Αναζήτηση

Creative Boom μοιράστηκε ένα σύνδεσμο

2025-06-06 08:27:04 ·

Sergio Membrillas on the art of staying true: Illustration, evolution, and finding joy in the process

Where others have become obsessed with speed and trends, Sergio Membrillas has built a career on slowing down and staying true to his craft. Over 13 years as a professional illustrator, he's evolved a distinct style – bold, graphic, and quietly playful – that feels both timeless and entirely his own. But this evolution, as he's quick to point out, wasn't something he forced.
"I believe evolution is essential for every artist," Sergio reflects. "Change is not something I resist; it's something I enjoy and welcome as part of the creative journey." His work, initially influenced by a love of Mid-Century graphic design, has gradually absorbed references as diverse as Etruscan art, Mesopotamian motifs, and early 20th-century traditional tattoos. It's a portfolio built on curiosity, not conformity.
Despite his stylistic clarity, Sergio's process remains refreshingly analogue at its core. He still begins each project with pencil and paper, leaning into the tactility of drawing by hand.
"I've always valued having a physical relationship with art," he says. "There's something essential about feeling the wood of the pencil, manually erasing mistakes, rather than simply double-tapping a screen."

His philosophy of working slowly, attentively, and with purpose shows in the balanced compositions and confident use of negative space that has become his signature. Sergio credits his background in graphic design for this instinctive sense of structure.
"There has always been a strong graphic sensibility within me," he says, noting that the discipline of design continues to inform his illustration practice, particularly in editorial and poster work where clarity and storytelling must co-exist.
Yet, like many creative careers, his path into illustration wasn't plotted from the start. Initially, Sergio imagined illustration would complement his design projects, not become the main event.
"At first, I thought I would incorporate my illustrations into my graphic design projects – but in the end, it turned out to be the other way around." A commission for EasyJet's in-flight magazine marked a pivotal moment that reframed illustration from a hobby to a profession. "It made me realize that being an illustrator is a real profession, just like any other."

Fast-forward to today, and Sergio's client list reads like a who's who of publishing and design, from The New Yorker to Pentagram. While the calibre of collaborators has changed, what matters most remains the same: trust.
"When a client trusts your work and approaches projects with an open mind, collaboration flourishes," he says. It's in these open, trusting relationships that Sergio finds the space to experiment and further develop his ideas.
Unsurprisingly, editorial work holds a special place for him. "Editorial projects offer wider creative margins, allowing for greater flexibility and innovation," he explains. Compared to the tighter confines of advertising, editorial illustration offers the opportunity to tell nuanced stories, and Sergio is clear that he views every assignment, regardless of format, as a collaborative effort.
If one thing is clear, though, it's that he's not that he's afraid to say no when needed. Maintaining a strong personal voice is non-negotiable.
"I always strive to stay true to myself and ensure that every project I undertake reflects a clear personal signature," he says. For Sergio, authenticity isn't just a matter of artistic pride; it's what differentiates an illustrator in a saturated, increasingly automated industry.
Valencia is home for Sergio, a city he credits with much of his creative energy. "Oh, Valencia! It's a beautiful city that inspires me and brings me joy," he says, describing it as a European cousin to Los Angeles with its sun-soaked streets and vibrant cultural scene. The blend of tradition and modernity fuels his practice, offering constant inspiration without the sensory overload that often accompanies larger creative hubs.

Given the pressure many creatives feel to keep pace with shifting trends, Sergio's approach feels almost radical. "I'm not particularly interested in trends," he says. "What truly matters to me is the feeling of having done something meaningful and fulfilling by the end of the day."
Instead of chasing what's fashionable, he draws inspiration from a surprisingly eclectic bookshelf, mixing everything from Wim Crouwel's graphic design classics to studies on Scandinavian tattoos and Alec Soth's photography. It's a reminder that fresh ideas rarely come from looking where everyone else is looking.
In the era of AI and content overload, the role of the illustrator is changing, but Sergio remains optimistic. While machine learning might churn out images at record speed, it can't replicate the nuance and emotional intelligence that underpin great illustration.
"Illustrators can tell stories, evoke emotions, and create meaningful connections that machines simply cannot replicate," he says. "Our role is shifting, but the value of authentic, thoughtful illustration remains indispensable."
That insistence on authenticity carries through to the advice he offers younger illustrators navigating a commercial landscape. "Create work that makes you happy when you go to sleep at night," Sergio advises. "It's important to find projects that align with your values and passions so your artistic voice remains authentic."
It's an ethos that has carried him through more than a decade of creative highs and industry shifts. Perhaps it's the real secret behind the clarity of his practice, which he has built not on chasing trends or algorithms but on careful craft, deliberate evolution, and the simple, enduring joy of a well-made pencil and a blank piece of paper.
#sergio #membrillas #art #staying #true

Sergio Membrillas on the art of staying true: Illustration, evolution, and finding joy in the process
Where others have become obsessed with speed and trends, Sergio Membrillas has built a career on slowing down and staying true to his craft. Over 13 years as a professional illustrator, he's evolved a distinct style – bold, graphic, and quietly playful – that feels both timeless and entirely his own. But this evolution, as he's quick to point out, wasn't something he forced. "I believe evolution is essential for every artist," Sergio reflects. "Change is not something I resist; it's something I enjoy and welcome as part of the creative journey." His work, initially influenced by a love of Mid-Century graphic design, has gradually absorbed references as diverse as Etruscan art, Mesopotamian motifs, and early 20th-century traditional tattoos. It's a portfolio built on curiosity, not conformity. Despite his stylistic clarity, Sergio's process remains refreshingly analogue at its core. He still begins each project with pencil and paper, leaning into the tactility of drawing by hand. "I've always valued having a physical relationship with art," he says. "There's something essential about feeling the wood of the pencil, manually erasing mistakes, rather than simply double-tapping a screen." His philosophy of working slowly, attentively, and with purpose shows in the balanced compositions and confident use of negative space that has become his signature. Sergio credits his background in graphic design for this instinctive sense of structure. "There has always been a strong graphic sensibility within me," he says, noting that the discipline of design continues to inform his illustration practice, particularly in editorial and poster work where clarity and storytelling must co-exist. Yet, like many creative careers, his path into illustration wasn't plotted from the start. Initially, Sergio imagined illustration would complement his design projects, not become the main event. "At first, I thought I would incorporate my illustrations into my graphic design projects – but in the end, it turned out to be the other way around." A commission for EasyJet's in-flight magazine marked a pivotal moment that reframed illustration from a hobby to a profession. "It made me realize that being an illustrator is a real profession, just like any other." Fast-forward to today, and Sergio's client list reads like a who's who of publishing and design, from The New Yorker to Pentagram. While the calibre of collaborators has changed, what matters most remains the same: trust. "When a client trusts your work and approaches projects with an open mind, collaboration flourishes," he says. It's in these open, trusting relationships that Sergio finds the space to experiment and further develop his ideas. Unsurprisingly, editorial work holds a special place for him. "Editorial projects offer wider creative margins, allowing for greater flexibility and innovation," he explains. Compared to the tighter confines of advertising, editorial illustration offers the opportunity to tell nuanced stories, and Sergio is clear that he views every assignment, regardless of format, as a collaborative effort. If one thing is clear, though, it's that he's not that he's afraid to say no when needed. Maintaining a strong personal voice is non-negotiable. "I always strive to stay true to myself and ensure that every project I undertake reflects a clear personal signature," he says. For Sergio, authenticity isn't just a matter of artistic pride; it's what differentiates an illustrator in a saturated, increasingly automated industry. Valencia is home for Sergio, a city he credits with much of his creative energy. "Oh, Valencia! It's a beautiful city that inspires me and brings me joy," he says, describing it as a European cousin to Los Angeles with its sun-soaked streets and vibrant cultural scene. The blend of tradition and modernity fuels his practice, offering constant inspiration without the sensory overload that often accompanies larger creative hubs. Given the pressure many creatives feel to keep pace with shifting trends, Sergio's approach feels almost radical. "I'm not particularly interested in trends," he says. "What truly matters to me is the feeling of having done something meaningful and fulfilling by the end of the day." Instead of chasing what's fashionable, he draws inspiration from a surprisingly eclectic bookshelf, mixing everything from Wim Crouwel's graphic design classics to studies on Scandinavian tattoos and Alec Soth's photography. It's a reminder that fresh ideas rarely come from looking where everyone else is looking. In the era of AI and content overload, the role of the illustrator is changing, but Sergio remains optimistic. While machine learning might churn out images at record speed, it can't replicate the nuance and emotional intelligence that underpin great illustration. "Illustrators can tell stories, evoke emotions, and create meaningful connections that machines simply cannot replicate," he says. "Our role is shifting, but the value of authentic, thoughtful illustration remains indispensable." That insistence on authenticity carries through to the advice he offers younger illustrators navigating a commercial landscape. "Create work that makes you happy when you go to sleep at night," Sergio advises. "It's important to find projects that align with your values and passions so your artistic voice remains authentic." It's an ethos that has carried him through more than a decade of creative highs and industry shifts. Perhaps it's the real secret behind the clarity of his practice, which he has built not on chasing trends or algorithms but on careful craft, deliberate evolution, and the simple, enduring joy of a well-made pencil and a blank piece of paper. #sergio #membrillas #art #staying #true

WWW.CREATIVEBOOM.COM

Sergio Membrillas on the art of staying true: Illustration, evolution, and finding joy in the process

Where others have become obsessed with speed and trends, Sergio Membrillas has built a career on slowing down and staying true to his craft. Over 13 years as a professional illustrator, he's evolved a distinct style – bold, graphic, and quietly playful – that feels both timeless and entirely his own. But this evolution, as he's quick to point out, wasn't something he forced. "I believe evolution is essential for every artist," Sergio reflects. "Change is not something I resist; it's something I enjoy and welcome as part of the creative journey." His work, initially influenced by a love of Mid-Century graphic design, has gradually absorbed references as diverse as Etruscan art, Mesopotamian motifs, and early 20th-century traditional tattoos. It's a portfolio built on curiosity, not conformity. Despite his stylistic clarity, Sergio's process remains refreshingly analogue at its core. He still begins each project with pencil and paper, leaning into the tactility of drawing by hand. "I've always valued having a physical relationship with art," he says. "There's something essential about feeling the wood of the pencil, manually erasing mistakes, rather than simply double-tapping a screen." His philosophy of working slowly, attentively, and with purpose shows in the balanced compositions and confident use of negative space that has become his signature. Sergio credits his background in graphic design for this instinctive sense of structure. "There has always been a strong graphic sensibility within me," he says, noting that the discipline of design continues to inform his illustration practice, particularly in editorial and poster work where clarity and storytelling must co-exist. Yet, like many creative careers, his path into illustration wasn't plotted from the start. Initially, Sergio imagined illustration would complement his design projects, not become the main event. "At first, I thought I would incorporate my illustrations into my graphic design projects – but in the end, it turned out to be the other way around." A commission for EasyJet's in-flight magazine marked a pivotal moment that reframed illustration from a hobby to a profession. "It made me realize that being an illustrator is a real profession, just like any other." Fast-forward to today, and Sergio's client list reads like a who's who of publishing and design, from The New Yorker to Pentagram. While the calibre of collaborators has changed, what matters most remains the same: trust. "When a client trusts your work and approaches projects with an open mind, collaboration flourishes," he says. It's in these open, trusting relationships that Sergio finds the space to experiment and further develop his ideas. Unsurprisingly, editorial work holds a special place for him. "Editorial projects offer wider creative margins, allowing for greater flexibility and innovation," he explains. Compared to the tighter confines of advertising, editorial illustration offers the opportunity to tell nuanced stories, and Sergio is clear that he views every assignment, regardless of format, as a collaborative effort. If one thing is clear, though, it's that he's not that he's afraid to say no when needed. Maintaining a strong personal voice is non-negotiable. "I always strive to stay true to myself and ensure that every project I undertake reflects a clear personal signature," he says. For Sergio, authenticity isn't just a matter of artistic pride; it's what differentiates an illustrator in a saturated, increasingly automated industry. Valencia is home for Sergio, a city he credits with much of his creative energy. "Oh, Valencia! It's a beautiful city that inspires me and brings me joy," he says, describing it as a European cousin to Los Angeles with its sun-soaked streets and vibrant cultural scene. The blend of tradition and modernity fuels his practice, offering constant inspiration without the sensory overload that often accompanies larger creative hubs. Given the pressure many creatives feel to keep pace with shifting trends, Sergio's approach feels almost radical. "I'm not particularly interested in trends," he says. "What truly matters to me is the feeling of having done something meaningful and fulfilling by the end of the day." Instead of chasing what's fashionable, he draws inspiration from a surprisingly eclectic bookshelf, mixing everything from Wim Crouwel's graphic design classics to studies on Scandinavian tattoos and Alec Soth's photography. It's a reminder that fresh ideas rarely come from looking where everyone else is looking. In the era of AI and content overload, the role of the illustrator is changing, but Sergio remains optimistic. While machine learning might churn out images at record speed, it can't replicate the nuance and emotional intelligence that underpin great illustration. "Illustrators can tell stories, evoke emotions, and create meaningful connections that machines simply cannot replicate," he says. "Our role is shifting, but the value of authentic, thoughtful illustration remains indispensable." That insistence on authenticity carries through to the advice he offers younger illustrators navigating a commercial landscape. "Create work that makes you happy when you go to sleep at night," Sergio advises. "It's important to find projects that align with your values and passions so your artistic voice remains authentic." It's an ethos that has carried him through more than a decade of creative highs and industry shifts. Perhaps it's the real secret behind the clarity of his practice, which he has built not on chasing trends or algorithms but on careful craft, deliberate evolution, and the simple, enduring joy of a well-made pencil and a blank piece of paper.

287

Παρακαλούμε συνδέσου στην Κοινότητά μας για να δηλώσεις τι σου αρέσει, να σχολιάσεις και να μοιραστείς με τους φίλους σου!
EasyDMARC μοιράστηκε ένα σύνδεσμο

2025-06-06 08:23:05 ·

Understanding the Relationship Between Security Gateways and DMARC

Email authentication protocols like SPF, DKIM, and DMARC play a critical role in protecting domains from spoofing and phishing. However, when SEGs are introduced into the email path, the interaction with these protocols becomes more complex.
Security gatewaysare a core part of many organizations’ email infrastructure. They act as intermediaries between the public internet and internal mail systems, inspecting, filtering, and routing messages.
This blog examines how security gateways handle SPF, DKIM, and DMARC, with real-world examples from popular gateways such as Proofpoint, Mimecast, and Avanan. We’ll also cover best practices for maintaining authentication integrity and avoiding misconfigurations that can compromise email authentication or lead to false DMARC failures.
Security gateways often sit at the boundary between your organization and the internet, managing both inbound and outbound email traffic. Their role affects how email authentication protocols behave.
An inbound SEG examines emails coming into your organization. It checks SPF, DKIM, and DMARC to determine if the message is authentic and safe before passing it to your internal mail servers.
An outbound SEG handles emails sent from your domain. It may modify headers, rewrite envelope addresses, or even apply DKIM signing. All of these can impact SPF, DKIM, or DMARC validation on the recipient’s side.

Understanding how SEGs influence these flows is crucial to maintaining proper authentication and avoiding unexpected DMARC failures.
Inbound Handling of SPF, DKIM, and DMARC by Common Security Gateways
When an email comes into your organization, your security gateway is the first to inspect it. It checks whether the message is real, trustworthy, and properly authenticated. Let’s look at how different SEGs handle these checks.
AvananSPF: Avanan verifies whether the sending server is authorized to send emails for the domain by checking the SPF record.
DKIM: It verifies if the message was signed by the sending domain and if that signature is valid.
DMARC: It uses the results of the SPF and DKIM check to evaluate DMARC. However, final enforcement usually depends on how DMARC is handled by Microsoft 365 or Gmail, as Avanan integrates directly with them.

Avanan offers two methods of integration:1. API integration: Avanan connects via APIs, no change in MX, usually Monitor or Detect modes.2. Inline integration: Avanan is placed inline in the mail flow, actively blocking or remediating threats.
Proofpoint Email Protection

SPF: Proofpoint checks SPF to confirm the sender’s IP is authorized to send on behalf of the domain. You can set custom rules.
DKIM: It verifies DKIM signatures and shows clear pass/fail results in logs.
DMARC: It fully evaluates DMARC by combining SPF and DKIM results with alignment checks. Administrators can configure how to handle messages that fail DMARC, such as rejecting, quarantining, or delivering them. Additionally, Proofpoint allows whitelisting specific senders you trust, even if their emails fail authentication checks.

Integration Methods

Inline Mode: In this traditional deployment, Proofpoint is positioned directly in the email flow by modifying MX records. Emails are routed through Proofpoint’s infrastructure, allowing it to inspect and filter messages before they reach the recipient’s inbox. This mode provides pre-delivery protection and is commonly used in on-premises or hybrid environments.
API-BasedMode: Proofpoint offers API-based integration, particularly with cloud email platforms like Microsoft 365 and Google Workspace. In this mode, Proofpoint connects to the email platform via APIs, enabling it to monitor and remediate threats post-delivery without altering the email flow. This approach allows for rapid deployment and seamless integration with existing cloud email services.

Mimecast

SPF: Mimecast performs SPF checks to verify whether the sending server is authorized by the domain’s SPF record. Administrators can configure actions for SPF failures, including block, quarantine, permit, or tag with a warning. This gives flexibility in balancing security with business needs.
DKIM: It validates DKIM signatures by checking that the message was correctly signed by the sending domain and that the content hasn’t been tampered with. If the signature fails, Mimecast can take actions based on your configured policies.
DMARC: It fully evaluates DMARC by combining the results of SPF and DKIM with domain alignment checks. You can choose to honor the sending domain’s DMARC policyor apply custom rules, for example, quarantining or tagging messages that fail DMARC regardless of the published policy. This allows more granular control for businesses that want to override external domain policies based on specific contexts.

Integration Methods

Inline Deployment: Mimecast is typically deployed as a cloud-based secure email gateway. Organizations update their domain’s MX records to point to Mimecast, so all inboundemails pass through it first. This allows Mimecast to inspect, filter, and process emails before delivery, providing robust protection.
API Integrations: Mimecast also offers API-based services through its Mimecast API platform, primarily for management, archival, continuity, and threat intelligence purposes. However, API-only email protection is not Mimecast’s core model. Instead, the APIs are used to enhance the inline deployment, not replace it.

Barracuda Email Security Gateway
SPF: Barracuda checks the sender’s IP against the domain’s published SPF record. If the check fails, you can configure the system to block, quarantine, tag, or allow the message, depending on your policy preferences.
DKIM: It validates whether the incoming message includes a valid DKIM signature. The outcome is logged and used to inform further policy decisions or DMARC evaluations.
DMARC: It combines SPF and DKIM results, checks for domain alignment, and applies the DMARC policy defined by the sender. Administrators can also choose to override the DMARC policy, allowing messages to pass or be treated differently based on organizational needs.
Integration Methods

Inline mode: Barracuda Email Security Gateway is commonly deployed inline by updating your domain’s MX records to point to Barracuda’s cloud or on-premises gateway. This ensures that all inbound emails pass through Barracuda first for filtering and SPF, DKIM, and DMARC validation before being delivered to your mail servers.
Deployment Behind the Corporate Firewall: Alternatively, Barracuda can be deployed in transparent or bridge mode without modifying MX records. In this setup, the gateway is placed inline at the network level, such as behind a firewall, and intercepts mail traffic transparently. This method is typically used in complex on-premises environments where changing DNS records is not feasible.

Cisco Secure EmailCisco Secure Email acts as an inline gateway for inbound email, usually requiring your domain’s MX records to point to the Cisco Email Security Appliance or cloud service.
SPF: Cisco Secure Email verifies whether the sending server is authorized in the sender domain’s SPF record. Administrators can set detailed policies on how to handle SPF failures.
DKIM: It validates the DKIM signature on incoming emails and logs whether the signature is valid or has failed.
DMARC: It evaluates DMARC by combining SPF and DKIM results along with domain alignment checks. Admins can configure specific actions, such as quarantine, reject, or tag, based on different failure scenarios or trusted sender exceptions.
Integration methods

On-premises Email Security Appliance: You deploy Cisco’s hardware or virtual appliance inline, updating MX records to route mail through it for filtering.
Cisco Cloud Email Security: Cisco offers a cloud-based email security service where MX records are pointed to Cisco’s cloud infrastructure, which filters and processes inbound mail.

Cisco Secure Email also offers advanced, rule-based filtering capabilities and integrates with Cisco’s broader threat protection ecosystem, enabling comprehensive inbound email security.
Outbound Handling of SPF, DKIM, and DMARC by Common Security Gateways
When your organization sends emails, security gateways can play an active role in processing and authenticating those messages. Depending on the configuration, a gateway might rewrite headers, re-sign messages, or route them through different IPs – all actions that can help or hurt the authentication process. Let’s look at how major SEGs handle outbound email flow.
Avanan – Outbound Handling and Integration Methods
Outbound Logic
Avanan analyzes outbound emails primarily to detect data loss, malware, and policy violations. In API-based integration, emails are sent directly by the original mail server, so SPF and DKIM signatures remain intact. Avanan does not alter the message or reroute traffic, which helps maintain full DMARC alignment and domain reputation.
Integration Methods
1. API Integration: Connects to Microsoft 365 or Google Workspace via API. No MX changes are needed. Emails are scanned after they are sent, with no modification to SPF, DKIM, or the delivery path.

How it works: Microsoft Graph API or Google Workspace APIs are used to monitor and intervene in outbound emails.
Protection level: Despite no MX changes, it can offer inline-like protection, meaning it can block, quarantine, or encrypt emails before they are delivered externally.
SPF/DKIM/DMARC impact: Preserves original headers and signatures since mail is sent directly from Microsoft/Google servers.

2. Inline Integration: Requires changing MX records to route email through Avanan. In this mode, Avanan can intercept and inspect outbound emails before delivery. Depending on the configuration, this may affect SPF or DKIM if not properly handled.

How it works: Requires adding Avanan’s
Protection level: Traditional inline security with full visibility and control, including encryption, DLP, policy enforcement, and advanced threat protection.
SPF/DKIM/DMARC impact: SPF configuration is needed by adding Avanan’s include mechanism to the sending domain’s SPF record. The DKIM record of the original sending source is preserved.

For configurations, you can refer to the steps in this blog.
Proofpoint – Outbound Handling and Integration Methods
Outbound Logic
Proofpoint analyzes outbound emails to detect and prevent data loss, to identify advanced threatsoriginating from compromised internal accounts, and to ensure compliance. Their API integration provides crucial visibility and powerful remediation capabilities, while their traditional gatewaydeployment delivers true inline, pre-delivery blocking for outbound traffic.
Integration methods
1. API Integration: No MX record changes are required for this deployment method. Integration is done with Microsoft 365 or Google Workspace.

How it works: Through its API integration, Proofpoint gains deep visibility into outbound emails and provides layered security and response features, including:

Detect and alert: Identifies sensitive content, malicious attachments, or suspicious links in outbound emails.
Post-delivery remediation: A key capability of the API model is Threat Response Auto-Pull, which enables Proofpoint to automatically recall, quarantine, or delete emails after delivery. This is particularly useful for internally sent messages or those forwarded to other users.
Enhanced visibility: Aggregates message metadata and logs into Proofpoint’s threat intelligence platform, giving security teams a centralized view of outbound risks and user behavior.

Protection level: API-based integration provides strong post-delivery detection and response, as well as visibility into DLP incidents and suspicious behavior.
SPF/DKIM/DMARC impact: Proofpoint does not alter SPF, DKIM, or DMARC because emails are sent directly through Microsoft or Google servers. Since Proofpoint’s servers are not involved in the actual sending process, the original authentication headers remain intact.

2. Gateway Integration: This method requires updating MX records or routing outbound mail through Proofpoint via a smart host.

How it works: Proofpoint acts as an inline gateway, inspecting emails before delivery. Inbound mail is filtered via MX changes; outbound mail is relayed through Proofpoint’s servers.
Threat and DLP filtering: Scans outbound messages for sensitive content, malware, and policy violations.
Real-time enforcement: Blocks, encrypts, or quarantines emails before they’re delivered.
Policy controls: Applies rules based on content, recipient, or behavior.
Protection level: Provides strong, real-time protection for outbound traffic with pre-delivery enforcement, DLP, and encryption.
SPF/DKIM/DMARC impact: Proofpoint becomes the sending server:

SPF: You need to configure ProofPoint’s SPF.
DKIM: Can sign messages; requires DKIM setup.
DMARC: DMARC passes if SPF and DKIM are set up properly.

Please refer to this article to configure SPF and DKIM for ProofPoint.
Mimecast – Outbound Handling and Integration Methods
Outbound Logic
Mimecast inspects outbound emails to prevent data loss, detect internal threats such as malware and impersonation, and ensure regulatory compliance. It primarily functions as a Secure Email Gateway, meaning it sits directly in the outbound email flow. While Mimecast offers APIs, its core outbound protection is built around this inline gateway model.
Integration Methods
1. Gateway IntegrationThis is Mimecast’s primary method for outbound email protection. Organizations route their outbound traffic through Mimecast by configuring their email serverto use Mimecast as a smart host. This enables Mimecast to inspect and enforce policies on all outgoing emails in real time.

How it works:
Updating outbound routing in your email system, or
Using Mimecast SMTP relay to direct messages through their infrastructure.
Mimecast then scans, filters, and applies policies before the email reaches the final recipient.

Protection level:
Advanced DLP: Identifies and prevents sensitive data leaks.
Impersonation and Threat Protection: Blocks malware, phishing, and abuse from compromised internal accounts.
Email Encryption and Secure Messaging: Applies encryption policies or routes messages via secure portals.

Regulatory Compliance: Enforces outbound compliance rules based on content, recipient, or metadata.
SPF/DKIM/DMARC impact:

SPF: Your SPF record must include Mimecast’s SPF mechanism based on your region to avoid SPF failures.
DKIM: A new DKIM record should be configured to make sure your emails are DKIM signed when routing through Mimecast.
DMARC: With correct SPF and DKIM setup, Mimecast ensures DMARC alignment, maintaining your domain’s sending reputation. Please refer to the steps in this detailed article to set up SPF and DKIM for Mimecast.

2. API IntegrationMimecast’s APIs complement the main gateway by providing automation, reporting, and management tools rather than handling live outbound mail flow. They allow you to manage policies, export logs, search archived emails, and sync users.
APIs enhance visibility and operational tasks but do not provide real-time filtering or blocking of outbound messages. Since APIs don’t process live mail, they have no direct effect on SPF, DKIM, or DMARC; those depend on your gatewaysetup.
Barracuda – Outbound Handling and Integration Methods
Outbound Logic
Barracuda analyzes outbound emails to prevent data loss, block malware, stop phishing/impersonation attempts from compromised internal accounts, and ensure compliance. Barracuda offers flexible deployment options, including both traditional gatewayand API-based integrations. While both contribute to outbound security, their roles are distinct.
Integration Methods
1. Gateway Integration— Primary Inline Security

How it works: All outbound emails pass through Barracuda’s security stack for real-time inspection, threat blocking, and policy enforcement before delivery.
Protection level:

Comprehensive DLP
Outbound spam and virus filtering
Enforcement of compliance and content policies

This approach offers a high level of control and immediate threat mitigation on outbound mail flow.

SPF/DKIM/DMARC impact:

SPF: Update SPF records to include Barracuda’s sending IPs or SPF include mechanism.
DKIM: Currently, no explicit setup is needed; DKIM of the main sending source is preserved.

Refer to this article for more comprehensive guidance on Barracuda SEG configuration.
2. API IntegrationHow it works: The API accesses cloud email environments to analyze historical and real-time data, learning normal communication patterns to detect anomalies in outbound emails. It also supports post-delivery remediation, enabling the removal of malicious emails from internal mailboxes after sending.
Protection level: Advanced AI-driven detection and near real-time blocking of outbound threats, plus strong post-delivery cleanup capabilities.
SPF/DKIM/DMARC impact: Since mail is sent directly by the original mail server, SPF and DKIM signatures remain intact, preserving DMARC alignment and domain reputation.

Cisco Secure Email– Outbound Handling and Integration Methods
Outbound Logic
Cisco Secure Email protects outbound email by preventing data loss, blocking spam and malware from internal accounts, stopping business email compromiseand impersonation attacks, and ensuring compliance. Cisco provides both traditional gateway appliances/cloud gateways and modern API-based solutions for layered outbound security.
Integration Methods
1. Gateway Integration– Cisco Secure Email GatewayHow it works: Organizations update MX records to route mail through the Cisco Secure Email Gateway or configure their mail serverto smart host outbound email via the gateway. All outbound mail is inspected and policies enforced before delivery.
Protection level:

Granular DLPOutbound spam and malware filtering to protect IP reputation
Email encryption for sensitive outbound messages
Comprehensive content and attachment policy enforcement

SPF: Check this article for comprehensive guidance on Cisco SPF settings.
DKIM: Refer to this article for detailed guidance on Cisco DKIM settings.

2. API Integration – Cisco Secure Email Threat Defense

How it works: Integrates directly via API with Microsoft 365, continuously monitoring email metadata, content, and user behavior across inbound, outbound, and internal messages. Leverages Cisco’s threat intelligence and AI to detect anomalous outbound activity linked to BEC, account takeover, and phishing.
Post-Delivery Remediation: Automates the removal or quarantine of malicious or policy-violating emails from mailboxes even after sending.
Protection level: Advanced, AI-driven detection of sophisticated outbound threats with real-time monitoring and automated remediation. Complements gateway filtering by adding cloud-native visibility and swift post-send action.
SPF/DKIM/DMARC impact: Since emails are sent directly by the original mail server, SPF and DKIM signatures remain intact, preserving DMARC alignment and domain reputation.

If you have any questions or need assistance, feel free to reach out to EasyDMARC technical support.
#understanding #relationship #between #security #gateways

Understanding the Relationship Between Security Gateways and DMARC
Email authentication protocols like SPF, DKIM, and DMARC play a critical role in protecting domains from spoofing and phishing. However, when SEGs are introduced into the email path, the interaction with these protocols becomes more complex. Security gatewaysare a core part of many organizations’ email infrastructure. They act as intermediaries between the public internet and internal mail systems, inspecting, filtering, and routing messages. This blog examines how security gateways handle SPF, DKIM, and DMARC, with real-world examples from popular gateways such as Proofpoint, Mimecast, and Avanan. We’ll also cover best practices for maintaining authentication integrity and avoiding misconfigurations that can compromise email authentication or lead to false DMARC failures. Security gateways often sit at the boundary between your organization and the internet, managing both inbound and outbound email traffic. Their role affects how email authentication protocols behave. An inbound SEG examines emails coming into your organization. It checks SPF, DKIM, and DMARC to determine if the message is authentic and safe before passing it to your internal mail servers. An outbound SEG handles emails sent from your domain. It may modify headers, rewrite envelope addresses, or even apply DKIM signing. All of these can impact SPF, DKIM, or DMARC validation on the recipient’s side. Understanding how SEGs influence these flows is crucial to maintaining proper authentication and avoiding unexpected DMARC failures. Inbound Handling of SPF, DKIM, and DMARC by Common Security Gateways When an email comes into your organization, your security gateway is the first to inspect it. It checks whether the message is real, trustworthy, and properly authenticated. Let’s look at how different SEGs handle these checks. AvananSPF: Avanan verifies whether the sending server is authorized to send emails for the domain by checking the SPF record. DKIM: It verifies if the message was signed by the sending domain and if that signature is valid. DMARC: It uses the results of the SPF and DKIM check to evaluate DMARC. However, final enforcement usually depends on how DMARC is handled by Microsoft 365 or Gmail, as Avanan integrates directly with them. Avanan offers two methods of integration:1. API integration: Avanan connects via APIs, no change in MX, usually Monitor or Detect modes.2. Inline integration: Avanan is placed inline in the mail flow, actively blocking or remediating threats. Proofpoint Email Protection SPF: Proofpoint checks SPF to confirm the sender’s IP is authorized to send on behalf of the domain. You can set custom rules. DKIM: It verifies DKIM signatures and shows clear pass/fail results in logs. DMARC: It fully evaluates DMARC by combining SPF and DKIM results with alignment checks. Administrators can configure how to handle messages that fail DMARC, such as rejecting, quarantining, or delivering them. Additionally, Proofpoint allows whitelisting specific senders you trust, even if their emails fail authentication checks. Integration Methods Inline Mode: In this traditional deployment, Proofpoint is positioned directly in the email flow by modifying MX records. Emails are routed through Proofpoint’s infrastructure, allowing it to inspect and filter messages before they reach the recipient’s inbox. This mode provides pre-delivery protection and is commonly used in on-premises or hybrid environments. API-BasedMode: Proofpoint offers API-based integration, particularly with cloud email platforms like Microsoft 365 and Google Workspace. In this mode, Proofpoint connects to the email platform via APIs, enabling it to monitor and remediate threats post-delivery without altering the email flow. This approach allows for rapid deployment and seamless integration with existing cloud email services. Mimecast SPF: Mimecast performs SPF checks to verify whether the sending server is authorized by the domain’s SPF record. Administrators can configure actions for SPF failures, including block, quarantine, permit, or tag with a warning. This gives flexibility in balancing security with business needs. DKIM: It validates DKIM signatures by checking that the message was correctly signed by the sending domain and that the content hasn’t been tampered with. If the signature fails, Mimecast can take actions based on your configured policies. DMARC: It fully evaluates DMARC by combining the results of SPF and DKIM with domain alignment checks. You can choose to honor the sending domain’s DMARC policyor apply custom rules, for example, quarantining or tagging messages that fail DMARC regardless of the published policy. This allows more granular control for businesses that want to override external domain policies based on specific contexts. Integration Methods Inline Deployment: Mimecast is typically deployed as a cloud-based secure email gateway. Organizations update their domain’s MX records to point to Mimecast, so all inboundemails pass through it first. This allows Mimecast to inspect, filter, and process emails before delivery, providing robust protection. API Integrations: Mimecast also offers API-based services through its Mimecast API platform, primarily for management, archival, continuity, and threat intelligence purposes. However, API-only email protection is not Mimecast’s core model. Instead, the APIs are used to enhance the inline deployment, not replace it. Barracuda Email Security Gateway SPF: Barracuda checks the sender’s IP against the domain’s published SPF record. If the check fails, you can configure the system to block, quarantine, tag, or allow the message, depending on your policy preferences. DKIM: It validates whether the incoming message includes a valid DKIM signature. The outcome is logged and used to inform further policy decisions or DMARC evaluations. DMARC: It combines SPF and DKIM results, checks for domain alignment, and applies the DMARC policy defined by the sender. Administrators can also choose to override the DMARC policy, allowing messages to pass or be treated differently based on organizational needs. Integration Methods Inline mode: Barracuda Email Security Gateway is commonly deployed inline by updating your domain’s MX records to point to Barracuda’s cloud or on-premises gateway. This ensures that all inbound emails pass through Barracuda first for filtering and SPF, DKIM, and DMARC validation before being delivered to your mail servers. Deployment Behind the Corporate Firewall: Alternatively, Barracuda can be deployed in transparent or bridge mode without modifying MX records. In this setup, the gateway is placed inline at the network level, such as behind a firewall, and intercepts mail traffic transparently. This method is typically used in complex on-premises environments where changing DNS records is not feasible. Cisco Secure EmailCisco Secure Email acts as an inline gateway for inbound email, usually requiring your domain’s MX records to point to the Cisco Email Security Appliance or cloud service. SPF: Cisco Secure Email verifies whether the sending server is authorized in the sender domain’s SPF record. Administrators can set detailed policies on how to handle SPF failures. DKIM: It validates the DKIM signature on incoming emails and logs whether the signature is valid or has failed. DMARC: It evaluates DMARC by combining SPF and DKIM results along with domain alignment checks. Admins can configure specific actions, such as quarantine, reject, or tag, based on different failure scenarios or trusted sender exceptions. Integration methods On-premises Email Security Appliance: You deploy Cisco’s hardware or virtual appliance inline, updating MX records to route mail through it for filtering. Cisco Cloud Email Security: Cisco offers a cloud-based email security service where MX records are pointed to Cisco’s cloud infrastructure, which filters and processes inbound mail. Cisco Secure Email also offers advanced, rule-based filtering capabilities and integrates with Cisco’s broader threat protection ecosystem, enabling comprehensive inbound email security. Outbound Handling of SPF, DKIM, and DMARC by Common Security Gateways When your organization sends emails, security gateways can play an active role in processing and authenticating those messages. Depending on the configuration, a gateway might rewrite headers, re-sign messages, or route them through different IPs – all actions that can help or hurt the authentication process. Let’s look at how major SEGs handle outbound email flow. Avanan – Outbound Handling and Integration Methods Outbound Logic Avanan analyzes outbound emails primarily to detect data loss, malware, and policy violations. In API-based integration, emails are sent directly by the original mail server, so SPF and DKIM signatures remain intact. Avanan does not alter the message or reroute traffic, which helps maintain full DMARC alignment and domain reputation. Integration Methods 1. API Integration: Connects to Microsoft 365 or Google Workspace via API. No MX changes are needed. Emails are scanned after they are sent, with no modification to SPF, DKIM, or the delivery path. How it works: Microsoft Graph API or Google Workspace APIs are used to monitor and intervene in outbound emails. Protection level: Despite no MX changes, it can offer inline-like protection, meaning it can block, quarantine, or encrypt emails before they are delivered externally. SPF/DKIM/DMARC impact: Preserves original headers and signatures since mail is sent directly from Microsoft/Google servers. 2. Inline Integration: Requires changing MX records to route email through Avanan. In this mode, Avanan can intercept and inspect outbound emails before delivery. Depending on the configuration, this may affect SPF or DKIM if not properly handled. How it works: Requires adding Avanan’s Protection level: Traditional inline security with full visibility and control, including encryption, DLP, policy enforcement, and advanced threat protection. SPF/DKIM/DMARC impact: SPF configuration is needed by adding Avanan’s include mechanism to the sending domain’s SPF record. The DKIM record of the original sending source is preserved. For configurations, you can refer to the steps in this blog. Proofpoint – Outbound Handling and Integration Methods Outbound Logic Proofpoint analyzes outbound emails to detect and prevent data loss, to identify advanced threatsoriginating from compromised internal accounts, and to ensure compliance. Their API integration provides crucial visibility and powerful remediation capabilities, while their traditional gatewaydeployment delivers true inline, pre-delivery blocking for outbound traffic. Integration methods 1. API Integration: No MX record changes are required for this deployment method. Integration is done with Microsoft 365 or Google Workspace. How it works: Through its API integration, Proofpoint gains deep visibility into outbound emails and provides layered security and response features, including: Detect and alert: Identifies sensitive content, malicious attachments, or suspicious links in outbound emails. Post-delivery remediation: A key capability of the API model is Threat Response Auto-Pull, which enables Proofpoint to automatically recall, quarantine, or delete emails after delivery. This is particularly useful for internally sent messages or those forwarded to other users. Enhanced visibility: Aggregates message metadata and logs into Proofpoint’s threat intelligence platform, giving security teams a centralized view of outbound risks and user behavior. Protection level: API-based integration provides strong post-delivery detection and response, as well as visibility into DLP incidents and suspicious behavior. SPF/DKIM/DMARC impact: Proofpoint does not alter SPF, DKIM, or DMARC because emails are sent directly through Microsoft or Google servers. Since Proofpoint’s servers are not involved in the actual sending process, the original authentication headers remain intact. 2. Gateway Integration: This method requires updating MX records or routing outbound mail through Proofpoint via a smart host. How it works: Proofpoint acts as an inline gateway, inspecting emails before delivery. Inbound mail is filtered via MX changes; outbound mail is relayed through Proofpoint’s servers. Threat and DLP filtering: Scans outbound messages for sensitive content, malware, and policy violations. Real-time enforcement: Blocks, encrypts, or quarantines emails before they’re delivered. Policy controls: Applies rules based on content, recipient, or behavior. Protection level: Provides strong, real-time protection for outbound traffic with pre-delivery enforcement, DLP, and encryption. SPF/DKIM/DMARC impact: Proofpoint becomes the sending server: SPF: You need to configure ProofPoint’s SPF. DKIM: Can sign messages; requires DKIM setup. DMARC: DMARC passes if SPF and DKIM are set up properly. Please refer to this article to configure SPF and DKIM for ProofPoint. Mimecast – Outbound Handling and Integration Methods Outbound Logic Mimecast inspects outbound emails to prevent data loss, detect internal threats such as malware and impersonation, and ensure regulatory compliance. It primarily functions as a Secure Email Gateway, meaning it sits directly in the outbound email flow. While Mimecast offers APIs, its core outbound protection is built around this inline gateway model. Integration Methods 1. Gateway IntegrationThis is Mimecast’s primary method for outbound email protection. Organizations route their outbound traffic through Mimecast by configuring their email serverto use Mimecast as a smart host. This enables Mimecast to inspect and enforce policies on all outgoing emails in real time. How it works: Updating outbound routing in your email system, or Using Mimecast SMTP relay to direct messages through their infrastructure. Mimecast then scans, filters, and applies policies before the email reaches the final recipient. Protection level: Advanced DLP: Identifies and prevents sensitive data leaks. Impersonation and Threat Protection: Blocks malware, phishing, and abuse from compromised internal accounts. Email Encryption and Secure Messaging: Applies encryption policies or routes messages via secure portals. Regulatory Compliance: Enforces outbound compliance rules based on content, recipient, or metadata. SPF/DKIM/DMARC impact: SPF: Your SPF record must include Mimecast’s SPF mechanism based on your region to avoid SPF failures. DKIM: A new DKIM record should be configured to make sure your emails are DKIM signed when routing through Mimecast. DMARC: With correct SPF and DKIM setup, Mimecast ensures DMARC alignment, maintaining your domain’s sending reputation. Please refer to the steps in this detailed article to set up SPF and DKIM for Mimecast. 2. API IntegrationMimecast’s APIs complement the main gateway by providing automation, reporting, and management tools rather than handling live outbound mail flow. They allow you to manage policies, export logs, search archived emails, and sync users. APIs enhance visibility and operational tasks but do not provide real-time filtering or blocking of outbound messages. Since APIs don’t process live mail, they have no direct effect on SPF, DKIM, or DMARC; those depend on your gatewaysetup. Barracuda – Outbound Handling and Integration Methods Outbound Logic Barracuda analyzes outbound emails to prevent data loss, block malware, stop phishing/impersonation attempts from compromised internal accounts, and ensure compliance. Barracuda offers flexible deployment options, including both traditional gatewayand API-based integrations. While both contribute to outbound security, their roles are distinct. Integration Methods 1. Gateway Integration— Primary Inline Security How it works: All outbound emails pass through Barracuda’s security stack for real-time inspection, threat blocking, and policy enforcement before delivery. Protection level: Comprehensive DLP Outbound spam and virus filtering Enforcement of compliance and content policies This approach offers a high level of control and immediate threat mitigation on outbound mail flow. SPF/DKIM/DMARC impact: SPF: Update SPF records to include Barracuda’s sending IPs or SPF include mechanism. DKIM: Currently, no explicit setup is needed; DKIM of the main sending source is preserved. Refer to this article for more comprehensive guidance on Barracuda SEG configuration. 2. API IntegrationHow it works: The API accesses cloud email environments to analyze historical and real-time data, learning normal communication patterns to detect anomalies in outbound emails. It also supports post-delivery remediation, enabling the removal of malicious emails from internal mailboxes after sending. Protection level: Advanced AI-driven detection and near real-time blocking of outbound threats, plus strong post-delivery cleanup capabilities. SPF/DKIM/DMARC impact: Since mail is sent directly by the original mail server, SPF and DKIM signatures remain intact, preserving DMARC alignment and domain reputation. Cisco Secure Email– Outbound Handling and Integration Methods Outbound Logic Cisco Secure Email protects outbound email by preventing data loss, blocking spam and malware from internal accounts, stopping business email compromiseand impersonation attacks, and ensuring compliance. Cisco provides both traditional gateway appliances/cloud gateways and modern API-based solutions for layered outbound security. Integration Methods 1. Gateway Integration– Cisco Secure Email GatewayHow it works: Organizations update MX records to route mail through the Cisco Secure Email Gateway or configure their mail serverto smart host outbound email via the gateway. All outbound mail is inspected and policies enforced before delivery. Protection level: Granular DLPOutbound spam and malware filtering to protect IP reputation Email encryption for sensitive outbound messages Comprehensive content and attachment policy enforcement SPF: Check this article for comprehensive guidance on Cisco SPF settings. DKIM: Refer to this article for detailed guidance on Cisco DKIM settings. 2. API Integration – Cisco Secure Email Threat Defense How it works: Integrates directly via API with Microsoft 365, continuously monitoring email metadata, content, and user behavior across inbound, outbound, and internal messages. Leverages Cisco’s threat intelligence and AI to detect anomalous outbound activity linked to BEC, account takeover, and phishing. Post-Delivery Remediation: Automates the removal or quarantine of malicious or policy-violating emails from mailboxes even after sending. Protection level: Advanced, AI-driven detection of sophisticated outbound threats with real-time monitoring and automated remediation. Complements gateway filtering by adding cloud-native visibility and swift post-send action. SPF/DKIM/DMARC impact: Since emails are sent directly by the original mail server, SPF and DKIM signatures remain intact, preserving DMARC alignment and domain reputation. If you have any questions or need assistance, feel free to reach out to EasyDMARC technical support. #understanding #relationship #between #security #gateways

EASYDMARC.COM

Understanding the Relationship Between Security Gateways and DMARC

Email authentication protocols like SPF, DKIM, and DMARC play a critical role in protecting domains from spoofing and phishing. However, when SEGs are introduced into the email path, the interaction with these protocols becomes more complex. Security gateways(SEGs) are a core part of many organizations’ email infrastructure. They act as intermediaries between the public internet and internal mail systems, inspecting, filtering, and routing messages. This blog examines how security gateways handle SPF, DKIM, and DMARC, with real-world examples from popular gateways such as Proofpoint, Mimecast, and Avanan. We’ll also cover best practices for maintaining authentication integrity and avoiding misconfigurations that can compromise email authentication or lead to false DMARC failures. Security gateways often sit at the boundary between your organization and the internet, managing both inbound and outbound email traffic. Their role affects how email authentication protocols behave. An inbound SEG examines emails coming into your organization. It checks SPF, DKIM, and DMARC to determine if the message is authentic and safe before passing it to your internal mail servers. An outbound SEG handles emails sent from your domain. It may modify headers, rewrite envelope addresses, or even apply DKIM signing. All of these can impact SPF, DKIM, or DMARC validation on the recipient’s side. Understanding how SEGs influence these flows is crucial to maintaining proper authentication and avoiding unexpected DMARC failures. Inbound Handling of SPF, DKIM, and DMARC by Common Security Gateways When an email comes into your organization, your security gateway is the first to inspect it. It checks whether the message is real, trustworthy, and properly authenticated. Let’s look at how different SEGs handle these checks. Avanan (by Check Point) SPF: Avanan verifies whether the sending server is authorized to send emails for the domain by checking the SPF record. DKIM: It verifies if the message was signed by the sending domain and if that signature is valid. DMARC: It uses the results of the SPF and DKIM check to evaluate DMARC. However, final enforcement usually depends on how DMARC is handled by Microsoft 365 or Gmail, as Avanan integrates directly with them. Avanan offers two methods of integration:1. API integration: Avanan connects via APIs, no change in MX, usually Monitor or Detect modes.2. Inline integration: Avanan is placed inline in the mail flow (MX records changed), actively blocking or remediating threats. Proofpoint Email Protection SPF: Proofpoint checks SPF to confirm the sender’s IP is authorized to send on behalf of the domain. You can set custom rules (e.g. treat “softfail” as “fail”). DKIM: It verifies DKIM signatures and shows clear pass/fail results in logs. DMARC: It fully evaluates DMARC by combining SPF and DKIM results with alignment checks. Administrators can configure how to handle messages that fail DMARC, such as rejecting, quarantining, or delivering them. Additionally, Proofpoint allows whitelisting specific senders you trust, even if their emails fail authentication checks. Integration Methods Inline Mode: In this traditional deployment, Proofpoint is positioned directly in the email flow by modifying MX records. Emails are routed through Proofpoint’s infrastructure, allowing it to inspect and filter messages before they reach the recipient’s inbox. This mode provides pre-delivery protection and is commonly used in on-premises or hybrid environments. API-Based (Integrated Cloud Email Security – ICES) Mode: Proofpoint offers API-based integration, particularly with cloud email platforms like Microsoft 365 and Google Workspace. In this mode, Proofpoint connects to the email platform via APIs, enabling it to monitor and remediate threats post-delivery without altering the email flow. This approach allows for rapid deployment and seamless integration with existing cloud email services. Mimecast SPF: Mimecast performs SPF checks to verify whether the sending server is authorized by the domain’s SPF record. Administrators can configure actions for SPF failures, including block, quarantine, permit, or tag with a warning. This gives flexibility in balancing security with business needs. DKIM: It validates DKIM signatures by checking that the message was correctly signed by the sending domain and that the content hasn’t been tampered with. If the signature fails, Mimecast can take actions based on your configured policies. DMARC: It fully evaluates DMARC by combining the results of SPF and DKIM with domain alignment checks. You can choose to honor the sending domain’s DMARC policy (none, quarantine, reject) or apply custom rules, for example, quarantining or tagging messages that fail DMARC regardless of the published policy. This allows more granular control for businesses that want to override external domain policies based on specific contexts. Integration Methods Inline Deployment: Mimecast is typically deployed as a cloud-based secure email gateway. Organizations update their domain’s MX records to point to Mimecast, so all inbound (and optionally outbound) emails pass through it first. This allows Mimecast to inspect, filter, and process emails before delivery, providing robust protection. API Integrations: Mimecast also offers API-based services through its Mimecast API platform, primarily for management, archival, continuity, and threat intelligence purposes. However, API-only email protection is not Mimecast’s core model. Instead, the APIs are used to enhance the inline deployment, not replace it. Barracuda Email Security Gateway SPF: Barracuda checks the sender’s IP against the domain’s published SPF record. If the check fails, you can configure the system to block, quarantine, tag, or allow the message, depending on your policy preferences. DKIM: It validates whether the incoming message includes a valid DKIM signature. The outcome is logged and used to inform further policy decisions or DMARC evaluations. DMARC: It combines SPF and DKIM results, checks for domain alignment, and applies the DMARC policy defined by the sender. Administrators can also choose to override the DMARC policy, allowing messages to pass or be treated differently based on organizational needs (e.g., trusted senders or internal exceptions). Integration Methods Inline mode (more common and straightforward): Barracuda Email Security Gateway is commonly deployed inline by updating your domain’s MX records to point to Barracuda’s cloud or on-premises gateway. This ensures that all inbound emails pass through Barracuda first for filtering and SPF, DKIM, and DMARC validation before being delivered to your mail servers. Deployment Behind the Corporate Firewall: Alternatively, Barracuda can be deployed in transparent or bridge mode without modifying MX records. In this setup, the gateway is placed inline at the network level, such as behind a firewall, and intercepts mail traffic transparently. This method is typically used in complex on-premises environments where changing DNS records is not feasible. Cisco Secure Email (formerly IronPort) Cisco Secure Email acts as an inline gateway for inbound email, usually requiring your domain’s MX records to point to the Cisco Email Security Appliance or cloud service. SPF: Cisco Secure Email verifies whether the sending server is authorized in the sender domain’s SPF record. Administrators can set detailed policies on how to handle SPF failures. DKIM: It validates the DKIM signature on incoming emails and logs whether the signature is valid or has failed. DMARC: It evaluates DMARC by combining SPF and DKIM results along with domain alignment checks. Admins can configure specific actions, such as quarantine, reject, or tag, based on different failure scenarios or trusted sender exceptions. Integration methods On-premises Email Security Appliance (ESA): You deploy Cisco’s hardware or virtual appliance inline, updating MX records to route mail through it for filtering. Cisco Cloud Email Security: Cisco offers a cloud-based email security service where MX records are pointed to Cisco’s cloud infrastructure, which filters and processes inbound mail. Cisco Secure Email also offers advanced, rule-based filtering capabilities and integrates with Cisco’s broader threat protection ecosystem, enabling comprehensive inbound email security. Outbound Handling of SPF, DKIM, and DMARC by Common Security Gateways When your organization sends emails, security gateways can play an active role in processing and authenticating those messages. Depending on the configuration, a gateway might rewrite headers, re-sign messages, or route them through different IPs – all actions that can help or hurt the authentication process. Let’s look at how major SEGs handle outbound email flow. Avanan – Outbound Handling and Integration Methods Outbound Logic Avanan analyzes outbound emails primarily to detect data loss, malware, and policy violations. In API-based integration, emails are sent directly by the original mail server (e.g., Microsoft 365 or Google Workspace), so SPF and DKIM signatures remain intact. Avanan does not alter the message or reroute traffic, which helps maintain full DMARC alignment and domain reputation. Integration Methods 1. API Integration: Connects to Microsoft 365 or Google Workspace via API. No MX changes are needed. Emails are scanned after they are sent, with no modification to SPF, DKIM, or the delivery path. How it works: Microsoft Graph API or Google Workspace APIs are used to monitor and intervene in outbound emails. Protection level: Despite no MX changes, it can offer inline-like protection, meaning it can block, quarantine, or encrypt emails before they are delivered externally. SPF/DKIM/DMARC impact: Preserves original headers and signatures since mail is sent directly from Microsoft/Google servers. 2. Inline Integration: Requires changing MX records to route email through Avanan. In this mode, Avanan can intercept and inspect outbound emails before delivery. Depending on the configuration, this may affect SPF or DKIM if not properly handled. How it works: Requires adding Avanan’s Protection level: Traditional inline security with full visibility and control, including encryption, DLP, policy enforcement, and advanced threat protection. SPF/DKIM/DMARC impact: SPF configuration is needed by adding Avanan’s include mechanism to the sending domain’s SPF record. The DKIM record of the original sending source is preserved. For configurations, you can refer to the steps in this blog. Proofpoint – Outbound Handling and Integration Methods Outbound Logic Proofpoint analyzes outbound emails to detect and prevent data loss (DLP), to identify advanced threats (malware, phishing, BEC) originating from compromised internal accounts, and to ensure compliance. Their API integration provides crucial visibility and powerful remediation capabilities, while their traditional gateway (MX record) deployment delivers true inline, pre-delivery blocking for outbound traffic. Integration methods 1. API Integration: No MX record changes are required for this deployment method. Integration is done with Microsoft 365 or Google Workspace. How it works: Through its API integration, Proofpoint gains deep visibility into outbound emails and provides layered security and response features, including: Detect and alert: Identifies sensitive content (Data Loss Prevention violations), malicious attachments, or suspicious links in outbound emails. Post-delivery remediation (TRAP): A key capability of the API model is Threat Response Auto-Pull (TRAP), which enables Proofpoint to automatically recall, quarantine, or delete emails after delivery. This is particularly useful for internally sent messages or those forwarded to other users. Enhanced visibility: Aggregates message metadata and logs into Proofpoint’s threat intelligence platform, giving security teams a centralized view of outbound risks and user behavior. Protection level: API-based integration provides strong post-delivery detection and response, as well as visibility into DLP incidents and suspicious behavior. SPF/DKIM/DMARC impact: Proofpoint does not alter SPF, DKIM, or DMARC because emails are sent directly through Microsoft or Google servers. Since Proofpoint’s servers are not involved in the actual sending process, the original authentication headers remain intact. 2. Gateway Integration (MX Record/Smart Host): This method requires updating MX records or routing outbound mail through Proofpoint via a smart host. How it works: Proofpoint acts as an inline gateway, inspecting emails before delivery. Inbound mail is filtered via MX changes; outbound mail is relayed through Proofpoint’s servers. Threat and DLP filtering: Scans outbound messages for sensitive content, malware, and policy violations. Real-time enforcement: Blocks, encrypts, or quarantines emails before they’re delivered. Policy controls: Applies rules based on content, recipient, or behavior. Protection level: Provides strong, real-time protection for outbound traffic with pre-delivery enforcement, DLP, and encryption. SPF/DKIM/DMARC impact: Proofpoint becomes the sending server: SPF: You need to configure ProofPoint’s SPF. DKIM: Can sign messages; requires DKIM setup. DMARC: DMARC passes if SPF and DKIM are set up properly. Please refer to this article to configure SPF and DKIM for ProofPoint. Mimecast – Outbound Handling and Integration Methods Outbound Logic Mimecast inspects outbound emails to prevent data loss (DLP), detect internal threats such as malware and impersonation, and ensure regulatory compliance. It primarily functions as a Secure Email Gateway (SEG), meaning it sits directly in the outbound email flow. While Mimecast offers APIs, its core outbound protection is built around this inline gateway model. Integration Methods 1. Gateway Integration (MX Record change required) This is Mimecast’s primary method for outbound email protection. Organizations route their outbound traffic through Mimecast by configuring their email server (e.g., Microsoft 365, Google Workspace, etc.) to use Mimecast as a smart host. This enables Mimecast to inspect and enforce policies on all outgoing emails in real time. How it works: Updating outbound routing in your email system (smart host settings), or Using Mimecast SMTP relay to direct messages through their infrastructure. Mimecast then scans, filters, and applies policies before the email reaches the final recipient. Protection level: Advanced DLP: Identifies and prevents sensitive data leaks. Impersonation and Threat Protection: Blocks malware, phishing, and abuse from compromised internal accounts. Email Encryption and Secure Messaging: Applies encryption policies or routes messages via secure portals. Regulatory Compliance: Enforces outbound compliance rules based on content, recipient, or metadata. SPF/DKIM/DMARC impact: SPF: Your SPF record must include Mimecast’s SPF mechanism based on your region to avoid SPF failures. DKIM: A new DKIM record should be configured to make sure your emails are DKIM signed when routing through Mimecast. DMARC: With correct SPF and DKIM setup, Mimecast ensures DMARC alignment, maintaining your domain’s sending reputation. Please refer to the steps in this detailed article to set up SPF and DKIM for Mimecast. 2. API Integration (Complementary to Gateway) Mimecast’s APIs complement the main gateway by providing automation, reporting, and management tools rather than handling live outbound mail flow. They allow you to manage policies, export logs, search archived emails, and sync users. APIs enhance visibility and operational tasks but do not provide real-time filtering or blocking of outbound messages. Since APIs don’t process live mail, they have no direct effect on SPF, DKIM, or DMARC; those depend on your gateway (smart host) setup. Barracuda – Outbound Handling and Integration Methods Outbound Logic Barracuda analyzes outbound emails to prevent data loss (DLP), block malware, stop phishing/impersonation attempts from compromised internal accounts, and ensure compliance. Barracuda offers flexible deployment options, including both traditional gateway (MX record) and API-based integrations. While both contribute to outbound security, their roles are distinct. Integration Methods 1. Gateway Integration (MX Record / Smart Host) — Primary Inline Security How it works: All outbound emails pass through Barracuda’s security stack for real-time inspection, threat blocking, and policy enforcement before delivery. Protection level: Comprehensive DLP (blocking, encrypting, or quarantining sensitive content) Outbound spam and virus filtering Enforcement of compliance and content policies This approach offers a high level of control and immediate threat mitigation on outbound mail flow. SPF/DKIM/DMARC impact: SPF: Update SPF records to include Barracuda’s sending IPs or SPF include mechanism. DKIM: Currently, no explicit setup is needed; DKIM of the main sending source is preserved. Refer to this article for more comprehensive guidance on Barracuda SEG configuration. 2. API Integration (Complementary & Advanced Threat Focus) How it works: The API accesses cloud email environments to analyze historical and real-time data, learning normal communication patterns to detect anomalies in outbound emails. It also supports post-delivery remediation, enabling the removal of malicious emails from internal mailboxes after sending. Protection level: Advanced AI-driven detection and near real-time blocking of outbound threats, plus strong post-delivery cleanup capabilities. SPF/DKIM/DMARC impact: Since mail is sent directly by the original mail server (e.g., Microsoft 365), SPF and DKIM signatures remain intact, preserving DMARC alignment and domain reputation. Cisco Secure Email (formerly IronPort) – Outbound Handling and Integration Methods Outbound Logic Cisco Secure Email protects outbound email by preventing data loss (DLP), blocking spam and malware from internal accounts, stopping business email compromise (BEC) and impersonation attacks, and ensuring compliance. Cisco provides both traditional gateway appliances/cloud gateways and modern API-based solutions for layered outbound security. Integration Methods 1. Gateway Integration (MX Record / Smart Host) – Cisco Secure Email Gateway (ESA) How it works: Organizations update MX records to route mail through the Cisco Secure Email Gateway or configure their mail server (e.g., Microsoft 365, Exchange) to smart host outbound email via the gateway. All outbound mail is inspected and policies enforced before delivery. Protection level: Granular DLP (blocking, encrypting, quarantining sensitive content) Outbound spam and malware filtering to protect IP reputation Email encryption for sensitive outbound messages Comprehensive content and attachment policy enforcement SPF: Check this article for comprehensive guidance on Cisco SPF settings. DKIM: Refer to this article for detailed guidance on Cisco DKIM settings. 2. API Integration – Cisco Secure Email Threat Defense How it works: Integrates directly via API with Microsoft 365 (and potentially Google Workspace), continuously monitoring email metadata, content, and user behavior across inbound, outbound, and internal messages. Leverages Cisco’s threat intelligence and AI to detect anomalous outbound activity linked to BEC, account takeover, and phishing. Post-Delivery Remediation: Automates the removal or quarantine of malicious or policy-violating emails from mailboxes even after sending. Protection level: Advanced, AI-driven detection of sophisticated outbound threats with real-time monitoring and automated remediation. Complements gateway filtering by adding cloud-native visibility and swift post-send action. SPF/DKIM/DMARC impact: Since emails are sent directly by the original mail server, SPF and DKIM signatures remain intact, preserving DMARC alignment and domain reputation. If you have any questions or need assistance, feel free to reach out to EasyDMARC technical support.

398

Παρακαλούμε συνδέσου στην Κοινότητά μας για να δηλώσεις τι σου αρέσει, να σχολιάσεις και να μοιραστείς με τους φίλους σου!
Microsoft Academic μοιράστηκε ένα σύνδεσμο

2025-06-06 07:52:50 ·

BenchmarkQED: Automated benchmarking of RAG systems

One of the key use cases for generative AI involves answering questions over private datasets, with retrieval-augmented generation as the go-to framework. As new RAG techniques emerge, there’s a growing need to benchmark their performance across diverse datasets and metrics.
To meet this need, we’re introducing BenchmarkQED, a new suite of tools that automates RAG benchmarking at scale, available on GitHub. It includes components for query generation, evaluation, and dataset preparation, each designed to support rigorous, reproducible testing.
BenchmarkQED complements the RAG methods in our open-source GraphRAG library, enabling users to run a GraphRAG-style evaluation across models, metrics, and datasets. GraphRAG uses a large language model to generate and summarize entity-based knowledge graphs, producing more comprehensive and diverse answers than standard RAG for large-scale tasks.
In this post, we walk through the core components of BenchmarkQED that contribute to the overall benchmarking process. We also share some of the latest benchmark results comparing our LazyGraphRAG system to competing methods, including a vector-based RAG with a 1M-token context window, where the leading LazyGraphRAG configuration showed significant win rates across all combinations of quality metrics and query classes.
In the paper, we distinguish between local queries, where answers are found in a small number of text regions, and sometimes even a single region, and global queries, which require reasoning over large portions of or even the entire dataset.
Conventional vector-based RAG excels at local queries because the regions containing the answer to the query resemble the query itself and can be retrieved as the nearest neighbor in the vector space of text embeddings. However, it struggles with global questions, such as, “What are the main themes of the dataset?” which require understanding dataset qualities not explicitly stated in the text.
AutoQ: Automated query synthesis
This limitation motivated the development of GraphRAG a system designed to answer global queries. GraphRAG’s evaluation requirements subsequently led to the creation of AutoQ, a method for synthesizing these global queries for any dataset.
AutoQ extends this approach by generating synthetic queries across the spectrum of queries, from local to global. It defines four distinct classes based on the source and scope of the queryforming a logical progression along the spectrum.
Figure 1. Construction of a 2×2 design space for synthetic query generation with AutoQ, showing how the four resulting query classes map onto the local-global query spectrum.
AutoQ can be configured to generate any number and distribution of synthetic queries along these classes, enabling consistent benchmarking across datasets without requiring user customization. Figure 2 shows the synthesis process and sample queries from each class, using an AP News dataset.
Figure 2. Synthesis process and example query for each of the four AutoQ query classes.

About Microsoft Research
Advancing science and technology to benefit humanity

View our story

Opens in a new tab
AutoE: Automated evaluation framework
Our evaluation of GraphRAG focused on analyzing key qualities of answers to global questions. The following qualities were used for the current evaluation:

Comprehensiveness: Does the answer address all relevant aspects of the question?
Diversity: Does it present varied perspectives or insights?
Empowerment: Does it help the reader understand and make informed judgments?
Relevance: Does it address what the question is specifically asking?

The AutoE component scales evaluation of these qualities using the LLM-as-a-Judge method. It presents pairs of answers to an LLM, along with the query and target metric, in counterbalanced order. The model determines whether the first answer wins, loses, or ties with the second. Over a set of queries, whether from AutoQ or elsewhere, this produces win rates between competing methods. When ground truth is available, AutoE can also score answers on correctness, completeness, and related metrics.
An illustrative evaluation is shown in Figure 3. Using a dataset of 1,397 AP News articles on health and healthcare, AutoQ generated 50 queries per class . AutoE then compared LazyGraphRAG to a competing RAG method, running six trials per query across four metrics, using GPT-4.1 as a judge.
These trial-level results were aggregated using metric-based win rates, where each trial is scored 1 for a win, 0.5 for a tie, and 0 for a loss, and then averaged to calculate the overall win rate for each RAG method.
Figure 3. Win rates of four LazyGraphRAG configurations across methods, broken down by the AutoQ query class and averaged across AutoE’s four metrics: comprehensiveness, diversity, empowerment, and relevance. LazyGraphRAG outperforms comparison conditions where the bar is above 50%.
The four LazyGraphRAG conditionsdiffer by query budgetand chunk size. All used GPT-4o mini for relevance tests and GPT-4o for query expansionand answer generation, except for LGR_b200_c200_mini, which used GPT-4o mini throughout.
Comparison systems were GraphRAG , Vector RAG with 8k- and 120k-token windows, and three published methods: LightRAG, RAPTOR, and TREX. All methods were limited to the same 8k tokens for answer generation. GraphRAG Global Search used level 2 of the community hierarchy.
LazyGraphRAG outperformed every comparison condition using the same generative model, winning all 96 comparisons, with all but one reaching statistical significance. The best overall performance came from the larger budget, smaller chunk size configuration. For DataLocal queries, the smaller budgetperformed slightly better, likely because fewer chunks were relevant. For ActivityLocal queries, the larger chunk sizehad a slight edge, likely because longer chunks provide a more coherent context.
Competing methods performed relatively better on the query classes for which they were designed: GraphRAG Global for global queries, Vector RAG for local queries, and GraphRAG Drift Search, which combines both strategies, posed the strongest challenge overall.
Increasing Vector RAG’s context window from 8k to 120k tokens did not improve its performance compared to LazyGraphRAG. This raised the question of how LazyGraphRAG would perform against Vector RAG with 1-million token context window containing most of the dataset.
Figure 4 shows the follow-up experiment comparing LazyGraphRAG to Vector RAG using GPT-4.1 that enabled this comparison. Even against the 1M-token window, LazyGraphRAG achieved higher win rates across all comparisons, failing to reach significance only for the relevance of answers to DataLocal queries. These queries tend to benefit most from Vector RAG’s ranking of directly relevant chunks, making it hard for LazyGraphRAG to generate answers that have greater relevance to the query, even though these answers may be dramatically more comprehensive, diverse, and empowering overall.
Figure 4. Win rates of LazyGraphRAG  over Vector RAG across different context window sizes, broken down by the four AutoQ query classes and four AutoE metrics: comprehensiveness, diversity, empowerment, and relevance. Bars above 50% indicate that LazyGraphRAG outperformed the comparison condition.
AutoD: Automated data sampling and summarization
Text datasets have an underlying topical structure, but the depth, breadth, and connectivity of that structure can vary widely. This variability makes it difficult to evaluate RAG systems consistently, as results may reflect the idiosyncrasies of the dataset rather than the system’s general capabilities.
The AutoD component addresses this by sampling datasets to meet a target specification, defined by the number of topic clustersand the number of samples per cluster. This creates consistency across datasets, enabling more meaningful comparisons, as structurally aligned datasets lead to comparable AutoQ queries, which in turn support consistent AutoE evaluations.
AutoD also includes tools for summarizing input or output datasets in a way that reflects their topical coverage. These summaries play an important role in the AutoQ query synthesis process, but they can also be used more broadly, such as in prompts where context space is limited.
Since the release of the GraphRAG paper, we’ve received many requests to share the dataset of the Behind the Tech podcast transcripts we used in our evaluation. An updated version of this dataset is now available in the BenchmarkQED repository, alongside the AP News dataset containing 1,397 health-related articles, licensed for open release.
We hope these datasets, together with the BenchmarkQED tools, help accelerate benchmark-driven development of RAG systems and AI question-answering. We invite the community to try them on GitHub.
Opens in a new tab
#benchmarkqedautomatedbenchmarking #ofrag #systems

BenchmarkQED: Automated benchmarking of RAG systems
One of the key use cases for generative AI involves answering questions over private datasets, with retrieval-augmented generation as the go-to framework. As new RAG techniques emerge, there’s a growing need to benchmark their performance across diverse datasets and metrics. To meet this need, we’re introducing BenchmarkQED, a new suite of tools that automates RAG benchmarking at scale, available on GitHub. It includes components for query generation, evaluation, and dataset preparation, each designed to support rigorous, reproducible testing.   BenchmarkQED complements the RAG methods in our open-source GraphRAG library, enabling users to run a GraphRAG-style evaluation across models, metrics, and datasets. GraphRAG uses a large language model to generate and summarize entity-based knowledge graphs, producing more comprehensive and diverse answers than standard RAG for large-scale tasks. In this post, we walk through the core components of BenchmarkQED that contribute to the overall benchmarking process. We also share some of the latest benchmark results comparing our LazyGraphRAG system to competing methods, including a vector-based RAG with a 1M-token context window, where the leading LazyGraphRAG configuration showed significant win rates across all combinations of quality metrics and query classes. In the paper, we distinguish between local queries, where answers are found in a small number of text regions, and sometimes even a single region, and global queries, which require reasoning over large portions of or even the entire dataset. Conventional vector-based RAG excels at local queries because the regions containing the answer to the query resemble the query itself and can be retrieved as the nearest neighbor in the vector space of text embeddings. However, it struggles with global questions, such as, “What are the main themes of the dataset?” which require understanding dataset qualities not explicitly stated in the text.   AutoQ: Automated query synthesis This limitation motivated the development of GraphRAG a system designed to answer global queries. GraphRAG’s evaluation requirements subsequently led to the creation of AutoQ, a method for synthesizing these global queries for any dataset. AutoQ extends this approach by generating synthetic queries across the spectrum of queries, from local to global. It defines four distinct classes based on the source and scope of the queryforming a logical progression along the spectrum. Figure 1. Construction of a 2×2 design space for synthetic query generation with AutoQ, showing how the four resulting query classes map onto the local-global query spectrum. AutoQ can be configured to generate any number and distribution of synthetic queries along these classes, enabling consistent benchmarking across datasets without requiring user customization. Figure 2 shows the synthesis process and sample queries from each class, using an AP News dataset. Figure 2. Synthesis process and example query for each of the four AutoQ query classes. About Microsoft Research Advancing science and technology to benefit humanity View our story Opens in a new tab AutoE: Automated evaluation framework Our evaluation of GraphRAG focused on analyzing key qualities of answers to global questions. The following qualities were used for the current evaluation: Comprehensiveness: Does the answer address all relevant aspects of the question? Diversity: Does it present varied perspectives or insights? Empowerment: Does it help the reader understand and make informed judgments? Relevance: Does it address what the question is specifically asking?   The AutoE component scales evaluation of these qualities using the LLM-as-a-Judge method. It presents pairs of answers to an LLM, along with the query and target metric, in counterbalanced order. The model determines whether the first answer wins, loses, or ties with the second. Over a set of queries, whether from AutoQ or elsewhere, this produces win rates between competing methods. When ground truth is available, AutoE can also score answers on correctness, completeness, and related metrics. An illustrative evaluation is shown in Figure 3. Using a dataset of 1,397 AP News articles on health and healthcare, AutoQ generated 50 queries per class . AutoE then compared LazyGraphRAG to a competing RAG method, running six trials per query across four metrics, using GPT-4.1 as a judge. These trial-level results were aggregated using metric-based win rates, where each trial is scored 1 for a win, 0.5 for a tie, and 0 for a loss, and then averaged to calculate the overall win rate for each RAG method. Figure 3. Win rates of four LazyGraphRAG configurations across methods, broken down by the AutoQ query class and averaged across AutoE’s four metrics: comprehensiveness, diversity, empowerment, and relevance. LazyGraphRAG outperforms comparison conditions where the bar is above 50%. The four LazyGraphRAG conditionsdiffer by query budgetand chunk size. All used GPT-4o mini for relevance tests and GPT-4o for query expansionand answer generation, except for LGR_b200_c200_mini, which used GPT-4o mini throughout. Comparison systems were GraphRAG , Vector RAG with 8k- and 120k-token windows, and three published methods: LightRAG, RAPTOR, and TREX. All methods were limited to the same 8k tokens for answer generation. GraphRAG Global Search used level 2 of the community hierarchy. LazyGraphRAG outperformed every comparison condition using the same generative model, winning all 96 comparisons, with all but one reaching statistical significance. The best overall performance came from the larger budget, smaller chunk size configuration. For DataLocal queries, the smaller budgetperformed slightly better, likely because fewer chunks were relevant. For ActivityLocal queries, the larger chunk sizehad a slight edge, likely because longer chunks provide a more coherent context. Competing methods performed relatively better on the query classes for which they were designed: GraphRAG Global for global queries, Vector RAG for local queries, and GraphRAG Drift Search, which combines both strategies, posed the strongest challenge overall. Increasing Vector RAG’s context window from 8k to 120k tokens did not improve its performance compared to LazyGraphRAG. This raised the question of how LazyGraphRAG would perform against Vector RAG with 1-million token context window containing most of the dataset. Figure 4 shows the follow-up experiment comparing LazyGraphRAG to Vector RAG using GPT-4.1 that enabled this comparison. Even against the 1M-token window, LazyGraphRAG achieved higher win rates across all comparisons, failing to reach significance only for the relevance of answers to DataLocal queries. These queries tend to benefit most from Vector RAG’s ranking of directly relevant chunks, making it hard for LazyGraphRAG to generate answers that have greater relevance to the query, even though these answers may be dramatically more comprehensive, diverse, and empowering overall. Figure 4. Win rates of LazyGraphRAG  over Vector RAG across different context window sizes, broken down by the four AutoQ query classes and four AutoE metrics: comprehensiveness, diversity, empowerment, and relevance. Bars above 50% indicate that LazyGraphRAG outperformed the comparison condition. AutoD: Automated data sampling and summarization Text datasets have an underlying topical structure, but the depth, breadth, and connectivity of that structure can vary widely. This variability makes it difficult to evaluate RAG systems consistently, as results may reflect the idiosyncrasies of the dataset rather than the system’s general capabilities. The AutoD component addresses this by sampling datasets to meet a target specification, defined by the number of topic clustersand the number of samples per cluster. This creates consistency across datasets, enabling more meaningful comparisons, as structurally aligned datasets lead to comparable AutoQ queries, which in turn support consistent AutoE evaluations. AutoD also includes tools for summarizing input or output datasets in a way that reflects their topical coverage. These summaries play an important role in the AutoQ query synthesis process, but they can also be used more broadly, such as in prompts where context space is limited. Since the release of the GraphRAG paper, we’ve received many requests to share the dataset of the Behind the Tech podcast transcripts we used in our evaluation. An updated version of this dataset is now available in the BenchmarkQED repository, alongside the AP News dataset containing 1,397 health-related articles, licensed for open release.   We hope these datasets, together with the BenchmarkQED tools, help accelerate benchmark-driven development of RAG systems and AI question-answering. We invite the community to try them on GitHub. Opens in a new tab #benchmarkqedautomatedbenchmarking #ofrag #systems

WWW.MICROSOFT.COM

BenchmarkQED: Automated benchmarking of RAG systems

One of the key use cases for generative AI involves answering questions over private datasets, with retrieval-augmented generation (RAG) as the go-to framework. As new RAG techniques emerge, there’s a growing need to benchmark their performance across diverse datasets and metrics. To meet this need, we’re introducing BenchmarkQED, a new suite of tools that automates RAG benchmarking at scale, available on GitHub (opens in new tab). It includes components for query generation, evaluation, and dataset preparation, each designed to support rigorous, reproducible testing.   BenchmarkQED complements the RAG methods in our open-source GraphRAG library, enabling users to run a GraphRAG-style evaluation across models, metrics, and datasets. GraphRAG uses a large language model (LLM) to generate and summarize entity-based knowledge graphs, producing more comprehensive and diverse answers than standard RAG for large-scale tasks. In this post, we walk through the core components of BenchmarkQED that contribute to the overall benchmarking process. We also share some of the latest benchmark results comparing our LazyGraphRAG system to competing methods, including a vector-based RAG with a 1M-token context window, where the leading LazyGraphRAG configuration showed significant win rates across all combinations of quality metrics and query classes. In the paper, we distinguish between local queries, where answers are found in a small number of text regions, and sometimes even a single region, and global queries, which require reasoning over large portions of or even the entire dataset. Conventional vector-based RAG excels at local queries because the regions containing the answer to the query resemble the query itself and can be retrieved as the nearest neighbor in the vector space of text embeddings. However, it struggles with global questions, such as, “What are the main themes of the dataset?” which require understanding dataset qualities not explicitly stated in the text.   AutoQ: Automated query synthesis This limitation motivated the development of GraphRAG a system designed to answer global queries. GraphRAG’s evaluation requirements subsequently led to the creation of AutoQ, a method for synthesizing these global queries for any dataset. AutoQ extends this approach by generating synthetic queries across the spectrum of queries, from local to global. It defines four distinct classes based on the source and scope of the query (Figure 1, top) forming a logical progression along the spectrum (Figure 1, bottom). Figure 1. Construction of a 2×2 design space for synthetic query generation with AutoQ, showing how the four resulting query classes map onto the local-global query spectrum. AutoQ can be configured to generate any number and distribution of synthetic queries along these classes, enabling consistent benchmarking across datasets without requiring user customization. Figure 2 shows the synthesis process and sample queries from each class, using an AP News dataset. Figure 2. Synthesis process and example query for each of the four AutoQ query classes. About Microsoft Research Advancing science and technology to benefit humanity View our story Opens in a new tab AutoE: Automated evaluation framework Our evaluation of GraphRAG focused on analyzing key qualities of answers to global questions. The following qualities were used for the current evaluation: Comprehensiveness: Does the answer address all relevant aspects of the question? Diversity: Does it present varied perspectives or insights? Empowerment: Does it help the reader understand and make informed judgments? Relevance: Does it address what the question is specifically asking?   The AutoE component scales evaluation of these qualities using the LLM-as-a-Judge method. It presents pairs of answers to an LLM, along with the query and target metric, in counterbalanced order. The model determines whether the first answer wins, loses, or ties with the second. Over a set of queries, whether from AutoQ or elsewhere, this produces win rates between competing methods. When ground truth is available, AutoE can also score answers on correctness, completeness, and related metrics. An illustrative evaluation is shown in Figure 3. Using a dataset of 1,397 AP News articles on health and healthcare, AutoQ generated 50 queries per class (200 total). AutoE then compared LazyGraphRAG to a competing RAG method, running six trials per query across four metrics, using GPT-4.1 as a judge. These trial-level results were aggregated using metric-based win rates, where each trial is scored 1 for a win, 0.5 for a tie, and 0 for a loss, and then averaged to calculate the overall win rate for each RAG method. Figure 3. Win rates of four LazyGraphRAG (LGR) configurations across methods, broken down by the AutoQ query class and averaged across AutoE’s four metrics: comprehensiveness, diversity, empowerment, and relevance. LazyGraphRAG outperforms comparison conditions where the bar is above 50%. The four LazyGraphRAG conditions (LGR_b200_c200, LGR_b50_c200, LGR_b50_c600, LGR_b200_c200_mini) differ by query budget (b50, b200) and chunk size (c200, c600). All used GPT-4o mini for relevance tests and GPT-4o for query expansion (to five subqueries) and answer generation, except for LGR_b200_c200_mini, which used GPT-4o mini throughout. Comparison systems were GraphRAG (Local, Global, and Drift Search), Vector RAG with 8k- and 120k-token windows, and three published methods: LightRAG (opens in new tab), RAPTOR (opens in new tab), and TREX (opens in new tab). All methods were limited to the same 8k tokens for answer generation. GraphRAG Global Search used level 2 of the community hierarchy. LazyGraphRAG outperformed every comparison condition using the same generative model (GPT-4o), winning all 96 comparisons, with all but one reaching statistical significance. The best overall performance came from the larger budget, smaller chunk size configuration (LGR_b200_c200). For DataLocal queries, the smaller budget (LGR_b50_c200) performed slightly better, likely because fewer chunks were relevant. For ActivityLocal queries, the larger chunk size (LGR_b50_c600) had a slight edge, likely because longer chunks provide a more coherent context. Competing methods performed relatively better on the query classes for which they were designed: GraphRAG Global for global queries, Vector RAG for local queries, and GraphRAG Drift Search, which combines both strategies, posed the strongest challenge overall. Increasing Vector RAG’s context window from 8k to 120k tokens did not improve its performance compared to LazyGraphRAG. This raised the question of how LazyGraphRAG would perform against Vector RAG with 1-million token context window containing most of the dataset. Figure 4 shows the follow-up experiment comparing LazyGraphRAG to Vector RAG using GPT-4.1 that enabled this comparison. Even against the 1M-token window, LazyGraphRAG achieved higher win rates across all comparisons, failing to reach significance only for the relevance of answers to DataLocal queries. These queries tend to benefit most from Vector RAG’s ranking of directly relevant chunks, making it hard for LazyGraphRAG to generate answers that have greater relevance to the query, even though these answers may be dramatically more comprehensive, diverse, and empowering overall. Figure 4. Win rates of LazyGraphRAG (LGR) over Vector RAG across different context window sizes, broken down by the four AutoQ query classes and four AutoE metrics: comprehensiveness, diversity, empowerment, and relevance. Bars above 50% indicate that LazyGraphRAG outperformed the comparison condition. AutoD: Automated data sampling and summarization Text datasets have an underlying topical structure, but the depth, breadth, and connectivity of that structure can vary widely. This variability makes it difficult to evaluate RAG systems consistently, as results may reflect the idiosyncrasies of the dataset rather than the system’s general capabilities. The AutoD component addresses this by sampling datasets to meet a target specification, defined by the number of topic clusters (breadth) and the number of samples per cluster (depth). This creates consistency across datasets, enabling more meaningful comparisons, as structurally aligned datasets lead to comparable AutoQ queries, which in turn support consistent AutoE evaluations. AutoD also includes tools for summarizing input or output datasets in a way that reflects their topical coverage. These summaries play an important role in the AutoQ query synthesis process, but they can also be used more broadly, such as in prompts where context space is limited. Since the release of the GraphRAG paper, we’ve received many requests to share the dataset of the Behind the Tech (opens in new tab) podcast transcripts we used in our evaluation. An updated version of this dataset is now available in the BenchmarkQED repository (opens in new tab), alongside the AP News dataset containing 1,397 health-related articles, licensed for open release.   We hope these datasets, together with the BenchmarkQED tools (opens in new tab), help accelerate benchmark-driven development of RAG systems and AI question-answering. We invite the community to try them on GitHub (opens in new tab). Opens in a new tab

487

Παρακαλούμε συνδέσου στην Κοινότητά μας για να δηλώσεις τι σου αρέσει, να σχολιάσεις και να μοιραστείς με τους φίλους σου!
fastcompany μοιράστηκε ένα σύνδεσμο

2025-06-06 07:12:24 ·

We can reshore American manufacturing

In my last Fast Company column, I shared my reasons for manufacturing my electric trucks in the U.S. I’m not alone. While near-shoring to North America has been underway for several years, the current tariff shifts and shipping complexities make U.S. manufacturing a higher priority still.

However, there were 292,825 factories in the U.S. as of 2021. Of those, 846 employ 1,000 people or more. Some of these are my engineering firm’s clients, giving us a front row seat to the complexity of retrofitting an existing factory to full U.S. manufacturing. While building a new factory is expensive and lengthy, these companies’ tasks are more difficult still.

There are good reasons for making the shift as quickly as possible. Moving to most or fully U.S. manufacturing brings higher visibility, faster response time, and higher resilience to supply chain disruption, as well as greater protection from tariff shifts and geopolitical change.

But if you’re early in the process, here’s my advice for your transition:

Determine a priority ranking for the refining and raw materials you shift to in-country and North American sourcing. Give highest ranking to categories including defense, high value items, and consumer safety items.

Be more strategic in the offshore suppliers you continue using for non-advanced manufacturing by prioritizing closer and more geographic-friendly locations for production and shipment such as Mexico and Argentina.

Utilize government-backed capital, where possible, for extracting/mining minerals and metals such as lithium, red mud, magnesium, etc.

Beyond the high-ranking product categories, move to domestic suppliers for primary materials such as steel, aluminum, cement, and plastics. Likewise, reduce offshoring of technical staff as well as raw materials, where possible.

Use all means possible to become power independent through solar production, micro-grids, and nuclear power production.

Consider creating a 4-year completion bonus for military vets. Hire vets wherever possible, as they make great workers and entrepreneurs.

Likewise, we can press for future policy changes that best support Made in America manufacturing, as follows:

Encourage ship building in the U.S., as well as creating new means of automated freight transit.

Work towards transformation plans for government-funded R&D to include more attractive loans, rebates, and grants, as well as programs for tax-free status for intellectual property during commercialization, to incent and support organizations making the shift.

Consider energy rebates to U.S. manufacturers and distributors to make American manufacturing more cost-effective and viable.

Create policies to include the cost of offshore staff in tariff calculations. Expand trade relationships with Caribbean nations for products such as sugar, avocados, bananas, etc.

Avoid or even ban foreign ownership of the food supply chain.

Create fair competition for government contracting.

Make health supplements and homeopathic medicines tax deductible, to promote a healthy workforce.

While it may not be readily evident, these policy changes are related to successful reshoring. In all, we need larger scale, lower costs, and more automated and simplified mechanisms for product manufacturing. These issues, in my experience, are as equally important as the raw materials we require. We need increased support for niche manufacturing. In my opinion, we also need deregulation, and increased access to land.

I believe we need better education, self-reliance, health, and incentive structures to get the capital, entrepreneurs, and workers for Made in America manufacturing. Who’s with me?

Matthew Chang is the founding partner of Chang Robotics.
#can #reshore #american #manufacturing

We can reshore American manufacturing
In my last Fast Company column, I shared my reasons for manufacturing my electric trucks in the U.S. I’m not alone. While near-shoring to North America has been underway for several years, the current tariff shifts and shipping complexities make U.S. manufacturing a higher priority still. However, there were 292,825 factories in the U.S. as of 2021. Of those, 846 employ 1,000 people or more. Some of these are my engineering firm’s clients, giving us a front row seat to the complexity of retrofitting an existing factory to full U.S. manufacturing. While building a new factory is expensive and lengthy, these companies’ tasks are more difficult still. There are good reasons for making the shift as quickly as possible. Moving to most or fully U.S. manufacturing brings higher visibility, faster response time, and higher resilience to supply chain disruption, as well as greater protection from tariff shifts and geopolitical change. But if you’re early in the process, here’s my advice for your transition: Determine a priority ranking for the refining and raw materials you shift to in-country and North American sourcing. Give highest ranking to categories including defense, high value items, and consumer safety items. Be more strategic in the offshore suppliers you continue using for non-advanced manufacturing by prioritizing closer and more geographic-friendly locations for production and shipment such as Mexico and Argentina. Utilize government-backed capital, where possible, for extracting/mining minerals and metals such as lithium, red mud, magnesium, etc. Beyond the high-ranking product categories, move to domestic suppliers for primary materials such as steel, aluminum, cement, and plastics. Likewise, reduce offshoring of technical staff as well as raw materials, where possible. Use all means possible to become power independent through solar production, micro-grids, and nuclear power production. Consider creating a 4-year completion bonus for military vets. Hire vets wherever possible, as they make great workers and entrepreneurs. Likewise, we can press for future policy changes that best support Made in America manufacturing, as follows: Encourage ship building in the U.S., as well as creating new means of automated freight transit. Work towards transformation plans for government-funded R&D to include more attractive loans, rebates, and grants, as well as programs for tax-free status for intellectual property during commercialization, to incent and support organizations making the shift. Consider energy rebates to U.S. manufacturers and distributors to make American manufacturing more cost-effective and viable. Create policies to include the cost of offshore staff in tariff calculations. Expand trade relationships with Caribbean nations for products such as sugar, avocados, bananas, etc. Avoid or even ban foreign ownership of the food supply chain. Create fair competition for government contracting. Make health supplements and homeopathic medicines tax deductible, to promote a healthy workforce. While it may not be readily evident, these policy changes are related to successful reshoring. In all, we need larger scale, lower costs, and more automated and simplified mechanisms for product manufacturing. These issues, in my experience, are as equally important as the raw materials we require. We need increased support for niche manufacturing. In my opinion, we also need deregulation, and increased access to land. I believe we need better education, self-reliance, health, and incentive structures to get the capital, entrepreneurs, and workers for Made in America manufacturing. Who’s with me? Matthew Chang is the founding partner of Chang Robotics. #can #reshore #american #manufacturing

WWW.FASTCOMPANY.COM

We can reshore American manufacturing

In my last Fast Company column, I shared my reasons for manufacturing my electric trucks in the U.S. I’m not alone. While near-shoring to North America has been underway for several years, the current tariff shifts and shipping complexities make U.S. manufacturing a higher priority still. However, there were 292,825 factories in the U.S. as of 2021. Of those, 846 employ 1,000 people or more. Some of these are my engineering firm’s clients, giving us a front row seat to the complexity of retrofitting an existing factory to full U.S. manufacturing. While building a new factory is expensive and lengthy, these companies’ tasks are more difficult still. There are good reasons for making the shift as quickly as possible. Moving to most or fully U.S. manufacturing brings higher visibility, faster response time, and higher resilience to supply chain disruption, as well as greater protection from tariff shifts and geopolitical change. But if you’re early in the process, here’s my advice for your transition: Determine a priority ranking for the refining and raw materials you shift to in-country and North American sourcing. Give highest ranking to categories including defense, high value items (such as steel, aluminum, and rare minerals, etc.), and consumer safety items (such as pharmaceutical components, etc.). Be more strategic in the offshore suppliers you continue using for non-advanced manufacturing by prioritizing closer and more geographic-friendly locations for production and shipment such as Mexico and Argentina. Utilize government-backed capital, where possible, for extracting/mining minerals and metals such as lithium, red mud, magnesium, etc. Beyond the high-ranking product categories, move to domestic suppliers for primary materials such as steel, aluminum, cement, and plastics. Likewise, reduce offshoring of technical staff as well as raw materials, where possible. Use all means possible to become power independent through solar production, micro-grids, and nuclear power production. Consider creating a 4-year completion bonus for military vets. Hire vets wherever possible, as they make great workers and entrepreneurs. Likewise, we can press for future policy changes that best support Made in America manufacturing, as follows: Encourage ship building in the U.S., as well as creating new means of automated freight transit. Work towards transformation plans for government-funded R&D to include more attractive loans, rebates, and grants, as well as programs for tax-free status for intellectual property during commercialization, to incent and support organizations making the shift. Consider energy rebates to U.S. manufacturers and distributors to make American manufacturing more cost-effective and viable. Create policies to include the cost of offshore staff in tariff calculations. Expand trade relationships with Caribbean nations for products such as sugar, avocados, bananas, etc. Avoid or even ban foreign ownership of the food supply chain. Create fair competition for government contracting. Make health supplements and homeopathic medicines tax deductible, to promote a healthy workforce. While it may not be readily evident, these policy changes are related to successful reshoring. In all, we need larger scale, lower costs, and more automated and simplified mechanisms for product manufacturing. These issues, in my experience, are as equally important as the raw materials we require. We need increased support for niche manufacturing. In my opinion, we also need deregulation, and increased access to land (particularly in the west; the federal government owns great quantities of the available land, which is choking available supply). I believe we need better education, self-reliance, health, and incentive structures to get the capital, entrepreneurs, and workers for Made in America manufacturing. Who’s with me? Matthew Chang is the founding partner of Chang Robotics.

358

Παρακαλούμε συνδέσου στην Κοινότητά μας για να δηλώσεις τι σου αρέσει, να σχολιάσεις και να μοιραστείς με τους φίλους σου!
David Andrew μοιράστηκε ένα σύνδεσμο

2025-06-05 14:29:38 ·

After switching off my iPhone 16's AI camera button, I've rediscovered the joy of capturing moments without tech interference. It’s liberating to take photos at my own pace, free from automated suggestions that often miss the mark. Instead of a perfectly polished image, I’m embracing the raw, authentic snapshots that tell a story. Have you ever felt overwhelmed by tech that’s meant to simplify your life? I’d love to hear your experiences with finding balance between technology and authenticity! #iPhone16 #Photography #TechBalance #AI #Authenticity

After switching off my iPhone 16's AI camera button, I've rediscovered the joy of capturing moments without tech interference. It’s liberating to take photos at my own pace, free from automated suggestions that often miss the mark. Instead of a perfectly polished image, I’m embracing the raw, authentic snapshots that tell a story. Have you ever felt overwhelmed by tech that’s meant to simplify your life? I’d love to hear your experiences with finding balance between technology and authenticity! #iPhone16 #Photography #TechBalance #AI #Authenticity

WWW.CNET.COM

I Turned Off My iPhone 16's AI Camera Button. Life Has Never Been Better

Commentary: It doesn't matter if Apple drops more AI at WWDC next week. I'm never turning my camera control button back on, and you should join me.

569

Παρακαλούμε συνδέσου στην Κοινότητά μας για να δηλώσεις τι σου αρέσει, να σχολιάσεις και να μοιραστείς με τους φίλους σου!
Charles Michael μοιράστηκε ένα σύνδεσμο

2025-06-05 12:27:26 ·

As the AI landscape rapidly evolves, organizations like Principal Financial Group (PFG) are stepping up to the challenge of effective AI governance. With over 100 AI applications in their toolkit—from fraud detection to automated claims processing—PFG recognizes the urgent need for a robust governance strategy to address risks such as bias, compliance, and ethical considerations. Their development of the Ethical and Responsible AI (ERAI) framework illustrates a proactive approach, ensuring transparency and human oversight across all AI initiatives. This commitment not only safeguards their operations but also sets a precedent for other industries to follow. Imagine the transformative impact if similar frameworks were adopted across sectors like healthcare or education, where ethical AI could enhance decision-making while prioritizing patient and student rights. The future of AI governance is not just about technology—it's about responsibility. #AIGovernance #EthicalAI #Innovation #DataPrivacy #AIResponsibility

As the AI landscape rapidly evolves, organizations like Principal Financial Group (PFG) are stepping up to the challenge of effective AI governance. With over 100 AI applications in their toolkit—from fraud detection to automated claims processing—PFG recognizes the urgent need for a robust governance strategy to address risks such as bias, compliance, and ethical considerations. Their development of the Ethical and Responsible AI (ERAI) framework illustrates a proactive approach, ensuring transparency and human oversight across all AI initiatives. This commitment not only safeguards their operations but also sets a precedent for other industries to follow. Imagine the transformative impact if similar frameworks were adopted across sectors like healthcare or education, where ethical AI could enhance decision-making while prioritizing patient and student rights. The future of AI governance is not just about technology—it's about responsibility. #AIGovernance #EthicalAI #Innovation #DataPrivacy #AIResponsibility

WWW.CIO.COM

“솔루션도 기업도 아직은 초기” AI 거버넌스 플랫폼 시장 현황과 기업의 고려사항

프린시펄 파이낸셜 그룹(Principal Financial Group, PFG)은 지난 몇 년 동안 AI 활용이 급증하면서 이를 종합적으로 관리할 수 있는 AI 거버넌스 전략과 이를 실행할 도구가 절실해졌다. PFG의 부사장 겸 최고 데이터 및 분석 책임자인 라제시 아로라는 “현재 자연어 처리, 머신러닝, 생성형 AI 모델 등 100건 이상의 AI 사용례를 운영 중이며, 이를 통해 사기 탐지, 보험

408

Παρακαλούμε συνδέσου στην Κοινότητά μας για να δηλώσεις τι σου αρέσει, να σχολιάσεις και να μοιραστείς με τους φίλους σου!
Charles Paul μοιράστηκε ένα σύνδεσμο

2025-06-05 11:51:22 ·

Unlock the future of smart living with geofencing! Imagine your home automatically adjusting to your preferences as you approach or leave—lights dimming, thermostats adjusting, and security systems activating. It’s not just for tech enthusiasts; even one simple gadget can kickstart your smart home journey. I started with just a smart bulb, and it transformed my daily routine. Geofencing offers convenience and energy savings, making your life easier and more efficient. Whether you’re a newbie or a seasoned pro, exploring geofencing can elevate your smart home experience. Don’t wait—dive into the world of automated living! #SmartHome #Geofencing #HomeAutomation #TechSavvy #FutureLiving

Unlock the future of smart living with geofencing! Imagine your home automatically adjusting to your preferences as you approach or leave—lights dimming, thermostats adjusting, and security systems activating. It’s not just for tech enthusiasts; even one simple gadget can kickstart your smart home journey. I started with just a smart bulb, and it transformed my daily routine. Geofencing offers convenience and energy savings, making your life easier and more efficient. Whether you’re a newbie or a seasoned pro, exploring geofencing can elevate your smart home experience. Don’t wait—dive into the world of automated living! #SmartHome #Geofencing #HomeAutomation #TechSavvy #FutureLiving

WWW.CNET.COM

The Best Smart Home Gadgets Offer Geofencing. Here's What It Is and How to Use It

Many home apps mention geofencing: Here's my take on what you should know and how you can get started with only one gadget or your existing setup.

258

Παρακαλούμε συνδέσου στην Κοινότητά μας για να δηλώσεις τι σου αρέσει, να σχολιάσεις και να μοιραστείς με τους φίλους σου!
Andrew Michael μοιράστηκε ένα σύνδεσμο

2025-06-05 11:47:01 ·

Just when you thought lawn care couldn't get any smarter, Eufy’s new robot lawn mowers are stepping up the game by ditching traditional navigation tools and relying solely on advanced camera technology! This leap in innovation reminds me of how motion capture in film and gaming has transformed the way we interact with technology. Just as we use cameras to capture every nuance in performance, these mowers use them to navigate effortlessly across your yard. Imagine a future where your lawn is as perfectly manicured as your favorite animated character! The blend of self-driving car tech with everyday chores is not just fascinating—it's a glimpse into a more automated lifestyle. Can't wait to see how this tech evolves! #RobotLawnMower #SmartTech #InnovationInMotion #FutureOfGardening #EufyTech

Just when you thought lawn care couldn't get any smarter, Eufy’s new robot lawn mowers are stepping up the game by ditching traditional navigation tools and relying solely on advanced camera technology! This leap in innovation reminds me of how motion capture in film and gaming has transformed the way we interact with technology. Just as we use cameras to capture every nuance in performance, these mowers use them to navigate effortlessly across your yard. Imagine a future where your lawn is as perfectly manicured as your favorite animated character! The blend of self-driving car tech with everyday chores is not just fascinating—it's a glimpse into a more automated lifestyle. Can't wait to see how this tech evolves! #RobotLawnMower #SmartTech #InnovationInMotion #FutureOfGardening #EufyTech

WWW.TECHRADAR.COM

These new robot lawn mowers use self-driving car tech to navigate

Eufy's robot lawn mowers do away with awkward RTK receivers and rely entirely on cameras for navigation.

384

Παρακαλούμε συνδέσου στην Κοινότητά μας για να δηλώσεις τι σου αρέσει, να σχολιάσεις και να μοιραστείς με τους φίλους σου!
Just Total Tech μοιράστηκε ένα σύνδεσμο

2025-06-05 09:20:44 ·

Cloud Security Best Practices Protecting Business Data in a Multi-Cloud World

The cloud has changed everything. It’s faster, cheaper, and easier to scale than traditional infrastructure. Initially, most companies chose a single cloud provider. That’s no longer enough. Now, nearly 86% of businesses use more than one cloud.
This approach—called multi-cloud—lets teams choose the best features from each provider. But it also opens the door to new security risks. When apps, data, and tools are scattered across platforms, managing security gets harder. And in today's world of constant cyber threats, ignoring cloud security is not an option.
Let’s walk through real-world challenges and the best ways to protect business data in a multi-cloud environment.

1. Know What You’re Working With
Start with visibility. Make a full inventory of the cloud platforms, apps, and storage your business uses. Ask every department—marketing, finance, HR—what tools they’ve signed up for. Many use services without informing IT. This is shadow IT, and it’s risky.
Once you have the list, figure out what data lives where. Some workloads are low-risk. Others involve customer records, credit card data, or legal files. Prioritize those.

2. Build a Unified Security Strategy
One of the biggest mistakes companies make is treating each cloud provider as a separate system. Every provider has its own rules, tools, and settings. If your security strategy is broken up, gaps will appear.
Instead, aim for a single, connected approach. Use the same access rules, encryption standards, and monitoring tools across all clouds. You don’t want different policies on AWS and Azure—it just invites trouble.
Tools like centralized dashboards, SIEM, and SOARhelp you keep everything in one place.

3. Enforce Strict Access Controls
In a multi-cloud world, identity and access control are one of the hardest things to get right. Every platform has its own login system. Without proper integration, mistakes happen. Someone might get more access than they need, or never lose access when they leave the company.
Stick to these practices:

Use role-based access control.
Limit permissions to the bare minimum.
Turn on multi-factor authentication.
Link logins across platforms using identity federation.

The more consistent your access rules are, the easier it is to control who gets in and what they can do.

4. Use the Zero Trust Model
Zero Trust means never assume anything is safe. Every user, device, and app must prove itself—every time. Even if a user is on your network, don’t trust them by default.
This model reduces risk. It checks each request. It verifies users. And it looks for signs of abnormal behavior, like someone logging in from a new device or country.
Zero Trust works well with automation and real-time monitoring. It also forces teams to rethink how data is shared and accessed.

5. Encrypt Data—Always
Encryption is a basic but powerful layer of defense. It protects data whether it’s sitting in storage or moving between systems. If attackers get in, encrypted data is useless without the keys.
Most cloud platforms offer built-in encryption. But don’t rely only on that. You can manage your own keys with tools like AWS KMS or Azure Key Vault. That gives you more control.
To stay safe:

Encrypt both at rest and in transit.
Avoid default settings.
Rotate encryption keys regularly.

6. Monitor in Real Time
Security is not a one-time task. You need to watch your systems around the clock. Set alerts for things like large file downloads, unusual logins, or traffic spikes.
Centralized monitoring helps a lot. It pulls logs from all your platforms and tools into one place. That way, your security team isn’t flipping between dashboards when something goes wrong.
Also, use automation to filter out noise and surface real threats faster.

7. Set Up Regular Audits and Compliance Checks
Multi-cloud setups are great for flexibility, but complex when it comes to compliance. Each platform has its own set of controls and certifications. Managing them all can be overwhelming.
That’s why audits matter.
Run security checks on a regular schedule—monthly, quarterly, or after every major change. Look for misconfigured permissions, missing patches, or unsecured data. And document everything.
Also, make sure your tools help meet regulations like GDPR, HIPAA, or PCI DSS. Automated compliance scans can help stay on top of this.

8. Prevent Data Loss with Smart Policies
Sensitive data is always at risk. Employees might share it by mistake. Attackers might try to steal it. That’s where Data Loss Preventioncomes in.
DLP tools block unauthorized sharing of personal data, financial records, or internal files. You can create rules like “Don’t send customer SSNs over email” or “Block uploads of credit card data to personal drives.”
DLP also supports compliance and helps avoid lawsuits or fines when accidents happen.

9. Automate Where You Can
Manual work slows things down, and mistakes happen. That’s why automation is key in cloud security.
Automate things like:

Patch management
Access reviews
Backup schedules
Security alerts

Automation speeds up your response time. It also frees your security team to focus on serious issues, not routine tasks.

10. Centralized Security Control
One major downside of multi-cloud isa lack of visibility. If you’re jumping between different tools for each cloud, you miss things.
Instead, use a centralized security management system. It collects data from all clouds, shows risk levels, flags issues, and helps you fix them from one place.
This unified view makes a huge difference. It helps you react faster and stay ahead of threats.

Final Thought
Cloud providers have made data storage and computing easier than ever. But with great power comes risk. Using multiple clouds gives more choice, but also more responsibility.
Most businesses today are not ready. Only 15% have a mature multi-cloud security plan, says the 2023 Cisco Cyber Security Readiness Index. That means many are exposed.
The good news? You can fix this. Start with simple steps. Know what you use. Lock it down. Watch it closely. Keep improving. And above all, treat cloud security not as a technical box to check, but as something critical to your business.
Because in today’s world, a single breach can shut you down. And that’s too big a risk to ignore.
#cloud #security #best #practices #protecting

Cloud Security Best Practices Protecting Business Data in a Multi-Cloud World
The cloud has changed everything. It’s faster, cheaper, and easier to scale than traditional infrastructure. Initially, most companies chose a single cloud provider. That’s no longer enough. Now, nearly 86% of businesses use more than one cloud. This approach—called multi-cloud—lets teams choose the best features from each provider. But it also opens the door to new security risks. When apps, data, and tools are scattered across platforms, managing security gets harder. And in today's world of constant cyber threats, ignoring cloud security is not an option. Let’s walk through real-world challenges and the best ways to protect business data in a multi-cloud environment. 1. Know What You’re Working With Start with visibility. Make a full inventory of the cloud platforms, apps, and storage your business uses. Ask every department—marketing, finance, HR—what tools they’ve signed up for. Many use services without informing IT. This is shadow IT, and it’s risky. Once you have the list, figure out what data lives where. Some workloads are low-risk. Others involve customer records, credit card data, or legal files. Prioritize those. 2. Build a Unified Security Strategy One of the biggest mistakes companies make is treating each cloud provider as a separate system. Every provider has its own rules, tools, and settings. If your security strategy is broken up, gaps will appear. Instead, aim for a single, connected approach. Use the same access rules, encryption standards, and monitoring tools across all clouds. You don’t want different policies on AWS and Azure—it just invites trouble. Tools like centralized dashboards, SIEM, and SOARhelp you keep everything in one place. 3. Enforce Strict Access Controls In a multi-cloud world, identity and access control are one of the hardest things to get right. Every platform has its own login system. Without proper integration, mistakes happen. Someone might get more access than they need, or never lose access when they leave the company. Stick to these practices: Use role-based access control. Limit permissions to the bare minimum. Turn on multi-factor authentication. Link logins across platforms using identity federation. The more consistent your access rules are, the easier it is to control who gets in and what they can do. 4. Use the Zero Trust Model Zero Trust means never assume anything is safe. Every user, device, and app must prove itself—every time. Even if a user is on your network, don’t trust them by default. This model reduces risk. It checks each request. It verifies users. And it looks for signs of abnormal behavior, like someone logging in from a new device or country. Zero Trust works well with automation and real-time monitoring. It also forces teams to rethink how data is shared and accessed. 5. Encrypt Data—Always Encryption is a basic but powerful layer of defense. It protects data whether it’s sitting in storage or moving between systems. If attackers get in, encrypted data is useless without the keys. Most cloud platforms offer built-in encryption. But don’t rely only on that. You can manage your own keys with tools like AWS KMS or Azure Key Vault. That gives you more control. To stay safe: Encrypt both at rest and in transit. Avoid default settings. Rotate encryption keys regularly. 6. Monitor in Real Time Security is not a one-time task. You need to watch your systems around the clock. Set alerts for things like large file downloads, unusual logins, or traffic spikes. Centralized monitoring helps a lot. It pulls logs from all your platforms and tools into one place. That way, your security team isn’t flipping between dashboards when something goes wrong. Also, use automation to filter out noise and surface real threats faster. 7. Set Up Regular Audits and Compliance Checks Multi-cloud setups are great for flexibility, but complex when it comes to compliance. Each platform has its own set of controls and certifications. Managing them all can be overwhelming. That’s why audits matter. Run security checks on a regular schedule—monthly, quarterly, or after every major change. Look for misconfigured permissions, missing patches, or unsecured data. And document everything. Also, make sure your tools help meet regulations like GDPR, HIPAA, or PCI DSS. Automated compliance scans can help stay on top of this. 8. Prevent Data Loss with Smart Policies Sensitive data is always at risk. Employees might share it by mistake. Attackers might try to steal it. That’s where Data Loss Preventioncomes in. DLP tools block unauthorized sharing of personal data, financial records, or internal files. You can create rules like “Don’t send customer SSNs over email” or “Block uploads of credit card data to personal drives.” DLP also supports compliance and helps avoid lawsuits or fines when accidents happen. 9. Automate Where You Can Manual work slows things down, and mistakes happen. That’s why automation is key in cloud security. Automate things like: Patch management Access reviews Backup schedules Security alerts Automation speeds up your response time. It also frees your security team to focus on serious issues, not routine tasks. 10. Centralized Security Control One major downside of multi-cloud isa lack of visibility. If you’re jumping between different tools for each cloud, you miss things. Instead, use a centralized security management system. It collects data from all clouds, shows risk levels, flags issues, and helps you fix them from one place. This unified view makes a huge difference. It helps you react faster and stay ahead of threats. Final Thought Cloud providers have made data storage and computing easier than ever. But with great power comes risk. Using multiple clouds gives more choice, but also more responsibility. Most businesses today are not ready. Only 15% have a mature multi-cloud security plan, says the 2023 Cisco Cyber Security Readiness Index. That means many are exposed. The good news? You can fix this. Start with simple steps. Know what you use. Lock it down. Watch it closely. Keep improving. And above all, treat cloud security not as a technical box to check, but as something critical to your business. Because in today’s world, a single breach can shut you down. And that’s too big a risk to ignore. #cloud #security #best #practices #protecting

JUSTTOTALTECH.COM

Cloud Security Best Practices Protecting Business Data in a Multi-Cloud World

The cloud has changed everything. It’s faster, cheaper, and easier to scale than traditional infrastructure. Initially, most companies chose a single cloud provider. That’s no longer enough. Now, nearly 86% of businesses use more than one cloud. This approach—called multi-cloud—lets teams choose the best features from each provider. But it also opens the door to new security risks. When apps, data, and tools are scattered across platforms, managing security gets harder. And in today's world of constant cyber threats, ignoring cloud security is not an option. Let’s walk through real-world challenges and the best ways to protect business data in a multi-cloud environment. 1. Know What You’re Working With Start with visibility. Make a full inventory of the cloud platforms, apps, and storage your business uses. Ask every department—marketing, finance, HR—what tools they’ve signed up for. Many use services without informing IT. This is shadow IT, and it’s risky. Once you have the list, figure out what data lives where. Some workloads are low-risk. Others involve customer records, credit card data, or legal files. Prioritize those. 2. Build a Unified Security Strategy One of the biggest mistakes companies make is treating each cloud provider as a separate system. Every provider has its own rules, tools, and settings. If your security strategy is broken up, gaps will appear. Instead, aim for a single, connected approach. Use the same access rules, encryption standards, and monitoring tools across all clouds. You don’t want different policies on AWS and Azure—it just invites trouble. Tools like centralized dashboards, SIEM (Security Information and Event Management), and SOAR (Security Orchestration, Automation, and Response) help you keep everything in one place. 3. Enforce Strict Access Controls In a multi-cloud world, identity and access control are one of the hardest things to get right. Every platform has its own login system. Without proper integration, mistakes happen. Someone might get more access than they need, or never lose access when they leave the company. Stick to these practices: Use role-based access control. Limit permissions to the bare minimum. Turn on multi-factor authentication. Link logins across platforms using identity federation. The more consistent your access rules are, the easier it is to control who gets in and what they can do. 4. Use the Zero Trust Model Zero Trust means never assume anything is safe. Every user, device, and app must prove itself—every time. Even if a user is on your network, don’t trust them by default. This model reduces risk. It checks each request. It verifies users. And it looks for signs of abnormal behavior, like someone logging in from a new device or country. Zero Trust works well with automation and real-time monitoring. It also forces teams to rethink how data is shared and accessed. 5. Encrypt Data—Always Encryption is a basic but powerful layer of defense. It protects data whether it’s sitting in storage or moving between systems. If attackers get in, encrypted data is useless without the keys. Most cloud platforms offer built-in encryption. But don’t rely only on that. You can manage your own keys with tools like AWS KMS or Azure Key Vault. That gives you more control. To stay safe: Encrypt both at rest and in transit. Avoid default settings. Rotate encryption keys regularly. 6. Monitor in Real Time Security is not a one-time task. You need to watch your systems around the clock. Set alerts for things like large file downloads, unusual logins, or traffic spikes. Centralized monitoring helps a lot. It pulls logs from all your platforms and tools into one place. That way, your security team isn’t flipping between dashboards when something goes wrong. Also, use automation to filter out noise and surface real threats faster. 7. Set Up Regular Audits and Compliance Checks Multi-cloud setups are great for flexibility, but complex when it comes to compliance. Each platform has its own set of controls and certifications. Managing them all can be overwhelming. That’s why audits matter. Run security checks on a regular schedule—monthly, quarterly, or after every major change. Look for misconfigured permissions, missing patches, or unsecured data. And document everything. Also, make sure your tools help meet regulations like GDPR, HIPAA, or PCI DSS. Automated compliance scans can help stay on top of this. 8. Prevent Data Loss with Smart Policies Sensitive data is always at risk. Employees might share it by mistake. Attackers might try to steal it. That’s where Data Loss Prevention (DLP) comes in. DLP tools block unauthorized sharing of personal data, financial records, or internal files. You can create rules like “Don’t send customer SSNs over email” or “Block uploads of credit card data to personal drives.” DLP also supports compliance and helps avoid lawsuits or fines when accidents happen. 9. Automate Where You Can Manual work slows things down, and mistakes happen. That’s why automation is key in cloud security. Automate things like: Patch management Access reviews Backup schedules Security alerts Automation speeds up your response time. It also frees your security team to focus on serious issues, not routine tasks. 10. Centralized Security Control One major downside of multi-cloud isa lack of visibility. If you’re jumping between different tools for each cloud, you miss things. Instead, use a centralized security management system. It collects data from all clouds, shows risk levels, flags issues, and helps you fix them from one place. This unified view makes a huge difference. It helps you react faster and stay ahead of threats. Final Thought Cloud providers have made data storage and computing easier than ever. But with great power comes risk. Using multiple clouds gives more choice, but also more responsibility. Most businesses today are not ready. Only 15% have a mature multi-cloud security plan, says the 2023 Cisco Cyber Security Readiness Index. That means many are exposed. The good news? You can fix this. Start with simple steps. Know what you use. Lock it down. Watch it closely. Keep improving. And above all, treat cloud security not as a technical box to check, but as something critical to your business. Because in today’s world, a single breach can shut you down. And that’s too big a risk to ignore.

297

Παρακαλούμε συνδέσου στην Κοινότητά μας για να δηλώσεις τι σου αρέσει, να σχολιάσεις και να μοιραστείς με τους φίλους σου!
TNW μοιράστηκε ένα σύνδεσμο

2025-06-05 09:18:31 ·

Klarna CEO: Engineers risk losing out to business people who can code

Klarna’s CEO has warned that software engineers risk being left behind in the AI era — unless they’re also business-savvy.
Speaking at SXSW London, Sebastian Siemiatkowski said the talent “who have really accelerated their careers at Klarna” are “business people who have learned to code.” The reason? “They can take their business understanding and turn it into deterministic or probabilistic statements with AI.”
This shift, he warned, poses a threat to engineers. “A lot of them have allowed themselves to be isolated with technical challenges only, and not been that interested in what the business actually does,” he said.
His message to them was blunt: “Engineers really need to step up and make sure they understand the business.”
Siemiatkowski’s comments add another layer to Klarna’s controversial AI transformation. In December 2023, he said advances in the field had led the buy-now-pay-later firm to freeze hiring for all roles — except engineers. A year later, he had an update: the company had stopped bringing on new staff entirely.
Register Now

Open job listings, however, told a different story. Klarna also recently launched a new recruitment drive to ensure customers can always speak to a human.
The apparent contradiction has drawn criticism, but the company is doubling down on automation.
Last year, Klarna announced that its OpenAI-powered assistant was doing the work of 700 full-time customer service agents. It also used an AI-generated version of Siemiatkowski to present its financial update — suggesting even CEOs could be automated.
The 43-year-old recently claimed that AI can already do “all of the jobs” that humans can do. At SXSW London, he stressed the need to be upfront about the risks.
“I don’t want to be one of the tech CEOs that are like no worries everything will be fine, because I do think there will be major implications for white collar jobs and so I want to be honest about it,” he said.
Despite the gloom, Siemiatkowski still sees big opportunities for people who blend business acumen with technical skills.
“That category of people will become even more valuable going forward,” he said.
Big names from both AI and fintech will be speaking at TNW Conference on June 19-20 in Amsterdam. Want to join them? Well, we have a special offer for you — use the code TNWXMEDIA2025 at the ticket checkout to get 30% off.

Story by

Thomas Macaulay

Managing editor

Thomas is the managing editor of TNW. He leads our coverage of European tech and oversees our talented team of writers. Away from work, he eThomas is the managing editor of TNW. He leads our coverage of European tech and oversees our talented team of writers. Away from work, he enjoys playing chessand the guitar.

Get the TNW newsletter
Get the most important tech news in your inbox each week.

Also tagged with
#klarna #ceo #engineers #risk #losing

Klarna CEO: Engineers risk losing out to business people who can code
Klarna’s CEO has warned that software engineers risk being left behind in the AI era — unless they’re also business-savvy. Speaking at SXSW London, Sebastian Siemiatkowski said the talent “who have really accelerated their careers at Klarna” are “business people who have learned to code.” The reason? “They can take their business understanding and turn it into deterministic or probabilistic statements with AI.” This shift, he warned, poses a threat to engineers. “A lot of them have allowed themselves to be isolated with technical challenges only, and not been that interested in what the business actually does,” he said. His message to them was blunt: “Engineers really need to step up and make sure they understand the business.” Siemiatkowski’s comments add another layer to Klarna’s controversial AI transformation. In December 2023, he said advances in the field had led the buy-now-pay-later firm to freeze hiring for all roles — except engineers. A year later, he had an update: the company had stopped bringing on new staff entirely. Register Now Open job listings, however, told a different story. Klarna also recently launched a new recruitment drive to ensure customers can always speak to a human. The apparent contradiction has drawn criticism, but the company is doubling down on automation. Last year, Klarna announced that its OpenAI-powered assistant was doing the work of 700 full-time customer service agents. It also used an AI-generated version of Siemiatkowski to present its financial update — suggesting even CEOs could be automated. The 43-year-old recently claimed that AI can already do “all of the jobs” that humans can do. At SXSW London, he stressed the need to be upfront about the risks. “I don’t want to be one of the tech CEOs that are like no worries everything will be fine, because I do think there will be major implications for white collar jobs and so I want to be honest about it,” he said. Despite the gloom, Siemiatkowski still sees big opportunities for people who blend business acumen with technical skills. “That category of people will become even more valuable going forward,” he said. Big names from both AI and fintech will be speaking at TNW Conference on June 19-20 in Amsterdam. Want to join them? Well, we have a special offer for you — use the code TNWXMEDIA2025 at the ticket checkout to get 30% off. Story by Thomas Macaulay Managing editor Thomas is the managing editor of TNW. He leads our coverage of European tech and oversees our talented team of writers. Away from work, he eThomas is the managing editor of TNW. He leads our coverage of European tech and oversees our talented team of writers. Away from work, he enjoys playing chessand the guitar. Get the TNW newsletter Get the most important tech news in your inbox each week. Also tagged with #klarna #ceo #engineers #risk #losing

THENEXTWEB.COM

Klarna CEO: Engineers risk losing out to business people who can code

Klarna’s CEO has warned that software engineers risk being left behind in the AI era — unless they’re also business-savvy. Speaking at SXSW London, Sebastian Siemiatkowski said the talent “who have really accelerated their careers at Klarna” are “business people who have learned to code.” The reason? “They can take their business understanding and turn it into deterministic or probabilistic statements with AI.” This shift, he warned, poses a threat to engineers. “A lot of them have allowed themselves to be isolated with technical challenges only, and not been that interested in what the business actually does,” he said. His message to them was blunt: “Engineers really need to step up and make sure they understand the business.” Siemiatkowski’s comments add another layer to Klarna’s controversial AI transformation. In December 2023, he said advances in the field had led the buy-now-pay-later firm to freeze hiring for all roles — except engineers. A year later, he had an update: the company had stopped bringing on new staff entirely. Register Now Open job listings, however, told a different story. Klarna also recently launched a new recruitment drive to ensure customers can always speak to a human. The apparent contradiction has drawn criticism, but the company is doubling down on automation. Last year, Klarna announced that its OpenAI-powered assistant was doing the work of 700 full-time customer service agents. It also used an AI-generated version of Siemiatkowski to present its financial update — suggesting even CEOs could be automated. The 43-year-old recently claimed that AI can already do “all of the jobs” that humans can do. At SXSW London, he stressed the need to be upfront about the risks. “I don’t want to be one of the tech CEOs that are like no worries everything will be fine, because I do think there will be major implications for white collar jobs and so I want to be honest about it,” he said. Despite the gloom, Siemiatkowski still sees big opportunities for people who blend business acumen with technical skills. “That category of people will become even more valuable going forward,” he said. Big names from both AI and fintech will be speaking at TNW Conference on June 19-20 in Amsterdam. Want to join them? Well, we have a special offer for you — use the code TNWXMEDIA2025 at the ticket checkout to get 30% off. Story by Thomas Macaulay Managing editor Thomas is the managing editor of TNW. He leads our coverage of European tech and oversees our talented team of writers. Away from work, he e (show all) Thomas is the managing editor of TNW. He leads our coverage of European tech and oversees our talented team of writers. Away from work, he enjoys playing chess (badly) and the guitar (even worse). Get the TNW newsletter Get the most important tech news in your inbox each week. Also tagged with

249

Παρακαλούμε συνδέσου στην Κοινότητά μας για να δηλώσεις τι σου αρέσει, να σχολιάσεις και να μοιραστείς με τους φίλους σου!