• MedTech AI, hardware, and clinical application programmes

    Modern healthcare innovations span AI, devices, software, images, and regulatory frameworks, all requiring stringent coordination. Generative AI arguably has the strongest transformative potential in healthcare technology programmes, with it already being applied across various domains, such as R&D, commercial operations, and supply chain management.Traditional models for medical appointments, like face-to-face appointments, and paper-based processes may not be sufficient to meet the fast-paced, data-driven medical landscape of today. Therefore, healthcare professionals and patients are seeking more convenient and efficient ways to access and share information, meeting the complex standards of modern medical science. According to McKinsey, Medtech companies are at the forefront of healthcare innovation, estimating they could capture between billion and billion annually in productivity gains. Through GenAI adoption, an additional billion plus in revenue is estimated from products and service innovations. A McKinsey 2024 survey revealed around two thirds of Medtech executives have already implemented Gen AI, with approximately 20% scaling their solutions up and reporting substantial benefits to productivity.  While advanced technology implementation is growing across the medical industry, challenges persist. Organisations face hurdles like data integration issues, decentralised strategies, and skill gaps. Together, these highlight a need for a more streamlined approach to Gen AI deployment. Of all the Medtech domains, R&D is leading the way in Gen AI adoption. Being the most comfortable with new technologies, R&D departments use Gen AI tools to streamline work processes, such as summarising research papers or scientific articles, highlighting a grassroots adoption trend. Individual researchers are using AI to enhance productivity, even when no formal company-wide strategies are in place.While AI tools automate and accelerate R&D tasks, human review is still required to ensure final submissions are correct and satisfactory. Gen AI is proving to reduce time spent on administrative tasks for teams and improve research accuracy and depth, with some companies experiencing 20% to 30% gains in research productivity. KPIs for success in healthcare product programmesMeasuring business performance is essential in the healthcare sector. The number one goal is, of course, to deliver high-quality care, yet simultaneously maintain efficient operations. By measuring and analysing KPIs, healthcare providers are in a better position to improve patient outcomes through their data-based considerations. KPIs can also improve resource allocation, and encourage continuous improvement in all areas of care. In terms of healthcare product programmes, these structured initiatives prioritise the development, delivery, and continual optimisation of medical products. But to be a success, they require cross-functional coordination of clinical, technical, regulatory, and business teams. Time to market is critical, ensuring a product moves from the concept stage to launch as quickly as possible.Of particular note is the emphasis needing to be placed on labelling and documentation. McKinsey notes that AI-assisted labelling has resulted in a 20%-30% improvement in operational efficiency. Resource utilisation rates are also important, showing how efficiently time, budget, and/or headcount are used during the developmental stage of products. In the healthcare sector, KPIs ought to focus on several factors, including operational efficiency, patient outcomes, financial health of the business, and patient satisfaction. To achieve a comprehensive view of performance, these can be categorised into financial, operational, clinical quality, and patient experience.Bridging user experience with technical precision – design awardsInnovation is no longer solely judged by technical performance with user experiencebeing equally important. Some of the latest innovations in healthcare are recognised at the UX Design Awards, products that exemplify the best in user experience as well as technical precision. Top products prioritise the needs and experiences of both patients and healthcare professionals, also ensuring each product meets the rigorous clinical and regulatory standards of the sector. One example is the CIARTIC Move by Siemens Healthineers, a self-driving 3D C-arm imaging system that lets surgeons operate, controlling the device wirelessly in a sterile field. Computer hardware company ASUS has also received accolades for its HealthConnect App and VivoWatch Series, showcasing the fusion of AIoT-driven smart healthcare solutions with user-friendly interfaces – sometimes in what are essentially consumer devices. This demonstrates how technical innovation is being made accessible and becoming increasingly intuitive as patients gain technical fluency.  Navigating regulatory and product development pathways simultaneously The establishing of clinical and regulatory paths is important, as this enables healthcare teams to feed a twin stream of findings back into development. Gen AI adoption has become a transformative approach, automating the production and refining of complex documents, mixed data sets, and structured and unstructured data. By integrating regulatory considerations early and adopting technologies like Gen AI as part of agile practices, healthcare product programmes help teams navigate a regulatory landscape that can often shift. Baking a regulatory mindset into a team early helps ensure compliance and continued innovation. Want to learn more about AI and big data from industry leaders? Check out AI & Big Data Expo taking place in Amsterdam, California, and London. The comprehensive event is co-located with other leading events including Intelligent Automation Conference, BlockX, Digital Transformation Week, and Cyber Security & Cloud Expo.Explore other upcoming enterprise technology events and webinars powered by TechForge here.
    #medtech #hardware #clinical #application #programmes
    MedTech AI, hardware, and clinical application programmes
    Modern healthcare innovations span AI, devices, software, images, and regulatory frameworks, all requiring stringent coordination. Generative AI arguably has the strongest transformative potential in healthcare technology programmes, with it already being applied across various domains, such as R&D, commercial operations, and supply chain management.Traditional models for medical appointments, like face-to-face appointments, and paper-based processes may not be sufficient to meet the fast-paced, data-driven medical landscape of today. Therefore, healthcare professionals and patients are seeking more convenient and efficient ways to access and share information, meeting the complex standards of modern medical science. According to McKinsey, Medtech companies are at the forefront of healthcare innovation, estimating they could capture between billion and billion annually in productivity gains. Through GenAI adoption, an additional billion plus in revenue is estimated from products and service innovations. A McKinsey 2024 survey revealed around two thirds of Medtech executives have already implemented Gen AI, with approximately 20% scaling their solutions up and reporting substantial benefits to productivity.  While advanced technology implementation is growing across the medical industry, challenges persist. Organisations face hurdles like data integration issues, decentralised strategies, and skill gaps. Together, these highlight a need for a more streamlined approach to Gen AI deployment. Of all the Medtech domains, R&D is leading the way in Gen AI adoption. Being the most comfortable with new technologies, R&D departments use Gen AI tools to streamline work processes, such as summarising research papers or scientific articles, highlighting a grassroots adoption trend. Individual researchers are using AI to enhance productivity, even when no formal company-wide strategies are in place.While AI tools automate and accelerate R&D tasks, human review is still required to ensure final submissions are correct and satisfactory. Gen AI is proving to reduce time spent on administrative tasks for teams and improve research accuracy and depth, with some companies experiencing 20% to 30% gains in research productivity. KPIs for success in healthcare product programmesMeasuring business performance is essential in the healthcare sector. The number one goal is, of course, to deliver high-quality care, yet simultaneously maintain efficient operations. By measuring and analysing KPIs, healthcare providers are in a better position to improve patient outcomes through their data-based considerations. KPIs can also improve resource allocation, and encourage continuous improvement in all areas of care. In terms of healthcare product programmes, these structured initiatives prioritise the development, delivery, and continual optimisation of medical products. But to be a success, they require cross-functional coordination of clinical, technical, regulatory, and business teams. Time to market is critical, ensuring a product moves from the concept stage to launch as quickly as possible.Of particular note is the emphasis needing to be placed on labelling and documentation. McKinsey notes that AI-assisted labelling has resulted in a 20%-30% improvement in operational efficiency. Resource utilisation rates are also important, showing how efficiently time, budget, and/or headcount are used during the developmental stage of products. In the healthcare sector, KPIs ought to focus on several factors, including operational efficiency, patient outcomes, financial health of the business, and patient satisfaction. To achieve a comprehensive view of performance, these can be categorised into financial, operational, clinical quality, and patient experience.Bridging user experience with technical precision – design awardsInnovation is no longer solely judged by technical performance with user experiencebeing equally important. Some of the latest innovations in healthcare are recognised at the UX Design Awards, products that exemplify the best in user experience as well as technical precision. Top products prioritise the needs and experiences of both patients and healthcare professionals, also ensuring each product meets the rigorous clinical and regulatory standards of the sector. One example is the CIARTIC Move by Siemens Healthineers, a self-driving 3D C-arm imaging system that lets surgeons operate, controlling the device wirelessly in a sterile field. Computer hardware company ASUS has also received accolades for its HealthConnect App and VivoWatch Series, showcasing the fusion of AIoT-driven smart healthcare solutions with user-friendly interfaces – sometimes in what are essentially consumer devices. This demonstrates how technical innovation is being made accessible and becoming increasingly intuitive as patients gain technical fluency.  Navigating regulatory and product development pathways simultaneously The establishing of clinical and regulatory paths is important, as this enables healthcare teams to feed a twin stream of findings back into development. Gen AI adoption has become a transformative approach, automating the production and refining of complex documents, mixed data sets, and structured and unstructured data. By integrating regulatory considerations early and adopting technologies like Gen AI as part of agile practices, healthcare product programmes help teams navigate a regulatory landscape that can often shift. Baking a regulatory mindset into a team early helps ensure compliance and continued innovation. Want to learn more about AI and big data from industry leaders? Check out AI & Big Data Expo taking place in Amsterdam, California, and London. The comprehensive event is co-located with other leading events including Intelligent Automation Conference, BlockX, Digital Transformation Week, and Cyber Security & Cloud Expo.Explore other upcoming enterprise technology events and webinars powered by TechForge here. #medtech #hardware #clinical #application #programmes
    WWW.ARTIFICIALINTELLIGENCE-NEWS.COM
    MedTech AI, hardware, and clinical application programmes
    Modern healthcare innovations span AI, devices, software, images, and regulatory frameworks, all requiring stringent coordination. Generative AI arguably has the strongest transformative potential in healthcare technology programmes, with it already being applied across various domains, such as R&D, commercial operations, and supply chain management.Traditional models for medical appointments, like face-to-face appointments, and paper-based processes may not be sufficient to meet the fast-paced, data-driven medical landscape of today. Therefore, healthcare professionals and patients are seeking more convenient and efficient ways to access and share information, meeting the complex standards of modern medical science. According to McKinsey, Medtech companies are at the forefront of healthcare innovation, estimating they could capture between $14 billion and $55 billion annually in productivity gains. Through GenAI adoption, an additional $50 billion plus in revenue is estimated from products and service innovations. A McKinsey 2024 survey revealed around two thirds of Medtech executives have already implemented Gen AI, with approximately 20% scaling their solutions up and reporting substantial benefits to productivity.  While advanced technology implementation is growing across the medical industry, challenges persist. Organisations face hurdles like data integration issues, decentralised strategies, and skill gaps. Together, these highlight a need for a more streamlined approach to Gen AI deployment. Of all the Medtech domains, R&D is leading the way in Gen AI adoption. Being the most comfortable with new technologies, R&D departments use Gen AI tools to streamline work processes, such as summarising research papers or scientific articles, highlighting a grassroots adoption trend. Individual researchers are using AI to enhance productivity, even when no formal company-wide strategies are in place.While AI tools automate and accelerate R&D tasks, human review is still required to ensure final submissions are correct and satisfactory. Gen AI is proving to reduce time spent on administrative tasks for teams and improve research accuracy and depth, with some companies experiencing 20% to 30% gains in research productivity. KPIs for success in healthcare product programmesMeasuring business performance is essential in the healthcare sector. The number one goal is, of course, to deliver high-quality care, yet simultaneously maintain efficient operations. By measuring and analysing KPIs, healthcare providers are in a better position to improve patient outcomes through their data-based considerations. KPIs can also improve resource allocation, and encourage continuous improvement in all areas of care. In terms of healthcare product programmes, these structured initiatives prioritise the development, delivery, and continual optimisation of medical products. But to be a success, they require cross-functional coordination of clinical, technical, regulatory, and business teams. Time to market is critical, ensuring a product moves from the concept stage to launch as quickly as possible.Of particular note is the emphasis needing to be placed on labelling and documentation. McKinsey notes that AI-assisted labelling has resulted in a 20%-30% improvement in operational efficiency. Resource utilisation rates are also important, showing how efficiently time, budget, and/or headcount are used during the developmental stage of products. In the healthcare sector, KPIs ought to focus on several factors, including operational efficiency, patient outcomes, financial health of the business, and patient satisfaction. To achieve a comprehensive view of performance, these can be categorised into financial, operational, clinical quality, and patient experience.Bridging user experience with technical precision – design awardsInnovation is no longer solely judged by technical performance with user experience (UX) being equally important. Some of the latest innovations in healthcare are recognised at the UX Design Awards, products that exemplify the best in user experience as well as technical precision. Top products prioritise the needs and experiences of both patients and healthcare professionals, also ensuring each product meets the rigorous clinical and regulatory standards of the sector. One example is the CIARTIC Move by Siemens Healthineers, a self-driving 3D C-arm imaging system that lets surgeons operate, controlling the device wirelessly in a sterile field. Computer hardware company ASUS has also received accolades for its HealthConnect App and VivoWatch Series, showcasing the fusion of AIoT-driven smart healthcare solutions with user-friendly interfaces – sometimes in what are essentially consumer devices. This demonstrates how technical innovation is being made accessible and becoming increasingly intuitive as patients gain technical fluency.  Navigating regulatory and product development pathways simultaneously The establishing of clinical and regulatory paths is important, as this enables healthcare teams to feed a twin stream of findings back into development. Gen AI adoption has become a transformative approach, automating the production and refining of complex documents, mixed data sets, and structured and unstructured data. By integrating regulatory considerations early and adopting technologies like Gen AI as part of agile practices, healthcare product programmes help teams navigate a regulatory landscape that can often shift. Baking a regulatory mindset into a team early helps ensure compliance and continued innovation. (Image source: “IBM Achieves New Deep Learning Breakthrough” by IBM Research is licensed under CC BY-ND 2.0.)Want to learn more about AI and big data from industry leaders? Check out AI & Big Data Expo taking place in Amsterdam, California, and London. The comprehensive event is co-located with other leading events including Intelligent Automation Conference, BlockX, Digital Transformation Week, and Cyber Security & Cloud Expo.Explore other upcoming enterprise technology events and webinars powered by TechForge here.
    0 التعليقات 0 المشاركات
  • IT Pros ‘Extremely Worried’ About Shadow AI: Report

    IT Pros ‘Extremely Worried’ About Shadow AI: Report

    By John P. Mello Jr.
    June 4, 2025 5:00 AM PT

    ADVERTISEMENT
    Enterprise IT Lead Generation Services
    Fuel Your Pipeline. Close More Deals. Our full-service marketing programs deliver sales-ready leads. 100% Satisfaction Guarantee! Learn more.

    Shadow AI — the use of AI tools under the radar of IT departments — has information technology directors and executives worried, according to a report released Tuesday.
    The report, based on a survey of 200 IT directors and executives at U.S. enterprise organizations of 1,000 employees or more, found nearly half the IT proswere “extremely worried” about shadow AI, and almost all of themwere concerned about it from a privacy and security viewpoint.
    “As our survey found, shadow AI is resulting in palpable, concerning outcomes, with nearly 80% of IT leaders saying it has resulted in negative incidents such as sensitive data leakage to Gen AI tools, false or inaccurate results, and legal risks of using copyrighted information,” said Krishna Subramanian, co-founder of Campbell, Calif.-based Komprise, the unstructured data management company that produced the report.
    “Alarmingly, 13% say that shadow AI has caused financial or reputational harm to their organizations,” she told TechNewsWorld.
    Subramanian added that shadow AI poses a much greater problem than shadow IT, which primarily focuses on departmental power users purchasing cloud instances or SaaS tools without obtaining IT approval.
    “Now we’ve got an unlimited number of employees using tools like ChatGPT or Claude AI to get work done, but not understanding the potential risk they are putting their organizations at by inadvertently submitting company secrets or customer data into the chat prompt,” she explained.
    “The data risk is large and growing in still unforeseen ways because of the pace of AI development and adoption and the fact that there is a lot we don’t know about how AI works,” she continued. “It is becoming more humanistic all the time and capable of making decisions independently.”
    Shadow AI Introduces Security Blind Spots
    Shadow AI is the next step after shadow IT and is a growing risk, noted James McQuiggan, security awareness advocate at KnowBe4, a security awareness training provider in Clearwater, Fla.
    “Users use AI tools for content, images, or applications and to process sensitive data or company information without proper security checks,” he told TechNewsWorld. “Most organizations will have privacy, compliance, and data protection policies, and shadow AI introduces blind spots in the organization’s data loss prevention.”
    “The biggest risk with shadow AI is that the AI application has not passed through a security analysis as approved AI tools may have been,” explained Melissa Ruzzi, director of AI at AppOmni, a SaaS security management software company, in San Mateo, Calif.
    “Some AI applications may be training models using your data, may not adhere to relevant regulations that your company is required to follow, and may not even have the data storage security level you deem necessary to keep your data from being exposed,” she told TechNewsWorld. “Those risks are blind spots of potential security vulnerabilities in shadow AI.”
    Krishna Vishnubhotla, vice president of product strategy at Zimperium, a mobile security company based in Dallas, noted that shadow AI extends beyond unapproved applications and involves embedded AI components that can process and disseminate sensitive data in unpredictable ways.
    “Unlike traditional shadow IT, which may be limited to unauthorized software or hardware, shadow AI can run on employee mobile devices outside the organization’s perimeter and control,” he told TechNewsWorld. “This creates new security and compliance risks that are harder to track and mitigate.”
    Vishnubhotla added that the financial impact of shadow AI varies, but unauthorized AI tools can lead to significant regulatory fines, data breaches, and loss of intellectual property. “Depending on the scale of the agency and the sensitivity of the data exposed, the costs could range from millions to potentially billions in damages due to compliance violations, remediation efforts, and reputational harm,” he said.
    “Federal agencies handling vast amounts of sensitive or classified information, financial institutions, and health care organizations are particularly vulnerable,” he said. “These sectors collect and analyze vast amounts of high-value data, making AI tools attractive. But without proper vetting, these tools could be easily exploited.”
    Shadow AI Everywhere and Easy To Use
    Nicole Carignan, SVP for security and AI strategy at Darktrace, a global cybersecurity AI company, predicts an explosion of tools that utilize AI and generative AI within enterprises and on devices used by employees.
    “In addition to managing AI tools that are built in-house, security teams will see a surge in the volume of existing tools that have new AI features and capabilities embedded, as well as a rise in shadow AI,” she told TechNewsWorld. “If the surge remains unchecked, this raises serious questions and concerns about data loss prevention, as well as compliance concerns as new regulations start to take effect.”
    “That will drive an increasing need for AI asset discovery — the ability for companies to identify and track the use of AI systems throughout the enterprise,” she said. “It is imperative that CIOs and CISOs dig deep into new AI security solutions, asking comprehensive questions about data access and visibility.”
    Shadow AI has become so rampant because it is everywhere and easy to access through free tools, maintained Komprise’s Subramanian. “All you need is a web browser,” she said. “Enterprise users can inadvertently share company code snippets or corporate data when using these Gen AI tools, which could create data leakage.”
    “These tools are growing and changing exponentially,” she continued. “It’s really hard to keep up. As the IT leader, how do you track this and determine the risk? Managers might be looking the other way because their teams are getting more done. You may need fewer contractors and full-time employees. But I think the risk of the tools is not well understood.”
    “The low, or in some cases non-existent, learning curve associated with using Gen AI services has led to rapid adoption, regardless of prior experience with these services,” added Satyam Sinha, CEO and co-founder of Acuvity, a provider of runtime Gen AI security and governance solutions, in Sunnyvale, Calif.
    “Whereas shadow IT focused on addressing a specific challenge for particular employees or departments, shadow AI addresses multiple challenges for multiple employees and departments. Hence, the greater appeal,” he said. “The abundance and rapid development of Gen AI services also means employees can find the right solution. Of course, all these traits have direct security implications.”
    Banning AI Tools Backfires
    To support innovation while minimizing the threat of shadow AI, enterprises must take a three-pronged approach, asserted Kris Bondi, CEO and co-founder of Mimoto, a threat detection and response company in San Francisco. They must educate employees on the dangers of unsupported, unmonitored AI tools, create company protocols for what is not acceptable use of unauthorized AI tools, and, most importantly, provide AI tools that are sanctioned.
    “Explaining why one tool is sanctioned and another isn’t greatly increases compliance,” she told TechNewsWorld. “It does not work for a company to have a zero-use mandate. In fact, this results in an increase in stealth use of shadow AI.”
    In the very near future, more and more applications will be leveraging AI in different forms, so the reality of shadow AI will be present more than ever, added AppOmni’s Ruzzi. “The best strategy here is employee training and AI usage monitoring,” she said.
    “It will become crucial to have in place a powerful SaaS security tool that can go beyond detecting direct AI usage of chatbots to detect AI usage connected to other applications,” she continued, “allowing for early discovery, proper risk assessment, and containment to minimize possible negative consequences.”
    “Shadow AI is just the beginning,” KnowBe4’s McQuiggan added. “As more teams use AI, the risks grow.”
    He recommended that companies start small, identify what’s being used, and build from there. They should also get legal, HR, and compliance involved.
    “Make AI governance part of your broader security program,” he said. “The sooner you start, the better you can manage what comes next.”

    John P. Mello Jr. has been an ECT News Network reporter since 2003. His areas of focus include cybersecurity, IT issues, privacy, e-commerce, social media, artificial intelligence, big data and consumer electronics. He has written and edited for numerous publications, including the Boston Business Journal, the Boston Phoenix, Megapixel.Net and Government Security News. Email John.

    Leave a Comment

    Click here to cancel reply.
    Please sign in to post or reply to a comment. New users create a free account.

    Related Stories

    More by John P. Mello Jr.

    view all

    More in IT Leadership
    #pros #extremely #worried #about #shadow
    IT Pros ‘Extremely Worried’ About Shadow AI: Report
    IT Pros ‘Extremely Worried’ About Shadow AI: Report By John P. Mello Jr. June 4, 2025 5:00 AM PT ADVERTISEMENT Enterprise IT Lead Generation Services Fuel Your Pipeline. Close More Deals. Our full-service marketing programs deliver sales-ready leads. 100% Satisfaction Guarantee! Learn more. Shadow AI — the use of AI tools under the radar of IT departments — has information technology directors and executives worried, according to a report released Tuesday. The report, based on a survey of 200 IT directors and executives at U.S. enterprise organizations of 1,000 employees or more, found nearly half the IT proswere “extremely worried” about shadow AI, and almost all of themwere concerned about it from a privacy and security viewpoint. “As our survey found, shadow AI is resulting in palpable, concerning outcomes, with nearly 80% of IT leaders saying it has resulted in negative incidents such as sensitive data leakage to Gen AI tools, false or inaccurate results, and legal risks of using copyrighted information,” said Krishna Subramanian, co-founder of Campbell, Calif.-based Komprise, the unstructured data management company that produced the report. “Alarmingly, 13% say that shadow AI has caused financial or reputational harm to their organizations,” she told TechNewsWorld. Subramanian added that shadow AI poses a much greater problem than shadow IT, which primarily focuses on departmental power users purchasing cloud instances or SaaS tools without obtaining IT approval. “Now we’ve got an unlimited number of employees using tools like ChatGPT or Claude AI to get work done, but not understanding the potential risk they are putting their organizations at by inadvertently submitting company secrets or customer data into the chat prompt,” she explained. “The data risk is large and growing in still unforeseen ways because of the pace of AI development and adoption and the fact that there is a lot we don’t know about how AI works,” she continued. “It is becoming more humanistic all the time and capable of making decisions independently.” Shadow AI Introduces Security Blind Spots Shadow AI is the next step after shadow IT and is a growing risk, noted James McQuiggan, security awareness advocate at KnowBe4, a security awareness training provider in Clearwater, Fla. “Users use AI tools for content, images, or applications and to process sensitive data or company information without proper security checks,” he told TechNewsWorld. “Most organizations will have privacy, compliance, and data protection policies, and shadow AI introduces blind spots in the organization’s data loss prevention.” “The biggest risk with shadow AI is that the AI application has not passed through a security analysis as approved AI tools may have been,” explained Melissa Ruzzi, director of AI at AppOmni, a SaaS security management software company, in San Mateo, Calif. “Some AI applications may be training models using your data, may not adhere to relevant regulations that your company is required to follow, and may not even have the data storage security level you deem necessary to keep your data from being exposed,” she told TechNewsWorld. “Those risks are blind spots of potential security vulnerabilities in shadow AI.” Krishna Vishnubhotla, vice president of product strategy at Zimperium, a mobile security company based in Dallas, noted that shadow AI extends beyond unapproved applications and involves embedded AI components that can process and disseminate sensitive data in unpredictable ways. “Unlike traditional shadow IT, which may be limited to unauthorized software or hardware, shadow AI can run on employee mobile devices outside the organization’s perimeter and control,” he told TechNewsWorld. “This creates new security and compliance risks that are harder to track and mitigate.” Vishnubhotla added that the financial impact of shadow AI varies, but unauthorized AI tools can lead to significant regulatory fines, data breaches, and loss of intellectual property. “Depending on the scale of the agency and the sensitivity of the data exposed, the costs could range from millions to potentially billions in damages due to compliance violations, remediation efforts, and reputational harm,” he said. “Federal agencies handling vast amounts of sensitive or classified information, financial institutions, and health care organizations are particularly vulnerable,” he said. “These sectors collect and analyze vast amounts of high-value data, making AI tools attractive. But without proper vetting, these tools could be easily exploited.” Shadow AI Everywhere and Easy To Use Nicole Carignan, SVP for security and AI strategy at Darktrace, a global cybersecurity AI company, predicts an explosion of tools that utilize AI and generative AI within enterprises and on devices used by employees. “In addition to managing AI tools that are built in-house, security teams will see a surge in the volume of existing tools that have new AI features and capabilities embedded, as well as a rise in shadow AI,” she told TechNewsWorld. “If the surge remains unchecked, this raises serious questions and concerns about data loss prevention, as well as compliance concerns as new regulations start to take effect.” “That will drive an increasing need for AI asset discovery — the ability for companies to identify and track the use of AI systems throughout the enterprise,” she said. “It is imperative that CIOs and CISOs dig deep into new AI security solutions, asking comprehensive questions about data access and visibility.” Shadow AI has become so rampant because it is everywhere and easy to access through free tools, maintained Komprise’s Subramanian. “All you need is a web browser,” she said. “Enterprise users can inadvertently share company code snippets or corporate data when using these Gen AI tools, which could create data leakage.” “These tools are growing and changing exponentially,” she continued. “It’s really hard to keep up. As the IT leader, how do you track this and determine the risk? Managers might be looking the other way because their teams are getting more done. You may need fewer contractors and full-time employees. But I think the risk of the tools is not well understood.” “The low, or in some cases non-existent, learning curve associated with using Gen AI services has led to rapid adoption, regardless of prior experience with these services,” added Satyam Sinha, CEO and co-founder of Acuvity, a provider of runtime Gen AI security and governance solutions, in Sunnyvale, Calif. “Whereas shadow IT focused on addressing a specific challenge for particular employees or departments, shadow AI addresses multiple challenges for multiple employees and departments. Hence, the greater appeal,” he said. “The abundance and rapid development of Gen AI services also means employees can find the right solution. Of course, all these traits have direct security implications.” Banning AI Tools Backfires To support innovation while minimizing the threat of shadow AI, enterprises must take a three-pronged approach, asserted Kris Bondi, CEO and co-founder of Mimoto, a threat detection and response company in San Francisco. They must educate employees on the dangers of unsupported, unmonitored AI tools, create company protocols for what is not acceptable use of unauthorized AI tools, and, most importantly, provide AI tools that are sanctioned. “Explaining why one tool is sanctioned and another isn’t greatly increases compliance,” she told TechNewsWorld. “It does not work for a company to have a zero-use mandate. In fact, this results in an increase in stealth use of shadow AI.” In the very near future, more and more applications will be leveraging AI in different forms, so the reality of shadow AI will be present more than ever, added AppOmni’s Ruzzi. “The best strategy here is employee training and AI usage monitoring,” she said. “It will become crucial to have in place a powerful SaaS security tool that can go beyond detecting direct AI usage of chatbots to detect AI usage connected to other applications,” she continued, “allowing for early discovery, proper risk assessment, and containment to minimize possible negative consequences.” “Shadow AI is just the beginning,” KnowBe4’s McQuiggan added. “As more teams use AI, the risks grow.” He recommended that companies start small, identify what’s being used, and build from there. They should also get legal, HR, and compliance involved. “Make AI governance part of your broader security program,” he said. “The sooner you start, the better you can manage what comes next.” John P. Mello Jr. has been an ECT News Network reporter since 2003. His areas of focus include cybersecurity, IT issues, privacy, e-commerce, social media, artificial intelligence, big data and consumer electronics. He has written and edited for numerous publications, including the Boston Business Journal, the Boston Phoenix, Megapixel.Net and Government Security News. Email John. Leave a Comment Click here to cancel reply. Please sign in to post or reply to a comment. New users create a free account. Related Stories More by John P. Mello Jr. view all More in IT Leadership #pros #extremely #worried #about #shadow
    WWW.TECHNEWSWORLD.COM
    IT Pros ‘Extremely Worried’ About Shadow AI: Report
    IT Pros ‘Extremely Worried’ About Shadow AI: Report By John P. Mello Jr. June 4, 2025 5:00 AM PT ADVERTISEMENT Enterprise IT Lead Generation Services Fuel Your Pipeline. Close More Deals. Our full-service marketing programs deliver sales-ready leads. 100% Satisfaction Guarantee! Learn more. Shadow AI — the use of AI tools under the radar of IT departments — has information technology directors and executives worried, according to a report released Tuesday. The report, based on a survey of 200 IT directors and executives at U.S. enterprise organizations of 1,000 employees or more, found nearly half the IT pros (46%) were “extremely worried” about shadow AI, and almost all of them (90%) were concerned about it from a privacy and security viewpoint. “As our survey found, shadow AI is resulting in palpable, concerning outcomes, with nearly 80% of IT leaders saying it has resulted in negative incidents such as sensitive data leakage to Gen AI tools, false or inaccurate results, and legal risks of using copyrighted information,” said Krishna Subramanian, co-founder of Campbell, Calif.-based Komprise, the unstructured data management company that produced the report. “Alarmingly, 13% say that shadow AI has caused financial or reputational harm to their organizations,” she told TechNewsWorld. Subramanian added that shadow AI poses a much greater problem than shadow IT, which primarily focuses on departmental power users purchasing cloud instances or SaaS tools without obtaining IT approval. “Now we’ve got an unlimited number of employees using tools like ChatGPT or Claude AI to get work done, but not understanding the potential risk they are putting their organizations at by inadvertently submitting company secrets or customer data into the chat prompt,” she explained. “The data risk is large and growing in still unforeseen ways because of the pace of AI development and adoption and the fact that there is a lot we don’t know about how AI works,” she continued. “It is becoming more humanistic all the time and capable of making decisions independently.” Shadow AI Introduces Security Blind Spots Shadow AI is the next step after shadow IT and is a growing risk, noted James McQuiggan, security awareness advocate at KnowBe4, a security awareness training provider in Clearwater, Fla. “Users use AI tools for content, images, or applications and to process sensitive data or company information without proper security checks,” he told TechNewsWorld. “Most organizations will have privacy, compliance, and data protection policies, and shadow AI introduces blind spots in the organization’s data loss prevention.” “The biggest risk with shadow AI is that the AI application has not passed through a security analysis as approved AI tools may have been,” explained Melissa Ruzzi, director of AI at AppOmni, a SaaS security management software company, in San Mateo, Calif. “Some AI applications may be training models using your data, may not adhere to relevant regulations that your company is required to follow, and may not even have the data storage security level you deem necessary to keep your data from being exposed,” she told TechNewsWorld. “Those risks are blind spots of potential security vulnerabilities in shadow AI.” Krishna Vishnubhotla, vice president of product strategy at Zimperium, a mobile security company based in Dallas, noted that shadow AI extends beyond unapproved applications and involves embedded AI components that can process and disseminate sensitive data in unpredictable ways. “Unlike traditional shadow IT, which may be limited to unauthorized software or hardware, shadow AI can run on employee mobile devices outside the organization’s perimeter and control,” he told TechNewsWorld. “This creates new security and compliance risks that are harder to track and mitigate.” Vishnubhotla added that the financial impact of shadow AI varies, but unauthorized AI tools can lead to significant regulatory fines, data breaches, and loss of intellectual property. “Depending on the scale of the agency and the sensitivity of the data exposed, the costs could range from millions to potentially billions in damages due to compliance violations, remediation efforts, and reputational harm,” he said. “Federal agencies handling vast amounts of sensitive or classified information, financial institutions, and health care organizations are particularly vulnerable,” he said. “These sectors collect and analyze vast amounts of high-value data, making AI tools attractive. But without proper vetting, these tools could be easily exploited.” Shadow AI Everywhere and Easy To Use Nicole Carignan, SVP for security and AI strategy at Darktrace, a global cybersecurity AI company, predicts an explosion of tools that utilize AI and generative AI within enterprises and on devices used by employees. “In addition to managing AI tools that are built in-house, security teams will see a surge in the volume of existing tools that have new AI features and capabilities embedded, as well as a rise in shadow AI,” she told TechNewsWorld. “If the surge remains unchecked, this raises serious questions and concerns about data loss prevention, as well as compliance concerns as new regulations start to take effect.” “That will drive an increasing need for AI asset discovery — the ability for companies to identify and track the use of AI systems throughout the enterprise,” she said. “It is imperative that CIOs and CISOs dig deep into new AI security solutions, asking comprehensive questions about data access and visibility.” Shadow AI has become so rampant because it is everywhere and easy to access through free tools, maintained Komprise’s Subramanian. “All you need is a web browser,” she said. “Enterprise users can inadvertently share company code snippets or corporate data when using these Gen AI tools, which could create data leakage.” “These tools are growing and changing exponentially,” she continued. “It’s really hard to keep up. As the IT leader, how do you track this and determine the risk? Managers might be looking the other way because their teams are getting more done. You may need fewer contractors and full-time employees. But I think the risk of the tools is not well understood.” “The low, or in some cases non-existent, learning curve associated with using Gen AI services has led to rapid adoption, regardless of prior experience with these services,” added Satyam Sinha, CEO and co-founder of Acuvity, a provider of runtime Gen AI security and governance solutions, in Sunnyvale, Calif. “Whereas shadow IT focused on addressing a specific challenge for particular employees or departments, shadow AI addresses multiple challenges for multiple employees and departments. Hence, the greater appeal,” he said. “The abundance and rapid development of Gen AI services also means employees can find the right solution [instantly]. Of course, all these traits have direct security implications.” Banning AI Tools Backfires To support innovation while minimizing the threat of shadow AI, enterprises must take a three-pronged approach, asserted Kris Bondi, CEO and co-founder of Mimoto, a threat detection and response company in San Francisco. They must educate employees on the dangers of unsupported, unmonitored AI tools, create company protocols for what is not acceptable use of unauthorized AI tools, and, most importantly, provide AI tools that are sanctioned. “Explaining why one tool is sanctioned and another isn’t greatly increases compliance,” she told TechNewsWorld. “It does not work for a company to have a zero-use mandate. In fact, this results in an increase in stealth use of shadow AI.” In the very near future, more and more applications will be leveraging AI in different forms, so the reality of shadow AI will be present more than ever, added AppOmni’s Ruzzi. “The best strategy here is employee training and AI usage monitoring,” she said. “It will become crucial to have in place a powerful SaaS security tool that can go beyond detecting direct AI usage of chatbots to detect AI usage connected to other applications,” she continued, “allowing for early discovery, proper risk assessment, and containment to minimize possible negative consequences.” “Shadow AI is just the beginning,” KnowBe4’s McQuiggan added. “As more teams use AI, the risks grow.” He recommended that companies start small, identify what’s being used, and build from there. They should also get legal, HR, and compliance involved. “Make AI governance part of your broader security program,” he said. “The sooner you start, the better you can manage what comes next.” John P. Mello Jr. has been an ECT News Network reporter since 2003. His areas of focus include cybersecurity, IT issues, privacy, e-commerce, social media, artificial intelligence, big data and consumer electronics. He has written and edited for numerous publications, including the Boston Business Journal, the Boston Phoenix, Megapixel.Net and Government Security News. Email John. Leave a Comment Click here to cancel reply. Please sign in to post or reply to a comment. New users create a free account. Related Stories More by John P. Mello Jr. view all More in IT Leadership
    Like
    Love
    Wow
    Sad
    Angry
    229
    0 التعليقات 0 المشاركات
  • What professionals really think about “Vibe Coding”

    Many don’t like it, buteverybody agrees it’s the future.“Vibe Coding” is everywhere. Tools and game engines are implementing AI-assisted coding, vibe coding interest skyrocketed on Google search, on social media, everybody claims to build apps and games in minutes, while the comment section gets flooded with angry developers calling out the pile of garbage code that will never be shipped.A screenshot from Andrej Karpathy with the original “definition” of Vibe CodingBUT, how do professionals feel about it?This is what I will cover in this article. We will look at:How people react to the term vibe coding,How their attitude differs based on who they are and their professional experienceThe reason for their stance towards “vibe coding”How they feel about the impact “vibe coding” will have in the next 5 yearsIt all started with this survey on LinkedIn. I have always been curious about how technology can support creatives and I believe that the only way to get a deeper understanding is to go beyond buzzwords and ask the hard questions. That’s why for over a year, I’ve been conducting weekly interviews with both the founders developing these tools and the creatives utilising them. If you want to learn their journeys, I’ve gathered their insights and experiences on my blog called XR AI Spotlight.Driven by the same motives and curious about people’s feelings about “vibe coding”, I asked a simple question: How does the term “Vibe Coding” make you feel?Original LinkedIn poll by Gabriele RomagnoliIn just three days, the poll collected 139 votes and it was clear that most responders didn’t have a good “vibe” about it. The remaining half was equally split between excitement and no specific feeling.But who are these people? What is their professional background? Why did they respond the way they did?Curious, I created a more comprehensive survey and sent it to everyone who voted on the LinkedIn poll.The survey had four questions:Select what describes you best: developers, creative, non-creative professionalHow many years of experience do you have? 1–5, 6–10, 11–15 or 16+Explain why the term “vibe coding” makes you feel excited/neutral/dismissive?Do you think “vibe coding” will become more relevant in the next 5 years?: It’s the future, only in niche use cases, unlikely, no idea)In a few days, I collected 62 replies and started digging into the findings, and that’s when I finally started understanding who took part in the initial poll.The audienceWhen characterising the audience, I refrained from adding too many options because I just wanted to understand:If the people responding were the ones making stuffWhat percentage of makers were creatives and what developersI was happy to see that only 8% of respondents were non-creative professionals and the remaining 92% were actual makers who have more “skin in the game“ with almost a 50/50 split between creatives and developers. There was also a good spread in the degree of professional experience of the respondents, but that’s where things started to get surprising.Respondents are mostly “makers” and show a good variety in professional experienceWhen creating 2 groups with people who have more or less than 10 years of experience, it is clear that less experienced professionals skew more towards a neutral or negative stance than the more experienced group.Experienced professionals are more positive and open to vibe codingThis might be because senior professionals see AI as a tool to accelerate their workflows, while more juniors perceive it as a competitor or threat.I then took out the non-professional creatives and looked at the attitude of these 2 groups. Not surprisingly, fewer creatives than developers have a negative attitude towards “vibe coding”, but the percentage of creatives and developers who have a positive attitude stays almost constant. This means that creatives have a more indecisive or neutral stance than developers.Creatives have a more positive attitude to vibe coding than developersWhat are people saying about “vibe coding”?As part of the survey, everybody had the chance to add a few sentences explaining their stance. This was not a compulsory field, but to my surprise, only 3 of the 62 left it empty. Before getting into the sentiment analysis, I noticed something quite interesting while filtering the data. People with a negative attitude had much more to say, and their responses were significantly longer than the other group. They wrote an average of 59 words while the others barely 37 and I think is a good indication of the emotional investment of people who want to articulate and explain their point. Let’s now look at what the different groups of people replied. Patterns in Positive Responses to “Vibe Coding”Positive responders often embraced vibe coding as a way to break free from rigid programming structures and instead explore, improvise, and experiment creatively.“It puts no pressure on it being perfect or thorough.”“Pursuing the vibe, trying what works and then adapt.”“Coding can be geeky and laborious… ‘vibing’ is quite nice.”This perspective repositions code not as rigid infrastructure, but something that favors creativity and playfulness over precision.Several answers point to vibe coding as a democratizing force opening up coding to a broader audience, who want to build without going through the traditional gatekeeping of engineering culture.“For every person complaining… there are ten who are dabbling in code and programming, building stuff without permission.”“Bridges creative with technical perfectly, thus creating potential for independence.”This group often used words like “freedom,” “reframing,” and “revolution.”. Patterns in Neutral Responses to “Vibe Coding”As shown in the initial LinkedIn poll, 27% of respondents expressed mixed feelings. When going through their responses, they recognised potential and were open to experimentation but they also had lingering doubts about the name, seriousness, and future usefulness.“It’s still a hype or buzzword.”“I have mixed feelings of fascination and scepticism.”“Unsure about further developments.”They were on the fence and were often enthusiastic about the capability, but wary of the framing.Neutral responders also acknowledged that complex, polished, or production-level work still requires traditional approaches and framed vibe coding as an early-stage assistant, not a full solution.“Nice tool, but not more than autocomplete on steroids.”“Helps get setup quickly… but critical thinking is still a human job.”“Great for prototyping, not enough to finalize product.”Some respondents were indifferent to the term itself, viewing it more as a label or meme than a paradigm shift. For them, it doesn’t change the substance of what’s happening.“At the end of the day they are just words. Are you able to accomplish what’s needed?”“I think it’s been around forever, just now with a new name.”These voices grounded the discussion in the terminology and I think they bring up a very important point that leads to the polarisation of a lot of the conversations around “vibe coding”. Patterns in Negative Responses to “Vibe Coding”Many respondents expressed concern that vibe coding implies a casual, unstructured approach to coding. This was often linked to fears about poor code quality, bugs, and security issues.“Feels like building a house without knowing how electricity and water systems work.”“Without fundamental knowledge… you quickly lose control over the output.”The term was also seen as dismissive or diminishing the value of skilled developers. It really rubbed people the wrong way, especially those with professional experience.“It downplays the skill and intention behind writing a functional, efficient program.”“Vibe coding implies not understanding what the AI does but still micromanaging it.”Like for “neutral” respondents, there’s a strong mistrust around how the term is usedwhere it’s seen as fueling unrealistic expectations or being pushed by non-experts.“Used to promote coding without knowledge.”“Just another overhyped term like NFTs or memecoins.”“It feels like a joke that went too far.”Ultimately, I decided to compare attitudes that are excitedand acceptingof vibe coding vs. those that reject or criticise it. After all, even among people who were neutral, there was a general acceptance that vibe coding has its place. Many saw it as a useful tool for things like prototyping, creative exploration, or simply making it easier to get started. What really stood out, though, was the absence of fear that was very prominent in the “negative” group and saw vibe coding as a threat to software quality or professional identity.People in the neutral and positive groups generally see potential. They view it as useful for prototyping, creative exploration, or making coding more accessible, but they still recognise the need for structure in complex systems. In contrast, the negative group rejects the concept outright, and not just the name, but what it stands for: a more casual, less rigorous approach to coding. Their opinion is often rooted in defending software engineering as a disciplined craft… and probably their job. “As long as you understand the result and the process, AI can write and fix scripts much faster than humans can.” “It’s a joke. It started as a joke… but to me doesn’t encapsulate actual AI co-engineering.”On the topic of skill and control, the neutral and positive group sees AI as a helpful assistant, assuming that a human is still guiding the process. They mention refining and reviewing as normal parts of the workflow. The negative group sees more danger, fearing that vibe coding gives a false sense of competence. They describe it as producing buggy or shallow results, often in the hands of inexperienced users. “Critical thinking is still a human job… but vibe coding helps with fast results.”“Vibe-Coding takes away the very features of a good developer… logical thinking and orchestration are crucial.”Culturally, the divide is clear. The positive and neutral voices often embrace vibe coding as part of a broader shift, welcoming new types of creators and perspectives. They tend to come from design or interdisciplinary backgrounds and are more comfortable with playful language. On the other hand, the negative group associates the term with hype and cringe, criticising it as disrespectful to those who’ve spent years honing their technical skills.“It’s about playful, relaxed creation — for the love of making something.”Creating a lot of unsafe bloatware with no proper planning.”What’s the future of “Vibe Coding”?The responses to the last question were probably the most surprising to me. I was expecting that the big scepticism towards vibe coding would align with the scepticism on its future, but that was not the case. 90% of people still see “vibe coding” becoming more relevant overall or in niche use cases.Vibe coding is here to stayOut of curiosity, I also went back to see if there was any difference based on professional experience, and that’s where we see the more experienced audience being more conservative. Only 30% of more senior Vs 50% of less experienced professionals see vibe coding playing a role in niche use cases and 13 % Vs only 3% of more experienced users don’t see vibe coding becoming more relevant at all.More experienced professionals are less likely to think Vibe Coding is the futureThere are still many open questions. What is “vibe coding” really? For whom is it? What can you do with it?To answer these questions, I decided to start a new survey you can find here. If you would like to further contribute to this research, I encourage you to participate and in case you are interested, I will share the results with you as well.The more I read or learn about this, I feel “Vibe Coding” is like the “Metaverse”:Some people hate it, some people love it.Everybody means something differentIn one form or another, it is here to stay.What professionals really think about “Vibe Coding” was originally published in UX Collective on Medium, where people are continuing the conversation by highlighting and responding to this story.
    #what #professionals #really #think #about
    What professionals really think about “Vibe Coding”
    Many don’t like it, buteverybody agrees it’s the future.“Vibe Coding” is everywhere. Tools and game engines are implementing AI-assisted coding, vibe coding interest skyrocketed on Google search, on social media, everybody claims to build apps and games in minutes, while the comment section gets flooded with angry developers calling out the pile of garbage code that will never be shipped.A screenshot from Andrej Karpathy with the original “definition” of Vibe CodingBUT, how do professionals feel about it?This is what I will cover in this article. We will look at:How people react to the term vibe coding,How their attitude differs based on who they are and their professional experienceThe reason for their stance towards “vibe coding”How they feel about the impact “vibe coding” will have in the next 5 yearsIt all started with this survey on LinkedIn. I have always been curious about how technology can support creatives and I believe that the only way to get a deeper understanding is to go beyond buzzwords and ask the hard questions. That’s why for over a year, I’ve been conducting weekly interviews with both the founders developing these tools and the creatives utilising them. If you want to learn their journeys, I’ve gathered their insights and experiences on my blog called XR AI Spotlight.Driven by the same motives and curious about people’s feelings about “vibe coding”, I asked a simple question: How does the term “Vibe Coding” make you feel?Original LinkedIn poll by Gabriele RomagnoliIn just three days, the poll collected 139 votes and it was clear that most responders didn’t have a good “vibe” about it. The remaining half was equally split between excitement and no specific feeling.But who are these people? What is their professional background? Why did they respond the way they did?Curious, I created a more comprehensive survey and sent it to everyone who voted on the LinkedIn poll.The survey had four questions:Select what describes you best: developers, creative, non-creative professionalHow many years of experience do you have? 1–5, 6–10, 11–15 or 16+Explain why the term “vibe coding” makes you feel excited/neutral/dismissive?Do you think “vibe coding” will become more relevant in the next 5 years?: It’s the future, only in niche use cases, unlikely, no idea)In a few days, I collected 62 replies and started digging into the findings, and that’s when I finally started understanding who took part in the initial poll.The audienceWhen characterising the audience, I refrained from adding too many options because I just wanted to understand:If the people responding were the ones making stuffWhat percentage of makers were creatives and what developersI was happy to see that only 8% of respondents were non-creative professionals and the remaining 92% were actual makers who have more “skin in the game“ with almost a 50/50 split between creatives and developers. There was also a good spread in the degree of professional experience of the respondents, but that’s where things started to get surprising.Respondents are mostly “makers” and show a good variety in professional experienceWhen creating 2 groups with people who have more or less than 10 years of experience, it is clear that less experienced professionals skew more towards a neutral or negative stance than the more experienced group.Experienced professionals are more positive and open to vibe codingThis might be because senior professionals see AI as a tool to accelerate their workflows, while more juniors perceive it as a competitor or threat.I then took out the non-professional creatives and looked at the attitude of these 2 groups. Not surprisingly, fewer creatives than developers have a negative attitude towards “vibe coding”, but the percentage of creatives and developers who have a positive attitude stays almost constant. This means that creatives have a more indecisive or neutral stance than developers.Creatives have a more positive attitude to vibe coding than developersWhat are people saying about “vibe coding”?As part of the survey, everybody had the chance to add a few sentences explaining their stance. This was not a compulsory field, but to my surprise, only 3 of the 62 left it empty. Before getting into the sentiment analysis, I noticed something quite interesting while filtering the data. People with a negative attitude had much more to say, and their responses were significantly longer than the other group. They wrote an average of 59 words while the others barely 37 and I think is a good indication of the emotional investment of people who want to articulate and explain their point. Let’s now look at what the different groups of people replied.😍 Patterns in Positive Responses to “Vibe Coding”Positive responders often embraced vibe coding as a way to break free from rigid programming structures and instead explore, improvise, and experiment creatively.“It puts no pressure on it being perfect or thorough.”“Pursuing the vibe, trying what works and then adapt.”“Coding can be geeky and laborious… ‘vibing’ is quite nice.”This perspective repositions code not as rigid infrastructure, but something that favors creativity and playfulness over precision.Several answers point to vibe coding as a democratizing force opening up coding to a broader audience, who want to build without going through the traditional gatekeeping of engineering culture.“For every person complaining… there are ten who are dabbling in code and programming, building stuff without permission.”“Bridges creative with technical perfectly, thus creating potential for independence.”This group often used words like “freedom,” “reframing,” and “revolution.”.😑 Patterns in Neutral Responses to “Vibe Coding”As shown in the initial LinkedIn poll, 27% of respondents expressed mixed feelings. When going through their responses, they recognised potential and were open to experimentation but they also had lingering doubts about the name, seriousness, and future usefulness.“It’s still a hype or buzzword.”“I have mixed feelings of fascination and scepticism.”“Unsure about further developments.”They were on the fence and were often enthusiastic about the capability, but wary of the framing.Neutral responders also acknowledged that complex, polished, or production-level work still requires traditional approaches and framed vibe coding as an early-stage assistant, not a full solution.“Nice tool, but not more than autocomplete on steroids.”“Helps get setup quickly… but critical thinking is still a human job.”“Great for prototyping, not enough to finalize product.”Some respondents were indifferent to the term itself, viewing it more as a label or meme than a paradigm shift. For them, it doesn’t change the substance of what’s happening.“At the end of the day they are just words. Are you able to accomplish what’s needed?”“I think it’s been around forever, just now with a new name.”These voices grounded the discussion in the terminology and I think they bring up a very important point that leads to the polarisation of a lot of the conversations around “vibe coding”.🤮 Patterns in Negative Responses to “Vibe Coding”Many respondents expressed concern that vibe coding implies a casual, unstructured approach to coding. This was often linked to fears about poor code quality, bugs, and security issues.“Feels like building a house without knowing how electricity and water systems work.”“Without fundamental knowledge… you quickly lose control over the output.”The term was also seen as dismissive or diminishing the value of skilled developers. It really rubbed people the wrong way, especially those with professional experience.“It downplays the skill and intention behind writing a functional, efficient program.”“Vibe coding implies not understanding what the AI does but still micromanaging it.”Like for “neutral” respondents, there’s a strong mistrust around how the term is usedwhere it’s seen as fueling unrealistic expectations or being pushed by non-experts.“Used to promote coding without knowledge.”“Just another overhyped term like NFTs or memecoins.”“It feels like a joke that went too far.”Ultimately, I decided to compare attitudes that are excitedand acceptingof vibe coding vs. those that reject or criticise it. After all, even among people who were neutral, there was a general acceptance that vibe coding has its place. Many saw it as a useful tool for things like prototyping, creative exploration, or simply making it easier to get started. What really stood out, though, was the absence of fear that was very prominent in the “negative” group and saw vibe coding as a threat to software quality or professional identity.People in the neutral and positive groups generally see potential. They view it as useful for prototyping, creative exploration, or making coding more accessible, but they still recognise the need for structure in complex systems. In contrast, the negative group rejects the concept outright, and not just the name, but what it stands for: a more casual, less rigorous approach to coding. Their opinion is often rooted in defending software engineering as a disciplined craft… and probably their job.😍 “As long as you understand the result and the process, AI can write and fix scripts much faster than humans can.”🤮 “It’s a joke. It started as a joke… but to me doesn’t encapsulate actual AI co-engineering.”On the topic of skill and control, the neutral and positive group sees AI as a helpful assistant, assuming that a human is still guiding the process. They mention refining and reviewing as normal parts of the workflow. The negative group sees more danger, fearing that vibe coding gives a false sense of competence. They describe it as producing buggy or shallow results, often in the hands of inexperienced users.😑 “Critical thinking is still a human job… but vibe coding helps with fast results.”🤮“Vibe-Coding takes away the very features of a good developer… logical thinking and orchestration are crucial.”Culturally, the divide is clear. The positive and neutral voices often embrace vibe coding as part of a broader shift, welcoming new types of creators and perspectives. They tend to come from design or interdisciplinary backgrounds and are more comfortable with playful language. On the other hand, the negative group associates the term with hype and cringe, criticising it as disrespectful to those who’ve spent years honing their technical skills.😍“It’s about playful, relaxed creation — for the love of making something.”🤮Creating a lot of unsafe bloatware with no proper planning.”What’s the future of “Vibe Coding”?The responses to the last question were probably the most surprising to me. I was expecting that the big scepticism towards vibe coding would align with the scepticism on its future, but that was not the case. 90% of people still see “vibe coding” becoming more relevant overall or in niche use cases.Vibe coding is here to stayOut of curiosity, I also went back to see if there was any difference based on professional experience, and that’s where we see the more experienced audience being more conservative. Only 30% of more senior Vs 50% of less experienced professionals see vibe coding playing a role in niche use cases and 13 % Vs only 3% of more experienced users don’t see vibe coding becoming more relevant at all.More experienced professionals are less likely to think Vibe Coding is the futureThere are still many open questions. What is “vibe coding” really? For whom is it? What can you do with it?To answer these questions, I decided to start a new survey you can find here. If you would like to further contribute to this research, I encourage you to participate and in case you are interested, I will share the results with you as well.The more I read or learn about this, I feel “Vibe Coding” is like the “Metaverse”:Some people hate it, some people love it.Everybody means something differentIn one form or another, it is here to stay.What professionals really think about “Vibe Coding” was originally published in UX Collective on Medium, where people are continuing the conversation by highlighting and responding to this story. #what #professionals #really #think #about
    UXDESIGN.CC
    What professionals really think about “Vibe Coding”
    Many don’t like it, but (almost) everybody agrees it’s the future.“Vibe Coding” is everywhere. Tools and game engines are implementing AI-assisted coding, vibe coding interest skyrocketed on Google search, on social media, everybody claims to build apps and games in minutes, while the comment section gets flooded with angry developers calling out the pile of garbage code that will never be shipped.A screenshot from Andrej Karpathy with the original “definition” of Vibe CodingBUT, how do professionals feel about it?This is what I will cover in this article. We will look at:How people react to the term vibe coding,How their attitude differs based on who they are and their professional experienceThe reason for their stance towards “vibe coding” (with direct quotes)How they feel about the impact “vibe coding” will have in the next 5 yearsIt all started with this survey on LinkedIn. I have always been curious about how technology can support creatives and I believe that the only way to get a deeper understanding is to go beyond buzzwords and ask the hard questions. That’s why for over a year, I’ve been conducting weekly interviews with both the founders developing these tools and the creatives utilising them. If you want to learn their journeys, I’ve gathered their insights and experiences on my blog called XR AI Spotlight.Driven by the same motives and curious about people’s feelings about “vibe coding”, I asked a simple question: How does the term “Vibe Coding” make you feel?Original LinkedIn poll by Gabriele RomagnoliIn just three days, the poll collected 139 votes and it was clear that most responders didn’t have a good “vibe” about it. The remaining half was equally split between excitement and no specific feeling.But who are these people? What is their professional background? Why did they respond the way they did?Curious, I created a more comprehensive survey and sent it to everyone who voted on the LinkedIn poll.The survey had four questions:Select what describes you best: developers, creative, non-creative professionalHow many years of experience do you have? 1–5, 6–10, 11–15 or 16+Explain why the term “vibe coding” makes you feel excited/neutral/dismissive?Do you think “vibe coding” will become more relevant in the next 5 years?: It’s the future, only in niche use cases, unlikely, no idea)In a few days, I collected 62 replies and started digging into the findings, and that’s when I finally started understanding who took part in the initial poll.The audienceWhen characterising the audience, I refrained from adding too many options because I just wanted to understand:If the people responding were the ones making stuffWhat percentage of makers were creatives and what developersI was happy to see that only 8% of respondents were non-creative professionals and the remaining 92% were actual makers who have more “skin in the game“ with almost a 50/50 split between creatives and developers. There was also a good spread in the degree of professional experience of the respondents, but that’s where things started to get surprising.Respondents are mostly “makers” and show a good variety in professional experienceWhen creating 2 groups with people who have more or less than 10 years of experience, it is clear that less experienced professionals skew more towards a neutral or negative stance than the more experienced group.Experienced professionals are more positive and open to vibe codingThis might be because senior professionals see AI as a tool to accelerate their workflows, while more juniors perceive it as a competitor or threat.I then took out the non-professional creatives and looked at the attitude of these 2 groups. Not surprisingly, fewer creatives than developers have a negative attitude towards “vibe coding” (47% for developers Vs 37% for creatives), but the percentage of creatives and developers who have a positive attitude stays almost constant. This means that creatives have a more indecisive or neutral stance than developers.Creatives have a more positive attitude to vibe coding than developersWhat are people saying about “vibe coding”?As part of the survey, everybody had the chance to add a few sentences explaining their stance. This was not a compulsory field, but to my surprise, only 3 of the 62 left it empty (thanks everybody). Before getting into the sentiment analysis, I noticed something quite interesting while filtering the data. People with a negative attitude had much more to say, and their responses were significantly longer than the other group. They wrote an average of 59 words while the others barely 37 and I think is a good indication of the emotional investment of people who want to articulate and explain their point. Let’s now look at what the different groups of people replied.😍 Patterns in Positive Responses to “Vibe Coding”Positive responders often embraced vibe coding as a way to break free from rigid programming structures and instead explore, improvise, and experiment creatively.“It puts no pressure on it being perfect or thorough.”“Pursuing the vibe, trying what works and then adapt.”“Coding can be geeky and laborious… ‘vibing’ is quite nice.”This perspective repositions code not as rigid infrastructure, but something that favors creativity and playfulness over precision.Several answers point to vibe coding as a democratizing force opening up coding to a broader audience, who want to build without going through the traditional gatekeeping of engineering culture.“For every person complaining… there are ten who are dabbling in code and programming, building stuff without permission.”“Bridges creative with technical perfectly, thus creating potential for independence.”This group often used words like “freedom,” “reframing,” and “revolution.”.😑 Patterns in Neutral Responses to “Vibe Coding”As shown in the initial LinkedIn poll, 27% of respondents expressed mixed feelings. When going through their responses, they recognised potential and were open to experimentation but they also had lingering doubts about the name, seriousness, and future usefulness.“It’s still a hype or buzzword.”“I have mixed feelings of fascination and scepticism.”“Unsure about further developments.”They were on the fence and were often enthusiastic about the capability, but wary of the framing.Neutral responders also acknowledged that complex, polished, or production-level work still requires traditional approaches and framed vibe coding as an early-stage assistant, not a full solution.“Nice tool, but not more than autocomplete on steroids.”“Helps get setup quickly… but critical thinking is still a human job.”“Great for prototyping, not enough to finalize product.”Some respondents were indifferent to the term itself, viewing it more as a label or meme than a paradigm shift. For them, it doesn’t change the substance of what’s happening.“At the end of the day they are just words. Are you able to accomplish what’s needed?”“I think it’s been around forever, just now with a new name.”These voices grounded the discussion in the terminology and I think they bring up a very important point that leads to the polarisation of a lot of the conversations around “vibe coding”.🤮 Patterns in Negative Responses to “Vibe Coding”Many respondents expressed concern that vibe coding implies a casual, unstructured approach to coding. This was often linked to fears about poor code quality, bugs, and security issues.“Feels like building a house without knowing how electricity and water systems work.”“Without fundamental knowledge… you quickly lose control over the output.”The term was also seen as dismissive or diminishing the value of skilled developers. It really rubbed people the wrong way, especially those with professional experience.“It downplays the skill and intention behind writing a functional, efficient program.”“Vibe coding implies not understanding what the AI does but still micromanaging it.”Like for “neutral” respondents, there’s a strong mistrust around how the term is used (especially on social media) where it’s seen as fueling unrealistic expectations or being pushed by non-experts.“Used to promote coding without knowledge.”“Just another overhyped term like NFTs or memecoins.”“It feels like a joke that went too far.”Ultimately, I decided to compare attitudes that are excited (positive) and accepting (neutral) of vibe coding vs. those that reject or criticise it. After all, even among people who were neutral, there was a general acceptance that vibe coding has its place. Many saw it as a useful tool for things like prototyping, creative exploration, or simply making it easier to get started. What really stood out, though, was the absence of fear that was very prominent in the “negative” group and saw vibe coding as a threat to software quality or professional identity.People in the neutral and positive groups generally see potential. They view it as useful for prototyping, creative exploration, or making coding more accessible, but they still recognise the need for structure in complex systems. In contrast, the negative group rejects the concept outright, and not just the name, but what it stands for: a more casual, less rigorous approach to coding. Their opinion is often rooted in defending software engineering as a disciplined craft… and probably their job.😍 “As long as you understand the result and the process, AI can write and fix scripts much faster than humans can.”🤮 “It’s a joke. It started as a joke… but to me doesn’t encapsulate actual AI co-engineering.”On the topic of skill and control, the neutral and positive group sees AI as a helpful assistant, assuming that a human is still guiding the process. They mention refining and reviewing as normal parts of the workflow. The negative group sees more danger, fearing that vibe coding gives a false sense of competence. They describe it as producing buggy or shallow results, often in the hands of inexperienced users.😑 “Critical thinking is still a human job… but vibe coding helps with fast results.”🤮“Vibe-Coding takes away the very features of a good developer… logical thinking and orchestration are crucial.”Culturally, the divide is clear. The positive and neutral voices often embrace vibe coding as part of a broader shift, welcoming new types of creators and perspectives. They tend to come from design or interdisciplinary backgrounds and are more comfortable with playful language. On the other hand, the negative group associates the term with hype and cringe, criticising it as disrespectful to those who’ve spent years honing their technical skills.😍“It’s about playful, relaxed creation — for the love of making something.”🤮Creating a lot of unsafe bloatware with no proper planning.”What’s the future of “Vibe Coding”?The responses to the last question were probably the most surprising to me. I was expecting that the big scepticism towards vibe coding would align with the scepticism on its future, but that was not the case. 90% of people still see “vibe coding” becoming more relevant overall or in niche use cases.Vibe coding is here to stayOut of curiosity, I also went back to see if there was any difference based on professional experience, and that’s where we see the more experienced audience being more conservative. Only 30% of more senior Vs 50% of less experienced professionals see vibe coding playing a role in niche use cases and 13 % Vs only 3% of more experienced users don’t see vibe coding becoming more relevant at all.More experienced professionals are less likely to think Vibe Coding is the futureThere are still many open questions. What is “vibe coding” really? For whom is it? What can you do with it?To answer these questions, I decided to start a new survey you can find here. If you would like to further contribute to this research, I encourage you to participate and in case you are interested, I will share the results with you as well.The more I read or learn about this, I feel “Vibe Coding” is like the “Metaverse”:Some people hate it, some people love it.Everybody means something differentIn one form or another, it is here to stay.What professionals really think about “Vibe Coding” was originally published in UX Collective on Medium, where people are continuing the conversation by highlighting and responding to this story.
    0 التعليقات 0 المشاركات
  • FrodoKEM: A conservative quantum-safe cryptographic algorithm

    In this post, we describe FrodoKEM, a key encapsulation protocol that offers a simple design and provides strong security guarantees even in a future with powerful quantum computers.
    The quantum threat to cryptography
    For decades, modern cryptography has relied on mathematical problems that are practically impossible for classical computers to solve without a secret key. Cryptosystems like RSA, Diffie-Hellman key-exchange, and elliptic curve-based schemes—which rely on the hardness of the integer factorization anddiscrete logarithm problems—secure communications on the internet, banking transactions, and even national security systems. However, the emergence of
    Quantum computers leverage the principles of quantum mechanics to perform certain calculations exponentially faster than classical computers. Their ability to solve complex problems, such as simulating molecular interactions, optimizing large-scale systems, and accelerating machine learning, is expected to have profound and beneficial implications for fields ranging from chemistry and material science to artificial intelligence.

    Spotlight: AI-POWERED EXPERIENCE

    Microsoft research copilot experience
    Discover more about research at Microsoft through our AI-powered experience

    Start now

    Opens in a new tab
    At the same time, quantum computing is poised to disrupt cryptography. In particular, Shor’s algorithm, a quantum algorithm developed in 1994, can efficiently factor large numbers and compute discrete logarithms—the very problems that underpin the security of RSA, Diffie-Hellman, and elliptic curve cryptography. This means that once large-scale, fault-tolerant quantum computers become available, public-key protocols based on RSA, ECC, and Diffie-Hellman will become insecure, breaking a sizable portion of the cryptographic backbone of today’s digital world. Recent advances in quantum computing, such as Microsoft’s Majorana 1, the first quantum processor powered by topological qubits, represent major steps toward practical quantum computing and underscore the urgency of transitioning to quantum-resistant cryptographic systems.
    To address this looming security crisis, cryptographers and government agencies have been working on post-quantum cryptography—new cryptographic algorithms that can resist attacks from both classical and quantum computers.
    The NIST Post-Quantum Cryptography Standardization effort
    In 2017, the U.S. National Institute of Standards and Technologylaunched the Post-Quantum Cryptography Standardization projectto evaluate and select cryptographic algorithms capable of withstanding quantum attacks. As part of this initiative, NIST sought proposals for two types of cryptographic primitives: key encapsulation mechanisms—which enable two parties to securely derive a shared key to establish an encrypted connection, similar to traditional key exchange schemes—and digital signature schemes.
    This initiative attracted submissions from cryptographers worldwide, and after multiple evaluation rounds, NIST selected CRYSTALS-Kyber, a KEM based on structured lattices, and standardized it as ML-KEM. Additionally, NIST selected three digital signature schemes: CRYSTALS-Dilithium, now called ML-DSA; SPHINCS+, now called SLH-DSA; and Falcon, now called FN-DSA.
    While ML-KEM provides great overall security and efficiency, some governments and cryptographic researchers advocate for the inclusion and standardization of alternative algorithms that minimize reliance on algebraic structure. Reducing algebraic structure might prevent potential vulnerabilities and, hence, can be considered a more conservative design choice. One such algorithm is FrodoKEM.
    International standardization of post-quantum cryptography
    Beyond NIST, other international standardization bodies have been actively working on quantum-resistant cryptographic solutions. The International Organization for Standardizationis leading a global effort to standardize additional PQC algorithms. Notably, European government agencies—including Germany’s BSI, the Netherlands’ NLNCSA and AIVD, and France’s ANSSI—have shown strong support for FrodoKEM, recognizing it as a conservative alternative to structured lattice-based schemes.
    As a result, FrodoKEM is undergoing standardization at ISO. Additionally, ISO is standardizing ML-KEM and a conservative code-based KEM called Classic McEliece. These three algorithms are planned for inclusion in ISO/IEC 18033-2:2006 as Amendment 2.
    What is FrodoKEM?
    FrodoKEM is a key encapsulation mechanismbased on the Learning with Errorsproblem, a cornerstone of lattice-based cryptography. Unlike structured lattice-based schemes such as ML-KEM, FrodoKEM is built on generic, unstructured lattices, i.e., it is based on the plain LWE problem.
    Why unstructured lattices?
    Structured lattice-based schemes introduce additional algebraic properties that could potentially be exploited in future cryptanalytic attacks. By using unstructured lattices, FrodoKEM eliminates these concerns, making it a safer choice in the long run, albeit at the cost of larger key sizes and lower efficiency.
    It is important to emphasize that no particular cryptanalytic weaknesses are currently known for recommended parameterizations of structured lattice schemes in comparison to plain LWE. However, our current understanding of the security of these schemes could potentially change in the future with cryptanalytic advances.
    Lattices and the Learning with Errorsproblem
    Lattice-based cryptography relies on the mathematical structure of lattices, which are regular arrangements of points in multidimensional space. A lattice is defined as the set of all integer linear combinations of a set of basis vectors. The difficulty of certain computational problems on lattices, such as the Shortest Vector Problemand the Learning with Errorsproblem, forms the basis of lattice-based schemes.
    The Learning with Errorsproblem
    The LWE problem is a fundamental hard problem in lattice-based cryptography. It involves solving a system of linear equations where some small random error has been added to each equation, making it extremely difficult to recover the original secret values. This added error ensures that the problem remains computationally infeasible, even for quantum computers. Figure 1 below illustrates the LWE problem, specifically, the search version of the problem.
    As can be seen in Figure 1, for the setup of the problem we need a dimension \that defines the size of matrices, a modulus \that defines the value range of the matrix coefficients, and a certain error distribution \from which we sample \matrices. We sample two matrices from \, a small matrix \and an error matrix \; sample an \matrix \uniformly at random; and compute \. In the illustration, each matrix coefficient is represented by a colored square, and the “legend of coefficients” gives an idea of the size of the respective coefficients, e.g., orange squares represent the small coefficients of matrix \ ). Finally, given \and \, the search LWE problem consists in finding \. This problem is believed to be hard for suitably chosen parameterssufficiently large) and is used at the core of FrodoKEM.
    In comparison, the LWE variant used in ML-KEM—called Module-LWE—has additional symmetries, adding mathematical structure that helps improve efficiency. In a setting similar to that of the search LWE problem above, the matrix \can be represented by just a single row of coefficients.
    FIGURE 1: Visualization of theLWE problem.
    LWE is conjectured to be quantum-resistant, and FrodoKEM’s security is directly tied to its hardness. In other words, cryptanalysts and quantum researchers have not been able to devise an efficient quantum algorithm capable of solving the LWE problem and, hence, FrodoKEM. In cryptography, absolute security can never be guaranteed; instead, confidence in a problem’s hardness comes from extensive scrutiny and its resilience against attacks over time.
    How FrodoKEM Works
    FrodoKEM follows the standard paradigm of a KEM, which consists of three main operations—key generation, encapsulation, and decapsulation—performed interactively between a sender and a recipient with the goal of establishing a shared secret key:

    Key generation, computed by the recipient

    Generates a public key and a secret key.
    The public key is sent to the sender, while the private key remains secret.

    Encapsulation, computed by the sender

    Generates a random session key.
    Encrypts the session key using the recipient’s public key to produce a ciphertext.
    Produces a shared key using the session key and the ciphertext.
    The ciphertext is sent to the recipient.

    Decapsulation, computed by the recipient

    Decrypts the ciphertext using their secret key to recover the original session key.
    Reproduces the shared key using the decrypted session key and the ciphertext.

    The shared key generated by the sender and reconstructed by the recipient can then be used to establish secure symmetric-key encryption for further communication between the two parties.
    Figure 2 below shows a simplified view of the FrodoKEM protocol. As highlighted in red, FrodoKEM uses at its core LWE operations of the form “\”, which are directly applied within the KEM paradigm.
    FIGURE 2: Simplified overview of FrodoKEM.
    Performance: Strong security has a cost
    Not relying on additional algebraic structure certainly comes at a cost for FrodoKEM in the form of increased protocol runtime and bandwidth. The table below compares the performance and key sizes corresponding to the FrodoKEM level 1 parameter setand the respective parameter set of ML-KEM. These parameter sets are intended to match or exceed the brute force security of AES-128. As can be seen, the difference in speed and key sizes between FrodoKEM and ML-KEM is more than an order of magnitude. Nevertheless, the runtime of the FrodoKEM protocol remains reasonable for most applications. For example, on our benchmarking platform clocked at 3.2GHz, the measured runtimes are 0.97 ms, 1.9 ms, and 3.2 ms for security levels 1, 2, and 3, respectively.
    For security-sensitive applications, a more relevant comparison is with Classic McEliece, a post-quantum code-based scheme also considered for standardization. In this case, FrodoKEM offers several efficiency advantages. Classic McEliece’s public keys are significantly larger—well over an order of magnitude greater than FrodoKEM’s—and its key generation is substantially more computationally expensive. Nonetheless, Classic McEliece provides an advantage in certain static key-exchange scenarios, where its high key generation cost can be amortized across multiple key encapsulation executions.
    TABLE 1: Comparison of key sizes and performance on an x86-64 processor for NIST level 1 parameter sets.
    A holistic design made with security in mind
    FrodoKEM’s design principles support security beyond its reliance on generic, unstructured lattices to minimize the attack surface of potential future cryptanalytic threats. Its parameters have been carefully chosen with additional security margins to withstand advancements in known attacks. Furthermore, FrodoKEM is designed with simplicity in mind—its internal operations are based on straightforward matrix-vector arithmetic using integer coefficients reduced modulo a power of two. These design decisions facilitate simple, compact and secure implementations that are also easier to maintain and to protect against side-channel attacks.
    Conclusion
    After years of research and analysis, the next generation of post-quantum cryptographic algorithms has arrived. NIST has chosen strong PQC protocols that we believe will serve Microsoft and its customers well in many applications. For security-sensitive applications, FrodoKEM offers a secure yet practical approach for post-quantum cryptography. While its reliance on unstructured lattices results in larger key sizes and higher computational overhead compared to structured lattice-based alternatives, it provides strong security assurances against potential future attacks. Given the ongoing standardization efforts and its endorsement by multiple governmental agencies, FrodoKEM is well-positioned as a viable alternative for organizations seeking long-term cryptographic resilience in a post-quantum world.
    Further Reading
    For those interested in learning more about FrodoKEM, post-quantum cryptography, and lattice-based cryptography, the following resources provide valuable insights:

    The official FrodoKEM website: /, which contains, among several other resources, FrodoKEM’s specification document.
    The official FrodoKEM software library:, which contains reference and optimized implementations of FrodoKEM written in C and Python.
    NIST’s Post-Quantum Cryptography Project:.
    Microsoft’s blogpost on its transition plan for PQC:.
    A comprehensive survey on lattice-based cryptography: Peikert, C. “A Decade of Lattice Cryptography.” Foundations and Trends in Theoretical Computer Science.A comprehensive tutorial on modern lattice-based schemes, including ML-KEM and ML-DSA: Lyubashevsky, V. “Basic Lattice Cryptography: The concepts behind Kyberand Dilithium.”.Opens in a new tab
    #frodokem #conservative #quantumsafe #cryptographic #algorithm
    FrodoKEM: A conservative quantum-safe cryptographic algorithm
    In this post, we describe FrodoKEM, a key encapsulation protocol that offers a simple design and provides strong security guarantees even in a future with powerful quantum computers. The quantum threat to cryptography For decades, modern cryptography has relied on mathematical problems that are practically impossible for classical computers to solve without a secret key. Cryptosystems like RSA, Diffie-Hellman key-exchange, and elliptic curve-based schemes—which rely on the hardness of the integer factorization anddiscrete logarithm problems—secure communications on the internet, banking transactions, and even national security systems. However, the emergence of Quantum computers leverage the principles of quantum mechanics to perform certain calculations exponentially faster than classical computers. Their ability to solve complex problems, such as simulating molecular interactions, optimizing large-scale systems, and accelerating machine learning, is expected to have profound and beneficial implications for fields ranging from chemistry and material science to artificial intelligence. Spotlight: AI-POWERED EXPERIENCE Microsoft research copilot experience Discover more about research at Microsoft through our AI-powered experience Start now Opens in a new tab At the same time, quantum computing is poised to disrupt cryptography. In particular, Shor’s algorithm, a quantum algorithm developed in 1994, can efficiently factor large numbers and compute discrete logarithms—the very problems that underpin the security of RSA, Diffie-Hellman, and elliptic curve cryptography. This means that once large-scale, fault-tolerant quantum computers become available, public-key protocols based on RSA, ECC, and Diffie-Hellman will become insecure, breaking a sizable portion of the cryptographic backbone of today’s digital world. Recent advances in quantum computing, such as Microsoft’s Majorana 1, the first quantum processor powered by topological qubits, represent major steps toward practical quantum computing and underscore the urgency of transitioning to quantum-resistant cryptographic systems. To address this looming security crisis, cryptographers and government agencies have been working on post-quantum cryptography—new cryptographic algorithms that can resist attacks from both classical and quantum computers. The NIST Post-Quantum Cryptography Standardization effort In 2017, the U.S. National Institute of Standards and Technologylaunched the Post-Quantum Cryptography Standardization projectto evaluate and select cryptographic algorithms capable of withstanding quantum attacks. As part of this initiative, NIST sought proposals for two types of cryptographic primitives: key encapsulation mechanisms—which enable two parties to securely derive a shared key to establish an encrypted connection, similar to traditional key exchange schemes—and digital signature schemes. This initiative attracted submissions from cryptographers worldwide, and after multiple evaluation rounds, NIST selected CRYSTALS-Kyber, a KEM based on structured lattices, and standardized it as ML-KEM. Additionally, NIST selected three digital signature schemes: CRYSTALS-Dilithium, now called ML-DSA; SPHINCS+, now called SLH-DSA; and Falcon, now called FN-DSA. While ML-KEM provides great overall security and efficiency, some governments and cryptographic researchers advocate for the inclusion and standardization of alternative algorithms that minimize reliance on algebraic structure. Reducing algebraic structure might prevent potential vulnerabilities and, hence, can be considered a more conservative design choice. One such algorithm is FrodoKEM. International standardization of post-quantum cryptography Beyond NIST, other international standardization bodies have been actively working on quantum-resistant cryptographic solutions. The International Organization for Standardizationis leading a global effort to standardize additional PQC algorithms. Notably, European government agencies—including Germany’s BSI, the Netherlands’ NLNCSA and AIVD, and France’s ANSSI—have shown strong support for FrodoKEM, recognizing it as a conservative alternative to structured lattice-based schemes. As a result, FrodoKEM is undergoing standardization at ISO. Additionally, ISO is standardizing ML-KEM and a conservative code-based KEM called Classic McEliece. These three algorithms are planned for inclusion in ISO/IEC 18033-2:2006 as Amendment 2. What is FrodoKEM? FrodoKEM is a key encapsulation mechanismbased on the Learning with Errorsproblem, a cornerstone of lattice-based cryptography. Unlike structured lattice-based schemes such as ML-KEM, FrodoKEM is built on generic, unstructured lattices, i.e., it is based on the plain LWE problem. Why unstructured lattices? Structured lattice-based schemes introduce additional algebraic properties that could potentially be exploited in future cryptanalytic attacks. By using unstructured lattices, FrodoKEM eliminates these concerns, making it a safer choice in the long run, albeit at the cost of larger key sizes and lower efficiency. It is important to emphasize that no particular cryptanalytic weaknesses are currently known for recommended parameterizations of structured lattice schemes in comparison to plain LWE. However, our current understanding of the security of these schemes could potentially change in the future with cryptanalytic advances. Lattices and the Learning with Errorsproblem Lattice-based cryptography relies on the mathematical structure of lattices, which are regular arrangements of points in multidimensional space. A lattice is defined as the set of all integer linear combinations of a set of basis vectors. The difficulty of certain computational problems on lattices, such as the Shortest Vector Problemand the Learning with Errorsproblem, forms the basis of lattice-based schemes. The Learning with Errorsproblem The LWE problem is a fundamental hard problem in lattice-based cryptography. It involves solving a system of linear equations where some small random error has been added to each equation, making it extremely difficult to recover the original secret values. This added error ensures that the problem remains computationally infeasible, even for quantum computers. Figure 1 below illustrates the LWE problem, specifically, the search version of the problem. As can be seen in Figure 1, for the setup of the problem we need a dimension \that defines the size of matrices, a modulus \that defines the value range of the matrix coefficients, and a certain error distribution \from which we sample \matrices. We sample two matrices from \, a small matrix \and an error matrix \; sample an \matrix \uniformly at random; and compute \. In the illustration, each matrix coefficient is represented by a colored square, and the “legend of coefficients” gives an idea of the size of the respective coefficients, e.g., orange squares represent the small coefficients of matrix \ ). Finally, given \and \, the search LWE problem consists in finding \. This problem is believed to be hard for suitably chosen parameterssufficiently large) and is used at the core of FrodoKEM. In comparison, the LWE variant used in ML-KEM—called Module-LWE—has additional symmetries, adding mathematical structure that helps improve efficiency. In a setting similar to that of the search LWE problem above, the matrix \can be represented by just a single row of coefficients. FIGURE 1: Visualization of theLWE problem. LWE is conjectured to be quantum-resistant, and FrodoKEM’s security is directly tied to its hardness. In other words, cryptanalysts and quantum researchers have not been able to devise an efficient quantum algorithm capable of solving the LWE problem and, hence, FrodoKEM. In cryptography, absolute security can never be guaranteed; instead, confidence in a problem’s hardness comes from extensive scrutiny and its resilience against attacks over time. How FrodoKEM Works FrodoKEM follows the standard paradigm of a KEM, which consists of three main operations—key generation, encapsulation, and decapsulation—performed interactively between a sender and a recipient with the goal of establishing a shared secret key: Key generation, computed by the recipient Generates a public key and a secret key. The public key is sent to the sender, while the private key remains secret. Encapsulation, computed by the sender Generates a random session key. Encrypts the session key using the recipient’s public key to produce a ciphertext. Produces a shared key using the session key and the ciphertext. The ciphertext is sent to the recipient. Decapsulation, computed by the recipient Decrypts the ciphertext using their secret key to recover the original session key. Reproduces the shared key using the decrypted session key and the ciphertext. The shared key generated by the sender and reconstructed by the recipient can then be used to establish secure symmetric-key encryption for further communication between the two parties. Figure 2 below shows a simplified view of the FrodoKEM protocol. As highlighted in red, FrodoKEM uses at its core LWE operations of the form “\”, which are directly applied within the KEM paradigm. FIGURE 2: Simplified overview of FrodoKEM. Performance: Strong security has a cost Not relying on additional algebraic structure certainly comes at a cost for FrodoKEM in the form of increased protocol runtime and bandwidth. The table below compares the performance and key sizes corresponding to the FrodoKEM level 1 parameter setand the respective parameter set of ML-KEM. These parameter sets are intended to match or exceed the brute force security of AES-128. As can be seen, the difference in speed and key sizes between FrodoKEM and ML-KEM is more than an order of magnitude. Nevertheless, the runtime of the FrodoKEM protocol remains reasonable for most applications. For example, on our benchmarking platform clocked at 3.2GHz, the measured runtimes are 0.97 ms, 1.9 ms, and 3.2 ms for security levels 1, 2, and 3, respectively. For security-sensitive applications, a more relevant comparison is with Classic McEliece, a post-quantum code-based scheme also considered for standardization. In this case, FrodoKEM offers several efficiency advantages. Classic McEliece’s public keys are significantly larger—well over an order of magnitude greater than FrodoKEM’s—and its key generation is substantially more computationally expensive. Nonetheless, Classic McEliece provides an advantage in certain static key-exchange scenarios, where its high key generation cost can be amortized across multiple key encapsulation executions. TABLE 1: Comparison of key sizes and performance on an x86-64 processor for NIST level 1 parameter sets. A holistic design made with security in mind FrodoKEM’s design principles support security beyond its reliance on generic, unstructured lattices to minimize the attack surface of potential future cryptanalytic threats. Its parameters have been carefully chosen with additional security margins to withstand advancements in known attacks. Furthermore, FrodoKEM is designed with simplicity in mind—its internal operations are based on straightforward matrix-vector arithmetic using integer coefficients reduced modulo a power of two. These design decisions facilitate simple, compact and secure implementations that are also easier to maintain and to protect against side-channel attacks. Conclusion After years of research and analysis, the next generation of post-quantum cryptographic algorithms has arrived. NIST has chosen strong PQC protocols that we believe will serve Microsoft and its customers well in many applications. For security-sensitive applications, FrodoKEM offers a secure yet practical approach for post-quantum cryptography. While its reliance on unstructured lattices results in larger key sizes and higher computational overhead compared to structured lattice-based alternatives, it provides strong security assurances against potential future attacks. Given the ongoing standardization efforts and its endorsement by multiple governmental agencies, FrodoKEM is well-positioned as a viable alternative for organizations seeking long-term cryptographic resilience in a post-quantum world. Further Reading For those interested in learning more about FrodoKEM, post-quantum cryptography, and lattice-based cryptography, the following resources provide valuable insights: The official FrodoKEM website: /, which contains, among several other resources, FrodoKEM’s specification document. The official FrodoKEM software library:, which contains reference and optimized implementations of FrodoKEM written in C and Python. NIST’s Post-Quantum Cryptography Project:. Microsoft’s blogpost on its transition plan for PQC:. A comprehensive survey on lattice-based cryptography: Peikert, C. “A Decade of Lattice Cryptography.” Foundations and Trends in Theoretical Computer Science.A comprehensive tutorial on modern lattice-based schemes, including ML-KEM and ML-DSA: Lyubashevsky, V. “Basic Lattice Cryptography: The concepts behind Kyberand Dilithium.”.Opens in a new tab #frodokem #conservative #quantumsafe #cryptographic #algorithm
    WWW.MICROSOFT.COM
    FrodoKEM: A conservative quantum-safe cryptographic algorithm
    In this post, we describe FrodoKEM, a key encapsulation protocol that offers a simple design and provides strong security guarantees even in a future with powerful quantum computers. The quantum threat to cryptography For decades, modern cryptography has relied on mathematical problems that are practically impossible for classical computers to solve without a secret key. Cryptosystems like RSA, Diffie-Hellman key-exchange, and elliptic curve-based schemes—which rely on the hardness of the integer factorization and (elliptic curve) discrete logarithm problems—secure communications on the internet, banking transactions, and even national security systems. However, the emergence of Quantum computers leverage the principles of quantum mechanics to perform certain calculations exponentially faster than classical computers. Their ability to solve complex problems, such as simulating molecular interactions, optimizing large-scale systems, and accelerating machine learning, is expected to have profound and beneficial implications for fields ranging from chemistry and material science to artificial intelligence. Spotlight: AI-POWERED EXPERIENCE Microsoft research copilot experience Discover more about research at Microsoft through our AI-powered experience Start now Opens in a new tab At the same time, quantum computing is poised to disrupt cryptography. In particular, Shor’s algorithm, a quantum algorithm developed in 1994, can efficiently factor large numbers and compute discrete logarithms—the very problems that underpin the security of RSA, Diffie-Hellman, and elliptic curve cryptography. This means that once large-scale, fault-tolerant quantum computers become available, public-key protocols based on RSA, ECC, and Diffie-Hellman will become insecure, breaking a sizable portion of the cryptographic backbone of today’s digital world. Recent advances in quantum computing, such as Microsoft’s Majorana 1 (opens in new tab), the first quantum processor powered by topological qubits, represent major steps toward practical quantum computing and underscore the urgency of transitioning to quantum-resistant cryptographic systems. To address this looming security crisis, cryptographers and government agencies have been working on post-quantum cryptography (PQC)—new cryptographic algorithms that can resist attacks from both classical and quantum computers. The NIST Post-Quantum Cryptography Standardization effort In 2017, the U.S. National Institute of Standards and Technology (NIST) launched the Post-Quantum Cryptography Standardization project (opens in new tab) to evaluate and select cryptographic algorithms capable of withstanding quantum attacks. As part of this initiative, NIST sought proposals for two types of cryptographic primitives: key encapsulation mechanisms (KEMs)—which enable two parties to securely derive a shared key to establish an encrypted connection, similar to traditional key exchange schemes—and digital signature schemes. This initiative attracted submissions from cryptographers worldwide, and after multiple evaluation rounds, NIST selected CRYSTALS-Kyber, a KEM based on structured lattices, and standardized it as ML-KEM (opens in new tab). Additionally, NIST selected three digital signature schemes: CRYSTALS-Dilithium, now called ML-DSA; SPHINCS+, now called SLH-DSA; and Falcon, now called FN-DSA. While ML-KEM provides great overall security and efficiency, some governments and cryptographic researchers advocate for the inclusion and standardization of alternative algorithms that minimize reliance on algebraic structure. Reducing algebraic structure might prevent potential vulnerabilities and, hence, can be considered a more conservative design choice. One such algorithm is FrodoKEM. International standardization of post-quantum cryptography Beyond NIST, other international standardization bodies have been actively working on quantum-resistant cryptographic solutions. The International Organization for Standardization (ISO) is leading a global effort to standardize additional PQC algorithms. Notably, European government agencies—including Germany’s BSI (opens in new tab), the Netherlands’ NLNCSA and AIVD (opens in new tab), and France’s ANSSI (opens in new tab)—have shown strong support for FrodoKEM, recognizing it as a conservative alternative to structured lattice-based schemes. As a result, FrodoKEM is undergoing standardization at ISO. Additionally, ISO is standardizing ML-KEM and a conservative code-based KEM called Classic McEliece. These three algorithms are planned for inclusion in ISO/IEC 18033-2:2006 as Amendment 2 (opens in new tab). What is FrodoKEM? FrodoKEM is a key encapsulation mechanism (KEM) based on the Learning with Errors (LWE) problem, a cornerstone of lattice-based cryptography. Unlike structured lattice-based schemes such as ML-KEM, FrodoKEM is built on generic, unstructured lattices, i.e., it is based on the plain LWE problem. Why unstructured lattices? Structured lattice-based schemes introduce additional algebraic properties that could potentially be exploited in future cryptanalytic attacks. By using unstructured lattices, FrodoKEM eliminates these concerns, making it a safer choice in the long run, albeit at the cost of larger key sizes and lower efficiency. It is important to emphasize that no particular cryptanalytic weaknesses are currently known for recommended parameterizations of structured lattice schemes in comparison to plain LWE. However, our current understanding of the security of these schemes could potentially change in the future with cryptanalytic advances. Lattices and the Learning with Errors (LWE) problem Lattice-based cryptography relies on the mathematical structure of lattices, which are regular arrangements of points in multidimensional space. A lattice is defined as the set of all integer linear combinations of a set of basis vectors. The difficulty of certain computational problems on lattices, such as the Shortest Vector Problem (SVP) and the Learning with Errors (LWE) problem, forms the basis of lattice-based schemes. The Learning with Errors (LWE) problem The LWE problem is a fundamental hard problem in lattice-based cryptography. It involves solving a system of linear equations where some small random error has been added to each equation, making it extremely difficult to recover the original secret values. This added error ensures that the problem remains computationally infeasible, even for quantum computers. Figure 1 below illustrates the LWE problem, specifically, the search version of the problem. As can be seen in Figure 1, for the setup of the problem we need a dimension \(n\) that defines the size of matrices, a modulus \(q\) that defines the value range of the matrix coefficients, and a certain error distribution \(\chi\) from which we sample \(\textit{“small”}\) matrices. We sample two matrices from \(\chi\), a small matrix \(\text{s}\) and an error matrix \(\text{e}\) (for simplicity in the explanation, we assume that both have only one column); sample an \(n \times n\) matrix \(\text{A}\) uniformly at random; and compute \(\text{b} = \text{A} \times \text{s} + \text{e}\). In the illustration, each matrix coefficient is represented by a colored square, and the “legend of coefficients” gives an idea of the size of the respective coefficients, e.g., orange squares represent the small coefficients of matrix \(\text{s}\) (small relative to the modulus \(q\)). Finally, given \(\text{A}\) and \(\text{b}\), the search LWE problem consists in finding \(\text{s}\). This problem is believed to be hard for suitably chosen parameters (e.g., for dimension \(n\) sufficiently large) and is used at the core of FrodoKEM. In comparison, the LWE variant used in ML-KEM—called Module-LWE (M-LWE)—has additional symmetries, adding mathematical structure that helps improve efficiency. In a setting similar to that of the search LWE problem above, the matrix \(\text{A}\) can be represented by just a single row of coefficients. FIGURE 1: Visualization of the (search) LWE problem. LWE is conjectured to be quantum-resistant, and FrodoKEM’s security is directly tied to its hardness. In other words, cryptanalysts and quantum researchers have not been able to devise an efficient quantum algorithm capable of solving the LWE problem and, hence, FrodoKEM. In cryptography, absolute security can never be guaranteed; instead, confidence in a problem’s hardness comes from extensive scrutiny and its resilience against attacks over time. How FrodoKEM Works FrodoKEM follows the standard paradigm of a KEM, which consists of three main operations—key generation, encapsulation, and decapsulation—performed interactively between a sender and a recipient with the goal of establishing a shared secret key: Key generation (KeyGen), computed by the recipient Generates a public key and a secret key. The public key is sent to the sender, while the private key remains secret. Encapsulation (Encapsulate), computed by the sender Generates a random session key. Encrypts the session key using the recipient’s public key to produce a ciphertext. Produces a shared key using the session key and the ciphertext. The ciphertext is sent to the recipient. Decapsulation (Decapsulate), computed by the recipient Decrypts the ciphertext using their secret key to recover the original session key. Reproduces the shared key using the decrypted session key and the ciphertext. The shared key generated by the sender and reconstructed by the recipient can then be used to establish secure symmetric-key encryption for further communication between the two parties. Figure 2 below shows a simplified view of the FrodoKEM protocol. As highlighted in red, FrodoKEM uses at its core LWE operations of the form “\(\text{b} = \text{A} \times \text{s} + \text{e}\)”, which are directly applied within the KEM paradigm. FIGURE 2: Simplified overview of FrodoKEM. Performance: Strong security has a cost Not relying on additional algebraic structure certainly comes at a cost for FrodoKEM in the form of increased protocol runtime and bandwidth. The table below compares the performance and key sizes corresponding to the FrodoKEM level 1 parameter set (variant called “FrodoKEM-640-AES”) and the respective parameter set of ML-KEM (variant called “ML-KEM-512”). These parameter sets are intended to match or exceed the brute force security of AES-128. As can be seen, the difference in speed and key sizes between FrodoKEM and ML-KEM is more than an order of magnitude. Nevertheless, the runtime of the FrodoKEM protocol remains reasonable for most applications. For example, on our benchmarking platform clocked at 3.2GHz, the measured runtimes are 0.97 ms, 1.9 ms, and 3.2 ms for security levels 1, 2, and 3, respectively. For security-sensitive applications, a more relevant comparison is with Classic McEliece, a post-quantum code-based scheme also considered for standardization. In this case, FrodoKEM offers several efficiency advantages. Classic McEliece’s public keys are significantly larger—well over an order of magnitude greater than FrodoKEM’s—and its key generation is substantially more computationally expensive. Nonetheless, Classic McEliece provides an advantage in certain static key-exchange scenarios, where its high key generation cost can be amortized across multiple key encapsulation executions. TABLE 1: Comparison of key sizes and performance on an x86-64 processor for NIST level 1 parameter sets. A holistic design made with security in mind FrodoKEM’s design principles support security beyond its reliance on generic, unstructured lattices to minimize the attack surface of potential future cryptanalytic threats. Its parameters have been carefully chosen with additional security margins to withstand advancements in known attacks. Furthermore, FrodoKEM is designed with simplicity in mind—its internal operations are based on straightforward matrix-vector arithmetic using integer coefficients reduced modulo a power of two. These design decisions facilitate simple, compact and secure implementations that are also easier to maintain and to protect against side-channel attacks. Conclusion After years of research and analysis, the next generation of post-quantum cryptographic algorithms has arrived. NIST has chosen strong PQC protocols that we believe will serve Microsoft and its customers well in many applications. For security-sensitive applications, FrodoKEM offers a secure yet practical approach for post-quantum cryptography. While its reliance on unstructured lattices results in larger key sizes and higher computational overhead compared to structured lattice-based alternatives, it provides strong security assurances against potential future attacks. Given the ongoing standardization efforts and its endorsement by multiple governmental agencies, FrodoKEM is well-positioned as a viable alternative for organizations seeking long-term cryptographic resilience in a post-quantum world. Further Reading For those interested in learning more about FrodoKEM, post-quantum cryptography, and lattice-based cryptography, the following resources provide valuable insights: The official FrodoKEM website: https://frodokem.org/ (opens in new tab), which contains, among several other resources, FrodoKEM’s specification document. The official FrodoKEM software library: https://github.com/Microsoft/PQCrypto-LWEKE (opens in new tab), which contains reference and optimized implementations of FrodoKEM written in C and Python. NIST’s Post-Quantum Cryptography Project: https://csrc.nist.gov/projects/post-quantum-cryptography (opens in new tab). Microsoft’s blogpost on its transition plan for PQC: https://techcommunity.microsoft.com/blog/microsoft-security-blog/microsofts-quantum-resistant-cryptography-is-here/4238780 (opens in new tab). A comprehensive survey on lattice-based cryptography: Peikert, C. “A Decade of Lattice Cryptography.” Foundations and Trends in Theoretical Computer Science. (2016) A comprehensive tutorial on modern lattice-based schemes, including ML-KEM and ML-DSA: Lyubashevsky, V. “Basic Lattice Cryptography: The concepts behind Kyber (ML-KEM) and Dilithium (ML-DSA).” https://eprint.iacr.org/2024/1287 (opens in new tab). (2024) Opens in a new tab
    0 التعليقات 0 المشاركات