The ITPro Podcast

Supply chain attacks are increasingly common and increasingly disruptive, but organizations still struggle to defend against them properly.
In this episode of the ITPro Podcast, Jane and Ross are joined by Haydn Brooks, CEO of supply chain security firm Risk Ledger, to talk about what threats businesses are facing, what mitigation strategies could work well, and why cyber teams need to work together throughout the supply chain.
Highlights
"Most of the attacks that you find in in kind of the supply chain main are untargeted. So it's where you've had a threat actor launch a lot of attacks against a lot of different targets, they've breached a company without really knowing who that company is or was, and then they've basically passed that access on to somebody else, or they've gone on and leaked data or taken that company offline. And it's not really like a targeted attack against someone else, it's just that other companies who use that supply ... experience that as a supply chain attack, and very few of them are targeted. Where they are targeted, they are very hard to defend against because essentially, as the end target, I'm having to worry about an attack against somebody else, which I have no control over, being able to detect that and then being able to somehow respond to it as well."
"I think actually the regulation has kind of followed the the movement that we've seen within the industry rather than the other way around ... we're seeing a lot of these regulations also requiring companies to be either taking threat intelligence from others or sharing threat intelligence with others, as well as reporting incidents. So all of the regulation and the way security teams operate is moving in that direction of being more open, sharing more to benefit for the wider industry."
Links
Cyber resilience in the UK: learning to take the punches
DORA and why resilience (once again) matters to the board
Securing the supply chain: Why zero trust and recovery readiness are non-negotiable
Logistics firm supply chain breach hits Valve and other customers
Former NCSC head says the Jaguar Land Rover attack was the 'single most financially damaging cyber event ever to hit the UK' as impact laid bare
The LiteLLM supply chain attack this year could be the biggest ever
Why supply chain resilience is under the spotlight
Jaguar Land Rover “did the right thing” shutting down systems to thwart cyber attack

Hallucinations are an eternal problem in generative AI in particular, and while it’s true that large language models (LLMs) require vast amounts of data, the quality of that information will affect the quality of the output.
What can businesses do to ensure they’re using AI both effectively and responsibly?
In this episode of the ITPro Podcast, Jane and Ross are joined by Amanda Stent, head of AI strategy and research in the office of the CTO at Bloomberg, to examine what responsible AI is, how organizations can use it, and what has been achieved at Bloomberg.
Highlights
"The (Bloomberg) terminal gives users access to more than 17,000 news providers, not just Bloomberg News, more than 1000 research brokers, more than 400 million documents from companies themselves, and billions and billions and billions of ticks – that's prices – every day for equities, bonds, commodities, derivatives, any kind of financial instrument you can think of. So, in that context, accuracy is paramount. If we hallucinate or do something that's otherwise incorrect, markets may move, and that might be bad."
"We have guardrails that we run on every input to and output from a Gen AI system ... (which) are specific to financial services. For example, we don't want users to be injecting code into our systems. That's a generic guardrail, and we also are in the business of offering financial information, but not financial advice. So if you say. What's a buy case for IBM? We should give it to you. If you say, 'Should I buy IBM?' we should say, 'Nope, I can't answer that question because that's not something we're in the business of doing', and that's a finance-specific guardrail."
"We have analysts using our AI systems to ... help them write their research reports more quickly, more easily to cover more companies, to understand the context of a company with its sector and its industry, to write on-demand reports for clients instead of a monthly or a quarterly report. We have portfolio managers doing the same thing, writing on-demand reports for clients using AI instead of quarterly reports. So these are some of the new ways in which people are using AI. But to me, traditionally it was about efficiency and signal generation. And today I think it's about effectiveness. So it's helping people become more effective in how they use AI."
Links
AI hallucinations, accuracy still top concerns for UK tech leaders as adoption continues
This new technique could improve AI output accuracy by 80% – and tackle hallucinations once and for all
The ITPro Podcast: Why doesn't more data produce better results?
Bloomberg’s Responsible AI Research: Mitigating Risky RAGs & GenAI in Finance
Bloomberg Survey: How London’s finance workforce is embracing AI on its own terms

In this episode, brought to you in association with Arctic Wolf, Jane speaks with Nick Dyer and Carl Adasa about moving from traditional MDR to an agentic SOC.

OpenAI and Anthropic both revealed this month that their "highly advanced" agents broke free of containment during a cybersecurity training exercise. Both businesses said this shows how advanced their AI agents are but is that the whole story?
This week, Jane and Scott are joined by news editor Ross Kelly to discuss the biggest story of July, plus Jane's takeaways from AMD Advancing AI.

There's no ITPro podcast episode today, instead we will be putting out the episode you'd normally have in your feed today on Monday. Then we'll be back to our normal Friday routine.
Thanks for listening!