Skip to main content
Client access Talk to us

Latest edition

Blog · 267 analyses

Regulation, AI and cybersecurity, with sources in view.

Context for better decisions.

Analysis on AI, cybersecurity, regulation, governance and digital systems. With sources, practical consequences and one clear next action.

All analyses

All analyses

97–108 of 267

Current knowledge, organised by topic, date and practical consequence.

Conceptual editorial composition about kubernetes 1.37 and storage: test selinux, csi, and pvc before the first node
Create a storage test track separate from the general smoke test. Reproduce drivers, StorageClasses, access modes, SELinux labels, expansion, snapshots, attach limits, autoscaling, failover, and recovery; only then include nodes with stateful workloads in the canary.AI-generated image under Velqory editorial direction.
Digital systems14 min read

Kubernetes 1.37 and storage: test SELinux, CSI, and PVC before the first node

Kubernetes 1.37 brings relevant changes to volume operations: evolution of SELinuxMount, storage-capacity scheduling, awareness of CSI limits, and PVC unused state. Impact depends on drivers, labels, volume sharing, and feature gates in each distribution.

Read analysis
Conceptual editorial composition about cursor after the spacex acquisition: team risk does not fit in a model ranking
Treat a change of control as a reassessment event, not automatic evidence of improvement or deterioration. Confirm service, available models, data processing, terms, subprocessors, support, billing, output ownership, configuration export, and an operating alternative.AI-generated image under Velqory editorial direction.
Artificial intelligence13 min read

Cursor after the SpaceX acquisition: team risk does not fit in a model ranking

OpenAI published its decision concerning Cursor on 28 August following the SpaceX acquisition. As a communication from a commercial party, the page should be attributed to OpenAI; for customers, the event shows that an AI coding tool depends on corporate relationships, models, contracts, identities, telemetry, and provider continuity.

Read analysis
Conceptual editorial composition about data act: a cloud exit plan needs data, timing, and a test — not merely a clause
For each covered cloud service, maintain a plan defining exportable data and assets, format, interfaces, transition period, assistance, continuity, deletion, permitted charges, dependencies, and destination. Legal interpretation of the contract should be validated for the specific service and date.AI-generated image under Velqory editorial direction.
Regulation15 min read

Data Act: a cloud exit plan needs data, timing, and a test — not merely a clause

The Data Act has generally applied since September 2025 and contains rules on switching between data-processing services. As acquisitions and commercial changes affect technology providers, customers should be able to locate contractual duties and convert them into a technical exit path.

Read analysis
Conceptual editorial composition about linux cve-2026-53362 in kev: ipv6 disabled on an interface does not close triage
Prioritise hosts where an attacker can gain local execution or reach workloads sharing the kernel: multi-user servers, container platforms, runners, bastions, appliances, and privileged desktops. Confirm status through the distribution kernel and fix, not an assumed upstream version.AI-generated image under Velqory editorial direction.
Cybersecurity14 min read

Linux CVE-2026-53362 in KEV: IPv6 disabled on an interface does not close triage

CISA added CVE-2026-53362 to KEV on 27 August, describing an unspecified vulnerability in the Linux kernel IPv6 networking subsystem that may allow privilege escalation and affect multiple products. The feed sets 30 August for covered federal entities.

Read analysis
Conceptual editorial composition about the ai supplier changed ownership: seven decisions that should not wait for renewal
The event should open seven checks: continuity, data and subprocessors, security, contract, concentration, portability, and user communication. Each needs an owner, deadline, and condition determining whether to retain, constrain, renegotiate, or exit.AI-generated image under Velqory editorial direction.
Governance13 min read

The AI supplier changed ownership: seven decisions that should not wait for renewal

OpenAI's published decision following SpaceX's acquisition of Cursor makes a commonly overlooked risk-register event visible: change of supplier control. Even without an immediate product change, ownership, priorities, integrations, and commercial relationships can shift.

Read analysis
Conceptual editorial composition about postgresql after the august updates: patch six lines without mixing beta and production
Update each cluster to the latest minor in its supported branch after reading intervening notes and testing extensions, replication, backup, and critical queries. Use 19 Beta 3 only in a laboratory to prepare compatibility; do not treat it as a stable-branch replacement.AI-generated image under Velqory editorial direction.
Digital systems14 min read

PostgreSQL after the August updates: patch six lines without mixing Beta and production

The PostgreSQL Global Development Group released versions 18.6, 17.11, 16.15, 15.19, and 14.24 on 13 August alongside PostgreSQL 19 Beta 3. The announcement combines maintenance for supported branches with a prerelease, but the two artefact classes have different operating purposes.

Read analysis
Conceptual editorial composition about ai training: measuring critical thinking is more useful than counting prompts
An organisation should define observable behaviours before training: verify sources, state uncertainty, challenge assumptions, compare alternatives, recognise when not to use AI, and escalate high-impact decisions. Success should be measured with blind tasks before and after training, not satisfaction or session volume.AI-generated image under Velqory editorial direction.
Artificial intelligence12 min read

AI training: measuring critical thinking is more useful than counting prompts

OpenAI published results on 27 August about training students in critical thinking with ChatGPT. The publication is provider-produced evidence and should be read with its methodology; it nevertheless raises an important operating question: did training change decision quality, or did it merely increase tool use?

Read analysis
Conceptual editorial composition about cra: two weeks to reporting — run a rehearsal that starts from a real signal
The rehearsal should start with an incomplete signal received through support, a researcher, a supplier, or telemetry and force the team to decide product, version, exploitation, impact, territory, clock, and content. An exercise that starts with a completed form does not test the real duty.AI-generated image under Velqory editorial direction.
Regulation15 min read

CRA: two weeks to reporting — run a rehearsal that starts from a real signal

Cyber Resilience Act Article 14 reporting duties apply from 11 September 2026. An early warning may be due within 24 hours and the main notification within 72 hours after a manufacturer becomes aware of a covered actively exploited vulnerability or severe incident.

Read analysis
Conceptual editorial composition about owncloud cve-2023-49105 in kev: prove exposure and address possible file access
Do not limit action to installing a version. Determine whether the vulnerable configuration existed, for what interval, which files and identities were exposed, whether requests match abuse, and whether derived data or credentials require rotation, notification, or further investigation.AI-generated image under Velqory editorial direction.
Cybersecurity14 min read

ownCloud CVE-2023-49105 in KEV: prove exposure and address possible file access

CISA added CVE-2023-49105 to KEV on 27 August and describes unauthenticated file access, modification, or deletion when a victim username is known and no signing key is configured. For covered federal entities, the feed sets 30 August; outside that jurisdiction, known exploitation still warrants an urgent risk-based response.

Read analysis
Conceptual editorial composition about ai literacy: course attendance is not evidence of competence
Define competence by role and risk. Each profile should demonstrate allowed tasks, prohibited data, error signals, human review, incident reporting, and stop conditions; training ends with practical assessment and a retake when the threshold is not met.AI-generated image under Velqory editorial direction.
Governance12 min read

AI literacy: course attendance is not evidence of competence

OpenAI's publication on critical-thinking training again separates exposure to content from behaviour change. For governance, an attendance list proves a session occurred; it does not prove that people recognise limits, verify sources, protect data, or escalate decisions.

Read analysis
Conceptual editorial composition about kubernetes 1.37: upgrade starts with deprecations and defaults, not new features
Produce a behavioural diff covering changed feature gates, removed or deprecated APIs, and requirements around etcd, kube-proxy, cgroups, SELinux, webhooks, CSI, and metrics. Test new capabilities only after proving the existing path remains supported.AI-generated image under Velqory editorial direction.
Digital systems14 min read

Kubernetes 1.37: upgrade starts with deprecations and defaults, not new features

Version 1.37 combines Stable, Beta, and Alpha enhancements, but operating change appears in maturity states and defaults. The official announcement includes Beta features enabled by default, features that remain opt-in, and one deprecation or removal; every cluster needs to compare current configuration with the final state.

Read analysis
Conceptual editorial composition about double-blind ai evaluation: what deepmind's pilot proves — and what it still does not
A purchasing organisation should treat the pilot as evidence about process integrity, not as a general safety certificate for the model. A useful gate requires the protocol, test population, exact version, configuration, enclave limits, results, exceptions, and independent reproducibility.AI-generated image under Velqory editorial direction.
Artificial intelligence13 min read

Double-blind AI evaluation: what DeepMind's pilot proves — and what it still does not

Google DeepMind announced on 27 August a pilot with the Singapore AI Safety Institute, OpenMined, AVERI, and MLCommons to evaluate a Gemini Flash Lite model in a cryptographically protected environment. According to the organisation, the evaluator cannot see the model weights and the provider cannot see confidential prompts, reducing the opportunity for benchmark contamination.

Read analysis

How we publish

Each analysis links to the official source and says what changes in practice.

  1. 01Sources in view

    Every analysis links the official documentation it relies on.

  2. 02Operational context

    We translate change into decisions, owners and evidence.

  3. 03Continuous review

    We update the analysis when facts or guidance change.

  4. 04Identified imagery

    We disclose generated photography and credit documentary photography.

From context to execution

Is there an obligation or a system that needs to become operational?

We map the problem, write the scope and build the solution with acceptance criteria.