, north America at the end of 2025, that, uh, this observability is hot again, and it's hot because we brought more complexity into our environments with these AI applications. Of course, snowflake, uh, would much rather you paid them store all your observability data on their platform, paying those other guys, Splunk and Datadog in particular, uh, to to store that same data.
So there's an element here of Snowflake wanting to, uh, hold more of your data, but also that we are definitely seeing more complexity as we're building more of these AI applications. One of the other things that we'll see is an increase of site reliability engineering being done by ai. So the AI SRE was another big topic at KubeCon, and this is the, the path that Snowflake is gonna head down as automatically resolving issues that appear in your AI applications based on this observability knowledge and made quite a lot of observability data in order to be able to drive those AI applications to help us.
So, yep, this is, this is absolutely a good thing. The only challenge, of course, is that there are a whole bunch of other really good observability tools around, and if you're a Snowflake shop, maybe you'll use observe with Snowflake rather than necessarily getting something that might suit your use case a little better. Just because you've got access to observe through an existing contract rather than having to build up a new contract, time will tell whether observe actually best some of the other, uh, observability tools and AI s SRE tools that are coming to market.
We'll be watching this closely and keeping track of how the, the, uh, AI SRE actually plays out and, uh, getting good data into your AI as well. There is, as we know, a global shortage of DRAM driven by all of the DRAM vendors switching to high bandwidth memory to fulfill all of those AI demands. The shortage is expected to push firewall prices higher in 2026 and squeezing both customers and vendors alike.
Analysts are saying rising memory costs are already cutting into margins at major firewall makers like for Palo Alto Networks and Checkpoint with some vendors raising prices to offset the impact as next generation firewalls require more memory to hold all of that more state pressure from surging DRAM prices is likely to intensify and costs are going up. I'd like to see more value as cost got, but I don't think that's what we're getting here. No, no, that's not what we're getting at all.
You know, what we're getting, we're less likely to get a firewall that we might need. And one of the reasons why that's happening is a little thing called supply and demand, because as we know, there is no more supply of dram. Somebody somewhere, I won't name names, went out and bought most of it.
We live in a market where one or two companies can go out and buy almost all the DRAM that's available and convince other manufacturers to switch what they're making. Eh, we'll come back to that. The problem is that appliance models that we've been producing like next generation firewalls and more advanced I-D-S-I-P-S boxes and things like that are no longer powered by high speed asics with relatively dumb processing capabilities.
Instead, they are almost all based on similar SDNX 86 architectures that require a wat of RAM to be able to hold the contents of those packet flows in memory to be able to process them. Okay, you're following along, right? Boxes need more memory.
Where are they gonna get it from? Because this isn't like any other problem where we could just manufacture something out of thin air. We literally are manufacturing as much RAM as we could, and we've seen this happen many times in the past.
If you're old enough to remember when they had a, uh, fire at one of the manufacturers over in the, the far east, uh, that actually caused a memory price spike for about six months, and that was when we knew when the shortage was likely to end and what had caused it here. We don't know when this is gonna happen. I mean, Corsair's already come out and said they're not gonna sell consumer DRAM anymore.
The problem is that the knock on effects from these decisions cannot be seen. Okay? They can be seen by people on Wall Street, um, they can be seen by people like us because we're sitting here going, yeah, laptop prices are gonna go up, phone prices are gonna go up, firewall prices are gonna go up, pretty much anything that uses ram, you think I'm kidding.
Your fridge uses ram, your washing machine uses ram. Anything that has a computer board in it uses some form of ram. Do you think that the prices of those things are gonna go up when nobody can buy the ram?
Because the only way to get ahold of RAM is to outbid the people who have paid through the TE for it. And what that means is that the companies who are beholden to shareholders who expect a certain return on their investment, that is then used to buy back the stock to raise the stock price, they're not going to accept a margin cut, but they're more than happy to pass those price hikes along to their customers. So folks, if you haven't already bought your next Gen firewall, or if someone's coming around knocking on your door, wanting you to upgrade to the next version because they need to make their boat payment this month, you might wanna get them to lock in the prices right now, because I promise you, in a month they're gonna be a lot higher.
IBM is launching a Sovereign IT platform based on Red Hat OpenShift that's gonna let organizations deploy isolated compliant workloads in as little as a day. It's designed to keep data identities and encryption keys under local control. IBM Sovereign Core helps enterprises meet regulatory and data sovereignty requirements, which is an increasing priority as AI workloads and geopolitical concerns drive demand for regionally managed infrastructure.
Al, do you think that customers are gonna buy off on a sovereign platform that they Absolutely right through the, uh, cloud Act in the US allows any, uh, any US court to essentially confiscate or get access to any data stored, uh, on a, on a platform that's operated by a US-based company. And that covers, uh, all of the major cloud providers that would care to, to use. Uh, the, the challenge then is of course, the uk, the us, um, oversight, uh, of what's happening in Europe is kind of concerning in the current geopolitical climate.
The, uh, kind of tensions between European states and the US leads us to want to more strongly, if we're a European company, uh, more strongly isolate ourselves within the actual sovereignty of the place we operate, be that a broader Europe or anywhere outside of the United States. And that's where sovereign, uh, cloud has become a very significant thing. Uh, the sovereign core platform from IBM looks interesting.
It's got all of the little tick boxes you wanna have along there. I mean, OpenShift is your Kubernetes platform. It's got components in there from HashiCorp in order to automate deployment processes.
Uh, it definitely is an interesting possibility for a sovereign cloud platform for large organizations, or equally for cloud providers that are European focused and European operating. Uh, the idea for the, the sovereign Cloud is that it needs to be self-contained. It needs to not rely on external services, external uh, authentication, those kinds of things.
When look at something like AWS where the authentication tool, the IAM service runs exclusively within the United States. Well, uh, this IBM Sovereign Cloud is, is putting the IBM verify identity service inside the cloud that runs, uh, it's not external. So yes, this is pretty significant.
Uh, general availability won't be for a little while because IBM is saying they're releasing the technical preview in February and general availability later in the year. I think we're probably seeing quite a lot of demand for this, uh, along with any other sovereign cloud platform that is available to, to customers. Uh, daily risk on this, of course, is that IBM is a US based company, and technically the Cloud Act says that these sovereign clouds that are operated with IBM software are still subject to US court jurisdiction.
So it will be interesting to see whether that gets in the way of people, whether we actually see more of a rise of open source or European based products for these things. Uh, again, time will tell. We are seeing other cloud providers building European operated clouds, European employees, European operating companies, interesting to see how this plays out over time.
DEA is acquiring strong DM to expand its privileged access management capabilities into IT infrastructure. Strong dms just-in-time identity-based access model helps reduce cybersecurity risks by eliminating long-term credentials for both humans and importantly, non-human identities such as AI agents. Together, Deline and strong DM aim to give security teams better visibility, limit overprovision access, and particularly, uh, long-term, uh, persistent credentials that are being reused.
And to support a move towards a zero standing privilege model, uh, this looks like an an awesome set of capabilities being added to one of the leading security companies. Uh, DEA has been in this privileged access management for a while, so this looks really cool to me, Tom, It's really cool. It was about a year ago that I finally, uh, had a chance to sit down and talk to the folks over at dea, and I wrote up an article over my LinkedIn page, and I went back and I looked at it, and as I was glancing through everything, one of the things that stuck out to me was, you know, they're doing a really great job of limiting access to certain things, but what they really need is a way to do that on the fly.
Because one of the problems that we run into now is that so many things get overprivileged over provisioned, and we never dial them back, right? Like, like, we've all done it, everybody, right? You know, the I'm just gonna give this user admin rights and, and that's gonna solve this problem that I'm having and, and I'll, I'll fix it later.
That was like 10 years ago and it's still not fixed. And I've got an admin user sitting out there doing things that it really shouldn't, you know, the same kind of people who run as root on a Linux box all the time. What's the worst that could happen?
Um, I have a list of all the worst that could happen. If you would like it, I'll, I'll make sure to send it to you. Now, what this is, is a great way to integrate what Strong DM is doing into things like, uh, deline as remote access system, right?
So you can, you can have a, a PAM module like fire up on the fly and give a contractor access that they need and then close it down right away when they're done, and, and you don't have to worry about it, right? Like, like this thing can automagically do things that that need to be done. And I think that that's a piece that deline really needed, and I know they're really excited about it.
They sent over the press release and, uh, I read through it. I was like, yeah, yeah, this is exactly what they need. And we're starting to see this shift, right?
More people are starting to integrate these pieces together to provide an all-in-one solution. And we see this a lot in the industry, right? We have these big solutions that are great for a while, and then maybe one of the parts doesn't get updated as soon as they could.
And then we, we fall back to the other extreme of no, no, no, everything needs to be a third party integration where, you know, one company does something really, really well, and this other company does something really, really well. We're gonna integrate the two of them, and that works until the companies stop talking to each other, or the integrations don't work the way that they're supposed to. But in the security space, I think why it's valuable is by having one central authority that you go to, it gives you the ability to kind of mold the solution the way you want it to without having to figure out all of that interconnection, interplay that needs to go on.
So, I, I salute the people at Delineate for doing this, and I can't wait to hear more about how strong DM is gonna, uh, you know, help them build to, uh, an awesome future for people that are trying to just basically keep people from getting into places that they should. Our friends over at Cloud Flare decided to acquire AI data marketplace, human Native to help build a fair, transparent system for compensating content creators whose work gets used to train AI models. The deal supports cloud flare's broader effort to protect the open internet by giving creators control over how their content is licensed, monetized, or blocked from AI use, while also providing AI developers with legally licensed high quality training data.
Al it sounds like this is the best of both worlds for people that wanna advance ai. I have high hopes for this. We have a bunch of, uh, cases in front of judges at the moment around AI tools that are reusing, uh, licensed or reusing, uh, copyrighted content, uh, and can be made to reproduce that content with no attribution.
So some suggestion that this is illegal copying of, uh, the original content rather than fair use. And if some way of resolving this out is gonna significantly help us if we don't resolve this problem. Now, what's gonna happen is there's gonna be no incentive to create new actual human created inspired content, this sort of thing that, that you and I write fairly frequently.
Uh, what will the incentive will be to just recreate things through AI tools and put as little effort into it as possible, because AI tools are gonna recreate all the content and take all the attribution anyway. And when I first looked at this, I thought, this is odd. A content network is getting into a, a marketplace for content, um, or at least for the creators to get paid for ai.
And I thought it was a little odd. And until I remembered Cloudflare's job, that Cloudflare's mission statement is not to be the best content delivery network in the world. Their mission statement is to build a better internet.
And in that context, this is exactly the right thing for, for CloudFlare to be doing. Working on ways of making sure that there is an incentive for people, content creators, to continue to create inspired, unique content that is valuable to people who wish to consume content, not just AI slop that has been overwhelming, uh, the internet recently. So I, I really hope that this is successful.
The devil is going to be in how the heck you make it work, because there's huge ai, um, large language models that were, that are in widespread use. Uh, they've been trained on internet crawls that have no attribution back to the original, uh, or at least the way attribution, no way showing that actually used this creator's content and this creator should be compensated. That's just not built in at the moment.
Uh, adding it afterwards is gonna be very difficult. There's not a huge incentive to the LM builders to give that attribution. In fact, there's a huge incentive to not attribute anything that your LLM creates to the original content creators that inspired it.
Um, it's just, let's go wall guide and lock you in. And that's exactly what CloudFlare wants to break us away from escape from, and it's a great thing. I wish them very well.
I don't have high hopes that they'll be very successful, but I really hope they're, The FCC is set to, uh, a proven new class of high power wifi, uh, for outdoor use. It'll be in the six gigahertz spectrum, and it's been long advocated by our wifi, uh, specialists, people who come and join us at Mobility Field, they will have been asking for this change is expected to deliver faster and more reliable connections for technologies like augmented or virtual reality, as well as IOT devices. Uh, and generally getting into large open outdoor spaces more easily, but also with some fencing around it, because of course, the longer range your device has, the more likely it's to cause an interference, and that needs to be built up.
Consumer groups say the, uh, decision strengthens the unlicensed spectrum use and will be very beneficial for everyday users. Uh, where are we gonna see this, Tom? Is this gonna be making our, uh, internet connectivity at a baseball game better?
It might, but the other thing you gotta consider is it's, it's going to make the device throughput a lot better, and it's gonna make coverage a lot better. So for those of you who don't know and have never dealt with, uh, the, the way that a, a standard gets processed, here's basically what happens in wifi. The FCC says, you guys can use this chunk of spectrum, right?
4 gigahertz, which is the same frequency as your microwave. We had five gigahertz, which is the same frequency as a radar station. Well, in the case of your microwave, yeah, we don't care.
Uh, someone, uh, by the way, that's why you don't put your access point on top of the microwave because when someone warms up their fish for lunch, it causes the wifi to go down. Uh, the five gigahertz band was really interesting because there are radar towers that operate there. And, uh, those were in DFS, and if you access point got a DFS hit from a radar tower, it had to shut down on that frequency.
Well, then we get to six gigahertz, and, and if you've ever heard a talk from, uh, Chuck Luki who used to be at Aruba, um, they did extensive testing in six gigahertz because the one thing that occupies the six gigahertz spectrum is satellite downlinks. And guess who was really upset when they wanted to open the six figure heart spectrum for unlicensed use? If you guess satellite downlink providers, you win the QPI doll, they went crazy and they wanted proof that it wasn't gonna interfere, and we're the incumbent, and you need to do this.
And Aruba walked into the meeting and said, here's all the proof you need. We don't interfere. And that somehow still managed to get them shut down for a very long time.
So if you've been to Best Buy recently and you bought a six gigahertz access point, you probably noticed that you can only legally use it indoors. Why? Because there are two different power modes for six gigahertz.
There's very low power, which is designed to be used in a building, and it has, it should not radiate outside of your building very far. And it has the power basically turned down a little bit. Then you have the rest, right?
And based on the stats in the article, you should be able to provide about twice the amount of power that you would get out of a normal access point, which usually runs around a hundred milliwatts. And that would provide a much bigger coverage area. Bigger coverage area means that the devices that are out there are going to be able to hear the signal better, they're gonna be able to transmit data better.
And if you're close enough to it, things like ar vr will be able to transmit a lot of data really fast. This is a big win for all of the companies that we're lobbying the FCC to make this happen. Read the article folks, because I'm gonna tell you a little secret, this did not come from the government.
Government doesn't care. This came from all of the device manufacturers that make all the access points and a lot of really big customers who want this turned on because they need better wifi and they lobbied and pushed and probably took somebody out to a steak dinner more than once to make this happen, which means that we now have this ability to do these things outdoors. That's a huge win.
Bravo to you guys for making this happen. We can finally unlock the complete power of six gigahertz without worrying about whether or not a satellite downlink provider is gonna yell at us. You know, there's still some geofencing and you've got that, um, a FS coordination database that you gotta worry about, but hey, we're getting there.
I'll take it. It's a win. Let's talk about our friends over at Open ai, because guess what, they signed another deal.
This one's worth more than $10 billion. With AI Chipmaker and Tech Field Day presenter Sarah Bruce, to secure up to 750 megawatts of computing capacity over the next three years. The agreement helps open AI address growing compute shortages as chat GPT usage scales, while signaling a shift towards long-term infrastructure partnerships in specialized AI hardware beyond traditional GPUs.
Al, is there a shortage that, uh, we needed to fill with Cbri? I think there's, there's some interesting challenges going on. One is that Nvidia has become extremely large based on the vast amounts of money that's being spent on AI hardware.
Now, when a single vendor becomes very large and becomes effectively the sole's supplier for a particular category, they get to dictate terms, and that's not good for the customers. Uh, in this case, the large AI vendors like OpenAI here, OpenAI is basically hedging and spending a bunch of money with CBRA to use a different architecture. So whilst NVIDIA is using GPUs, and they're sort of, uh, one of the interesting things in looking at the physical size of these, and that's one of the things that BU really focuses on, uh, these Nvidia GPUs are, I dunno, teacup size.
What's, what's the, the US measure for something that's, you know, hand size or palm of your ham size, um, smaller than that, whereas the, uh, ceris design uses wafer scale, so they use the entire wafer of silicon, uh, dinner plate size. They say it's, again, not a metric measure, but it's, it's a US measure of size. Uh, these much larger devices, larger, it's not a chip because it's the entire wafer, uh, can process large AI models much faster than the indi individual GPU based systems can.
It has a much larger capacity just on that single unit. So this is an interesting move for OpenAI to say, we're not just gonna use Nvidia chips, we're also gonna second source, and we're gonna second source at pretty big scale. As you said, this is a $10 billion deal, uh, over a few years to buy the 715 megawatts worth of computing capacity.
It's not just a, a second source to make a tick box on the audit sheet. It's a second source to make sure that Nvidia doesn't have complete dominance of, uh, of how, uh, these AI companies can actually build their infrastructure. I think it's a great thing to see.
And generally, I think we do need to see innovation in the types of, uh, accelerators that are being used for ai, AI infrastructure field day event. Next week, we'll be looking at some of the issues around building different types of AI infrastructure for different workloads, whether it's the massive training or the inference stages. Uh, these are different types of workloads and different types of, uh, chips make a big difference, particularly at the sorts of scales that OpenAI works at.
Uh, this incidentally is not the beginning of the relationship between OpenAI and CEUs. Uh, Sam Altman was an investor and CEUs previously as well, so he's been staying pretty close to this, making sure that he got some inside news as service was pro progressing. Um, it's a great thing.
I I really like that this is happening, and I hope we see more than a couple of chip vendors or chip designs, uh, that can actually deliver great things for our, uh, AI infrastructure, for AI applications as they scale. Speaking of AI applications, we got some interesting news that we wanted to take a little, little bit of a closer look at this specifically, a, a critical vulnerability in ServiceNow that shows that a, a rapidly and possibly somewhat carelessly deployed ai, uh, can turn into a major security threat, uh, a rushing out agent AI into production without proper authentication, authorization and guardrails around it, organizations can, can produce a, a new attack surface, uh, and these things can bypass all of the conventional defenses. Uh, AI agents, uh, need to work in a zero trust model.
They need to be set up with lease privilege and all of those good security things that maybe we short circuit because we're in a rush to get our AI things out. And that certainly happened for ServiceNow, but this isn't the first, this isn't gonna be the last story around AI agents that are deployed out in an insecure way. And I recommend you take a look back at a video that Fortinet did with us at Cloud Field Day 24, where they illustrated just how easy it's to get an AI application to help you to hack itself.
In their demo, they prompted the AI application, this, um, poorly secured AI application to tell them how to hack into it. And this is not normally how attackers work. Normally attackers are very smart and already have some idea of how they're gonna compromise your system.
Well, if you give them an AI that knows about your system and you don't protect it enough, the AI will absolutely help them to attack. So, uh, it's absolutely a, a risk, the security of your AI system is a really significant problem if you don't address it before it's deployed out. 3 out of 10, uh, severity.
Uh, and it's in service now because they had done some very fast and a little bit loose moves that ServiceNow should know not to do, shouldn't they, Tom? com because it was a heck of a read. CV 25 or 20 25, 12, what was it?
12, uh, oh, whatever, four 20. You know what we're calling it? We're calling it Body snatcher.
That's how you know it's important. It got a name. 3 out of 10.
Uh, it allows anybody anywhere to impersonate one of your admins with just an email address. Does that sound like a controller you want in your system? Probably thinking to yourself, well, who in their right mind rolled this out to production?
We dunno. But that's part of the problem, right? Is you've got on the one hand, the traditionalists who are like, let's not do this too fast, because we've seen what happens when things break and, and we've been in the data center at 2:00 AM when it's an all hands on deck.
Oh my god, things broke problem. I was just listening to an episode of the Packet Pushers podcast from our friend Scott Rob, uh, total network operations, where they were talking to a guy who from Intel, where there was like a, you could send a malformed packet to an Intel networking card and basically shut it down. And he's like, yeah, I had to miss a Sound Garden concert, uh, to be in there to fix that problem.
Well, then on the other side, you've got these, I'll try not to say bad words, but you've got these people who are like, oh, we'll just, just coat it, vibe, coat it, and push it to production and we'll just solve the other problems. You know what that reminds me of? Well, hey, I know there's a leak in the tank on the space.
I'll just launch it. We'll fix it in orbit. How hard can it be to fix a space shuttle?
Uh, pretty hard, actually. Here's a problem. And we talked about this last week when we talked about Palo Alto Shield.
Um, framework security is something that you have to think about at all times. Do not trust this to provide coded thing. Do not trust this to a DevOps team that is just pushing and rolling and doing stuff.
And I have talked to a ton of people over the last couple of years that are trying to integrate these kinds of checks into the development process so they don't escape into the wild. Those companies are even more important now because when you code an agent and you kick it out the door like a baby bird falling out of the nest, it, like you said in the intro, if it doesn't know that, it's not supposed to tell people how to hack it, it won't. Here's another thing.
We do not let our users have privileged access everywhere. I just talked about that in the delineate story, right? What about your AI agents?
Do you put a horizon on them or do you just assume that they're like the backup operators account? Nobody ever logs into it. It, there's no problem with it having complete and total access across my entire environment.
Yeah, all of the backup people just cringe. You cannot push code out the door without a lock on it. I'm just, I'm gonna draw a line in the sand right here with a big GPU that probably costs like $20,000.
If you listen to Security Boulevard, the podcast that I do with Mitch Ashley, Fernando Montenegro, and, and Alan, uh, Shimmel, we talk about this all the time. Like, you cannot just throw AI at a problem and take what it gives you and not use your brain. You've gotta look at controls, you've gotta have lifecycle management.
You have to keep your eyeballs on that thing. And you know how I know that the people who are doing this are probably pretty young because they've never been around a toddler, because toddlers, you have to keep your eyes on constantly. I feel like anybody who's writing controls in an organization should have to spend a week with a 2-year-old, because I promise you, the minute it goes quiet, the minute you turn your back, they are into something that they shouldn't be.
And if you can figure out how to put baby gates up and put locks on things, now you're ready for the big time. Folks. What you think al think we need to put 'em all with some toddlers and figure this out?
You know, I, I feel bad for the toddlers. Um, being, having vibe coded controls around the toddlers is not something I think I wanna see. Uh, but as you say, Jake Poland makes the, the great point.
You know, you can't add security from orbit as it's as it's going along. Uh, in fact, the only way to be sure is to nuke it from orbit. And that's what he is suggesting.
You stop this move to, uh, try and push as many AI features as fast as you can because it, when it breaks stuff, it's gonna break your entire organization. This particular ServiceNow vulnerability that, uh, got deployed around October time, uh, for hosted instances, it's huge. It is a really big problem.
Uh, and retrofitting best practice onto something that's currently wor working is always harder than building it from the beginning with good principles. And fundamentally, this is just about having good principles, but it's about understanding that your AI is very similar. I mean, particularly in is very much similar to having a minimum wage person who is working inside your data center and they have no loyalty to you unless you give them very strict guidance, but they can misbehave.
And that's an absolute concern for anybody that is running Agent ai. You should absolutely be starting from the beginning as with all applications starting from the beginning with a security basis. Uh, but I think we can continue to flog this one for a long time and we are gonna see more of these vulnerabilities come through.
We absolutely are. They may not come through in such a visible place as, uh, one of our favorite organizations, ServiceNow being hit with this, but lots of smaller organizations are gonna be hit with these kinds of vulnerabilities and province. This is gonna be a common attack vector, and we'll see the usual host of security vendors trying to help build a fence or at least be the ambulance at the bottom of the cliff to try and save you.
But fundamentally, if you don't build that 10 at the top, if you don't protect yourself from going wrong, it'll go wrong, can go wrong fast. Something that doesn't go wrong, of course, are the tech Field day events that we're running throughout the year. Uh, I'm feeling a little stressed at the moment because I have a big event coming next week with the AI Infrastructure Field Day event running January 28th to 30th.
Uh, I'll be out in Santa Clara with my delegates as well as with my sponsoring companies. Got a great lineup. Uh, we've got two different business units from Cisco.
We have, uh, fabrics AI as well as xite have solid Im Hammer Space and Forward Networks all presenting through those three days. Plus. We also have a presentation from Brian Martin talking about some res research that the Signal six five team within RUM have done.
And I'm also gonna give a little bit of coverage of some recent reports written by the analysts at RUM Research that are around some of the security challenges and some of the other data challenges for building AI infrastructure. Looking forward to a great few days there and spending time with the awesome people that are the Tech Field Day delegates. I'll be back in in Silicon Valley again, uh, for Cloud Field Day 25 in March, that's running the 11th and 12th of March.
We're building that one out as well. Have some nice companies talking about excellent things that they're doing in cloud and, uh, really learning more about hybrid multi-cloud and, and data management across those kinds of spaces. Uh, following that of course, Tom, you have an interesting new, uh, event that we're going to.
You're right, we are gonna be doing Tech Field Day Extra at RSAC for the very first time. Now, for those of you who don't know, it is RSAC conference. It is no longer the RSA conference that got spun out a few years ago.
Uh, we actually just recorded a really great episode of Security Boulevard, where we talk about Jim Easter, easterly being the new CEO of of RSAC. Uh, make sure you check that out when it goes live, uh, here very soon. But we are gonna be getting some great presentations from, uh, Veeam Object First Commvault and more.
And I'm going to be there. Uh, I'm gonna be hanging out with some of our friends. Uh, the folks from Techstrong and the FU Group are gonna be there, you know, my co-hosts for my other podcast like Alan and Fernando and Mitch.
Uh, we're also gonna see some of my friends like Wolfgang and JJ and you know, people from the security industry, uh, if you, if you know who they are, right? Because otherwise, you know, they're super secret packer, hoodie people, but whatever, we're gonna be there. It's gonna be fun.
We're gonna be there the whole week of RSA. I'm gonna see what kind of fun I can get into, and I hope that you're able to join us too, just like I'm glad that you're able to join us for this week's episode of The Rundown. You know, we publish these new episodes every Wednesday.
We do it on YouTube. We also do it in your favor, podcast application of choice, uh, no matter where you subscribe. We love that.
Subscribe to both. Uh, the Rundown is also streamed on Textron tv. You can make sure you check us on all the other stuff that we do through Textron and Future Group, whether it's other podcasts that we do or other events that we're at, like Al's gonna be at next week.
Speaking of which, when we come back next week, I'm gonna have a new, uh, co-host because Al's gonna be enjoying Sunny California. And, uh, we'll be back to talk about all of the tech news that happens, and we might even talk about all the cool stuff that's happening at AI infrastructure if you're not able to tune in. But until then, for myself, Tom Hollingsworth, for Alistair Cook, and for everybody across the nation, thank you so much for tuning in for this week's episode of The Rundown.
We'll see you next week.