This is an issue that’s becoming increasingly important as technology moves deeper into Britain’s critical infrastructure, public services and national security systems.

So, is Britain’s reliance on foreign technology becoming a national security risk? And if the answer is yes, what can Britain actually do about it?

The Real Risk Is Dependency, According To Experts

For several of the experts, the biggest problem isn’t foreign ownership itself. Rather, it’s the absence of alternatives and the access to these alternatives.

Muhammad Yahya Patel, vCISO and Cybersecurity Advisor for EMEA at Huntress, argues that foreign technology can provide enormous benefits, including security capabilities that would be difficult and expensive to recreate domestically.

The problem, however, begins when a critical service becomes dependent on one supplier, technology or jurisdiction. John Harms, Head of Government Solutions at Quantexa, makes a similar point. According to Harms, keeping data in Britain doesn’t automatically make a system sovereign if the technology controlling that data remains dependent on an overseas provider. And that’s where things get rather complicated.

Indeed, this changes the question from whether or not the tech is British to whether or not Britain could function without it.

Some Experts Think Britain Needs An Exit Strategy

It’s not the glamorous option, especially when considered alongside the idea of building a giant British tech industry from the ground up. However, what’s more important is that it could be considerably more practical.

Evgenii Arsentev, CEO of AskDocDoc, argues that Britain should focus on making critical technologies replaceable rather than trying to recreate everything domestically. And that means open interfaces, portable data and tested alternatives.

His point is particularly relevant for governments and large organisations, which can spend years building processes around a particular provider. At that point, switching suppliers isn’t just a technical decision; it can mean replacing systems, retraining staff and rebuilding entire workflows.

Kim Larsen, CISO at Keepit, similarly argues that sovereignty starts with knowing exactly where critical data and workloads sit, who controls access to them and what happens if that access is suddenly removed. Essentially, you can’t build resilience around a dependency you don’t fully understand.

AI Is A Different Problem

AI could make this question a lot more difficult. Rob Demain, CEO of e2e-assure, argues that the UK’s dependence on foreign AI is particularly concerning because the most capable models are largely being developed by American companies, while Chinese models represent another major source of advanced AI.

For critical infrastructure, that creates a question about what happens if the AI being relied upon is suddenly unavailable, restricted or changed by the company or government behind it.��Demain’s answer is to focus on the control layer. The AI that’s used to protect critical infrastructure, he argues, should be capable of running locally and under UK ownership and jurisdiction.

That doesn’t necessarily mean that Britain needs to build the world’s best foundation model tomorrow, but it does mean that critical systems shouldn’t become incapable of functioning without access to someone else’s model.

Is It Possible for Britain To Become Technologically Sovereign?

It’s tough to say, but probably not.��Warren O’Driscoll, Head of Security Practice at NTT DATA UK&I, points out that Britain simply lacks the scale to achieve “top-to-bottom sovereignty”. Now, that doesn’t mean doing nothing.

O’Driscoll argues that investment should instead be targeted at areas where sovereignty matters most, particularly sensitive government operations and critical infrastructure, alongside sectors where Britain already has strong scientific and technological capabilities.

Matthew Barrington-Packer, Delivery Consultant across MOD, BAE Systems and Imperial College London, takes an even more operational approach to the issue.��For him, sovereignty can’t remain an aspiration in government policy documents, because critical dependencies need owners, replacement decisions and deadlines. Ultimately, knowing that you have a vulnerability isn’t the same as fixing it.

So What Does Britain Actually Need?

Perhaps the answer isn’t sovereignty in the traditional sense at all. Raphaël Auphan, COO at Proton, argues that governments and businesses should audit their technology stacks, map their dependencies and establish fallbacks where necessary.

Matt Lloyd Davies, Principal Security Author at Pluralsight, makes the point that concentration is actually the central risk. A supplier being foreign can add geopolitical concerns, but relying heavily on one supplier is a vulnerability regardless of where that supplier comes from.

And so, the objective isn’t to stop using American, European, Asian or other international technology, but rather to make sure Britain can still operate if one of those relationships suddenly changes. In this case, the UK would have more choice, visibility, interoperability and the ability to switch if necessary.

Because Britain may never be technologically self-sufficient, and perhaps it doesn’t actually need to be. But if a country can’t replace a critical system, maintain it without outside (foreign) help or keep it running when an overseas supplier becomes unavailable, then the question of technological sovereignty stops being theoretical and starts becoming a major issue of resilience and national security.

Our Experts

• Kim Larsen: CISO at Keepit
• Evgenii Arsentev: PhD, Chief Executive Officer at AskDocDoc
• Raphaël Auphan: Chief Operating Officer at Proton
• Warren O’Driscoll: Head of Security Practice at NTT DATA UK&I
• Muhammad Yahya Patel: vCISO and Cybersecurity Advisor for EMEA at Huntress
• Andriy Dovbenko: Founder of UK-Ukraine TechExchange
• Rob Demain: CEO of e2e-assure
• Stuart Harvey:��CEO of Datactics
• John Harms:��Head of Government Solutions, Quantexa
• Jack Collier: Chief Growth Officer at io.net
• Matthew Barrington-Packer:��Delivery Consultant (MOD, BAE Systems, Imperial College London) and Author of, “Just F*cking Ship It”
• Daniel Di Nardo: Network and Security Consultant at
• Matt Lloyd Davies: Principal Security Author at Pluralsight
• Lee Perkins: CEO at Civica

Kim Larsen, CISO at Keepit

“Sir Richard Dearlove is right to flag the risk, however, there’s no quick fix here. Similar to the situation across Europe, Britain won’t become independent of global hyperscalers overnight. That’s the reality we’re all working with.

“What’s changing is that awareness and the tools to manage this risk are catching up: new technologies, new vendors, and regulation are all moving in the right direction, giving organisations more options than they had even a year ago.

“And fortunately, the wake-up calls that we have had in recent years can be responded to: we can get to work on protecting critical infrastructure today, even if we do still have technological dependencies.

“It’s essentially about governance: It’s less dramatic, slightly more dull, but knowing exactly where your critical data and workloads sit, who controls access to them, and what happens if that access is suddenly cut off, is the best data protection right now. Sovereignty starts with control over your own data, not with abandoning the infrastructure you depend on for better or worse.”

Evgenii Arsentev,��PhD, Chief Executive Officer at AskDocDoc

“Sovereignty arguments usually fixate on who owns the hardware. The sharper question for anyone running critical services is substitutability: if your main supplier changed terms, raised prices or went dark on Friday, what would still be running on Monday?

“For most organisations the honest answer is nothing, because the dependency was never on a product, it was on a whole way of working that grew around one vendor’s tools. That is a supply risk before it is a foreign policy one. I would not spend public money rebuilding a domestic copy of everything. I would spend it on making swaps possible: open interfaces, portable data, and at least one tested alternative for anything the country cannot do without. Dependence you can exit in a week is not a national security risk. Dependence nobody has ever tried to exit is.”

Raphaël Auphan, Chief Operating Officer at Proton

“In today’s world, digital sovereignty is no different from actual sovereignty. Sir Richard Dearlove is right: British businesses are over-reliant on technology owned by other jurisdictions. Proton’s research shows 74% of European firms fear a US “kill switch” cutting them off from their digital tools. Over half (54%) say they couldn’t survive a single day without them. This isn’t an abstract fear. Proton’s Tech Watch found that 88% of the UK’s publicly listed companies run their email on US infrastructure, directly exposed to US law.

“When an economy goes offline at another government’s whim, that isn’t just a business continuity issue, it’s a national security vulnerability. The answer isn’t necessarily British-built everything, but jurisdiction matters. As a Swiss, European company that employs engineers across the continent, including in the UK, Proton operates under laws that no Washington or Beijing administration can override. More broadly, government and British businesses must audit their tech stacks, map their dependencies, and build fallbacks in case a supplier’s politics change. This isn’t about isolationism but instead having options when the supply chain stops being neutral.”

Warren O’Driscoll, Head of Security Practice at NTT DATA UK&I

“Compared to trading blocs such as the USA, China and even the EU, the UK lacks technology manufacturing industrial capacity and is heavily dependent on providers from other shores for key infrastructure to support services including cloud, compute, security and AI. And we have a lot to lose if things go awry: our economy is built around services, which depend on digital technologies. As UK businesses roll out AI, achieving a level of sovereignty will become ever more important both to protecting economic growth, and to averting disruption to critical services.

“On the positive side, strengthening our sovereign AI capabilities could enable us to generate more value from our advanced scientific, digital and research sectors: the government is right to warn that digital inventions and innovations coming out of the UK are too often monetised in countries with stronger domestic digital infrastructures and production. Occupying the regulatory middle ground between the US and the EU, the UK can take a more flexible approach – avoiding either the EU’s regulatory rigidity or the USA’s ‘sell it first, build and regulate later’ approach, and putting it in a strong position to host digital innovators and cutting-edge research.

“So intelligently-targeted spending on sovereign AI could boost national resilience, growth and investment. These investments should be proportionate to risk – prioritising sovereignty in sensitive government operations and critical national infrastructure, for example. They should also favour high-potential sectors – focusing on fields such as biotechnologies and advanced engineering, in which we have lacked the secure, domestic capacity to scale new technologies.

“It’s important to be realistic here. The UK lacks the scale to achieve anything like top-to-bottom sovereignty, and £1.1 billion is tiny by comparison with the sums being invested elsewhere: we’ll have to accept that some elements of AI sovereignty cannot be achieved. Nonetheless, it is a helpful and positive signal as to the government’s direction of travel; we can only hope that the new administration continues on this journey.”

Stuart Harvey, CEO of Datactics

“The most important concern around digital sovereignty is about who has access to data and how this is regulated.

“The biggest challenge isn’t only the dependence on external technology providers, but also whether control is retained over the quality, governance and lineage of the data that underpins businesses and national security.”

“At its core, digital sovereignty ensures that sensitive national data is protected under national laws and oversight that is managed with clear accountability. Building UK AI capabilities is a strategic move to reduce the structural risk of relying on platforms where access can be withdrawn at any moment.”

Muhammad Yahya Patel,��vCISO and Cybersecurity Advisor for EMEA at Huntress

“Britain’s reliance on foreign technology can create national security risks, but we need to be careful not to confuse foreign ownership with insecurity.

“The bigger issue is dependency. The UK benefits enormously from global technology and from trusted international partners. In some cases, major overseas technology providers offer security capabilities and resilience that would be difficult or costly to reproduce domestically.

“The risk arises when a critical public service becomes so dependent on one supplier, technology or jurisdiction that we have no realistic alternative if that service is disrupted, compromised or becomes unavailable. So, the answer isn’t simply to “buy British”. We need to identify our critical technology dependencies, scrutinise supply chains, diversify where appropriate and make sure organisations have credible contingency and exit plans.

“Ultimately, resilience comes from having options. We should be able to benefit from the best global technology without becoming so dependent on any single supplier, country or technology that its disruption becomes our crisis.”

Andriy Dovbenko, Founder of UK–Ukraine TechExchange

“In a recent piece in a UK national newspaper, Sir Richard Dearlove, the former head of MI6, warned that foreign states have their ‘fingerprints all over our critical national infrastructure’. I’ve taken some time to digest those comments, and I think they raise a question Britain needs to answer: how much control do we have over the technology we would depend on in a crisis?

“My view is that technological dependence becomes a national security risk when we lose the ability to act independently. If we cannot repair a system, replace a critical component or keep a service running without an overseas supplier’s support, that has consequences for our security.

“Ukraine gives this debate a very practical context. The Russian cyberattack on the Viasat satellite network began approximately an hour before the full-scale invasion in February 2022. Britain should take that experience seriously when assessing the resilience of its own communications and critical infrastructure.

“Ukraine’s experience also shows why access to engineers, production capacity and the ability to adapt technology quickly matter so much. Buying a finished product is only part of the equation. You need the people and capabilities to keep it effective as circumstances change.

“Through UK–Ukraine TechExchange, I see considerable potential to connect Ukrainian defence innovation with British investment, engineering and manufacturing. We should be developing those partnerships with a long-term ambition: building capabilities that both countries can sustain, improve and rely on.

“For Britain, that means giving promising defence and technology companies a clearer route from trials to meaningful contracts. It means procurement decisions that take maintenance, supply chains and operational control as seriously as the purchase price. And it means testing whether alternatives actually work before we need them.

“Foreign ownership alone does not make a technology unsafe, and Britain will continue to need international partners. But we should understand exactly where our dependencies leave us exposed and invest in the capacity to address them.

“What stays with me after Dearlove’s comments is this: sovereignty has to be something we can exercise under pressure. We need to know that the systems we rely on will remain available, and that we have the skills and resources to respond when they fail.”

Rob Demain,��CEO of e2e-assure

“The dependency to worry about now is AI. The most capable models are American and the companies that build them set the guardrails, hold back capability and Washington can pull access entirely. The alternative on the open market is Chinese. China is giving open-weight models because distribution is the strategy. So the real choice facing UK critical infrastructure is American models we don’t control or Chinese models we can’t put in an assurance chain.

“Britain has no answer of its own today, despite earmarking £750m for a national super computer. That won’t be fixed quickly, so the practical step is sovereignty at the control layer: AI used to defend critical infrastructure should run locally, under UK ownership and jurisdiction, on infrastructure that keeps operating if a foreign government changes its mind. That is buildable today. A British AI model is a longer project.”

John Harms, Head of Government Solutions, Quantexa

“Using international technology is not, in itself, a national security risk. The real danger is dependency. If critical public services become so reliant on a single provider that the government loses control of its data, cannot easily switch suppliers or risks disruption if that technology becomes unavailable, then it becomes a question of national resilience.

“Keeping data on British soil doesn’t automatically give Britain technological sovereignty. What matters is retaining control, visibility and freedom of choice.

“The answer isn’t to shut out global technology companies. The government should build open, interoperable technology ecosystems that allow it to choose the best technology while avoiding dependence on any one provider. True technological sovereignty means Britain can benefit from global innovation without ever becoming so reliant on a supplier that it loses the freedom to choose.”

Jack Collier, Chief Growth Officer at io.net

“Three American companies – Amazon, Microsoft, and Google – own nearly all of the UK’s cloud infrastructure. Britain talks about AI leadership, but the country’s work to train and deploy AI models runs on machines owned by these global providers. There’s no British alternative to keep them honest.

“The UK’s only homegrown public cloud provider, UKCloud, went bust in 2022 after American giants opened UK data centres and undercut them on price. In September 2025, the Ministry of Defence handed Google a £400 million “sovereign cloud” contract. A month later, HMRC awarded Amazon a £500 million contract as the sole bidder after rivals pulled out.

This creates a national security problem. Britain is increasingly dependent on foreign companies for infrastructure storing critical data. There’s also an economic cost – British businesses, startups and research projects pay high and unpredictable computing costs to the same hyperscalers, raising the price of experimenting with AI and turning ideas into viable products.”

Matthew Barrington-Packer, Delivery Consultant (MOD, BAE Systems, Imperial College London) and Author of, “Just F*cking Ship It”

“Dearlove is right about the risk but the diagnosis usually stops too early. Having spent twenty years delivering programmes across UK defence and critical infrastructure, I’d argue our biggest sovereignty weakness isn’t which foreign kit sits in the stack — it’s how slowly we replace anything. British infrastructure operators know where their dependencies are; what they lack is the institutional will to act on that knowledge.

“Replacement programmes get agreed by every committee and committed to by none, deferred year after year as “under review.” A sovereignty strategy is only as strong as its delivery dates. The practical fix is unglamorous: name each critical dependency, name its replacement decision, and put an owner and a hard date on it. Sovereignty isn’t declared in policy papers. It’s shipped, system by system.”

Daniel Di Nardo, Network and Security Consultant at��Intellibreach��

“In my opinion, Sir Richard Dearlove’s warning underscores a very real cybersecurity risk. If one of the foreign states has influence or control over the critical infrastructure, it is a significant security concern for the United States, not only technological but also geopolitical. States should ensure that their critical infrastructure is protected from being taken advantage of by foreign governments.

“This hazard can be mitigated by implementing a least-privilege access rule, conducting constant identity checks, and having an approval process in case of privilege escalation. In addition, it is essential to have a plan for rolling back or revoking access if something goes wrong or an unauthorized breach occurs. The strategy to prevent cyber intrusion and respond to it is vital for each country.

“Thus, the expert’s words are important for the U.S. government in assessing the potential risks of foreign states and their involvement in the development of critical infrastructure technologies. Without proper control and management, technology can be taken over by foreign agents, which will inevitably lead to destabilization and geopolitical risks.”

Matt Lloyd Davies, Principal Security Author at Pluralsight��

The risk is real, but “foreign technology” and “loss of sovereignty” aren’t the same thing. Critical infrastructure will always rely on global suppliers. The real question is whether those dependencies leave the UK unable to operate, maintain, replace, or recover essential services without external cooperation.”

“The national security concern is concentrated dependency, not foreign origin on its own. If a critical service depends heavily on a single overseas supplier, component, cloud platform, or remote support model, that can create strategic leverage even without a cyberattack.”

“That’s as much a resilience issue as a cybersecurity issue. The key question isn’t “is this a threat” but whether the UK understands its critical technology dependencies and has credible alternatives if a supplier, country, or technology suddenly becomes unavailable.”

“This isn’t a uniquely British problem. The EU is having a near-identical debate right now. About two-thirds of European cloud services run through three US companies, and the European Commission has just launched its own Tech Sovereignty Package. Even Germany (usually the sensible one!) admits in its own surveys that most companies want independence from US providers but don’t have it. Most advanced economies are built on the same small set of hyperscalers and suppliers, and everyone is now working out what that means.”

“Concentration is the core risk regardless of who the supplier is. That said, adversary-owned dependency does carry an added layer on top of ordinary concentration risk: the possibility of deliberate leverage or disruption, not just accidental failure or commercial disruption. Concentration risk exists either way; the adversarial case adds intent to the equation.
The answer isn’t technological isolation, it’s better visibility of supply chains, stronger scrutiny of technology used in critical infrastructure, control over remote access, diversification where dependencies are too concentrated, and contingency planning that’s actually exercised.”

“Sovereignty should mean retaining meaningful operational choice. The UK doesn’t need to build everything domestically, but for genuinely critical systems, it should know what it depends on, where control sits, and what happens if that dependency fails.”

Lee Perkins,��CEO at Civica

“This is a concern, but we need to keep a sense of perspective. Every day, people rely on technology to access healthcare, local services, education and emergency support. If critical systems – or the data behind them – become overly dependent on decisions made outside the UK, that creates a vulnerability we can’t ignore.

“At the same time, that does not mean rejecting global technology. International providers bring expertise, investment and security capabilities that are often hard to match. Britain should continue building its own digital capability while working closely with trusted partners. Public bodies need a clear understanding of where their data sits, how systems connect and who is involved in the supply chain. Greater transparency, interoperability and flexibility are just as important as security in building long-term resilience.”

For any questions, comments or features,��please contact us directly.

The post Experts Comment: Is Britain’s Reliance On Foreign Technology Becoming A National Security Risk? appeared first on 91̽��.

Tell Me About Yourselves and PANIO

I’m Cameron Shaw, a multi-exit founder in biotech and longevity, including taking a biotech company through a Nasdaq IPO.

And I’m Moe Hanafy, a multi-time founder and operator across SaaS and AI, with experience launching and scaling 30+ products and platforms globally, generating $Ms in revenue.

We are the co-founders of PANIO, The Dog Longevity Company.

We’re taking many of the principles transforming human longevity; prevention, comprehensive diagnostics, personalised interventions and continuous optimisation and applying them to dogs.

PANIO looks beneath the surface across 400+ health markers to build a much deeper understanding of each individual dog. We then turn that data into meaningful, personalised actions designed to improve health today while giving every dog the best possible chance of a longer, healthier life.

What Inspired You To Start PANIO, and What Problem Were You Trying To Solve?

Too many dog parents experience the same heartache: discovering something is wrong when it’s already too late. Behind that is often quiet suffering that, with earlier information and intervention, might have been reduced or avoided.

We wanted to move dog healthcare from reactive to proactive.

Human longevity is increasingly focused on understanding what is happening beneath the surface before disease presents itself. Why shouldn’t we do the same for dogs?

PANIO was built to identify those signals earlier and, crucially, do something meaningful with them. If we can intervene sooner, optimise health and potentially prevent some of that suffering and heartache, that’s an incredibly powerful reason to exist.

What Has Been Your Biggest Challenge So Far, and How Did You Overcome It?

One of the biggest challenges has been deciding what not to build.

The opportunity in dog health is enormous. There are diagnostics, genetics, wearables, nutrition, supplements, therapeutics and countless other directions we could pursue. When you can see the bigger vision, there’s a temptation to build everything at once.

We’ve had to become disciplined about sequencing: establish the strongest possible foundation, understand the dog comprehensively, make that information actionable, and build from there.

The ambition hasn’t become smaller. If anything, it has grown. We’ve simply learnt that building something ambitious requires being incredibly focused on what comes first.

Can You Describe a Pivotal Moment That Significantly Shaped the Direction of PANIO?

Seeing our first real-world results was pivotal. We were finding significant levels of chronic inflammation, elevated cortisol, parasites and other underlying signals in dogs that appeared perfectly healthy.

But we quickly realised testing alone wasn’t enough. Dog parents naturally asked: “What do I do next?”

It’s all well and good giving someone a sophisticated test result, but saying “here are your results, see you later” doesn’t solve the problem.

That shaped PANIO into what it is today: not simply measuring, but translating data into meaningful insight around diet, nutrition, supplementation, exercise and appropriate interventions, then tracking the dog over time to understand what is actually working.

How Do You Define Success?

For your business:��We want PANIO to change an industry and make a genuinely positive impact while doing it. If we can help shift dog healthcare from predominantly reactive treatment towards proactive, preventative health and ultimately give millions of dogs more healthy years with their families, that is success. Building a significant global company and creating meaningful impact don’t have to be opposing goals.

As a founder (Cameron):��My definition has evolved. Earlier in my career, milestones like fundraising, valuations, exits and an IPO felt like the scorecard. Today, I’m more interested in whether I can build something enduring, surround myself with exceptional people and look back knowing the company genuinely mattered.

As a founder (Moe):��It’s the same as it’s always been for me. Every venture I’ve joined or started has had one thing in common: the ambition to build a genuinely great business that also creates a meaningful, positive impact at scale. Success is being able to do both, create something commercially strong while improving the lives of millions of people along the way.

What Advice Would You Give To Someone Thinking About Launching Their Own Startup?

First, be brutally honest with yourself about whether you actually want this life.

Not everyone is supposed to start a company, just as not everyone is supposed to be a professional footballer. That isn’t killing someone’s dream; it’s recognising what the job actually demands.

Are you prepared for years of uncertainty, frustration, rejection and potentially significant personal financial pressure? Are you still going to want it when the excitement of “starting a company” has disappeared?

If the answer is genuinely yes, then start. Don’t wait for perfect conditions. Get something in front of customers, listen obsessively and adapt quickly.

But entrepreneurship shouldn’t be pursued because it sounds exciting. You have to want the reality, not the headline.

What’s Next for PANIO? Any Exciting Developments We Should Watch Out For?

PANIO is now live across the US, UK and UAE, and we’re only at the beginning of what we want to build.

One area we’re particularly excited about is PANIO Frontier, our R&D arm, which has been part of the vision from day one. Frontier is focused on bringing cutting-edge science and new interventions into canine longevity, moving us beyond simply understanding and monitoring health towards finding new ways to actively improve it.

There are some developments there that we’re deliberately keeping under wraps for now.

More broadly, our ambition is for PANIO to become the longevity platform that follows a dog throughout its life, continuously measuring, learning and helping optimise their health as they age.

Want to be featured as 91̽��’s Founder of the Week? Find out more about this weekly feature and how to get involved here.

Founders’ 5 with Cameron Shaw and Moe Hanafy

Want to find out more about the men behind PANIO? Stick around for 91̽��’s exclusive Founders’ 5 with Cameron Shaw and Moe Hanafy.

Favourite Business Tool?

�䲹������Dz�:��Notion. It’s probably the least glamorous answer, but I like anything that creates clarity. Startups become chaotic incredibly quickly: people, ideas, meetings, decisions and priorities all moving simultaneously. Having one place where the team can document what we’re doing, why we’re doing it and what happens next is invaluable. The more ambitious the company becomes, the more important simple organisational discipline becomes.

Moe: Airtable. I love tools that let you turn messy thinking into an operating system, and Airtable does that incredibly well. We’ve used it for everything from CRMs and pipelines to operations, research and internal workflows. It sits in that sweet spot between a spreadsheet and custom software, flexible enough to evolve as the business changes, without needing to build something from scratch every time.

One Lesson You Learned the Hard Way?

�䲹������Dz�:��Establish your culture before you grow your team. It’s crucial to establish the ethos, expectations and standards of a company before you start building a larger team. People need clarity on how you operate, what you expect from each other, and what is and isn’t acceptable. If you don’t define that early, culture starts to form by accident, and every new person can pull it in a different direction. I’ve learnt that skills and experience are only part of building a great team. The best people also understand the standards, values and behaviours expected of them from day one.

�ѴDZ�:��Small communication gaps become fault lines as a company scales. As a business scales, teams naturally become more specialised, but small gaps in alignment quickly turn into duplicated work, conflicting priorities and expensive decisions made without the full picture. I learned that good communication isn’t corporate overhead; it’s operating infrastructure.

One Future Trend You’re Watching?

�䲹������Dz�:��The convergence of AI and preventative healthcare. We’re moving from healthcare based on occasional snapshots towards systems that can continuously learn from genetics, biomarkers, lifestyle and longitudinal data. AI’s ability to connect those enormous datasets and identify patterns humans simply couldn’t process manually could fundamentally change how we think about prevention, ageing and personalised medicine. We’re obviously particularly interested in what that means for animal health.

Moe: Everything personalised, effortlessly. We’re moving from products designed for the average person towards experiences that continuously adapt to the individual. That will extend far beyond personalised medicine into software interfaces, education, nutrition, financial products and even how information is presented to us. The important part is “effortlessly”: people won’t want to configure all of this themselves. AI will increasingly understand context and quietly personalise the world around us.

One Quote You Live By?

Cameron: “Luck is what happens when preparation meets opportunity.” I’ve always liked the principle behind that quote. You can’t control when an opportunity appears, who you happen to meet or when circumstances suddenly change in your favour. But you can control whether you’ve done enough work to be ready when it happens.
�ѴDZ�:��“Materiam superabat opus”; the workmanship surpassed the material. I love the idea that what ultimately creates value isn’t necessarily the raw material you start with, but what you make of it. That feels particularly relevant to startups. You almost never begin with enough money, people, information or time. Two teams can start with almost identical resources and create completely different outcomes. The difference is judgement, creativity, execution and craftsmanship. For me, it’s a reminder that constraints don’t determine the quality of the outcome. The work can become more valuable than the materials you were given.

One Book/Podcast You Recommend?

Cameron: “The Hard Thing About Hard Things,”by Ben Horowitz. Building a company is rarely the clean, linear journey people describe afterwards. Most of the genuinely difficult decisions happen when every available option has downsides and there isn’t an obvious right answer. The book captures that reality better than most business books I’ve read.

�ѴDZ�:��Isaac Asimov’s “Foundation” series. What fascinates me is the idea of psychohistory: taking something as apparently chaotic as civilisation and asking whether, at sufficient scale, it might become understandable and even predictable. One I think about in a similar hierarchy is knowledge: mathematics underpins physics, physics informs chemistry, chemistry gives rise to biology, and eventually you reach psychology and sociology, with each layer becoming exponentially more complex. We’re now reaching a remarkable point where humanity is beginning to understand and manipulate biology with extraordinary precision. “Foundation” makes you wonder whether one day our understanding of societies could become comparably sophisticated.

Want to be featured as 91̽��’s Founder of the Week? Know someone who deserves to be recognised as a founder making waves in the startup landscape? Find out more about this weekly feature and how to get involved here.

The post Founders Of The Week: Cameron Shaw And Moe Hanafy appeared first on 91̽��.

While it obviously isn’t the first time that Amodei and other Big Tech leaders have made important, poignant statements about the more troubling aspects of the future of AI, this letter lands in a slightly different space. Indeed, it follows what seems to be becoming a slew of resignations by Anthropic employees, with Mrinank Sharma in February and now, most recently, Jacob Coxon, former Anthropic researcher, last week. According to The BBC and Business Insider, these explosive departures have been shrouded in dramatic language, including notions that AI companies are “gambling with our lives” and creating “a world in peril”, to name but a few.

And so, Dario Amodei has taken to his own website to address some of these concerns, and he’s done so in a rather poignant open letter entitled, “We Must Pace The Frontier”.

Amodei’s Take On the “AI Problem”

Unsurprisingly, the article quickly gained attention for a few reasons. Firstly, it was, perhaps indirectly, responding to the recent statements about the state of the AI industry that have been causing significant alarm and anxiety around the world.

Second, Amodei’s letter clearly acknowledges the issues and concerns being faced in AI now and going forward without sugarcoating the situation.

And finally, while he’s acknowledging the seriousness of the concerns, the Anthropic CEO isn’t simply offering a warning; he’s actually providing a proposal for a step-by-step strategy to deal with a potentially serious issue.�� He hasn’t suggested that AI companies and governments need to stop development. Rather, he’s��arguing that the AI industry should deliberately slow the pace of frontier AI development so that safety measures have time to catch up.

It’s worth taking the time to unpack exactly what Dario Amodei has stated and suggested, as well as what he hasn’t, when it comes to global safety concerns over the future of AI and the wrold as we know it.

A Quick Overview Of Amodei’s Argument

It’ll be hard to do his letter justic in so few words, but even so, I think it’s important that we simplify and explain what’s�� being said so that the letter is accessible and easy to understand for everybody. So, here’s my shot at exactly that.

At the heart of the letter is a simple concern: that is, AI capabilities are advancing faster than our ability to understand, monitor and control them. To explain this, Amodei points specifically to two developments.

The first is what he calls recursive self-improvement – AI increasingly helping to build the next generation of AI systems. The second is the recent OpenAI-Hugging Face incident that involved AI agents behaving in unexpected and potentially harmful ways, which he argues demonstrates how quickly capabilities are evolving.

Amodei believes states firmly that he believes that AI could deliver enormous benefits, from accelerating scientific research to improving human health. However, he immediately notes, with no uncertainty, that the industry needs to become more deliberate about how quickly it pushes capabilities forward. Importantly, he repeatedly stresses that this does not mean stopping AI development altogether.

In fact, he outlines a three-step process that he believes will help us control the potential problems and dangers of AI, while still allowing it to progress and provide us with the many incredible advantages it has to offer humanity. Importantly, he explains that these steps don’t have to (and may not) be followed in chronological order, and not only that, he acknowledges that some may be significantly more challenging to deal with than others.

So, with those caveats in mind, here’s how he explains the three steps that need to be taken in order to make AI development safe.

Step One: Embedded Evaluators

The first step is the most immediate and arguably the most practical. Amodei wants frontier AI companies to give independent third-party evaluators ongoing access to their systems, processes and safety practices. These evaluators would effectively operate inside AI companies, helping verify that safety commitments are being followed and identifying potential risks before models are released.

He immediately states, on behalf of Anthropic, that he is committed to implementing this approach immediately and is encouraging other frontier labs to do the same. The idea is similar to external auditors in finance: rather than asking companies to assess their own safety practices, independent experts would have visibility into what is actually happening. Thus, it would be much like a “neutral” industry-wide body that would evaluate each company without bias or corporate intention.

Step Two: Coordination Between Democracies

The second step moves beyond individual companies, and this is where things become more challenging.��Amodei argues that frontier AI companies operating in democratic countries should coordinate around common safety standards and limits on unchecked capability growth. The goal is to avoid a situation where companies feel pressured to move faster simply because competitors are doing the same.

In other words, he wants AI companies to compete on products and innovation without creating a race where safety is sacrificed for speed. In his words, rather than a “race to the bottom”, they need to create an environment that encourages “a race to the top”.

He also suggests governments may need to help facilitate some of these discussions, particularly where antitrust concerns could otherwise make collaboration difficult.

Step Three: Global Cooperation

The final step in the letter is arguably the most ambitious.��Amodei argues that democratic nations should eventually work with countries including China to establish international AI safety agreements. These could range from banning particularly dangerous uses of AI to creating shared testing standards for frontier systems.

At the same time, he acknowledges the geopolitical reality, which, unfortunatley, screams out at the reader as soon as the phrase “global cooporation” entered the chat. The letter repeatedly argues that democracies must maintain their technological lead and prevent authoritarian governments from gaining a strategic advantage through AI. Thus, he certainly seems to be presenting global cooperation as something that should happen alongside efforts to preserve Western leadership in AI technology.

The Letter In Brief

With so many immediate reactions from personalities all over the world, both experts and non-experts, it’s worth highlighting both what Amodei does explicitly assert and what he does not.

What Amodei �ٴDZ����Say

One reason the essay generated so much discussion is that many people interpreted it as a call for an AI slowdown, and in a sense, it is.

Amodei explicitly argues that frontier AI development should proceed at a more measured pace. He believes additional time should be used to improve alignment research, interpretability, operational security and safety testing before capabilities advance too much further.

His core argument is that slowing capability growth slightly could buy valuable time to make future AI systems safer and more understandable.

What Amodei���ٴDZ����’����Say

However, there are ideas floating around that Amodei doesn’t address or agree with, and the essay also specifies several things it does not advocate:

• It does not call for a complete pause in AI development.
• It does not propose shutting down frontier AI labs.
• It does not argue that AI itself is inherently bad.

And these things are repeatedly noted throughout the writing, leaving very little space for interpretation (in my opinion).

Despite the dramatic headlines, it does not suggest the industry should stop innovating. In fact, Amodei repeatedly emphasises the enormous benefits AI could bring if developed responsibly. Thus, he’s saying innovation should continue, but under the right circumstances that are controlled, monitored and agreed upon.

Thus, the letter is less about stopping AI and more about creating mechanisms that make it easier to slow down when necessary. And, of course, control the beast altogether.

Immediate Critiques of Dario Amodei’s “We Must Pace the Frontier”

It wasn’t long before the Anthropic CEO garnered support from close colleagues in the industry.

Both Sam Altman and Elon Musk, among others, responded to Amodei’s letter on X, asserting that they agree with his evaluation of the situation and the suggested path forward. They seem to at least generally agree that stronger safety oversight and coordination are needed as models become more capable.

��

Critics, however, have raised concerns that, at this point, are all too familiar. Some argue the proposals could strengthen the position of large AI companies by creating barriers that smaller competitors and open-source projects would struggle to meet. Meanwhile, others question whether the industry can genuinely regulate itself, particularly when commercial incentives continue to reward faster progress. Basically, is what Amodei is suggesting even possible at all?

Of course, perhaps unsurprisingly, China does not seem to agree with Anthropic and the West’s chracterisation of the impending AI problem. Indeed, according to China Tech News, today, Chinese Foreign Ministry spokesman Guo Jiakun said: “Fearmongering, confrontation and vicious competition will only disrupt the process of global AI governance and serve the interests of no one”. This seems to reflect Chinese concerns that moderation in AI safety and innovation may be used to justify US restrictions on Chinese development.

Ultimately, in addition to disagreements over strategy and intention as well as geopolitical concerns, there’s also a major practical challenge that doesn’t seem to be going away; one that Amodei acknowledges in his letter, in many respects. That is, most people seem to agree that AI should be safe, but far fewer people agree on who gets to decide what “safe enough” actually means.

Thus, Amodei’s letter isn’t a demand to stop AI, nor is it a detailed blueprint for global regulation. Instead, it’s an argument that frontier AI is approaching a point where safety can no longer be treated as a secondary consideration. His three-step plan is, according to the letter, supposed to be an attempt to give safety research time to keep pace with capability gains. Ultimately, an objective that ought to serve the greater good.

Whether the industry, both in the West and around the world, embraces that vision remains to be seen. But as AI systems become increasingly powerful, one thing is for sure: the debate has shifted from what AI can do to a more difficult question of, who gets to decide how quickly it should advance?

The post Dario Amodei’s Three-Step Plan For “Pacing The Frontier” Of AI Development Explained appeared first on 91̽��.

But, from a technical standpoint, one thing not everybody has a secure grip on is understanding how all those computers actually work together. Essentially, that’s where cluster computing comes in.

A computer cluster is essentially a group of connected computers that work together as though they were one system. Instead of asking a single machine to handle an enormous workload, the job can be distributed across multiple computers, or “nodes”, which makes the process quicker and more efficient.

On the surface, it sounds relatively simple, but this idea sits underneath a surprisingly large amount of modern computing.

What Is A Computer Cluster?

Put simply, a computer cluster is a collection of computers that are connected through a network and are configured to work together. Each individual computer is known as a node. Nodes have their own processors, memory, operating systems and other resources, but there’s underlying software that coordinates them so that they can collectively tackle workloads.

You can think of it kind of like a startup. No matter how competent they are, one person can only do so much. But, if you give the same job or task to a group of people with expertise across the board, they’ll be able to divide up the responsibilities and work between them, coordinate the team and ultimately, make the overall task significantly more manageable.

This is pretty much how a computer cluster works. Except in this case, the “employees” are really computers, and the clusters can include anything from three or four computers to hundreds, if not thousands, of nodes.

How Does Cluster Computing Work?

The computers in a cluster communicate over a network which normally uses a high-speed local area network (LAN). All this coordination is aided or facilitated by specialised software, sometimes called middleware, which also helps to distribute workloads between them.

A simple thought experiment can be really helpful to explain this concept. Imagine a company receives a million customer requests in a short period of time. Rather than sending every request to one server, a cluster could distribute those requests across dozens or hundreds of servers. That means that each node is able to handle a specific part of the workload, while the overall system presents itself to users as one service. It’s pretty much about dividing and conquering.

Now, this is particularly useful because computers can work in parallel. Instead of having Computer A being allocated task one, two, three and four, you could rather allocate Computers A, B, C and D with one task each. Once they’ve all been completed, they can be consolidated once again.

If done properly, this can dramatically increase the amount of work a system can handle, decreasing the workload and pressure on the system as a whole.

Why Do Businesses Use Computer Clusters?

The main reasons businesses choose to use computer clusters rather than a single system are to improve performance, scalability and overall reliability.

If tasks are divided up among several nodes, that means that the system is able to complete work far faster than a single computer would’ve been able to do, and at a higher quality. When it comes to things like really important scientific research, simulations, AI, machine learning and data analysis of large data sets, this can be incredibly beneficial.

And that leads to scale. If businesses now have the ability to deal with more tasks and complete them far more quickly than before, that means organisations can add more nods rather than replacing one machine with an increasingly powerful computer (that would also be far more expensive). This is called horizontal scaling. IBM explains that it’s possible to increase the resources of clusters by simply adding notes, thus allowing organisations to adjust their capacity in response to changes in demand.

This is helpful for startups that tend to start out with fairly modest infrastructure and aim to expand their computing capacity as their customer base and workloads grow.

Reliability is another significant selling point for cluster computing. By spreading the load across multiple computers (rather than putting everything on one computer), the failure of a single computer won’t take an entire service offline all at once. Rather, if one computer goes down, while it will still be inconvenient, it won’t crash the whole system all at once. Rather, one of the other nodes can take over in the meantime.

Different Types of Computer Clusters

There are different types of computer clusters, built for different purposes.

High-performance computing (HPC) clusters, on the one hand, are designed to tackle computationally intensive workloads. They’re used for things like scientific simulations, research and more often now than ever before, AI and machine learning.

High-availability clusters focus on keeping services running: if one node fails, another can take over.

Load-balancing clusters distribute incoming workloads between multiple servers, helping prevent one machine from becoming overwhelmed.

It’s also possible for there to be combinations of these approaches, depending on what an organisation is trying to achieve.

Are Cluster Computing and Cloud Computing?

The two terms are often confused, sometimes even erroneously used interchangeably, but they’re not the same. Cluster computing is all about connecting computers together so that they can work together as a coordinated system, while cloud computing is more broad. The latter describes a process in which computing resources like servers, storage and software are provided on demand, normally through the internet.

These two can certainly overlap. For instance, cloud providers can make use of clusters behind the scenes in order to deliver computing services to clients. Meanwhile, organisations can also build and manage their own clusters.

So, they’re not the same thing at all, but essentially, clusters are an important part of the infrastructure that makes modern cloud computing possible.

Cluster Computing Is An Important Part of Modern AI

Training and running advanced AI models can require enormous amounts of computing power. Instead of relying on one super-powerful machine, organisations can connect large numbers of processors and GPUs into clusters capable of handling huge workloads.

That means when you hear about AI companies building massive computing infrastructure, there’s a good chance you’re also hearing about clusters – even if the word itself isn’t being used. The basic idea is surprisingly old (like many terms in the AI world, actually), but its importance is growing as computing workloads become bigger and more demanding.

In other words, cluster computing is essentially about getting computers to stop working alone and start working as a team. And as AI, cloud computing and data-intensive startups continue to grow, that team is only getting bigger.

The post What Is A Computer Cluster Or Cluster Computing? appeared first on 91̽��.

And for good reason. At the moment, Britain is focused on investing heavily in sovereign technology capabilities, by means of its £500 million Sovereign AI Fund, among other things, while policymakers on the sidelines are still questioning whether the UK has become too reliant on a small number of overseas technology providers. Geopolitical instability seems to be at an all-time high these days, from the Russia-Ukraine war to the US-Iran conflict (to name a issues), making many previously reliable relationships and partnerships seem a little less strong than they once did.

In light of current circumstances, the focus has shifted to control. That is, control over who owns the infrastructure that powers public services, where the technology come from and what happens if access to it becomes restricted during a geopolitical dispute.

Concerns Around Tech Dependence Are Growing

According to new polling from Merlin Strategy, concern about foreign control of critical infrastructure is widespread across the UK. The survey of 2,011 adults found that 85% would be concerned if a foreign government could restrict Britain’s access to infrastructure it relies on during a future conflict or international crisis.

Further to this, around 65% of respondents said they would feel unsafe about overseas-headquartered companies owning technology or data relied upon by the armed forces and border security, while 63% expressed similar concerns about policing and law enforcement systems. Undoubtedly, these concerns reflect growing scrutiny of the UK’s reliance on large international technology providers.

According to Politico, earlier this year, the House of Commons Science, Innovation and Technology Committee warned that the UK’s dependence on a small number of US technology companies could represent a strategic vulnerability, emphasising a concern that many people have already been worried about for quite some time. In particular, several MPs highlighted the growing role of Palantir, a US-based data analytics company, in the public sector, describing the company’s increasing presence as an “unacceptable point of weakness”. The committee also warned that Britain may not always be able to rely on allies for access to critical technologies, calling for a clearer national AI sovereignty strategy.

With a US President and government behaving incredibly unpredictably, constantly lashing out at other foreign powers (both friends and enemies) without much warning, the concern is not without warrant.

Technology Has Become A National Security Question

Dearlove’s warning reflects a growing belief among policymakers that critical technology infrastructure now sits alongside traditional defence assets as a matter of national security. “Foreign states, including China, have their fingerprints all over our critical national infrastructure, and that means we’re exposed. For the sake of Britain’s national security this cannot continue,” he said.

“The UK needs sovereignty over the technology and hardware that underpins its public services or it risks overseas actors taking control of them at will.”

Former Chair of the House of Commons Defence Committee Tobias Ellwood argues that the threat landscape has fundamentally changed. “Britain’s enemies no longer need to bomb a power station to damage the country; increasingly, they can attack or disrupt the technology that keeps it running,” he said.

Ellwood believes the challenge isn’t necessarily foreign technology itself, but rather the absence of alternatives. As he explains, “We cannot build everything ourselves, nor should we. But when it comes to the systems essential to keeping Britain running, we must have a sovereign fallback.” Essentially, it’s probably not a great idea for Britian to have all its eggs in one basket.

His warning highlights a growing concern among security experts that dependence on overseas providers could leave critical services vulnerable to political decisions made beyond Britain’s control. “A political decision taken thousands of miles away could restrict access to technology on which our economy, public services and national security depend,” he added. And that is of great concern to a nation that prides itself on its independence.

What Does This Mean For UK Startups?

For the UK’s technology sector, the debate presents both a challenge and an opportunity. Successive governments have talked about backing British technology businesses, while Prime Minister Andy Burnham has pledged to use public procurement to support domestic firms. Defence Secretary John Healey has also promised to buy British “not if possible, but by design” across areas including defence, AI and technology.

If policymakers become more serious about technology sovereignty, it could create significant opportunities for British startups operating in cloud infrastructure, cybersecurity, AI, data management and digital public services.

The reality, though, is that replacing global technology giants is unlikely to happen overnight. The UK’s public and private sectors remain deeply integrated with international providers including Microsoft, Amazon Web Services and Palantir, and changing that is going to be a systemic project that’ll take a great deal of time, effort, money and collaboration to achieve.

Thus, the question isn’t just about whether Britain can become completely independent, but more about whether it can build enough domestic capability to avoid becoming dangerously dependent. At least for now. Indeed, as AI becomes more and more deeply embedded into government systems, public services and national infrastructure, that question is likely to become one of the most important technology debates of the decade.

In fact, in many ways, it already is.

The post How Dependent Is Britain On Foreign Technology? appeared first on 91̽��.

Please Introduce Yourself

I’m Oluwasesan Kayode Yackson, a senior software and DevOps engineer, entrepreneur, and Co-founder & Chief Operating Officer of ProtonLabs Technology Inc. I began my career in pharmacy, earning my bachelor’s degree before transitioning into software engineering and cloud infrastructure. Today, I combine scientific rigor, cloud infrastructure expertise, and operational leadership to build scalable, high-performance technology systems.

At ProtonLabs, I oversee our global cloud infrastructure, DevOps strategy, business operations, growth, and strategic partnerships. My focus is on making complex, high-scale AI infrastructure simple, resilient, and accessible so our products can reliably serve millions of users worldwide every day.

Can you tell us about ProtonLabs and the AI products you’ve built, including AskYourPDF, Cowriter.ai, Detect.ai and Simplicity.AI?

ProtonLabs is a UK-based AI company dedicated to developing practical solutions that simplify complex workflows and boost human productivity. We specialize in bridging the gap between frontier AI capability and everyday usability by building tools that fit directly into existing user workflows.

Our product portfolio includes:

• AskYourPDF: Our flagship document intelligence platform that allows users to extract insights, summarize research papers, and interact with complex documents via text, web extensions, mobile apps, and direct ChatGPT integrations.
• Cowriter.ai: An AI-assisted writing and deep research platform designed to help users produce high quality content and accelerate literature discovery.
• Detect.ai: An advanced AI-content detection tool built to help organizations and individuals verify content authenticity and maintain editorial integrity.
• Simplicity.AI: A smart AI form filler that converts static or scanned PDFs into interactive digital documents and auto-fills complex tax, legal, healthcare, employment, and immigration paperwork accurately in seconds.

ProtonLabs’ products now serve more than 5 million users worldwide. What do you think has been the biggest factor behind the company’s success and growth?

Our growth comes down to three core principles: solving real user pain points, moving with extreme execution speed, and taking distribution as seriously as engineering.

As a bootstrapped company, we’ve always had to maintain operational discipline. We focus less on top-of funnel vanity metrics like sign-ups and more on customer retention, willingness to pay, and organic word of mouth.

From an infrastructure and product perspective, a major driver was our multi-surface distribution strategy. We didn’t force users to change their habits; instead, we met them where they were already working— building integrations across the web, ChatGPT plugins, Chrome extensions, Zotero, mobile platforms, and robust APIs. When you combine high product utility with seamless distribution and high platform availability, organic growth naturally follows.

As a judge for SaaS66, what qualities will you be looking for when evaluating startups?

I am looking for companies that make complexity feel effortless. From an operational and technical standpoint, I will be evaluating four key areas:

• Clear Value Proposition: Can the founders explain in plain language who the customer is, what painful problem is being solved, and why their solution is significantly better than current alternatives?
• Technical Rigor & Reliability: Is the underlying cloud architecture built to scale securely, economically, and reliably as user demand grows?
• Distribution Clarity: Does the team have a clear, repeatable strategy for acquiring and retaining users without relying purely on paid marketing?
• Execution Speed: Can the founders demonstrate fast feedback loops between customer input and product iteration?

What separates a good SaaS business from a great one?

A good SaaS business builds a useful product, finds an initial customer base, and grows revenue by solving a visible problem. A great SaaS business builds a resilient, highly scalable system that becomes deeply embedded in the customer’s daily operations while maintaining relentless discipline around unit economics.

From an operational and technical standpoint, the differentiation comes down to four critical factors:

• Workflow Integration vs. Point Solutions: Good SaaS tools are nice-to-have utilities that live in an open tab. Great SaaS tools integrate directly into existing workflows—via APIs, extensions, and ecosystem integrations—making them essential and creating natural retention without forcing users to build entirely new habits.
• Unit Economics and Infrastructure Efficiency: Good companies scale revenue, but great companies scale margins. In AI and software engineering, managing cloud infrastructure costs, optimizing server operations, and ensuring high platform availability as traffic grows is what keeps gross margins healthy as you scale to millions of users.
• Retention Over Acquisition: Good SaaS focuses heavily on top-of-funnel sign-ups and marketing hype. Great SaaS focuses relentlessly on cohorts, usage depth, willingness to pay, and net revenue retention. If users aren’t coming back organically and recommending the product, growth is just an expensive illusion.
• Speed of the Feedback Loop: Good teams ship features on a schedule. Great teams shorten the loop between user feedback, system observability, and engineering deployment to continually refine the product based on how people actually use it every day.

What are the biggest mistakes you see SaaS founders making when trying to scale their businesses?

The most common mistakes I see stem from misaligned scaling priorities:

• Premature Scaling: Rushing to scale distribution, sales, or infrastructure before achieving true product-market fit and solid unit economics.
• Ignoring Distribution: Relying on the assumption that a technically superior product will sell itself. Technical founders must treat distribution and growth with the same architectural rigor as their codebase.
• Neglecting Cloud Cost & Architecture Efficiency: Overlooking infrastructure margins early on. In AI and SaaS, inefficient API usage or unoptimized cloud architecture can quickly ruin unit economics as user volume scales.
• Focusing on Attention Over Value: Confusing viral sign-ups with sustainable retention. If users don’t return or aren’t willing to pay, long-term growth will collapse.

If you could give one piece of advice to founders entering SaaS66 this year, what would it be?

Be remarkably concrete and lead with evidence.

Within your first couple of sentences, state clearly who you serve, the exact problem you solve, the measurable outcome you create, and how your approach is fundamentally different. Avoid vague jargon or long market histories.

Back up your story with hard metrics—retention, unit economics, customer outcomes, and growth trajectory. Finally, ensure you articulate your distribution model just as clearly as your technical architecture. Show us not only that you can build a great platform, but how you will get it into the hands of millions.

What are you most looking forward to seeing in the SaaS industry in the next few years?

I am most excited about the transition from isolated, chat-based AI tools into deeply embedded workflow automation engines.

We are moving past generic prompt-and-response setups toward autonomous, context-aware systems capable of retrieving complex data, executing background tasks across multiple tool stacks, and handing off work seamlessly to human operators when human oversight is required. Seeing these workflow advancements applied to heavy operational fields like legal, healthcare, logistics, document intelligence, and corporate administration represents a massive opportunity to redefine software productivity.

The post A Chat With Oluwasesan Kayode Yackson, Co-Founder And COO at ProtonLabs Technology Inc. Ltd. and 91̽�� SaaS66 2026 Judge appeared first on 91̽��.

But it’s not quite as simple as that; there’s an important catch. The Cyber Resilience Act (CRA) isn’t simply introducing a blanket rule that every business have to report every single cyberattack within 24 hours. From 11 September, the first major CRA reporting obligations apply to manufacturers of products with digital elements, covering actively exploited vulnerabilities and severe incidents affecting product security. Importantly, most of the wider CRA requirements won’t apply until December 2027, so this is just the beginning.

Still, 24 hours is 24 hours. So, is this actually a realistic expectation?

The 24-Hour Clock Isn’t Quite What It Sounds Like

Under Article 14 of the act, manufacturers must submit an early warning within 24 hours of becoming aware of an actively exploited vulnerability or a severe incident. A more detailed notification follows within 72 hours, and finally, the last report comes a little later, depending on the specific circumstances.

So, it’s really important to note the difference between these three deadlines, because, as several of our experts point out, nobody is realistically expected to solve an entire cyberattack before lunch tomorrow. It would be nice, but it’s not realistic.

Martin Riley, CTO at Bridewell, argues that the 24-hour warning is deliberately designed as an escalation rather than a completed investigation. The first notification is essentially an alarm bell: letting people know that something serious is happening, and alerting other organisations using the affected product that they may need to take precautions.

Jose Lejin PJ, Principal Member of Technical Staff at Salesforce, makes much the same point: “The 24-hour rule is workable if you read what the CRA actually requires. It is not ‘explain the whole cyberattack by tomorrow.’”

And that might be the most important part of properly understanding the rule. The EU isn’t necessarily asking businesses to know everything within a day; it’s asking them to know enough to raise the alarm.

What If You Don’t Know You’ve Been Hacked?

Of course, that makes things more complicated.��Muhammad Yahya Patel, vCISO and Cybersecurity Advisor for EMEA at Huntress, says the requirement is “directionally right but operationally challenging”. In the first 24 hours of an incident, organisations may still be trying to understand what happened, contain the damage and preserve evidence.

Rob Demain, CEO of e2e-assure, similarly argues that the deadline is realistic primarily for organisations with mature detection capabilities. If you have continuous monitoring, you might know something is wrong within minutes, so it’s easier to follow these rules. Figuring out exactly what happened, however, can take a lot longer. It’s possible that this could expose some issues with cybersecurity maturity, and at the end of the day, that’s generally the point.

The biggest problem with a 24-hour reporting deadline may not be the reporting but rather how realistic the detection process is within that window. As Ali Waezzadah, CISO at iCOUNTER, puts it, “Manufacturers cannot report what they cannot detect.” If a company doesn’t know that a vulnerability is being actively exploited, the clock hasn’t really become its problem yet. The problem is that it might not even know the clock has started.

The Supply Chain Could Make This Even Harder

Modern software isn’t exactly a neat little box built entirely by one company. Products can contain proprietary code, open-source packages, third-party components and now, more often than not, AI models and services too.

Eran Kinsbruner of Checkmarx says manufacturers will need continuous visibility across their software supply chains so they understand which vulnerabilities affect their products. Ilkka Turunen, Field CTO at Sonatype, takes this further. He warns that organisations need to know which components are inside which products and which versions are affected before an incident occurs. Because trying to reconstruct that information manually during a crisis could make the 24-hour window “nearly impossible to meet”.

This is where the CRA could have an interesting unintended consequence. The regulation may effectively force companies to invest in software inventories, dependency tracking, monitoring and incident-response infrastructure earlier than they otherwise would have, which will most likely have really postive effects on overall cybersecurity.

So, Is 24 Hours Actually Realistic?

For a large manufacturer with strong monitoring, clear escalation procedures, incident-response expertise and a detailed understanding of its software and hardware stack, probably, yes. But, for a smaller company that discovers an exploit at 3am and starts asking who’s actually responsible for reporting it, the answer is more complicated.

Daryl Flack, Partner at Avella Security, describes 24 hours as “a pretty unforgiving window”, particularly because organisations need to establish whether an incident actually meets the reporting threshold and get the right technical and legal people involved.

And that may sound daunting at first, but it’s also precisely the point. The CRA is effectively asking companies, if you sell connected technology into the European market, how quickly could you actually tell the people who depend on it that something serious is wrong? How well can you understand the problems and how quickly can you deal with them?

So, perhaps it’s less about whether a company can fill in a form within 24 hours and more about how confident they are in how well they could potentially deal with a sudden issue, and this all comes down to proper planning. Indeed, it seems as if the regulation may have already identified a bigger cybersecurity problem, and perhaps this is the first step towards making things safer.

Experts Comment:

• Muhammad Yahya Patel: vCISO and Cybersecurity Advisor for EMEA at Huntress
• Rob Demain: CEO of e2e-assure
• Carl B. Johnson: President at Cleared Systems; Owner at ComputerSecurity.us
• Darren Williams:��Founder and CEO at BlackFog
• Artem Serebrov: Director of Product at PCA Cyber Security
• Eran Kinsbruner: Vice President of Product Marketing at Checkmarx
• Martin Riley: Chief Technology Officer at Bridewell
• Camellia Chan: CEO and Co-founder of X-PHY
• Daryl Flack: Partner at Avella Security
• Ilkka Turunen: Field CTO at Sonatype
• Omair Manzoor: Founder, CEO and Chief Hacker at ioSENTRIX
• Jose Lejin PJ: Principal Member of Technical Staff at Salesforce
• Ali Waezzadah: CISO at iCOUNTER
• Shane Tierney: Senior Program Manager, GRC, Drata
• Marty Puranik: Founder and CEO of Atlantic.Net

Muhammad Yahya Patel, vCISO and Cybersecurity Advisor for EMEA at Huntress

“The 24-hour early warning requirement under the CRA is directionally right but operationally challenging in a way that deserves honest acknowledgment. The operational reality is more complicated, though. In the first 24 hours of a significant incident, most organisations are trying to understand the scope, stop the bleeding, and preserve evidence. The problem is that many organisations don’t yet have the detection and escalation maturity to know within 24 hours that they have something reportable, let alone the nature of what’s been accessed inside a complex environment.

“Reporting inaccurate information to regulators under mandatory timelines creates its own problems both for the organisation revising its initial assessment and for the regulator acting on incomplete intelligence. It’s important to mention, The CRA doesn’t ask businesses to report being attacked. It asks manufacturers to report when their products are being used as the attack vector.”

Rob Demain, CEO of e2e-assure

“It’s only realistic for businesses that already have mature detection in place. And a 24-hour deadline is only asking for it to be reported, not the full investigation. Organisations running continuous monitoring will usually know within minutes that they’ve been hit; what takes longer is establishing scope, root cause, and impact, and that work can carry on after the initial notification.

“Transparency in itself has merit, but “full” and “accurate” aren’t the same thing. A rushed report built on guesswork can misdirect response efforts and cause more harm than a short delay would. The right balance is early, honest signalling, i.e. “we’ve identified a significant incident and are investigating”, rather than a complete picture on day one.
The real test isn’t whether 24 hours is realistic but whether an organisation has invested in the visibility to detect an incident that fast at all.”

Carl B. Johnson, President at Cleared Systems; Owner at ComputerSecurity.us��

“The 24-hour reporting rule is realistic only for organisations that already have mature incident response, asset visibility, vulnerability management, and decision-making authority in place. For many businesses, the hardest part will not be writing the report. It will be knowing quickly enough what happened, whether the issue is reportable, who must be notified, and who inside the company has authority to make that call.

“The public deserves timely notice, but rushed reporting can also create confusion if facts are incomplete. The right balance is fast initial notification, followed by disciplined updates as the investigation develops.”

Darren Williams, Founder and CEO at BlackFog

”The 24-hour requirement is realistic, but only if we recognise what it is: an early warning, not a completed forensic investigation. The real challenge for many organisations is that they still lack visibility into what data has left the network, where it went, and whether an incident is still active. Attackers can exfiltrate sensitive information in minutes, so waiting days for perfect attribution creates unnecessary risk for customers and partners.

“The right balance is phased disclosure. Notify quickly with what is known, then provide deeper technical detail as the investigation develops. The CRA should force organisations to improve detection, data exfiltration monitoring and incident response readiness.
Companies that cannot establish the basic facts of an attack within 24 hours have a broader security problem than simply meeting a regulatory deadline.’’

Artem Serebrov, Director of Product at PCA Cyber Security

“New regulatory obligations on device manufacturers to report the active exploitation of vulnerabilities in their products are likely to collide with the reality of cyber security monitoring and its limits. Device manufacturers selling into the European market aren’t currently obliged by the EU to monitor how cyber criminals are targeting vulnerabilities in their products. It’s therefore no surprise that the majority of manufacturers lack sophisticated capabilities to pick up on vulnerability exploitation – particularly dark web monitoring, which is essential to track how vulnerability discovery and exploitation play out in cybercriminal forums.

“Overall, there are parallels to be drawn between the current state of the Cyber Resilience Act and the early days of GDPR rules. Similarly, under GDPR, obligations to report data leakage were introduced without obligations to measure data loss. This invited companies to softly limit the extent to which they were monitoring data loss in the interest of avoiding hefty GDPR-related fines. It will be interesting to see how EU policymakers react to avoid a similar state of affairs with Cyber Resilience Act reporting obligations in effect.”

Eran Kinsbruner,��Vice President of Product Marketing at Checkmarx

“What all this means for manufacturers is that secure development, effective vulnerability handling, and traceability across the software supply chain should be elevated to the top of their priority list. They need to have processes in place to ensure continuous visibility across their software supply chain so they know which vulnerabilities will impact their product.

“Modern applications are assembled from a complex ecosystem of components, with combinations of proprietary code, open-source packages, third-party components and, increasingly, AI models and services all interconnected. Organisations need to understand these components, their dependencies and the risks they introduce. Reviewing your application security tools to ensure they continuously scan code and environments to find new vulnerabilities, automatically map the affected applications and environments, assess and prioritise risk and remediation, and log every action taken for auditable evidence, will be critical.”

Martin Riley, Chief Technology Officer at Bridewell

“There’s an important nuance in how this rollout is being framed. What takes effect [today] isn’t the whole EU Cyber Resilience Act coming into force. The Act’s broader obligations, conformity assessments, CE marking, secure-by-design requirements, don’t apply until December 2027. What starts [today] is a narrower and much sharper piece: Article 14’s requirement for manufacturers to report actively exploited vulnerabilities and severe incidents. It’s been brought forward by 15 months because regulators want early visibility into live exploitation before the rest of the regime is in place. That’s a deliberate sequencing choice, not an accident.

“The detail that gets lost in most coverage is when the clock actually starts. It isn’t triggered by a confirmed, fully investigated breach. It starts the moment a manufacturer becomes aware that a vulnerability is being actively exploited, or that a severe incident has occurred. That’s a much lower bar than people assume, and it’s deliberate. The 24-hour early warning was never meant to explain what happened. It’s meant to raise the alarm early enough that other organisations running the same product can start applying compensating controls before anyone has the full picture. Waiting for certainty defeats the purpose. At that stage, speed of warning matters more than completeness of warning.

“The structure reflects that thinking. There are three stages, not one. Within 24 hours, an early warning, essentially a flag that something serious is happening and where. Within 72 hours, a fuller notification covering what’s known about the product, the nature of the exploit, and any mitigations already available. Then a final report, within 14 days of a fix becoming available for a vulnerability, or within a month for a severe incident. Each stage adds detail as the investigation matures. None of them demand the full story on day one.

“So is it realistic? Yes, because it was never designed to be a full report in 24 hours. It’s a structured escalation, and the first step is deliberately lightweight. What it does demand is that organisations already have the internal capability to detect exploitation, escalate it, and notify a regulator within a day, before the root cause is even established. For a mature vendor with an established incident response function, that’s achievable. For smaller manufacturers or newer entrants without that function built out, it will be uncomfortable.

“That discomfort is probably a feature rather than a flaw. If a 24-hour early warning duty causes a vendor genuine pain, that’s a sign their detection and response capability wasn’t where it needed to be, regardless of the regulation. The Act is simply forcing that gap into the open earlier than the market would otherwise expose it.”

Jonathan Lee, Director of Cyber Strategy and UK Public Policy Lead at TrendAI

“The Cyber Resilience Act is often portrayed as a 24-hour cyberattack reporting rule, but its real focus is manufacturers reporting actively exploited vulnerabilities and severe incidents affecting products with digital elements. The clock starts ticking once there’s a reasonable degree of certainty that a serious issue exists, not once every fact is confirmed. An early warning is required at 24 hours, fuller details at 72, with final reporting to follow. That reflects the reality that understanding the full extent of an incident can take days or weeks.

“Transparency matters, but regulator notification isn’t the same as public disclosure. These reports go to ENISA and national CSIRTs, helping defenders act early while investigations continue. The real test isn’t whether organisations can file a report within 24 hours, it’s whether they can detect a severe incident within 24 hours. If they can’t, the deadline is the least of their problems.”

Camellia Chan, CEO and Co-founder of X-PHY

‘‘The CRA’s 24-hour initial reporting requirement puts direct pressure on manufacturers to ensure their internal processes are ready. The bigger challenge, however, is spotting an attack quickly enough to act.

“Vulnerability exploitation already accounts for more than one in five observed initial intrusions across the EU. Attackers are also increasingly targeting weaknesses deeper within devices and infrastructure, where conventional software monitoring can have less visibility. As AI speeds up the discovery and use of new flaws, identifying those threats becomes even harder.

“Reporting an incident quickly is crucial, but the clock doesn’t stop there. The sooner teams understand where an attack is happening, the sooner they can contain it and limit the impact on operations and user data. That means having security across the full technology stack, including at the hardware level.”

Daryl Flack, Partner at Avella Security��

“24 hours is a pretty unforgiving window. In those 24 hours, you need to identify the issue, establish whether you are dealing with an actively exploited vulnerability or a severe security incident, bring in the right technical and legal people and get the early-warning notification out the door. That’s no mean feat.

“It’s also important to remember this isn’t just an EU vendor issue. UK and US manufacturers selling relevant products into the EU are caught too, and it includes legacy products already in distribution, not simply whatever gets launched after 11 September.

“The interesting bit here is that this reporting clock starts well before many of the Cyber Resilience Act’s wider engineering obligations kick in. So, manufacturers could be reporting vulnerabilities in products they’re not yet formally required to “fix” under the full Cyber Resilience Act regime.

“That’s where this could get tricky. It could create some interesting tension between vendors and operators, particularly around what “actively exploited” actually means in practice and when everyone agrees that the 24-hour clock has actually started.”

Ilkka Turunen, Field CTO at Sonatype��

“The EU Cyber Resilience Act’s 24-hour reporting requirement exposes a basic problem for many organisations: they still don’t have a clear understanding of the software they ship. The average software supply chain is over 180 external components, and in 2025 Sonatype found nearly 1.8 billion downloads that had risks with fixes available but ignored. This shadow inventory is set to grow with the rise of AI development.

“The CRA makes every risk from every adopted component the concern of the organisation using it. When a vulnerability affecting any one adopted component is actively exploited, teams now have a 24-hour deadline to report it to ENISA and their local regulator.

“Teams need to know which products contain the affected components, which versions are exposed and inform both the regulator and their customers. If that picture has to be reconstructed manually during an incident, the reporting window will be nearly impossible to meet.

“The CRA will necessitate accurate, up-to-date software supply chain data before an incident happens. Organisations need to be able to trace components and dependencies as part of the development process, not for the first time under incident pressure.”

Omair Manzoor, Founder, CEO and Chief Hacker at ioSENTRIX��

“The 24-hour reporting requirement is well-intentioned but creates a tension between speed and accuracy that most organizations are not equipped to resolve. In our incident response work, determining the scope of a breach within 24 hours is possible for organizations with mature detection and forensic capabilities. For most businesses — particularly SMBs that the CRA now covers — 24 hours is barely enough time to confirm whether an incident actually occurred, let alone characterize it meaningfully.

“The realistic compromise is tiered reporting: an initial notification within 24 hours confirming a potentially exploitable vulnerability has been discovered, followed by a substantive technical report within 72 hours once forensic analysis provides actionable detail. Forcing detailed disclosure before the organization understands what happened risks publishing inaccurate information that misleads affected parties and potentially exposes attack details that help other threat actors.

“The organisations that will meet this requirement are those that invest in incident response preparedness before an incident occurs — pre-built response playbooks, retained forensic partners, and pre-drafted notification templates. The CRA effectively makes incident response planning mandatory, which is the right outcome even if the 24-hour timeline is aggressive.”

Jose Lejin PJ, Principal Member of Technical Staff at Salesforce

“The 24 hour rule is workable if you read what the CRA actually requires. It is not “explain the whole cyberattack by [today].”

“From 11 September, manufacturers of products with digital elements must send ENISA and the coordinating CSIRT an early warning within 24 hours of becoming aware of an actively exploited vulnerability or a severe incident that affects product security. Awareness means a reasonable degree of certainty after an initial look, not the first odd log. A fuller notification is due in 72 hours. Users should be told so they can protect themselves. The rest of the CRA (secure by design, CE marking) still waits until December 2027.

“That staged split is the right balance. The public should not wait weeks. Firms also should not be forced to publish guesses that panic customers or help the attacker. Complete root cause in a day is not realistic. A short, factual early warning is. Teams that already know who declares awareness and what they will file can meet this. Teams that wait until the investigation feels finished will miss it.”

Ali Waezzadah, CISO at iCOUNTER

“The question states “report a cyberattack in 24 hours,” but the CRA’s rule is not a general “you got hacked, notify us in24 hours”. It covers manufacturers and focused on product security:

• An actively exploited vulnerability in a product
• A severe incident affecting the security of the product

“The “we suffered a cyberattack” reporting is under different rules. A company could suffer a terrible ransomware attack on its internal HR systems and have zero CRA reporting obligations, because it didn’t affect a product’s security. The real challenge is not the clock — it is detection and the definition of “aware”. Manufacturers cannot report what they cannot detect. The timer starts when the company becomes “aware.” When does the company become “aware”? A cautious compliance officer says the clock starts early, and a diligent engineer wants to finish the analysis.

“The requirement is achievable if the underlying capabilities exist, and difficult if it doesn’t. The vital question is “do manufacturers have the essential capabilities to know within 24 hours”? For most, that’s the honest gap. The regulation is essentially using a reporting deadline as a lever to force detection investment.

“For a well-resourced company that has built the underlying capabilities, while they still have some work to do, 24 hours is doable. For others, it won’t be about whether the form can be filed fast enough — it will be about whether they even know they have something to file.”

Shane Tierney, Senior Program Manager, GRC, Drata

“The broader CRA requirements become fully applicable on 11th December 2027, but the September milestone is a practical forcing function for in-scope organisations to formalise and rehearse vulnerability-handling and incident-reporting processes before an incident occurs.

Instead of treating it purely as a compliance checkbox, enterprises should use it as a prompt to strengthen operational discipline around vulnerability handling, reporting and risk management. This means having a clear record of the staged reporting process. Teams also need to know what must be disclosed, who to contact, and how to submit each report.

Where enterprises can really get ahead, though, is by turning these obligations into an operating program: defining product scope, assigning ownership, rehearsing vulnerability handling, maintaining the necessary evidence, and connecting testing and documentation to the other frameworks they already manage, such as SOC 2, ISO 27001, and GDPR, for example. An effective and efficient GRC team shouldn’t need to be building a parallel, manual process just for CRA or any other mandate.

This is where automation can help. Modern compliance platforms can help teams map CRA requirements to existing internal controls, organise supporting evidence, and connect relevant testing and monitoring across the frameworks they already manage. That readiness support complements, but does not replace, product-security, engineering, legal, conformity-assessment, or incident-reporting responsibilities.

The organisations that treat this deadline as an opportunity to consolidate and automate their compliance operations, instead of adding on another manual process, will be the ones who handle CRA, and whatever comes next, with less friction.”

Marty Puranik, Founder and CEO of Atlantic.Net

“It’s probably not feasible because it takes time to identify and remediate. In addition, it could make things worse since you would have to disclose the vulnerability or vulnerable paths before you have remediated, potentially drawing even more attacks – it takes time for commercial vendors to release patches.

“A more reasonable policy would be to notify customer in a certain time period IF the problem can be remediated first. Disclosing active vulnerabilities is a bad idea.”

The post The EU Cyber Resilience Act Starts Today: Can Businesses Really Report A Cyberattack In 24 Hours? appeared first on 91̽��.

Of course, while AI (whether it’s Chat, Perplexity, Claude, Gemini or any other model) is undeniably incredible, especially when it comes to writing, we now know that it’s still fallible. It makes mistakes, it hallucinates and it’s simply not completely reliable. Not only that, it lacks a certain “human touch” that while we can’t always explain exactly what is, we just know it’s missing.

But, much like most things in life, there’s a limit to what AI can do. One of these constraints is the fact that AI is only as useful as the instructions you give it. And that’s where prompt engineering comes in.

The term has become increasingly common as generative AI has moved from being a novelty to a serious business tool. While we’re mostly concerned about the jobs AI is taking and how many humans will be replaced by AI systems, this may be a situation in which AI is actually creating a job.

What Is Prompt Engineering?

Put simply, prompt engineering is the process of designing, testing and refining instructions given to an AI system to get a particular result. A prompt is just the input you give an AI model: it could be a question, an instruction, a description or a combination of all three.

Prompt engineering is about working out how to phrase that input so the AI understands what you actually want. Similar to how when you Google something, typing in an entire sentence with perfect grammar isn’t going to be as effective as using keywords.

According to IBM, effective prompt engineering helps generative AI systems produce outputs that are more relevant, accurate and aligned with the user’s intended goal.

That might sound obvious. After all, if you ask ChatGPT to “write something about startups”, you’re probably going to get something fairly vague. But, if you tell it that you’re writing a 700-word article for a technology publication aimed at startup founders, ask for a conversational tone and specify exactly which aspects of the startup ecosystem you want covered, you’ve given the model considerably more to work with and it’s more likely to produce something a little closer to what you’re looking for.

Why Does Prompt Engineering Matter?

Generative AI doesn’t necessarily know what you mean simply because you know what you mean, and that’s something that many people don’t quite seem to understand (and this was a problem even before AI shifted into the mainstream). Humans regularly leave things unsaid because we rely on context, so AI models are much more likely to produce useful results when you provide that context explicitly.

A good prompt can tell an AI model what to do, who the output is for, what information it should use, what format the answer should take and what it should avoid.

For instance, in a professional situation, an employee asking an AI tool to “summarise this customer feedback” might get a reasonable answer. But, a carefully constructed prompt could instead ask the system to identify the five most common complaints, group similar issues together, quote representative examples and present the findings in a format suitable for a management report.

In this case, the underlying AI hasn’t necessarily changed, but the instructions have, thus producing a far better result.

How Does Prompt Engineering Work?

Unfortunately, as convenient as it would be, there isn’t one magical formula for writing the perfect prompt. In fact, much of prompt engineering involves testing, reviewing and refining.

One of the simplest approaches is to be clear and specific. Give the AI enough context to understand the task, explain what you want the output to look like and provide examples where useful.

This can also involve techniques such as zero-shot and few-shot prompting. Zero-shot prompting means asking an AI model to complete a task without giving it examples of what you want. Few-shot prompting, meanwhile, gives the model a small number of examples to demonstrate the desired result.

For example, rather than simply asking an AI to classify customer reviews as positive or negative, you could provide several examples showing exactly how you want different types of reviews categorised. This means that it’s not only using its own judgement (which is, of course, based on information and date it’s been trained on), but it can actually start to interpret your own judgement too, and if it’s effective, replicate that.

Is Prompt Engineering Just Writing Good Questions?

It’s not just about asking good questions, although that’s a big part of it. Prompt engineering can range from simply improving the wording of a request to much more sophisticated processes involving prompt templates, examples, external data, testing and automated workflows.

PromptEngineering.org describes the discipline as involving the systematic design and optimisation of prompts, rather than simply coming up with clever sentences. And, this is where prompt engineering starts becoming particularly relevant to startups and businesses.

A company building an AI-powered customer service tool, for example, isn’t going to manually type a beautifully crafted prompt every time a customer asks a question, because that’s simply not realistic. It’s difficult and it’s time-consuming. Developers, on the other hand, can create structured prompts and workflows that consistently tell the underlying model how to behave. Thus, in this kind of situation, the prompt almost becomes part of the product.

Do You Need To Be A Prompt Engineer?

Not everybody needs to be a prompt engineer per se, but if you’re going to be using AI consistently, especially in a professional situation, it would be a good idea to try and understand it as far as possible.

The good news is that in many everyday situations, the basics are surprisingly simple. You must be specific, provide context, explain the desired outcome and don’t be afraid to refine your request.

But, professional prompt engineering requires a lot more technical knowledge than just being clear. At the highest level, it can require engineers to also understand large language models, programming, data structures, algorithms and the limitations of AI systems. So, there’s is a difference between being good at prompting an AI tool and working professionally in prompt engineering.

How Long Will Prompt Engineering Be Relevant?

This is the question we ask across the board in technology and AI these days, as innovation as constant and technical skills seem to become irrelevant quicker than they appear. Indeed, as AI models become better at understanding natural language, the need to obsess over exactly which words is most likely going to decrease.

But the thing is, that doesn’t mean the underlying concept of prompt engineering is disappearing altogether. It’s probably just going to change and evolve. Businesses still need to decide what they want AI systems to do, what information they should have access to, what rules they should follow and what a successful result looks like.

So, prompt engineering may become less about simply finding the perfect sentence and more about designing effective interactions between humans, data and AI systems. That is, it’ll probably become more advanced and complex. But hey, these days, what isn’t?

The post What Is Prompt Engineering? appeared first on 91̽��.

So the question we’re asking is, what would happen if we could simply choose what kind of feed we wanted?

It’s the sentiment that’s been floating around the internet in recent months, and now, it’s the idea behind a proposed new set of social media rules in Australia. These rules could give users significantly more control over how their feeds are curated.

According to Reuters, Australia’s government is proposing legislation that would require platforms to give users a choice between an algorithmically personalised feed, on the one hand, and one showing content only from accounts they have chosen to follow. Users would also need to be notified about the choice, rather than having the personalised option operate entirely in the background.

This seems to be part of Australia’s wider push to make social media platforms more accountable for online safety, especially as they were one of the first countries to introduce a social media ban for children under the age of 16 in December 2025. The proposed rules would also require platforms to assess and report on measures that they’ve taken to address harms that are affecting Australian users, with companies potentially facing fines of up to A$109.2 million for failing to comply with these new regulations.

On the face of it, giving people more control over what they see sounds like an obvious win, especially since that is, for all intents and purposes, what they’ve been asking for. But is switching off the algorithm really the answer?

Do We Actually Want An Algorithm-Free Internet?

I’ve spoken at great length about this seemingly growing desire to escape algorithms, whether that’s Bluesky giving users more control over how content spreads or the nostalgia surrounding the supposedly algorithm-free days of MySpace. And I think the really important issue to understand here is the fact that people keep talking about algorithms as if they’re at the centre of all “evil”.

But I believe that perhaps most people don’t necessarily want no algorithms; they want algorithms to stop making all decisions for them. And to take this further, in other cases, it’s not even that people don’t want algorithms. They think they don’t want them, but there’s a high chance that they won’t actually like what reality looks like without algorithms.

After all, recommendation systems can be incredibly useful and they’ve been used for a very long time. They can introduce us to new music, creators, products, news and communities that we would probably never have found ourselves.

Sumit Kumar, co-founder of digital solutions experts Creative Ideaz, points out that personalised feeds can prevent us from wasting time on content that isn’t relevant to us. At the same time, he argues that some users understandably find the amount of information platforms collect about them invasive.

Finding the balance between these two things is what’s been tough.��The better an algorithm gets at predicting what we want, the more it potentially influences what we see, and that’s where it can go a little bit too far.

Could More Choice for Users Actually Break The Echo Chamber?

This is where Australia’s proposal gets particularly interesting, because in some ways, it’s assuming that giving users control over their own feeds will automatically solve these problems. Because if algorithms learn that you engage with a certain type of political content, for example, they can keep serving you more of it. Eventually, your feed might become a remarkably accurate reflection of your existing worldview.

And that’s not necessarily because the platform has decided you should believe something. It could simply be because you’ve demonstrated that you are more likely to click, watch, comment or share it.

Kumar believes giving users more control could help address this problem, arguing that it could allow people to avoid harmful or hateful content while potentially giving them a more balanced view rather than reinforcing divisive echo chambers.

But it’s just not as simple as that. Humans are perfectly capable of creating echo chambers all on their own, without algorithms, whether we want to believe it or not.��If I choose to follow only people I agree with, remove anyone who challenges my opinions and deliberately select the content I want to consume, I can create a very comfortable little bubble all by myself. It’s a social phenomenon that we’re seeing encouraged across platforms and social environments across the board these days.

In fact, one may argue that an algorithm might occasionally be the thing introducing me to something I wouldn’t otherwise have seen. It may be something you don’t like or don’t agree with, but just because you didn’t choose to see it doesn’t make it inherently bad.

Perhaps The Real Issue Is Control

This is why I don’t think the debate should simply become “algorithms are bad” versus “algorithms are useful”, because that’s simply not a fair representation of the whole issue. After all, both can be true. The problem is what happens when personalisation becomes so sophisticated that users no longer feel like they’re choosing what to see.

Australia’s proposal doesn’t necessarily mean the end of algorithms. Instead, it could give users a clearer choice about whether they want the algorithm to curate their experience. Or, whether we choose to accept it or not, it might even expose the fact that perhaps we (users) are the a bigger part of the problem than we’d like to believe. Algorithms may not require us to make constant conscious decisions, but they’re still showing us content based on what we like and want to see, whether we’re totally aware of it or not. Will this change in how algorithms work and are implemented expose a darker reality about how we really are?

As Kumar puts it, social media can be a useful tool for learning and entertainment, but it isn’t always clear how our data is being used. Giving users more power over what they see, he argues, “can only be a good thing”. And I think in some ways, it’s true that transparency is positive, but I think people may not be very happy with what they discover about themselves. Whether that’s the fact that they start finding their feeds boring and end up begrudgingly reverting to the dreaded algorithmic version, or they start consciously choosing to see the content they used to pretend not to enjoy.

Ultimately, giving people more control could be positive, but it could also reveal that we don’t always want what we think we want, and I’m not sure people are ready to face that reality. An algorithm might annoy us by showing us something outside our usual interests, but it might also occasionally expose us to an idea, person or perspective we would never have chosen ourselves.

If Australia does eventually give users that choice, we’ll get to see what happens when millions of people can decide whether they want the algorithm or not. And maybe we’ll discover that we really do want a more human-controlled internet.��Or, perhaps we’ll discover that, after years of complaining about algorithms, most of us quite like having something else decide what to watch next, whether that’s due to the unpredictability of the feed or the removed accountability that it allows us.

Who knows what the results will be, but I’m pretty sure this is going to bring to life some thoughts and feelings they don’t see coming.

The post Could Australia’s Proposed Algorithm Rule Break The Current Echo Chamber That Is Social Media Today? appeared first on 91̽��.

This feud is nothing new. Much like Paris Hilton and Nicole Richie’s iconic early-2000s feud, the quarrel between Musk and Chess.com has been ongoing for years. But now, Musk seems to believe he holds a silver bullet: AI will “solve” Chess just like it did Checkers, he has claimed.

Cue: gasps, whispers and shock among the crowd! Followed by outrageous applause and and a roaring, standing ovation! Well, perhaps in his imagination, but in reality, the world in which most of us live, it’s been more like the virtual version of many confused expressions and the exchange of one too many awkward glances between strangers.

Look, Elon’s done a lot in his day – hell, he’s done a lot this year. But, is he really arguing with a website? Or rather, whoever’s controlling the social media for the website? And not just any website, but Chess.com?

The answer is yes, and while the story is admittedly absurd, I do believe there’s a far greater truth in this fun little anecdote that we ought to take note of. Almost like a small child trying to keep a secret who blurts everything out at the dinner table by accident. I think Musk has, in a way, revealed the essence of why his understanding of the world, technology, AI and just about everything else is often so far from common consensus, and the trouble is, this reflects a logic that is becoming widely adopted (whether intentional or not).

Indeed, I don’t think it’s just him; I think this manner of thinking is what we’re seeing in so many powerful figures in big tech, and for that reason, it’s well worth sticking around and taking a few notes.

Musk Vs. Chess: AI Will Win, Mark My Words!

Essentially, Elon took to X to make his feelings known about the game that seems to get him rather riled up: he asserted, in a flurried string of posts, that soon enough, AI will “fully solve” Chess,, because, in his words, “Chess is hard for humans but not for computers”. Of course, Chess.com fired back with a response that cited numbers and spoke about the sheer complexity of the game of chess, essentially concluding that it would be virtually impossible to map all possibilities.

The exchange went on, becoming increasingly petty and heated, and much like most arguments on social media, there was no clear winner.

But here’s what stood out to me, and hopefully to many other people who were furiously snacking on the metaphorical popcorn while the feud unfolded: why are we arguing about whether or not a computer would be more likely to win a game than a human?

I’m not dismissing the obvious relevance of the fact that the whole issue is based on exponential probability, something computers tend to be pretty good at. Nor am I disagreeing with him; he’s probably right. But the thing is, the whole discussion is missing the point of why and how we play a game like chess, and chess is becoming symbolic of a far greater truth.

Perhaps Winning By Solving An Algorithm Isn’t the Point

There are many things in the world – many tedious, time-consuming tasks – that would be made exponentially easier if we could find a way to get them done immediately. To remove all friction from the equation and make it as easy as simply imagining it were done, to having it actually be accomplished in a matter of seconds.

For instance, when you’re late for work and you’re stuck in traffic, wouldn’t it be so convenient to just be able to click your fingers and teleport to the office? Or, what about something more practical, like having to manually fill out forms, only to enter the data into a system in multiple different places a seemingly infinite number of times? With modern technology and AI, we can make that happen in a heartbeat – time saved, fewer curse words uttered.

Both of these examples, while one is real and the other imaginary, include friction that I’m sure we can all agree is pretty unnecessary when it comes to having a positive impact on us and our lives. Sure, someone may argue that sitting in traffic gives you time to think or entering data manually is good for…actually, I can’t even think of a good reason why anybody would want to do manual data entry.

But ultimately, regardless of these potential motivations, these are situations in which the thing that makes them difficult, tedious, time-consuming, and annoying are pretty unnecessary – they don’t actually contribute to the overall goal or final output.

What about something that requires a process to be followed in order for the final goal to be achieved? For instance, going for a run. People run for different reasons – whether it’s to gain fitness, boost mental health, keep physically healthy, lose weight – but no matter the specific motivation, I think it’s safe to say that the activity is about more than reaching a destination or a turning point; it’s about the process.

The point isn’t that you need to physically be five miles away from home. The point is the movement that you do that ends up with you being five miles down the road. After all, if it wasn’t, it would probably be a lot quicker and easier to just hop on a train or in an Uber, right? It’s also why we have treadmills that don’t get you anywhere at all.

And that’s the difference I think Elon is fundamentally misunderstanding.

Chess isn’t being stuck in traffic on the way to work or doing manual data entry at 16:59 on a Friday. Playing chess is going for a run.

Who “Wins” If We Solve Chess?

An AI platform gets a pat on the back, Elon shows off a smug grin and…we all carry on with our day?

I believe that a huge takeaway from Chess.comgate, as I will refer to it from hereonout, ought to be the realisation that perhaps we are way too focused on “solving” everything. And it’s not just an Elon issue, although he takes it to the extremes and certainly shines a very bright (flood) light on it, as he does most things.

With technology having advanced so dramatically over the last decade or so, we’re at a point where we have so much more power than ever before to find solutions and quick fixes. Don’t have time to go grocery shopping? No worries, just login to an app, select your daily pre-organised shopping list and hit order – it’ll be at your house in a few hours. Or, going on holiday but don’t want to get a travel agent to organise the trip for you? Just ask Chat to create a detailed itinerary.

We’ve become so used to having just about anything we need at our fingertips, that it almost feels as if the logic has reversed somewhat. Not only is it possible to sort these things out really quickly, but they should be organised without any hassle. And now, we’re beginning to apply this logic to just about every facet of our lives, even when it’s totally unnecessary.

So, when Elon Musk chose to get into a heated argument with “some random intern at a chess website” (his words, not mine, and I’d argue that he actually kind of schooled himself by admitting this), he inadvertently gave us the greatest example of how our logic is becoming skewed by our obsession with removing any and all friction from our lives.

I say this, because other situations tend to involve significantly more nuance and can be more challenging to explain, but when it comes to chess, I’m sure most people can agree that the process of playing the game is far more important than the final outcome. In fact, the outcome – having a winner and a loser – really only has value because of the intellectual and strategic game that has been played in order to achieve the final goal. So simply asking a computer programme and an advanced AI model to solve it is completely missing the point and would be, well, futile.

I don’t necessarily think that Musk’s obsession with “solving” chess is going to go away, nor do I think that the outcome of this issue in itself will have dramatic consequences for humanity. However, I do think it has revealed a far more telling indication of how our logic is changing with our increasing ability to quickly solve problems with very little (or no) friction. The lesson here should be, I believe, that we need to stop asking whether or not it’s possible to “solve” something, and rather, we should question whether or not we need to “solve” it at all, rather than just work through it ourselves.

Otherwise, I fear we’re zooming towards a dystopian future in which instead of using our smart watches to simply track our runs, they’ll have sliding scales for things like serotonin and other hormones that we can simply modify whenever we feel need a little boost, without putting in any effort, using any brain power or making any kind of intelligent decisions.

Personally, I’d rather just go for a run.

The post Elon Musk Wants To “Solve” Chess, But Isn’t The Struggle The Point Of The Game? appeared first on 91̽��.