Category: Tech

The Nintendo Switch 2 is already a huge success. Nintendo is selling more units than it can manufacture, and it’s likely the high demand will hold for quite a while. The original Switch (and the upgraded versions) sold incredibly well, so Nintendo has a massive user base ready to upgrade to a more powerful version that can handle much more complex games.

Still, it’s not all good news. Now that the Switch 2 is in the hands of millions of users, some gamers have discovered that Nintendo hasn’t really fixed one of the worst things about the first model. The new Joy-Con controllers can experience the infamous drift, and at least one user encountered the problem just days after buying the Switch 2.

The same “fix” applies. You have to send your Joy-Cons to Nintendo, and the company will repair them for free. But that doesn’t guarantee your next controller won’t experience drifting.

A Reddit user posted the following clip, showing how one of the controllers is exhibiting the infamous Joy-Con drift problem.

Tech. Entertainment. Science. Your inbox.

Sign up for the most interesting tech & entertainment news out there.

By signing up, I agree to the Terms of Use and have reviewed the Privacy Notice.

He confirmed that he contacted Nintendo, and he’ll have to ship the controller to the company to repair or replace it:

I got my Switch 2 from Walmart on Thursday but was unable to use it until Friday. The left Joy-Con felt a little cattywampus, but I still was able to play Mario Kart World. Today, Saturday 6/7, the stick felt worse when pushing right. I guess I already had stick drift or something. Tried to recalibrate it in the Switch Settings, and it showed the joystick all messed up. Called Nintendo and now have to send it in for repair. My luck in a nutshell, lol.

The Switch 2 Joy-Con drift issue isn’t exactly surprising. Nintendo said a few months ago that it didn’t use the “Hall Effect” stick design in the new controllers. That would have been one way to prevent drift. The Hall Effect design uses magnets, which might have interfered with the Joy-Con’s built-in magnets. These controllers attach and detach to the console using strong magnets, a feature that wasn’t in the first-gen models.

In early June, Nintendo confirmed it’ll replace Joy-Con 2 controllers that develop drift for free.

Teardown: Switch 2 Joy-Con 2 controller (left) vs. Switch Joy-Con controller (right). Image source: iFixit

Separately, iFixit released its Nintendo Switch 2 teardown, starting with the Joy-Con controllers. The well-known repair site suggested that Joy-Con 2 units might still be prone to drifting since Nintendo didn’t adopt a new design to prevent it.

Besides Hall Effect controllers, Nintendo could have used Tunneling Magnetoresistance (TMR) sensors. That’s not the case either. iFixit pointed out the magnet issue but said TMR sensors could have worked instead:

But that shouldn’t stop them from going with TMR, which is less susceptible to magnetic interference. Whatever tech they use, however, joysticks are a high-wear component. They can still break in a drop, even if they never suffer from drift. Being able to replace these things is a high priority for game console repairability.

As you’ll see in the following clip, repairing the Switch 2 isn’t easy. iFixit gave the console a 3/10 score.

If you experience Switch 2 Joy-Con drift, your best option is to contact Nintendo and arrange a repair or replacement. One way to lower the risk of drifting is to keep the controllers as clean as possible, though that’s easier said than done. Another option is using a different controller while the console is docked.

Source

The Scattered Spider/Dragonforce cyber attacks that struck Marks & Spencer and Co-op during the spring have been classed as a Category 2 cyber event on the UK Cyber Monitoring Centre’s (CMC’s) recently launched ‘hurricane scale’, with total costs likely to end up somewhere between £270m and £440m.

The CMC – an arm’s-length body set up by the insurance industry to assess the impact of cyber attacks on the UK and help organisations better manage their risk profiles, and backed by cyber experts including former NCSC lead Ciaran Martin – said that based on its incident categorisation matrix, the incident had had a “substantial financial impact” and resulted in “economic reverberations “across third-party suppliers, franchisees and supporting services”.

In their assessment, the CMC team described the impact from the event as “narrow and deep” with significant implications for both companies and knock-on effects spreading to their suppliers, partners and service providers. This is in stark contrast to a “shallow and broad” event like the CrowdStrike incident of July 2024, where a far larger number of businesses suffered but the impact to any one organisation was much less.

The CMC said that while it has yet to book a Category 4 or 5 event in the UK, had the disruption extended more widely across the retail sector, the attack campaign might have been ranked higher. In the event, of course, Scattered Spider’s campaign is known to have hit just two major retailers.

That said, the CMC did note a third attack on Harrods, and other retailers and retail-adjacent organisations reported to have experienced incidents in the past few months, but said it had to confine its analysis to the more widely reported M&S and Co-op incidents because there was a lack of information about the cause and impact of other events at the time.

CMC CEO Will Mayes told Computer Weekly: “This assessment provides, for the cyber and wider business community, a robust piece of analysis on the financial impact of a cyber event affecting two major retailers, which has been at the centre of a high volume of media attention.

“We’re hugely grateful to our Technical Committee for the depth of expertise and experience that they applied to analysing the implications of the incident.”

Financial costs

In arriving at its figure of £270m to £400m, the CMC has drawn on a range of public and commercial data sources, including its own modelling, and a figure of approximately £300m floated by M&S in May during its annual results call.

The CMC said its figure might have been higher based on statements made by M&S of an anticipated July restart date for online shopping. However, the fact that the retailer has since stood up some of its online shopping operations meant the CMC could pare back its estimates.

The total figure includes covering the costs of business interruption arising from lost sales opportunities, incident response and IT restoration costs, and legal and notification costs. It does not include any ransom payments as it is not known if any have been made.

Based on stats drawn from transactional data platform Fable Data, the CMC said that M&S saw a daily reduction in spend of 22% during the incident, with online sales dropping to essentially zero and in-store sales down 15% as the firm struggled to keep its Food Halls and other locations topped up. For Co-op, daily spend dropped by 11% during the first 30 days of the incident.

The CMC observed that M&S’ distinct own-label business model and a number of exclusive contracts with suppliers left it particularly vulnerable to supply chain effects, with suppliers struggling to reroute goods, particularly items relying on cold chain storage.

Turning to Co-op, the Fable data show daily spend dropped by 11% during the first 30 days of the incident. The CMC said that because Co-op is frequently the only bricks and mortar grocery chain in more isolated and remote parts of the country – particularly in the Highlands and Islands of Scotland – the incident demonstrated the broader social impacts of such cyber attacks.

“The event underscores retail sector vulnerabilities tied to just-in-time stock systems, lack of back-end storage, and high dependency on IT-driven order flows. When systems fail, it is challenging to revert to manual processes,” said the team.

Preparing to fail

Looking into the future, the CMC said the Scattered Spider attacks had been an object lesson in preparedness for the retail sector, stressing the need to test business continuity and crisis response plans against ransomware attacks, including procedures for inventory management, and crisis communications.

As well as noting, naturally, the need for improved cyber hygiene and proper understanding of retailers’ exposure to third-party risk – likely how the M&S and Co-op incidents began – the CMC also said that retailers needed to consider that the costs of business interruptions can be extreme, and it is wise to ensure that capital, or adequate insurance protection, is available to cover cyber attacks.

This article was edited at 21:30 BST on Friday 20 June 2025 to incorporate additional information provided by the CMC.

Source

The number of Cyber Essentials badges issued via the National Cyber Security Centre (NCSC) backed security certification scheme continues to increase but at a slower pace than is really needed to secure the resilience of Britain’s business community.

This is according to new statistics – covering the January to March 2025 quarter – published on Thursday 19 June by the government, which revealed that 10,064 base-level Cyber Essentials certifications and 3,272 advanced Cyber Essentials Plus certifications were awarded in the period.

This was a small advance on the period covering October to December 2024, when 9,790 Cyber Essentials and 3,388 Cyber Essentials Plus certifications were awarded.

Microbusinesses and small enterprises were the most heavily represented during Q1, accounting for 5,988 Cyber Essentials certifications respectively. A total of 1,780 medium-sized businesses received their badges, and 916 large enterprises were certified.

However, of the awards made during Q1, 7,557 were recertifications by existing scheme members – Cyber Essentials must be renewed every 12 months – and only 2,507 went to net new members, an indication that while Cyber Essentials is a general success, more work needs to be done to improve awareness of the scheme.

“Every 13 minutes, a UK business achieves Cyber Essentials certification. This progress is certainly something to celebrate, yet in the grand scheme, its uptake is limited to less than one in one hundred businesses,” said Andy Kays, CEO of Socura, a managed security services provider (MSSP) with offices in Cardiff and London.

“Disappointingly, only a quarter of UK businesses with 250 or more employees are Cyber Essentials certified. This is concerning, considering the certification covers a level of cyber hygiene that all businesses should already be following,” said Kays.

Recognising that there is often an expectation that working through compliance and certification processes can be something of an onerous chore, Kays pointed out that for businesses that are maintaining a decent standard of cyber hygiene, achieving Cyber Essentials compliance should be a doddle.

 “Given the number of high-profile breaches in the news recently, Cyber Essentials presents an important opportunity to signal to customers, partners, and suppliers that cyber security is taken seriously. It also helps organisations lay the foundations for more proactive security measures,” he added.

What is Cyber Essentials?

Launched in 2014 under the auspices of CESG, then national authority for information assurance – later to be folded into the NCSC – Cyber Essentials was borne from recognition that the UK needed to be doing more to protect businesses and organisations from cyber attacks.

Investigations conducted by CESG in the early 2010s showed that many cyber attacks could have been prevented entirely if one or more of just five technical controls had been in place:

• Secure configuration – setting up computers to minimise potential entry points for bad actors;
• User access control – ensuring businesses control who can access data and services, and at what level;
• Malware protection – identifying ways to stop malicious software, including ransomware, before it has a chance to bed in;
• Security update management – stopping bad actors from accessing networks through software vulnerabilities with appropriate and timely patching strategies;
• Firewall implementation – creating a filter between the public internet and business networks and systems.

Together, these controls came to form the basis of Cyber Essentials, which has been delivered through NCSC delivery partner IASME since 2020, it has issued close to 190,000 certificates to date.

Crucially, any businesses seeking to operate certain UK government contracts to handle sensitive and personal data must hold Cyber Essentials certification.

Speaking on the occasion of the scheme’s tenth anniversary last year, cyber security minister Feryal Clarke said: “We have always believed Cyber Essentials helps drive better cyber security across the economy. However, we can now prove that it does.  

“Recent insurance data shows us that organisations with Cyber Essentials are 92% less likely to make a claim on their insurance than those without it.  

“Additionally, where organisations require their third parties to get Cyber Essentials, we know they experience fewer third-party cyber incidents,” she said.

Writing in Computer Weekly at the time, Adam Pilton, a cyber security consultant at CyberSmart and former detective sergeant investigating cyber crime at Dorset Police, said that in the broadest possible terms, Cyber Essentials was very successful because it has helped organisations that might otherwise have fallen by the wayside put some of the basics in place.

“When working in law enforcement to protect and investigate cyber crime, one of the major contributing factors to an organisation being breached, or otherwise hit by cyber criminal activity, was that they did not have the basic controls in place, leading to them being viewed by cyber criminals as low hanging fruit, and could be targeted by actors on the lower end of the sophistication spectrum,” said Pilton.

“Cyber Essentials … have managed to protect against the basic forms of cyber attacks to which SMEs routinely fall victim. While it is unlikely that the frameworks suggested by Cyber Essentials would protect an organisation entirely from attacks on the more persistent, sophisticated end, it has provided organisations with the ammunition to defend against the more everyday instances of cyber crime, which for a small business can be equally as devastating as the sophisticated ones,” he wrote.

Source

iPad users have plenty of reasons to be excited when iPadOS 26 arrives this fall. Even though it took Apple a long time to unlock the tablet’s full potential, it’s finally happening with iPadOS 26. Among the new features, Apple is adding a new window tiling system and more Mac-like capabilities, such as window controls, a menu bar, an improved Files app, quick folder access from the dock, and more.

With all these updates, it finally feels like Apple figured out how to deliver a computer-like experience on a touch-first device. While it’s still too early to offer a full review or share in-depth impressions of the beta software, it’s impressive what the company has accomplished.

Much of this is thanks to the new Liquid Glass UI, which sets Apple devices up for the future while making them feel more connected to each other. Working on a Mac and an iPad has never felt so similar.

That said, this powerful iPadOS 26 experience makes me wish the iPad had one more feature, though this one isn’t about software. I think the only thing missing from Apple’s tablet is MagSafe support.

Tech. Entertainment. Science. Your inbox.

Sign up for the most interesting tech & entertainment news out there.

By signing up, I agree to the Terms of Use and have reviewed the Privacy Notice.

Apple should bring MagSafe to the iPad Pro

Image source: José Adorno for BGR

Hear me out.

I was already using the M4 iPad Pro during work trips and while on the go. With iPadOS 26, it feels like I can finally enjoy even more of what this amazing device has to offer. While users can already customize it with a nano-texture display and cellular options, it’s still missing one key feature: MagSafe support.

Of course, it’s not the iPhone’s version of MagSafe that Apple should add, but the Mac’s original version. It could use the same technology and be included as an extra port on the iPad. Even better, Apple could integrate it into the Magic Keyboard, making it the safest way to charge in busy spots, coffee shops, or anywhere else on the go.

Apple wouldn’t need to change much about the iPad to make this happen, and it would be such a useful addition. I love the MagSafe support on the Mac, and if it were available on other Apple devices, I’d use it all the time.

Source

In this storage supplier profile, we look at IBM, which has perhaps the longest history of all the storage players, and in IT much more widely, in servers, services and the cloud.

We find the company well set on its ongoing efforts to reorient after a period of declining revenues. That reorientation manifests itself as a strong embrace with the cloud, containerisation and as-a-service modes of purchase.

In this article, we look at IBM, its origins, its key storage products, and its approach to the cloud, containers and consumption models of storage purchasing.

IBM is a giant among corporations in general, in IT, and in storage.

It was founded in 1911 as the Computing-Tabulating-Recording Company. That was clearly a bit of a mouthful, so it changed its name to International Business Machines in 1924. It became a leader in punch card recording systems, and later electric typewriters, calculators and other office machinery.

From the 1960s, it was core to the roots of modern IT, and led the way in mainframe and personal computing. Having been a pioneer in the PC market, it started to slide against emerging players, and thus got out of consumer products to focus on the enterprise.

A huge and more recent shift for IBM was its acquisition of Red Hat for $34bn in 2019. That brought the Red Hat portfolio of Linux, and cloud- and container-focused products Ceph and OpenStack, to IBM and showed the company had put a big bet on the cloud.

How does IBM rank against other storage players?

In 2023, according to IDC’s external storage system revenues, IBM was eighth in terms of market share (4.7%) and revenue of $1.468bn. That was a shade behind Hitachi, which recorded £1.554bn and a 4.9% share. Above those two are – in rank order – Dell, Huawei, HPE, Lenovo, NetApp and Pure Storage.

Eighth position marks a further relative decline by IBM in terms of revenues and market share. In the second quarter of 2021, IDC ranked IBM joint-fifth among storage array makers, also with market share of 4.7%. In 2022, it was seventh, with 4.4% share and revenue of $1.396bn.

IBM is in a state of relative long-term decline against other companies, including in tech.

In 1980, IBM was the eighth-largest US company in the Fortune 500, with no other tech company in the top 30. By 2023, it ranked 65th, with many tech companies ahead of it, including Amazon and Apple. In 2024, it had crept up the rankings a little to 63rd.

IBM revenue has been on a downward trend over the past two decades, with averages of around $90bn from the turn of the millennium to around 2007, and reaching $106bn in 2011. It has declined since then – down to around $55bn in 2020 – but with a little bounce back to $62.7bn for 2024.

But it’s still a giant. At year-end 2024-2025, IBM turned over $62.83bn in revenue and had around 277,000 employees. That’s down from 466,995 in 2012. In the UK, IBM currently has 21,000 employees and 125 offices.

What are IBM’s key storage products?

IBM Storage FlashSystem arrays come in the 5000, 5200, 7300 and 9500 series, with media available in combinations of of HDD, 2.5” SSD flash and NVMe. Capacities increase from about 0.5PB in the 5000 series to 4.5PB in the 9500, as does controller central processing unit performance.

IBM added the C200 to this family in early 2025. It comes with higher capacity QLC flash drives and is aimed at archive use cases and sequential input/output.  

Block storage is the focus, with iSCSI and Fibre Channel connectivity.

All FlashSystem arrays have connectivity to public clouds for data tiering, migration, replication and snapshots. That functionality comes as part of IBM’s Storage Virtualize operating environment, which all these products run.

IBM’s Storage DS8000 family of flash storage is targeted at customers with IBM zSystem mainframe systems (via FICON) and IBM i (formerly Power) servers (via Fibre Channel).

The two model sub-lines are the entry and midrange DS8A10 with3.69PB maximum capacity, plus the DS8A50 with up to 7.37PB capacity. All offer minimum access time of 80µs, or 13µs with the mainframe-optimised zHyperLink connection.

IBM claims eight nines availability for DS8000 arrays. They come with full data encryption, immutable copies – Safeguarded Copy – to protect against ransomware, automated tiering and disaster recovery functionality. Other features include hybrid cloud connectivity, a number of deep integrations with IBM server and mainframe operating systems, and container storage via CSI.

IBM Storage Scale is the company’s scale-out storage for file and object. It is based on Storage Scale hardware appliance nodes that can scale from a few tens of TB to yottabytes, with millions of IOPS per node and throughput into the low hundreds of GBps. On the software side, it runs IBM’s Spectrum Scale / General Parallel File System, and can give object access and tiering via OpenStack Swift and S3 application programming interfaces.

It is targeted at unstructured data and AI/ML workloads and for deployments that can build clusters across wide geographical areas. Storage media supported include spinning disk HDDs and NVMe SSDs. Connectivity is via 100Gbps Ethernet and Infiniband.

IBM Storage Fusion integrates compute, storage and networking into a hyper-converged infrastructure (HCI) system that comes with the Red Hat OpenShift Kubernetes application platform.

IBM is a long-standing player in tape, with tape, tape management and virtual tape library products up to the latest LTO-10 standard in its TS series range.

Many IBM storage products are also available as software, including Storage Fusion, Storage Scale, Storage Ceph (block, file and object storage aimed at AI workloads), Storage Insights AIOps, Storage Protect protection, and Storage Defender which can combine with Storage Protect, FlashSystem’s Safeguarded Copy, Storage Fusion and Cohesity’s DataProtect. IBM QRadar is the company’s ransomware discovery and recovery product family.

IBM Spectrum Virtualize is a long-standing component in IBM’s offer, and was known as SAN Volume Controller or SVC. It is a block storage virtualisation system that can allow storage hardware from multiple suppliers to talk to each other as well as to storage in the cloud. It also offers advanced storage services such as snapshots, replication and storage tiering. 

What markets and workloads does IBM target?

IBM is huge, with a very broad range of storage products. It has the capability to deliver storage for any workload from block storage at entry level and mid-range to massive capacity and performance and mainframe connectivity.

It is one of two storage suppliers with the latter capability, alongside Hitach Vantara. As with other IT and storage suppliers, key focuses currently are on AI use cases, flash storage, hybrid cloud, and cloud-native applications and containerisation.

How is the role of the cloud in the IBM offer?

IBM has bet heavily on the cloud storage, in hybrid- and multi-cloud modes. Key to this strategy is use of Red Hat Ceph and OpenShift as a platform that leans heavily on use of containers and cloud native applications in cloud environments.

The company is perhaps unique among array suppliers in having its own hyperscaler-style public cloud with services for block, file and object storage modes that can be used with its cloud servers or bare metal compute.

Cloud File Storage provides NFS file shares from 10GB to 32TB with customisable performance levels.

Cloud Block Storage can be detached and re-attached to allow for movement between workloads and is aimed at enterprise applications, databases and high-frequency transactional workloads.

Cloud Object Storage is aimed at customers’ unstructured data and can be deployed on-premise, as part of IBM Cloud Platform offerings, or in hybrid form.

Its hardware and storage software products also allow for hybrid cloud connectivity.

What is the IBM container strategy?

Containers can be managed on IBM via Red Hat OpenShift or various IBM cloud services.

These include OpenShift on IBM Cloud, IBM Cloud Code Engine, IBM Cloud Kubernetes Service and IBM z/OS Container Platform.

What consumption models of purchasing does IBM offer?

IBM’s Storage as a Service works across on-premise datacentre and cloud, and is based on IBM FlashSystem and DS8900F hardware. It comes with a base level set at current needs plus 50% extra pre-installed. Base and expansion capacity cost the same.

Storage as a Service offers three tiers that all have the same latency – down to 50μs – and six nines availability, but differ in terms of minimum capacity, IOPS per TB, read and write throughput. These differences are reflected in costs that range from $80 to $225 per TB per month.

Storage Utility is a pay-per-use model that delivers 200% more than base capacity from day one. That means datacentre upheaval is avoided by over-provisioning and then using IBM Storage Insights to monitor further capacity needs.

Customers pay only for what they use, and if their data needs shrink during any month, the bill will reflect usage, albeit with a minimum “base”.

Source

SCI Semiconductors, a Cambridge-based tech company working on Capability Hardware Enhanced Risc Instructions (Cheri) systems to manage cyber defences, is to receive funding from the UK government’s Defence Technology Exploitation Programme (DTEP) to continue its work on embedding the emergent technology into military systems.

Cheri, which has been in development for some time, is capable of defending against memory-related vulnerabilities which are a factor in the majority of cyber attacks, perhaps as many as 70%.

It works to address a lack of memory safety in implementations of programming languages by compartmentalising each piece of data or system resource with its own access rules.

Effectively, this stops programs from doing things they should not, and makes it harder for a threat actor to trick a program into doing something it should not, limiting the potential damage of a cyber attack.

The funding award will see SCI receive a grant worth 50% of the project value targeted at developing Cheri-based services that meet Britain’s defence and security challenges. It will be working on this alongside Ultra, a higher-tier defence and security tech supplier, which is providing mentoring support during the project.

“The UK government are keen to act on Security by Design, and this project will leverage Cheri technology, a key technology to delivering this capability,” said SCI chief executive Haydn Povey. “With over 70% of critical vulnerabilities and exploits [CVEs] directly linked to software memory safety issues, which form the vast majority of cyber attacks on critical systems, there is a clear need to address this systemic weakness.

“This project is directly focused on ensuring communication systems and active control systems are more robust, higher integrity, and are inherently secured against broad-based cyber attacks.”

British success story

The core ecosystem surrounding Cheri – which ultimately has its roots in a joint project between the University of Cambridge and SRI International, an American research institute – now comprises around 136 companies and employs close to 1,000 people in the Cambridge area.

There are several Cheri products in development, including Arm’s Morello board (hence Cheri), and a couple of other potentials, but they are still mostly at the developmental stage.

Nevertheless, the British government believes the technology could offer significantly enhanced protection for multiple sectors, including critical national infrastructure (CNI) such as utilities and defence.

The government now wants to overcome gaps that it believes still exist in propelling Cheri into real-world applications – resolving these gaps will be a core goal of SCI’s DTEP project, which will focus on the development of high-integrity, isolated hardware and software structures for a broad array of defence applications, including military control systems.

Earlier in 2025, the Department for Science, Innovation and Technology (DSIT) announced work to drive adoption of Cheri, backed by a multimillion-pound fund focused on bringing commercially viable products and services to market and upskilling tech professionals and engineers in memory safety.

DSIT is also looking to do more to incentivise demand for adoption of secure-by-design systems such as Cheri, and plans to launch a programme to identify potential early adopter customers. A tender notice for a delivery partner for this particular project was published in April.

Source

Tariffs proposed by the US government threaten to upend trading relationships across the world, with IT procurement already feeling the effects. And the tariff situation has changed many times since Donald Trump took office.

Since the president announced plans to levy charges on imports to the US, there have been retaliatory moves by trading partners that include Canada, Mexico and especially China. Meanwhile, there have been pauses on tariffs ruled by the US International Trade Court, pending an appeal, and trade agreements with countries that include the UK.

But so far, the 10% global tariff on most exports to the US looks set to come into force after the current 90-day pause ends.

Even so, some public sector organisations, including NHS Trusts, have delayed IT upgrades due to uncertainty about pricing because of tariffs.

What’s the risk to procurement of tariff disruption?

IT is at some risk from disruption due to tariffs. IT projects often run over several years, with long lead times for some hardware components and complex global supply chains. Tariffs hold the potential to drive up short-term purchasing costs.

But the longer term impact of US tariffs and retaliatory measures from other countries is hard to predict. This is because of the political negotiations taking place, but also because of how organisations buy IT and related services.

The impact of tariffs will differ between hardware OEMs, cloud providers and software-as-a-service (SaaS) suppliers that increasingly build their products on top of the large cloud suppliers’ infrastructure. 

“Tariffs will likely drive up costs for end customers in the long run as suppliers have to pass on those expenses,” says Michael Bayer, chief financial officer (CFO) at cloud data storage company Wasabi.

“Differential tariff structures are already having an impact on storage suppliers who are reconsidering their long-term manufacturing strategies in light of a dynamic and uncertain trade environment,” he adds. “Those contribute to supply chain constraints. We see this already as public and private sector customers consider moving to cloud to mitigate these effects.”

Cloud computing can offer some protection from tariff-related IT cost inflation, at least in the short term. But for businesses that operate hybrid environments, as well as the cloud providers themselves, tariffs on equipment will inevitably affect costs over time – but tariffs are not the only reason.

Ashish Nadkarni, group vice-president and general manager for worldwide infrastructure research at industry analysts IDC, adds: “We’ve been polling CIOs and IT decision-makers, and most of them are bracing for higher budgets to procure infrastructure.

“Tariffs may be one reason, but more largely, they’re looking at increased cost given the geopolitical uncertainty. Most of them are bracing for higher operating costs. If you are a CIO, I think it will be difficult to ask your CFO for more money mid-cycle. But in the budget cycle, you’re going to want a higher budget because that uncertainty is going to linger for a few more years.”

This, Nadkarni says, will apply even if the US strikes bilateral trade deals with more countries. Organisations might also be able to defer purchasing.

Jon Collins, field CTO at analysts GigaOm, adds: “Hard infrastructure procurement is on three-year cycles anyway, so it’s more about understanding what is coming up for renewal. At the same time, organisations are increasingly looking to sweat their assets, increasing to five or even seven-year cycles.”

As well as keeping hardware running for longer, organisations might consider buying used or refurbished hardware – this happened during the Covid-19 pandemic, when hardware was often in short supply. Firms might also look at other ways to maximise the value of their infrastructure, such as improving server and storage utilisation.

What challenges does the public sector face from tariff disruption?

Private sector organisations, however, are better placed to defer purchases than their public sector counterparts. Private sector firms can also increase prices or, in extreme cases, choose not to offer a service at all. That is rarely the case in the public sector.

Not only are most public sector services critical, but budgets are fixed and departments often under pressure to cut costs or do more with less. Some public sector organisations can increase what they charge some users, but most cannot, and deferring projects causes practical and political issues. It might not, for example, be possible to push an IT upgrade into the next Parliamentary or Congressional cycle.

“Public sector organisations face unique challenges during uncertain times,” warns Wasabi’s Bayer. “Private sector entities can scale up or down their investments. But public sector entities provide critical public infrastructure services upon which citizens depend, and they are subject to rigid budgeting and spending cycles so they can’t easily absorb cost increases.”

Another issue facing the public sector is tighter controls on data sovereignty. Some workloads, or at least their data, cannot be moved to the cloud. For other datasets, cloud options are more limited, with the need to use local availability zones. This removes a potential mitigation for public sector CIOs, even if cloud prices are less likely to rise over the short term.

“I do think that quietly, behind the covers, government agencies are factoring in increased budgets for procuring [IT],” says IDC’s Nadkarni. “They won’t declare it, but they’re at the mercy of contractors who are not going to deliver goods if those goods are going to cost more.”

Local government is likely to fare worse than central government, he suggests, due to smaller overall budgets.

How do you use the cloud to mitigate tariff disruption?

Can cloud offer a way out, even for public sector bodies that handle sensitive data? The answer is a qualified yes, as long as CIOs and chief data officers are able to match data residency requirements to budgets. Organisations should also consider greater use of software-as-a-service applications, with the right data protection in place.

“I am hearing of non-US organisations stating they would rather not buy from US companies,” says GigaOm’s Jon Collins. “I think this is really driving a desire for control and sovereignty, in terms of whether an organisation – commercial or governmental – can make its own decisions, guarantee its own data and minimise the chances of surprises down the line.”

Cloud and SaaS services also have good reasons to control costs for public sector customers. Governments have large budgets and are willing to sign long-term contracts. And with hardware making up only one part of cloud suppliers’ costs, tariffs should only have a second or third order effect on what customers ultimately pay.

Even if cloud providers do face higher costs – and raise their prices in time – switching from on-premise architecture to cloud avoids a short-term spike in infrastructure costs.

CIOs might even be able to lock pricing. The cloud services market remains highly competitive and governments are usually reliable customers. Even if cloud is not a public sector CIO’s first choice, it can buy time while the global trade situation stabilises, allowing services to keep running.

Source

Cisco has introduced a network architecture attributed with delivering a platform relevant for the new world of work, offering simplicity and speed, and powering the campuses, branches and industrial networks of the future.

Kicking off its Cisco Live 2025 annual showcase, Cisco CEO Chuck Robbins stressed that every business is having to evolve at “an incredible pace”, taking notice of not just technology transitions, but also the global geopolitical landscape, making lives more complicated than they used to be. He added that the new era of authenticity will only be secured by fusing security services into the networks that make business workflows possible.

As it announced the platform, the company quoted findings from its IT networking leader survey, which stressed how a major infrastructure shift was underway and that artificial intelligence (AI) could either double the strain or solve it.

Specifically, the research found that 97% of businesses believe they need to upgrade their networks to make AI and internet of things (IoT) initiatives successful, and the stakes are high: a single severe outage can inflict nearly $160bn in losses globally. Faced with these challenges, IT teams need a new approach to scale operations, reduce downtime, and unlock new levels of efficiency and innovation.

Putting the launch into context at Cisco Live 2025, Cisco president and chief product officer Jeetu Patel (pictured above) warned that as AI transforms work, it will fuel explosive traffic growth across campus, branch and industrial networks, and could overwhelm IT teams with complexity and novel security risks at a time when downtime has never been more costly.

Moreover, he said that going forward, there would only be two types of company: those that are really adept with their use of AI, and those that really struggle. Cisco’s mission, he assured, was to make sure businesses fell into the first category by providing all of the necessary infrastructure safety and security, in addition to supporting AI datacentre build-outs, and to future-proof workplaces through an underlying substrate of global connectivity.

“I think the infrastructure requirements for AI will change quite substantially because of the demand for more compute, more power and more network bandwidth. It’s almost insatiable. Just imagine what the world could do if we weren’t constrained on [these fronts],” said Patel.

“[We will] build out the datacentres, build out the workplaces and make sure that they have secure global connectivity across all of them,” he added. “We will make sure that we are providing our innovations to help organisations move to this era of agentic AI and … we have a bunch of innovations around AI-ready datacentres and future-proofing workplaces.”

Network modernisation

As Patel envisaged the era of agentic AI, he stressed that sometimes enterprises underestimated just how much networking was essential for running an effective AI operation, and that they have to modernise networks to carry the workloads that come with the technology.

“Modern means it’s secure, reliable, high performance,” he said. “You have to re-rack your entire network, or your entire datacentre. You have to rebuild the network, you have to change the latency requirements, you have to change the performance, you have to change power efficiency to be much, much more. And if you do those things right, by definition, your constraints start going down around infrastructure.”

Cisco president and chief product officer Jeetu Patel addresses the audience at Cisco Live 2025

The new architecture is said to deliver the operational simplicity through unified management, next-generation networking devices purpose-built for AI workloads, as well as advanced security capabilities embedded into the network. Indeed, Patel noted that security was now a prerequisite for productivity. The end result was that the new platform could empower enterprises to confidently adopt and scale AI services, giving them a competitive edge.

Cisco regards operational complexity as among the greatest challenges currently facing IT teams, and the unified management platform aims to address this by bringing together the management of Meraki and Catalyst devices, along with support for next-gen wireless, switching, routing and industrial networks. These are delivered from a single platform that supports any cloud, on-premise or hybrid deployment.

The new unified management platform is also said to be further differentiated by ThousandEyes assurance – extended to mobile endpoints, and industrial IoT – to deliver deeper, more actionable visibility into enterprise networks and Microsoft Azure. A new integration between ThousandEyes and Splunk is said to result in SDD real-time insights from network to application, with assurance and observability across both owned and unowned infrastructure, helping ensure consistent performance and operational resilience.

At the heart of the platform is AgenticOps, an AI-driven approach designed to turn real-time telemetry, automation and deep domain expertise into intelligent, end-to-end actions. AgenticOps capabilities are seen as extending across domains and are powered by a new Deep Network Model – a domain-specific LLM. The Deep Network Model also powers the Cisco AI Assistant, a natural-language interface built to identify issues, diagnose root causes and automate workflows.

The claimed result is that AI that understands networks and works the way IT does, reducing task time from hours to minutes. The new AI Canvas offers a generative AI user interface for customer dashboards that enables NetOps, SecOps and DevOps teams to collaborate, optimise operations and reduce IT strain.

Cisco Live also saw the company unveil purpose-built hardware intended to meet the unprecedented demands AI workloads will place on networks to deliver the required low latency, high capacity and security for the AI-powered enterprise. Each device is tailored to meet the specific demands of its environment.

The new range is said to represent the largest refresh of networking devices Cisco has carried out, encompassing the needs of campus, branch and industrial IoT applications. The switches are built on Cisco Silicon One core foundation technology featuring custom ASICs that are programmable, so users don’t have to take out a new piece of silicon every single time it has a new use case.

Cisco also announced it was extending its Wi-Fi 7 portfolio with the Cisco Wireless 9179F Series Access Points for stadiums and large venues, and is delivering cloud-managed roaming for large campuses with a Campus Gateway.

To meet the performance and reliability demands of industrial AI use cases, Cisco has introduced ruggedised switches in a variety of form factors to support applications including visual quality inspections and autonomous mobile robots. New critical wireless use cases are now connected with the integration of Ultra-Reliable Wireless Backhaul together with Wi-Fi technology in a single access point.

The new generation of Cisco Smart Switches can deliver up to 51.2Tbps of throughput, below five microsecond latency and quantum-resistant secure networking that the company says will power AI applications. New routers offer native SD-WAN and secure access service edge integration, next-generation firewall, and post-quantum security into a single-box WAN offering – with up to three times the throughput of previous generations.

Commenting on the core of the new switches, Martin Lund, executive vice-president of Cisco’s common hardware group, said what the new devices were based on was a new architecture for a new world, and that businesses had to have capability to be able to adapt to the new workloads.

“The networks have to go faster [with] lower latency, lower power,” he said. “It has to be a more efficient solution and it just keeps going at a rate that’s faster than anything I’ve seen before … The entire stack is being developed and rewritten as we speak. That’s industry-wide. We’re speeding up the innovation.”

Security challenges

Looking at a fundamental aspect of the modern network, Cisco accentuated that enterprise networks face a complex and dynamic security landscape. To combat these continually evolving threats, the company said it was integrating advanced security seamlessly into the network and is unveiling new protections across three critical layers: securing network infrastructure; defending data in transit; and protecting users, endpoints and applications.

For Patel, while clearly stating that security was a prerequisite in the adoption of AI, he stressed how that security was a prerequisite for productivity and that everything started with trust.

“The trust that people have in these systems really matters in the way in which you adopt, you accelerate adoption,” he said. “Without safety and security, you don’t trust the system. If you don’t trust the system, you’re not going to use it.

“And one of the big reasons why we created AI defence was we wanted to have a common substrate of security and safety across every model, every agent, every application, every cloud. And the reason we wanted to be common across is because you want to be consistent, so that if you change out your model, you should not have to rethink your security architecture when you’re building an application.

“Every single time you build an application with the use of AI, you should not be rebuilding your security stack,” said Patel. “In the past, what would happen is you would always make this trade-off between security. If you want to be secure, do you want to be productive? And [now] for the very first time, security is becoming an accelerant to adoption, rather than becoming an impediment.”

Source

The UK’s Cyber Security and Resilience (CSR) Bill represents a golden opportunity to enhance Britain’s national cyber security posture but risks losing the support of key industry stakeholders unless its backers adopt a more comprehensive outlook, a group of MPs has warned.

In a report published 11 June, the Cyber Innovation All-Party Parliamentary Group (APPG) said that they found widespread support for stronger cyber laws, but that more collaboration and a “more ambitious, future-proofed” approach was needed to maximise its benefits.

In compiling its report, the APPG conducted a national study of cyber professionals, incorporating inputs from a roundtable discussion at which representatives of managed security services providers (MSSPs), cyber suppliers, academics and other organisations shared their views.

It said that while 46% of respondents believed the CSR Bill will support economic growth, 44% merely saw “the potential”. The APPG warned that amid ongoing cyber attacks targeting the British economy – notably the retail sector – this underscored the need for politicians to be more ambitious and inclusive.

Cyber Innovation APPG chair, recently elected MP and former BCS policy lead Dan Aldridge said: “This bill is a historic opportunity to strengthen the UK’s cyber resilience, but we risk falling short if we don’t listen to those on the frontline.

“We’re calling on DSIT to open up the conversation, coordinate across government, to provide a timeline and process for tackling the urgent issues that are deemed out of scope. By future-proofing regulations and giving parliament a clear role in oversight, we can make sure the UK remains secure and competitive in a rapidly changing digital world.”

Till Sommer, policy counsel at the Cybersecurity Business Network (CBN) – a coalition of security organisations that also provides the APPG’s secretariat, added: “We need all the inputs we can get for the bill, from across the cyber sector in the UK. We encourage stakeholders nationwide to participate in these crucial discussions so that the CSR Bill delivers the resilience, innovation and growth our sector needs.”

Ransomware is not the only issue we face

Since it was first floated in last summer’s King’s Speech, the CSR Bill has attracted headlines and stimulated much debate thanks to clauses that will mandate ransomware incident reporting for key sectors including local councils, schools and NHS Trusts. This is something the government is keen to get through because it believes this will provide better data on cyber incidents, improve the UK’s national understanding of the treacherous threat landscape and potentially provide early warning of incoming attacks.

However, cyber security is about much more than ransomware prevention, and the APPG report acknowledges this, saying that the CSR Bill, while transformative, is too narrow in its scope and excludes key opportunities which may be very beneficial to the economy, and wider society.

The APPG highlighted several areas in which it believes the bill could be enhanced. These include embedding corporate governance in decision-making flows, better empowering cyber pros to address new threats and offering those in threat intel functions better legal protections, and aligning regulatory requirements to reduce compliance issues and elevate standards.

It called the government to enter into more consultation with Britain’s cyber sector and bring stakeholders into the drafting process, account for the increased use of AI and quantum computing and the passing of NIS2 in the European Union (EU).

The APPG also said stakeholders wanted to see more done on regulatory alignment and favoured a more collaborative approach with regulators, and supported the Bill’s proposals around the power of direction and use of secondary legislation for future-proofing the bill, provided these are robust and Parliament’s role is clearly defined.

Source

Microsoft’s latest Patch Tuesday update landed on schedule on 10 June, with admins facing a much lighter load heading into the summer – at least lighter than of late – with barely 70 security flaws awaiting attention and just two potential zero-day common vulnerabilities and exposures (CVEs) in scope.

The two most pressing issues for patching this month are CVE-2025-33053, a remote code execution (RCE) flaw in Web Distributed Authoring and Versioning (WEBDAV), and CVE-2025-33073, an elevation of privilege (EoP) vulnerability in Windows Server Message Block (SMB) Client. Both carry a CVSS score of 8.8.

Microsoft revealed it has evidence that the first of these CVEs is already being exploited in the wild, although proof-of-concept code is not publicly available, while for the second, the opposite is true. It credited the RCE flaw to Alexandra Gofman and David Driker of Check Point Research, and the second to researchers with CrowdStrike, Synacktiv, SySS GmbH, and Google Project Zero.

Out of these two, CVE-2025-33053 probably presents the most pressing patching need. This is because in practice, the issue affects various tools that still incorporate the defunct Internet Explorer browser in a legacy capacity, hence Microsoft has been forced into the position of producing patches for long out-of-support platforms, dating back as far as Windows 8 and Server 2012.

“This vulnerability allows attackers to execute remote code on affected systems when users click on malicious URLs,” said Mike Walters, president and co-founder of patch management specialist Action1. “The exploit takes advantage of WebDAV’s file handling capabilities to run arbitrary code in the context of the current user. If the user holds administrative privileges, the impact can be severe.  

“What makes this flaw particularly concerning is the widespread use of WebDAV in enterprise environments for remote file sharing and collaboration. Many organisations enable WebDAV for legitimate business needs – often without fully understanding the security risks it introduces. 

“The potential impact is extensive, with millions of organisations worldwide at risk. An estimated 70 to 80% of enterprises could be vulnerable – especially those lacking strict URL filtering or user training on phishing threats,” he added.

Meanwhile, Ben Hopkins, cyber threat intelligence researcher at Immersive, ran the rule over the second potential zero-day, CVE-2023-33073, saying; “It’s classified as an Elevation of Privilege vulnerability, which indicates that a successful exploit would allow an attacker to gain higher-level permissions on a compromised system.

“Threat actors highly seek out vulnerabilities of this nature. Once an attacker has gained an initial foothold on a machine, often through methods like phishing or exploiting another vulnerability, they can leverage privilege escalation flaws to gain deeper control.

“With elevated privileges, an attacker could potentially disable security tools, access and exfiltrate sensitive data, install persistent malware, or move laterally across the network to compromise additional systems. Given the high severity rating and the critical role of SMB in Windows networking, organisations should prioritise applying the necessary security patches to mitigate the risk posed by this vulnerability.”

Ten critical flaws, hanging on the wall

The Microsoft June Patch Tuesday update also includes no fewer 10 critical flaws – four affecting Microsoft Office, and one apiece in Microsoft SharePoint Server, Power Automate, Windows KDC Proxy Service (KPSSVC), Windows Netlogon, Windows Remote Desktop Services and Windows Schannel. Out of these, eight – including all four office vulns – are RCE issues, and the other two enable privilege escalation.

Kev Breen, senior director of threat research at Immersive, said defenders should put the Office vulnerabilities high on their list of priorities.

“Listed as a use after free, heap-based buffer overflow, and type confusion RCE, these vulnerabilities would allow an attacker to craft a malicious document that, if sent and opened by a victim, would give the attacker access to run commands on the victim’s computer remotely,” said Breen.

“Microsoft also says that The Preview Pane is an attack vector, meaning that simply viewing the attachment in something like Outlook could be enough to trigger the exploit. More concerning is that Microsoft says there are no updates available for Microsoft 365 at the time of release, and customers will be notified via a revision to this notice.

“While this CVE is not actively being exploited, the risk remains high as threat actors have been known to quickly reverse engineer patches to create n-day exploits before organisations have a chance to roll out patches,” he added.

Source