Connect with us

Tech

Beyond integration theatre: Building stronger cyber platforms | Computer Weekly

Published

on

Beyond integration theatre: Building stronger cyber platforms | Computer Weekly


Modern chief information security officers (CISOs) face a threat landscape defined by distributed systems, volatile supply chains, and expanding attack surfaces. Platform consolidation is often used to reduce complexity, yet only architectures with deep integration across data, control, and identity planes achieve the intended security benefits. This makes the integration layer a dominant source of enterprise risk.

While unified security platforms promise simplicity, attackers are increasingly bypassing core systems and exploiting the connections between them: API links, OAuth tokens, third‑party apps, and automation workflows. These integrations quietly expand the enterprise trust boundary and introduce new single points of failure. Over‑privileged tokens, undocumented workflows, vulnerable open/closed source components, and fragmented ownership make it possible for attackers to authenticate themselves through trusted integrations rather than breach the platform directly.

All this means that this integrated layer, not the platform itself, is the new enterprise perimeter, meaning CISOs must govern delegated trust with the same rigour as they do for core systems. When converging multiple solutions they must mitigate the inherent security risks that come with single‑point‑of‑failure systems through architectural redundancy and modularity and ensure true integration.

Demand evidence of true integration, not integration theatre

There are several factors that distinguish a true platform from integration theatre. Scrutinising these will show where vendors are using marketing to obscure a lack of genuine integration:

Data: A platform should decouple the data plane from the control plane. At the data layer, it should allow for a single data lake that all security logs feed into and all solutions read from simultaneously. Aggregated data can then be correlated to deliver full visibility across systems and detect sophisticated multi‑stage attacks instead of having multiple databases connected via APIs and sync actions.

Policy orchestration: Policies should be written once, be consistent and propagated across the stack, from endpoints and email to firewalls and intrusion detection systems (IDS), without the need to deploy them through different user interfaces (UIs).

Identity and authorisation: All platform components should integrate through a common identity broker, using a central policy orchestrator to enforce both Role‑Based and Attribute‑Based Access Control consistently across the environment. Multiple logins, inconsistent roles, or fragmented identity experiences are strong indicators of integration theatre rather than true unification.

Interoperability: Integration theatre provides a collection of black boxes with no meaningful influence on each other. Unified solutions, on the other hand, work together and do not just coexist. They use telemetry to provide context and build a complete attack‑path picture, offering seamless connectivity to edge devices and third parties, such as Microsoft Defender’s 57 API connectors or Cisco’s 100+ third‑party integrations.

Architect for resilience, not dependency

Vendor consolidation can simplify environments but also create monocultures and single points of failure. To avoid over‑reliance on any one platform, organisations should adopt a cyber security mesh architecture. This is a central policy source with distributed enforcement across global locations, ensuring that critical controls remain functional even if the core platform fails. Pairing the platform with best‑of‑breed niche tools preserves flexibility and reduces vendor lock‑in. The Q3 2025 Forrester Zero Trust Landscape reinforces the view that zero-trust has to be an overall strategy, not a single product. This can then build higher resilience, greater architectural flexibility, and a reduced likelihood that systemic platform failure will lead to business disruption.

Govern the integration layer as a first-class asset

With integrations now acting as primary vectors of delegated trust, organisations must treat them with the same scrutiny as they would for any core security asset. This requires continuously inventorying all integrations, enforcing least‑privilege API scopes, mandating short‑lived and automatically rotated credentials, and applying real‑time anomaly detection to API behaviour. Threat modelling must precede deployment, and integration risk must be embedded into third‑party governance frameworks.

When exposure is high, organisations should rapidly map critical integrations, assess token lifetimes and privilege levels, and execute targeted remediation such as rotation, down‑scoping, monitoring, or removal. They should create a tightly controlled blast radius, a hardened identity perimeter, and a measurable reduction in delegated trust risk as these are the very factors attackers increasingly exploit.

Organisations that succeed will be those that govern the integration layer with the same discipline as the platforms themselves. That means CISOs must look beyond vendor claims and examine how data, identity, and policy truly operate. Authentic platforms share telemetry, policy engines, and a unified identity layer, while theatrical ones rely on brittle connectors.

But they need to recognise that even the strongest platform reshapes risk rather than removing it. To prevent the platform becoming a single point of failure, organisations must pair consolidation with disciplined governance of delegated trust, continuous integration‑layer risk assessment, and architectural safeguards such as mesh‑based enforcement and distributed control planes. The strongest strategy blends unified efficiencies with the resilience and scrutiny required to withstand inevitable failures.

Joe Mayhew and Ahmed Tikail are cyber security experts at PA Consulting



Source link

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

Tech

Signal’s Creator Is Helping Encrypt Meta AI

Published

on

Signal’s Creator Is Helping Encrypt Meta AI


Moxie Marlinspike, the privacy advocate who created the secure communication app Signal and its widely used open source encryption protocol, said this week that his privacy-focused AI platform, Confer, will start incorporating its technology into Meta’s AI systems.

Every day, billions of chat messages sent through Signal, Meta’s WhatsApp, and Apple’s Messages are protected by end-to-end encryption. The feature, which makes it impossible for tech companies and anyone other than the sender and recipient to snoop on your messages, has become mainstream over the past decade. As generative AI platforms explode in popularity, though, people are now also exchanging billions of messages a day with AI chatbots that don’t offer the protection of end-to-end encryption—making it easy for AI firms to access what you talk about.

This is by design, given that platforms often want to train their AI models on as much user data as possible and have made it hard to opt out of having your information used as training data. But as chatbots and AI agents have become more capable, some technologists and companies are pushing to create more constrained and privacy-focused systems.

“As LLMs continue to be able to do more, we should expect even more data to flow into them,” Marlinspike wrote in a short blog post about his collaboration with Meta published on Tuesday. “Right now, none of that data is private. It is shared with AI companies, their employees, hackers, subpoenas, and governments. As is always the case with unencrypted data, it will inevitably end up in the wrong hands.”

Marlinspike wrote that he will “work to integrate Confer’s privacy technology so that it underpins Meta AI.” He also emphasized that Confer, which debuted at the beginning of this year, will continue to operate independent of Meta. The project’s goal, Marlinspike added, is to offer a technology that “allows everyone to get the full power of AI along with the full privacy of an encrypted conversation.”

In 2016, Marlinspike worked with WhatsApp, which is owned by Meta, to roll out end-to-end encryption to more than a billion accounts simultaneously. Over the last year, WhatsApp has introduced a Meta AI chatbot into its app, which isn’t shielded from the company in the same way individual chats are.

“People use AI in ways that are deeply personal and require access to confidential information,” WhatsApp head Will Cathcart wrote on Wednesday on the social media platform X about the collaboration with Confer. “It’s important that we build that technology in a way that gives people the power to do that privately.”

The adoption of encrypted AI is still emerging. The cryptographic schemes used in end-to-end encryption for traditional digital communication aren’t easily or directly translatable into data protections for generative AI. For its part, Confer is still a new project, and Marlinspike’s blog post did not provide specific details about how exactly the collaboration with Meta will work or what the specific goals are for integration.

Neither Marlinspike nor Meta provided WIRED with additional comment ahead of publication.

Mallory Knodel, a cryptography researcher at New York University, says it would be “great for people using chatbots that use Meta AI to have confidentiality and privacy within that exchange.” Crucially, that means Meta would not be able to access AI chat data for training, says Knodel, who along with colleagues recently published a study on end-to-end encryption and AI. “I really hope more AI chatbots adopt this approach.”

Knodel’s preliminary, initial assessments of Confer indicate that the platform isn’t perfect, but is an important example of how to build a private AI chatbot.



Source link

Continue Reading

Tech

Boots or Trail Runners? Depends if You Want Speed, Durability, or Ankle Support

Published

on

Boots or Trail Runners? Depends if You Want Speed, Durability, or Ankle Support


When I started hiking, big leather boots were the only real option. They were burly, stiff, and difficult to break in, but one pair would last you decades. Technology has mercifully caught up, however. If you head to the trails today, most hikers and backpackers are opting for more lightweight, low-cut options. While an influx of new shoes from brands like Hoka, Merrell, Danner, and Salomon has transformed the footwear industry, that doesn’t mean the hiking boot has had its day. It just depends on what you’re looking to do and when you’re doing it.

Which shoes should you pick to go out for the day? I tested countless pairs of great hiking boots, trail runners, and hiking shoes across a variety of terrain, from forest trails and coastal paths to high alpine terrain. To get a better understanding of the differences between the many options available—and which is right for you—I grilled Ingrid Johnson, a leading footwear product specialist at REI. (For what it’s worth, Johnson’s personal recommendation is the Salomon XA Pro).

When you’ve chosen your next pair of trail running shoes (or hiking boots), be sure to check out more of WIRED’s outdoor guides, like the Best Gravel Running Shoes, the Best Merino Wool T-Shirts, and the Best Electric Bikes.

Update March 2026: We added links to recent coverage, added the On Running Cloudrock Low, and updated links and prices.

Jump to Section

Here’s When You Need Boots

If you’re carrying a heavy pack over rough terrain, or if it’s wet or snowy, you need hiking boots. They tend to be higher at the ankle, with stiff midsoles and protective toe caps, and they are generally made from very durable materials like leather and tough synthetic fabrics like Cordura. Hiking boots prioritize stability, protection, and durability.

Boots generally have thick, deep lugs, tougher soles, stronger toe guards, and sturdier ankle support. They protect you from rock impact, uneven ground, moisture, and often colder conditions. The high-cut designs also offer more ankle support, something I found reassuring when coming back from a recent injury.

But don’t think that hiking boot brands are stuck in the dark ages. Borrowing lightweight features and materials from trail running, brands are able to offer technical boots with cushioning, grip, and stability. They’re still heavy, but featherweight compared to a traditional leather boot. Hoka’s Kaha 3 GTX ($240) is one of the best boots available, blending soft nubuck leather, Vibram Megagrip sole, and bags of cushioning. Here are a few other picks:

Perennially popular for good reason, these Salomons boast superb levels of comfort and support without the bulk typically associated with traditional walking boots. They feel like ski boots, but that’s not a criticism; the height and support is most welcome when walking all day carrying a full pack.



Source link

Continue Reading

Tech

Get Ready for a Year of Chaotic Weather in the US

Published

on

Get Ready for a Year of Chaotic Weather in the US


Despite being declared the third-hottest year on record, 2025 was a relatively quiet year for climate disasters in the US. No major hurricanes made landfall, while the total number of acres burned in wildfires last year—a way of measuring the intensity of wildfire season—fell below the 10-year average.

But starting this week, the West is experiencing what looks to be a record-breaking heat wave, while forecasting models predict that a strong El Niño event is likely to emerge later this year. These two unrelated phenomena could set the stage for a long stretch of unpredictable and extreme weather reaching into next year, compounding the effects of a climate that’s getting hotter and hotter thanks to human activity.

First, there’s the heat. Beginning this week and heading into next, a massive ridge of high-pressure air will bring record-breaking temperatures to the American West. The National Weather Service predicts that temperature records across multiple states are set to be broken in dozens of locations, stretching as far east as Missouri and Tennessee. The NWS has issued heat warnings for parts of California, Arizona, and Nevada, as well as fire warnings for parts of Wyoming, Nebraska, South Dakota, and Colorado.

“This will be the single strongest ridge we’ve observed outside of summer in any month,” says Daniel Swain, a climate scientist at the University of California Agriculture and Natural Resources.

The other remarkable thing about this heat wave, Swain says, is just how long it’s going to last. “This is not a day or two of extreme heat,” he says. “We’ve already in some of these places been seeing record highs every day for a week, and we expect to see them every day for another at least seven to 10 days.” The later end of March will be much more intense, with temperatures in some places breaking April and May records. “There aren’t that many weather patterns that can result in an 85- or 90-degree temperature in San Francisco, Salt Lake City, and Denver in the same week.”

This late winter heat wave is adding on to an already warm winter in the West—with big implications for the summer. A month ago, snowpack levels across multiple states were at record lows thanks to warmer-than-average temperatures. According to data provided by the Department of Agriculture, snowpack levels were still sitting below 50 percent of average across many Western states. Snowpack is a critical natural reservoir for rivers in the West; between 60 to 70 percent of the region’s water supply in many areas comes from melting snow. Low snowpack is a bad sign for already-stressed rivers like the Colorado, which supplies water for 40 million people in seven states.

The ongoing heat wave, Swain says, will more than likely make conditions even worse. “April 1st is typically the point at which snowpack would be, at least historically, at its peak,” he says. Even if temperatures cool off until summer, these low snowpack levels are also a worrisome sign for the upcoming fire season. Snow droughts like the one the West is experiencing can dry out soil, kill trees, and lessen stream flow: ideal conditions for a wildfire to grow. Meanwhile, the water supply in the Colorado River could drop even lower. States that rely on the river are already facing a political crisis as they attempt to renegotiate water rights; a drought would only up the ante.

Then there’s El Niño. Last week, the National Weather Service announced that there was more than a 60 percent chance of an El Niño event emerging in August or September. Various weather models suggest that this El Niño could be particularly strong. While we likely won’t know for sure until summer, “the fact that [all the models] are moving upwards is worth watching,” says Zeke Hausfather, a research scientist at Berkeley Earth.



Source link

Continue Reading

Trending