The growth in developing and deploying large language models (LLMs) is closely tied to architectural innovations, large-scale datasets, and hardware improvements. Models like DeepSeek-V3, GPT-4o, Claude 3.5 Sonnet, and LLaMA-3 have demonstrated how scaling enhances reasoning and dialogue capabilities. However, as their performance increases, so do computing, memory, and communication bandwidth demands, placing substantial strain on hardware. Without parallel progress in model and infrastructure co-design, these models risk becoming accessible only to organizations with massive resources. This makes optimizing training cost, inference speed, and memory efficiency a critical area of research. A core challenge is the mismatch between model size and hardware capabilities. LLM memory consumption grows over 1000% annually, while high-speed memory bandwidth increases by less than 50%. During inference, caching prior context in Key-Value (KV) stores adds to memory strain and slows processing. Dense models activate all parameters per token, escalating computational costs, particularly for models with hundreds of billions of parameters. This results in billions of floating-point operations per token and high energy demands. Time Per Output Token (TPOT), a key performance metric, also suffers, impacting user experience. These problems call for solutions beyond simply adding more hardware. Techniques like Multi-Query Attention (MQA) and Grouped-Query Attention (GQA) reduce memory usage by sharing attention weights. Windowed KV caching lowers memory use by storing only recent tokens, but can limit long-context understanding. Quantized compression with low-bit formats like 4-bit and 8-bit cuts memory further, though sometimes with trade-offs in accuracy. Precision formats such as BF16 and FP8 improve training speed and efficiency. While useful, these techniques often tackle individual issues rather than a comprehensive solution to scaling challenges. Researchers from DeepSeek-AI introduced a more integrated and efficient strategy with the development of DeepSeek-V3, designed to scale intelligently rather than excessively. Utilizing 2,048 NVIDIA H800 GPUs, the model achieves state-of-the-art performance while focusing on cost-efficiency. Instead of depending on expansive infrastructure, the team engineered the model architecture to work harmoniously with hardware constraints. Central to this effort are innovations such as Multi-head Latent Attention (MLA) for memory optimization, a Mixture of Experts (MoE) framework for computational efficiency, and FP8 mixed-precision training to accelerate performance without sacrificing accuracy. A custom Multi-Plane Network Topology was also employed to minimize inter-device communication overhead. Collectively, these components make DeepSeek-V3 a scalable and accessible solution, capable of rivaling much larger systems while operating on significantly leaner resources. The architecture achieves memory efficiency by reducing the KV cache requirement per token to just 70 KB using MLA, compared to 327 KB and 516 KB in Qwen-2.5 and LLaMA-3.1, respectively. This reduction is accomplished by compressing attention heads into a smaller latent vector jointly trained with the model. Computational efficiency is further boosted with the MoE model, which increases total parameters to 671 billion but only activates 37 billion per token. This contrasts sharply with dense models that require full parameter activation. For example, LLaMA-3.1 needs 2,448 GFLOPS per token, while DeepSeek-V3 operates at just 250 GFLOPS. Also, the architecture integrates a Multi-Token Prediction (MTP) module, enabling the generation of multiple tokens in a single step. The system achieves up to 1.8x improvement in generation speed, and real-world measurements show 80-90% token acceptance for speculative decoding. Using a system interconnected by CX7 400 Gbps InfiniBand NICs, DeepSeek-V3 achieves a theoretical TPOT of 14.76 milliseconds, equal to 67 tokens per second. With higher-bandwidth setups like NVIDIA GB200 NVL72 offering 900 GB/s, this number can be reduced to 0.82 milliseconds TPOT, potentially achieving 1,200 tokens per second. The practical throughput is lower due to compute-communication overlap and memory limitations, but the framework lays the foundation for future high-speed implementations. FP8 precision further adds to the speed gains. The training framework applies tile-wise 1×128 and block-wise 128×128 quantization, with less than 0.25% accuracy loss compared to BF16. These results were validated on smaller 16B and 230B parameter versions before integration into the 671B model. Several key takeaways from the research on insights into DeepSeek-V3 include: MLA compression reduces KV cache size per token from 516 KB to 70 KB, significantly lowering memory demands during inference. Only 37 billion of the 671 billion total parameters are activated per token, dramatically reducing compute and memory requirements without compromising model performance. DeepSeek-V3 requires just 250 GFLOPS per token, compared to 2,448 GFLOPS for dense models like LLaMA-3.1, highlighting its computational efficiency. Achieves up to 67 tokens per second (TPS) on a 400 Gbps InfiniBand network, with the potential to scale to 1,200 TPS using advanced interconnects like NVL72. Multi-Token Prediction (MTP) improves generation speed by 1.8×, with a token acceptance rate of 80-90%, enhancing inference throughput. FP8 mixed-precision training enables faster computation with less than 0.25% accuracy degradation, validated through extensive small-scale ablations. Capable of running on a $10,000 server equipped with a consumer-grade GPU, delivering nearly 20 TPS, making high-performance LLMs more accessible. In conclusion, the research presents a well-rounded framework for building powerful and resource-conscious large-scale language models. By directly addressing fundamental constraints, such as memory limitations, high computational costs, and inference latency, the researchers demonstrate that intelligent architecture-hardware co-design can unlock high performance without relying on vast infrastructure. DeepSeek-V3 is a clear example of how efficiency and scalability coexist, enabling broader adoption of cutting-edge AI capabilities across diverse organizations. This approach shifts the narrative from scaling through brute force to scaling through smarter engineering. Check out the Paper. All credit for this research goes to the researchers of this project. Also, feel free to follow us on Twitter and don’t forget to join our 90k+ ML SubReddit. Sana HassanSana Hassan, a consulting intern at Marktechpost and dual-degree student at IIT Madras, is passionate about applying technology and AI to address real-world challenges. With a keen interest in solving practical problems, he brings a fresh perspective to the intersection of AI and real-life solutions.Sana Hassanhttps://www.marktechpost.com/author/sana-hassan/Meet LangGraph Multi-Agent Swarm: A Python Library for Creating Swarm-Style Multi-Agent Systems Using LangGraphSana Hassanhttps://www.marktechpost.com/author/sana-hassan/ByteDance Introduces Seed1.5-VL: A Vision-Language Foundation Model Designed to Advance General-Purpose Multimodal Understanding and ReasoningSana Hassanhttps://www.marktechpost.com/author/sana-hassan/Researchers from Tsinghua and ModelBest Release Ultra-FineWeb: A Trillion-Token Dataset Enhancing LLM Accuracy Across BenchmarksSana Hassanhttps://www.marktechpost.com/author/sana-hassan/Coding Agents See 75% Surge: SimilarWeb’s AI Usage Report Highlights the Sectors Winning and Losing in 2025’s Generative AI Boom

Join our daily and weekly newsletters for the latest updates and exclusive content on industry-leading AI coverage. Learn More Unpatched systems are a ticking time bomb. Fifty-seven percent of cyberattack victims acknowledge that available patches would have prevented breaches, yet nearly one-third admit failing to act, compounding the risk. Ponemon research shows organizations now take an alarming average of 43 days to detect cyberattacks, even after a patch is released, up from 36 days the previous year. According to the Verizon 2024 Data Breach Investigations Report, attackers’ ability to exploit vulnerabilities surged by 180% from 2023 to 2024. Chronic firefighting makes manual or partially automated patching overly burdensome, further pushing patching down teams’ priority lists. Relying on manual or partially automated patching systems is considered too time-consuming, further reducing patching to the bottom of a team’s action item list. This is consistent with an Ivanti study that found that the majority (71%) of IT and security professionals think patching is overly complex, cumbersome and time-consuming. When it comes to patching, complacency kills Attackers aggressively exploit legacy Common Vulnerabilities and Exposures (CVEs), often ten or more years old. A sure sign of how effective attackers’ tradecraft is becoming at targeting legacy CVEs is their success with vulnerabilities in some cases, 10-plus years old. A sure sign that attackers are finding new ways to weaponize old vulnerabilities is reflected in the startling stat that 76% of vulnerabilities leveraged by ransomware were reported between 2010 and 2019. The misalignment between IT and security teams compounds delays, with 27% lacking cohesive patch strategies and nearly a quarter disagreeing on patch schedules. One of the unexpected benefits of automating patch management is breaking the impasse between IT and security when it comes to managing the patch workload.    “Typically, on average, an enterprise may patch 90% of desktops within two to four weeks, 80% of Windows servers within six weeks and only 25% of Oracle Databases within six months from patch release date”, writes Gartner in their recent report, “We’re not patching our way out of vulnerability exposure.” The report states that “the cold, hard reality is that no one is out patching threat actors at scale in any size organization, geography or industry vertical.” Ring deployment: proactive defense at scale Every unpatched endpoint or threat surface invites attackers to exploit it. Enterprises are losing the patching race, which motivates attackers even more. In the meantime, patching has become exponentially more challenging for security and IT teams to manage manually. Approximately a decade ago, ring deployment began to rely on Microsoft-dominated networks. Since then, ring deployments have proliferated across on-premise and cloud-based patch and risk management systems. Ring deployment provides a phased, automated strategy, shrinking attacker windows and breach risks. Ring deployment rolls out patches incrementally through carefully controlled stages or “rings:” Test Ring (1%): Core IT teams quickly validate patch stability. Early Adopter Ring (5–10%): A broader internal group confirms real-world compatibility. Production Ring (80–90%): Enterprise-wide rollout after stability is conclusively proven. Ivanti’s recent release of ring deployment is designed to give security teams greater control over when patches will be deployed, to which systems and how each sequence of updates will be managed. By addressing patching issues early, the goal is to minimize risks and reduce and eliminate disruptions. Gartner’s ring deployment strategy escalates patches from internal IT outward, providing continuous validation and dramatically reducing deployment risk. Source: Gartner, “Modernize Windows and Third-Party Application Patching,” p. 6. Ring deployment crushes MTTP, ends reactive patching chaos Relying on outdated vulnerability ratings to lead patch management strategies only increases the risk of a breach as enterprises race to keep up with growing patch backlogs. That’s often when patching becomes cybersecurity’s endless nightmare, with attackers looking to capitalize on the many legacy CVEs that remain unprotected. Gartner’s take in their recent report “Modernize windows and third-party application patching” makes the point brutally clear, showing how traditional patching methods routinely fail to keep pace. In contrast, enterprises embracing ring deployment are getting measurable results. Their research finds ring deployment achieves a “99% patch success within 24 hours for up to 100,000 PCs,” leaving traditional methods far behind. During an interview with VentureBeat, Tony Miller, Ivanti’s VP of enterprise services, emphasized that “Ivanti Neurons for Patch Management and implementing Ring Deployment is an important part of our Customer Zero journey.” He said the company uses many of its own products, which allows for a quick feedback loop and gives developers insight into customers’ pain points. Miller added: “We’ve tested out Ring Deployment internally with a limited group, and we are in the process of rolling it out organization-wide. In our test group, we have benefited from deploying patches based on real-world risk, and ensuring that updates don’t interrupt employee productivity–a significant challenge for any IT organization.” VentureBeat also spoke with Jesse Miller, SVP and director of IT at Southstar Bank, about leveraging Ivanti’s dynamic Vulnerability Risk Rating (VRR), an AI-driven system continuously recalibrated with real-time threat intelligence, live exploit activity, and current attack data. Miller stated clearly: “This is an important change for us and the entire industry. Judging a patch based on its CVSS now is like working in a vacuum. When judging how impactful something can be, you have to take everything from current events, your industry, your environment and more into the equation. Ultimately, we are just making wiser decisions as we are not disregarding CVSS scoring; we are simply adding to it.” Miller also highlighted his team’s prioritization strategy: “We have been able to focus on prioritizing Zero-Day and Priority patches to get out first, as well as anything being exploited live in the wild. Using patch prioritization helps us eliminate our biggest risk first so that we can reduce our attack surface as quickly as possible.” By combining ring deployment and dynamic VRR technology, Ivanti Neurons provides enterprises with structured visual orchestration of incremental patch rollouts. This approach sharply reduces Mean-Time-to-Patch (MTTP), accelerating patches from targeted testing through full deployment and significantly decreasing the exposure windows that attackers exploit. Caption: The Ivanti Neurons interface visually manages deployment rings, success thresholds, patching progress and streamlining operational clarity. Source: Ivanti Neurons Comparing Ivanti Neurons, Microsoft Autopatch, Tanium and ServiceNow: Key strengths and gaps When selecting enterprise patch management solutions, apparent differences emerge among leading providers, including Microsoft Autopatch, Tanium, ServiceNow and Ivanti Neurons. Microsoft Autopatch relies on ring deployment but is restricted to Windows environments, including Microsoft 365 applications. Ivanti Neurons expands on this concept by covering a broader spectrum, including Windows, macOS, Linux and various third-party applications. This enables enterprise-wide patch management for organizations with large-scale, diverse infrastructure. Tanium stands out for its robust endpoint visibility and detailed reporting features, but its infrastructure requirements typically align better with resource-intensive enterprises. Meanwhile, ServiceNow’s strength lies in workflow automation and IT service management integrations. Executing actual patches often demands significant additional customization or third-party integrations. Ivanti Neurons aims to differentiate by integrating dynamic risk assessments, phased ring deployments and automated workflows within a single platform. It directly addresses common enterprise challenges in patch management, including visibility gaps, operational complexity and uncertainty about vulnerability prioritization with real-time risk assessments and intuitive visual dashboards. Caption: Ivanti Neurons provides real-time patch status, vulnerability assessments, and risk exposure metrics, ensuring continuous visibility. Source: Ivanti Neurons Transforming patch management into a strategic advantage Patching alone cannot eliminate vulnerability exposure. Gartner’s analysts continue to stress the necessity of integrating compensating controls, including endpoint protection platforms (EPP), multifactor authentication, and network segmentation to reinforce security beyond basic patching. Combining ring deployment with integrated compensating controls that are part of a broader zero-trust framework ensures security, allows IT teams to shrink exposure windows, and better manage cyber risks. Ivanti’s approach to ring deployment incorporates real-time risk assessments, automated remediation workflows, and built-in threat management, directly aligning patch management with broader business resilience strategies. The design decision to make it part of Neurons for Patch Management delivers the scale enterprises need to improve risk management’s real-time visibility.   Bottom line: Integrating ring deployment with compensating controls and prioritization tools transforms patch management from a reactive burden to a strategic advantage. Daily insights on business use cases with VB Daily If you want to impress your boss, VB Daily has you covered. We give you the inside scoop on what companies are doing with generative AI, from regulatory shifts to practical deployments, so you can share insights for maximum ROI. Read our Privacy Policy Thanks for subscribing. Check out more VB newsletters here. An error occured.

Let's make this simple: You want to know if there are any post- or mid-credits scenes in Final Destination: Bloodlines. The answer is no. There weren't any credits scenes in the first five movies and there isn’t one in the sixth either!There is some imagery that runs along with the credits which is fun to check out though.Full spoilers for the movie (and the entire Final Destination series so far) follow!Final Destination: Bloodlines manages to have fun with the formula of the series, both sticking to the basic scenario fans expect – someone’s premonition of an impending terrible tragedy leads them to escape that tragedy alongside a group of others, only for Death itself to kill those who escaped it one by one in elaborate ways – while also introducing its own specifics that make it feel a bit different and fresh. Let’s break down the ending of the film and how it relates to the series as a whole…The Best Final Destination DeathsThe Set-UpIn Bloodlines, Iris (played by Gabrielle Rose in the present and Brec Bassinger in the past), the woman who had the premonition of the collapse of the high-rise Skyview Restaurant Tower, did so way way back in 1968. And unlike in the previous films, where many still died in the actual disaster except the few people who left thanks to the premonition, in this situation, Iris saved all of the hundreds of people packing the restaurant that night, who were evacuated thanks to her warning. Slowly but surely, Death did come after them for escaping its grasp, except there were extenuating circumstances, since so many of these people went on to have children and sometimes grandchildren. So Death, always so tidy and persistent, has spent the last 57 years killing not only each survivor off but the entire bloodline that has resulted from each person, since by Death’s rules, they shouldn’t have existed in the first place.. Now, Death’s work on Project: Skyview (our term, not Death’s) is nearly complete, and Iris’ family remains his big unfinished task – all of which starts to become clear to Iris’ granddaughter Stefani (Kaitlyn Santa Juana) when she begins having nightmares of Iris’ Skyview premonition, leading her to seek out the grandmother she’d never met, and who she was always told was crazy. PlayFinal Destination: Bloodlines Ending ExplainedA Reunion to Die ForStefani is initially skeptical of Iris’ story and the reason she now has spent years barricaded inside a house she’s attempted to death-proof to protect herself the best she can, even as she tells Stefani she now is dying from cancer and thus won’t be able to escape Death much longer. But when the still disbelieving Stefani goes outside to leave, Iris impulsively runs after her to ensure Stefani takes the book in which Iris has collected her findings on what happened to all those who survived Skyview and how to try to avoid literal Death traps - and decides to prove what she knows about Death’s plan by staying outside long enough for a weather vane to snap off and impale her in front of Stefani. Soon enough, with Iris dead, Death now goes after everyone else in the family, which includes Stefani’s brother and her estranged mother, plus her uncle and three cousins (anyone who married into the family, like Stefani’s father or her aunt are safe, since they would have existed regardless of Skyview). And after Uncle Howard (Alex Zahara) and his daughter Julia (Anna Lore) both go out in classic Final Destination scenarios involving a lawnmower and a garbage truck, the rest of the family is suddenly much more onboard with the claims of both Stefani and her mother Darlene (Rya Kihlstedt) - the latter of whom returns after years in self-exile because her own erratic behavior thanks to her mother’s “Death is everywhere” teachings had made her fear how she was raising her kids. Tony Todd’s Final Appearance: One Last Message From an IconMaking an emotional final appearance as his second most famous horror character after Candyman, the late, great Tony Todd – who passed away a few months after production wrapped on Bloodlines – returns as Final Destination regular William Bludworth, who Stefani and her family encounter at a hospital, learning he is the “JB” Iris referred to in her book. It turns out JB is a nickname his friends use, based off of his full name being William John Bludworth. It’s a fun way to suddenly add some personal touches to a character who was so enigmatic in his previous appearances that this is the first time since we met him 25 years ago that his name has been spoken out loud. Bludworth is only in the one scene, which was the norm for Todd’s role in this franchise, but it’s a big one for several reasons, effectively bidding a well-earned fond farewell to both the character and the man who played him. PlayBeyond his middle name and a nickname we didn’t know before, Bludworth reveals much more, including that he was the little boy who Iris tried to help in her premonition in 1968, in which the two of them died last in the tower collapse, making him the other last target Death has been seeking among those who survived the Skyview. Now though, like Iris did, he has terminal cancer and his time is nearly up once Iris’ family are all gone. Todd himself was sadly in the final stages of stomach cancer when he shot Final Destination: Bloodlines and the filmmakers have noted all involved understood the situation and why it was important to properly say goodbye to the character while, most importantly, giving Todd his due. As Bloodlines co-director Zach Lipovsky explained to IGN, “We’re really grateful that we had the ability to, from the beginning, design that experience for the audience with Tony and with all the writers and everybody. We knew he was ill for quite a while and he was extremely excited to be in the movie. He was very grateful for the ability to participate in the film and he was so joyful on set when he was there and he was cracking jokes and really excited to just have his ability to be in the film and give his character a lot more backstory. We give a lot of answers to who Bludworth is in the film, which is something that during the franchise, people have been clamoring for for a really long time. But we also knew that this was also going to be a goodbye of the character. And that's something that we worked very closely with him, to figure out really the best way of doing that, because these films are about death and his mortality was very present as we were working with him.” Bludworth tells Stefani and the others there are two known methods to actually cheat Death, in a moment that is rather exciting for longtime Final Destination fans in terms of acknowledging previous lore. First, as established in Final Destination 5, you can take the life of someone else - basically using that other person as a sacrifice, with you now getting the “credit” for the time your victim naturally had left to live, or even potentially some extra credit if they had decades and decades more to go before they would have died. But perhaps more importantly, because it’s the only way Bludworth knows of to save everyone still alive involved in a situation like this, is the cheat introduced in Final Destination 2 where clinically dying but then being resuscitated breaks Death’s chain completely. Which means if one of the family can pull this off, they can all be saved. But Bludworth says only one person has ever done this successfully (more on that below). He had this sort of mischievous smile, even when he delivers that line and then says, ‘Good luck.’ -Co-director Zach Lipovsky on shooting Tony Todd's final scene“Todd’s scene ends with Bludworth revealing that he is going to retire and enjoy the time he has left and then his final words get notably poignant for a Final Destination film - something Lipovsky credits fully to Todd. “One of the unique opportunities that came up was that near the end of that scene, we asked him to actually throw away the script for a moment and just speak from the heart as to everything that he was thinking about as far as what the movie was about, what the franchise has been about, but also just what life's about and what is it all about in the end. And the take that's in the film where he says, ‘Life is precious. Cherish every second because you never know when…’ And the earnestness that he says that with all came in the moment from him. And I think you really feel that when you watch the movie that he's obviously speaking as a character who knows that their death is coming, but he's also speaking as an actor who's speaking to the audience as far as what's important in life. And that was a really powerful moment on set when we filmed that with him.” Not surprisingly, it was a highly emotional day on set when Todd shot his scene, but Lipovsky loves how Todd’s actual final words of “Good luck” to the other characters (and, essentially, to the audience) and how he delivers them let him also meld the actor and Bludworth together further.“He had this sort of mischievous smile, even when he delivers that line and then says, ‘Good luck’ in the way that he has – that sort of dark, mischievous way as he goes out the door – he knew exactly what he was doing and he relished [it].” Final Destination: Bloodline GalleryFarewell to the Family While still at the hospital, Stefani’s cousins Erik (Richard Harmon) and Bobby (Owen Patrick Joyner) are the next to go. Technically, Erik wasn’t on Death’s list because he doesn’t share Iris’ bloodline – he’s shocked to discover he was the result of an affair his mother Brenda (April Telek) had – but he gets taken out too when he attempts to break the chain by “killing” his brother using Bobby’s peanut allergy before rushing him to the ER to be revived. However, an errant, Death-controlled MRI machine acting like it’s Magneto on a rampage pulls the piercing-laden Erik towards it, who is then snapped in half when a wheelchair shoves him into the MRI machine in a very unrecommended manner - and then Bobby is stabbed by a projectile-powered spring from a vending machine, which drills into his head. With Uncle Howard’s side of the family all gone, it’s just Stefani and her brother Charlie (Tio Briones) and Darlene left. Given all Iris did to keep it safe for herself inside, they decide to go to Iris’ abandoned cabin, with Darlene intending to now live the isolated life her mother did - because if Death can’t get to her, it can’t move on to her kids. But when they arrive, Death does its best to keep them out, with the RV crashing and Stefani submerged in water as a result, while the house itself gets set on fire and explodes. Darlene is then killed when a post falls onto her but Charlie gets to his sister, who has seemingly drowned, and performs CPR on her. He is able to save her, and in the process, seems to have finally stopped Death from continuing to hunt them. The siblings laugh, thinking they’ve escaped - before one of the train cars suddenly pivots, sending huge logs flying which crush and kill Stefani and Charlie.“Sometime later, Charlie is getting ready for prom night alongside his dad and sister and it’s mentioned to his date’s father, who’s a doctor, how Charlie brought Stefani back from the dead. However, the doctor then tells them that, considering how quickly Stefani was revived, she was unconscious but never actually clinically dead… which means Death was never truly thwarted.And that’s when a train passing by crashes and derails, skidding through the street and seemingly aiming right for Stefani and Charlie, who desperately try to outrun it. It comes to a stop and the siblings laugh, thinking they’ve escaped - before one of the train cars suddenly pivots on its side, sending huge logs it was carrying flying through the air, which crush and kill Stefani and Charlie, in a callback to one of the franchise’s most famous and most meme’d moments (from Final Destination 2). Does Final Destination Bloodlines Have a Mid- or Post-Credit Scene?Not really, but there are some visuals accompanying the closing credits that focus on articles Iris had collected in her book about various notable deaths through the years, intercut with quick footage from some of those tragedies - before we end on the newest article, reporting on Stefani and Charlie’s bizarre death. PlayBut Does Bloodlines Set Up Final Destination 7 in Any Way?The sixth Final Destination movie doesn’t really offer any set-up for a seventh installment… unless it does? This is a franchise that has never been about heavy serialization. Only the second movie was truly a direct sequel with explicit plot threads to the movie that preceded it, including a prominent returning character in the form of Ali Larter’s Clear Rivers. But following that film – and Clear dying in it – the series consisted of nearly entirely standalone stories that introduced a brand new group of characters each time, with the exception of a possible William Bludworth scene (he wasn’t in Final Destination 3 or 4, though Tony Todd made an audio cameo in FD3). And having new characters made sense, because Final Destination 3, 4 and 5, as with Bloodlines now, also made sure there were zero survivors among their crop of new Death targets. Along with Bludworth, the only real recurring element beyond the core concept was that the strange occurrences of the first film’s Flight 180 explosion and the ill-fated group who initially escaped that scenario were at least somewhat well known and would usually be brought up at some point, but even then, usually in a nebulous manner. (Though Final Destination 5 of course skipped a Flight 180 mention in order to mask its very fun Secret Prequel status, with that film’s ending looping back into the original movie in a thrilling manner.)To have Final Destination 2's Kimberly brought up makes it hard not to wonder if there might be plans for her going forward as someone with important information for those wishing to stop Death.“All of which is to say that it really stands out in Final Destination: Bloodlines when Bludworth, while explaining how you can actually cheat Death – and talking about the only person who did it – says the name Kimberly Corman. Played by AJ Cook, Kimberly Corman was the main character in 2003’s Final Destination 2, and following multiple mentions in Bloodlines of the “survivor” Iris wrote about “JB” finding in her book, Bludworth specifically mentions Kimberly as the one and only person who’s ever fully cheated Death without it coming back around on her. In Final Destination 2’s conclusion, Kimberly purposely drove into a lake and drowned and was truly clinically dead briefly before a doctor resuscitated her. (It’s worth noting that Kimberly’s actions also saved her friend, Thomas Burke, who would have died after her, but we’ll just assume Bludworth didn’t want to complicate matters and stuck to discussing the person whose actual decision affected the outcome.)Longtime mega-fans of the series may recall that the Final Destination 3 DVD had a “Choose Their Fate” interactive special feature where you could see alternate scenarios from what occurred in the film. And in one of them, a headline did report on Kimberly and Burke’s eventual deaths. But that version of the story was never canon and now Bludworth’s information in Bloodlines confirms Kimberly’s method really and truly worked and she’s still alive. It’s been 22 years since we’ve seen Kimberly or Burke but to have Kimberly’s name suddenly brought up in this manner makes it hard not to wonder if there might be plans for her going forward as someone with important information for those wishing to stop Death in the future - especially given that, with Bludworth no longer an option, this series is probably in need of a new Person Who Knows Things for the newbies to go to, given sticking only to internet searches for your characters just isn’t cinematically exciting. And look, AJ Cook’s been plenty busy for the past couple of decades as a cast member on Criminal Minds, but maybe she can still take a break to go deal with Death once again. Of course, there’s also Iris’ book and all of the information she’s gathered as a notable remaining element, and it does stand out that Stefani’s father Marty (Tinpo Lee) and Aunt Brenda are both alive at the end of the film, thanks to not being part of Iris’ bloodline. Could either one of them or Iris’ book play a role in the future, at least as far as briefly appearing to pass on what they know? We’ll have to see what Death’s – and the Final Destination producers’ – design is.What did you think of Bloodlines? Let’s discuss in the comments!Note: This story was updated with full spoilers on May 16, 2025.

Join our daily and weekly newsletters for the latest updates and exclusive content on industry-leading AI coverage. Learn More Google’s new AlphaEvolve shows what happens when an AI agent graduates from lab demo to production work, and you’ve got one of the most talented technology companies driving it. Built by Google’s DeepMind, the system autonomously rewrites critical code and already pays for itself inside Google. It shattered a 56-year-old record in matrix multiplication (the core of many machine learning workloads) and clawed back 0.7% of compute capacity across the company’s global data centers. Those headline feats matter, but the deeper lesson for enterprise tech leaders is how AlphaEvolve pulls them off. Its architecture – controller, fast-draft models, deep-thinking models, automated evaluators and versioned memory – illustrates the kind of production-grade plumbing that makes autonomous agents safe to deploy at scale. Google’s AI technology is arguably second to none. So the trick is figuring out how to learn from it, or even using it directly. Google says an Early Access Program is coming for academic partners and that “broader availability” is being explored, but details are thin. Until then, AlphaEvolve is a best-practice template: If you want agents that touch high-value workloads, you’ll need comparable orchestration, testing and guardrails. Consider just the data center win. Google won’t put a price tag on the reclaimed 0.7%, but its annual capex runs tens of billions of dollars. Even a rough estimate puts the savings in the hundreds of millions annually—enough, as independent developer Sam Witteveen noted on our recent podcast, to pay for training one of the flagship Gemini models, estimated to cost upwards of $191 million for a version like Gemini Ultra. VentureBeat was the first to report about the AlphaEvolve news earlier this week. Now we’ll go deeper: how the system works, where the engineering bar really sits and the concrete steps enterprises can take to build (or buy) something comparable. 1. Beyond simple scripts: The rise of the “agent operating system” AlphaEvolve runs on what is best described as an agent operating system – a distributed, asynchronous pipeline built for continuous improvement at scale. Its core pieces are a controller, a pair of large language models (Gemini Flash for breadth; Gemini Pro for depth), a versioned program-memory database and a fleet of evaluator workers, all tuned for high throughput rather than just low latency. A high-level overview of the AlphaEvolve agent structure. Source: AlphaEvolve paper. This architecture isn’t conceptually new, but the execution is. “It’s just an unbelievably good execution,” Witteveen says. The AlphaEvolve paper describes the orchestrator as an “evolutionary algorithm that gradually develops programs that improve the score on the automated evaluation metrics” (p. 3); in short, an “autonomous pipeline of LLMs whose task is to improve an algorithm by making direct changes to the code” (p. 1). Takeaway for enterprises: If your agent plans include unsupervised runs on high-value tasks, plan for similar infrastructure: job queues, a versioned memory store, service-mesh tracing and secure sandboxing for any code the agent produces.  2. The evaluator engine: driving progress with automated, objective feedback A key element of AlphaEvolve is its rigorous evaluation framework. Every iteration proposed by the pair of LLMs is accepted or rejected based on a user-supplied “evaluate” function that returns machine-gradable metrics. This evaluation system begins with ultrafast unit-test checks on each proposed code change – simple, automatic tests (similar to the unit tests developers already write) that verify the snippet still compiles and produces the right answers on a handful of micro-inputs – before passing the survivors on to heavier benchmarks and LLM-generated reviews. This runs in parallel, so the search stays fast and safe. In short: Let the models suggest fixes, then verify each one against tests you trust. AlphaEvolve also supports multi-objective optimization (optimizing latency and accuracy simultaneously), evolving programs that hit several metrics at once. Counter-intuitively, balancing multiple goals can improve a single target metric by encouraging more diverse solutions. Takeaway for enterprises: Production agents need deterministic scorekeepers. Whether that’s unit tests, full simulators, or canary traffic analysis. Automated evaluators are both your safety net and your growth engine. Before you launch an agentic project, ask: “Do we have a metric the agent can score itself against?” 3. Smart model use, iterative code refinement AlphaEvolve tackles every coding problem with a two-model rhythm. First, Gemini Flash fires off quick drafts, giving the system a broad set of ideas to explore. Then Gemini Pro studies those drafts in more depth and returns a smaller set of stronger candidates. Feeding both models is a lightweight “prompt builder,” a helper script that assembles the question each model sees. It blends three kinds of context: earlier code attempts saved in a project database, any guardrails or rules the engineering team has written and relevant external material such as research papers or developer notes. With that richer backdrop, Gemini Flash can roam widely while Gemini Pro zeroes in on quality. Unlike many agent demos that tweak one function at a time, AlphaEvolve edits entire repositories. It describes each change as a standard diff block – the same patch format engineers push to GitHub – so it can touch dozens of files without losing track. Afterward, automated tests decide whether the patch sticks. Over repeated cycles, the agent’s memory of success and failure grows, so it proposes better patches and wastes less compute on dead ends. Takeaway for enterprises: Let cheaper, faster models handle brainstorming, then call on a more capable model to refine the best ideas. Preserve every trial in a searchable history, because that memory speeds up later work and can be reused across teams. Accordingly, vendors are rushing to provide developers with new tooling around things like memory. Products such as OpenMemory MCP, which provides a portable memory store, and the new long- and short-term memory APIs in LlamaIndex are making this kind of persistent context almost as easy to plug in as logging. OpenAI’s Codex-1 software-engineering agent, also released today, underscores the same pattern. It fires off parallel tasks inside a secure sandbox, runs unit tests and returns pull-request drafts—effectively a code-specific echo of AlphaEvolve’s broader search-and-evaluate loop. 4. Measure to manage: targeting agentic AI for demonstrable ROI AlphaEvolve’s tangible wins – reclaiming 0.7% of data center capacity, cutting Gemini training kernel runtime 23%, speeding FlashAttention 32%, and simplifying TPU design – share one trait: they target domains with airtight metrics. For data center scheduling, AlphaEvolve evolved a heuristic that was evaluated using a simulator of Google’s data centers based on historical workloads. For kernel optimization, the objective was to minimize actual runtime on TPU accelerators across a dataset of realistic kernel input shapes. Takeaway for enterprises: This clarity allows the agent to self-improve and demonstrate unambiguous value. 5. Laying the groundwork: essential prerequisites for enterprise agentic success While AlphaEvolve’s achievements are inspiring, Google’s paper is also clear about its scope and requirements. The primary limitation is the need for an automated evaluator; problems requiring manual experimentation or “wet-lab” feedback are currently out of scope for this specific approach. The system can consume significant compute – “on the order of 100 compute-hours to evaluate any new solution” (AlphaEvolve paper, page 8), necessitating parallelization and careful capacity planning. Before allocating significant budget to complex agentic systems, technical leaders must ask critical questions: Machine-gradable problem? Do we have a clear, automatable metric against which the agent can score its own performance? Compute capacity? Can we afford the potentially compute-heavy inner loop of generation, evaluation, and refinement, especially during the development and training phase? Codebase & memory readiness? Is your codebase structured for iterative, possibly diff-based, modifications? And can you implement the instrumented memory systems vital for an agent to learn from its evolutionary history? Takeaway for enterprises: The increasing focus on robust agent identity and access management, as seen with platforms like Frontegg, Auth0 and others, also points to the maturing infrastructure required to deploy agents that interact securely with multiple enterprise systems. The agentic future is engineered, not just summoned AlphaEvolve’s message for enterprise teams is manifold. First, your operating system around agents is now far more important than model intelligence. Google’s blueprint shows three pillars that can’t be skipped: Deterministic evaluators that give the agent an unambiguous score every time it makes a change. Long-running orchestration that can juggle fast “draft” models like Gemini Flash with slower, more rigorous models – whether that’s Google’s stack or a framework such as LangChain’s LangGraph. Persistent memory so each iteration builds on the last instead of relearning from scratch. Enterprises that already have logging, test harnesses and versioned code repositories are closer than they think. The next step is to wire those assets into a self-serve evaluation loop so multiple agent-generated solutions can compete, and only the highest-scoring patch ships.  As Cisco’s Anurag Dhingra, VP and GM of Enterprise Connectivity and Collaboration, told VentureBeat in an interview this week: “It’s happening, it is very, very real,” he said of enterprises using AI agents in manufacturing, warehouses, customer contact centers. “It is not something in the future. It is happening there today.” He warned that as these agents become more pervasive, doing “human-like work,” the strain on existing systems will be immense: “The network traffic is going to go through the roof,” Dhingra said. Your network, budget and competitive edge will likely feel that strain before the hype cycle settles. Start proving out a contained, metric-driven use case this quarter – then scale what works. Watch the video podcast I did with developer Sam Witteveen, where we go deep on production-grade agents, and how AlphaEvolve is showing the way: Daily insights on business use cases with VB Daily If you want to impress your boss, VB Daily has you covered. We give you the inside scoop on what companies are doing with generative AI, from regulatory shifts to practical deployments, so you can share insights for maximum ROI. Read our Privacy Policy Thanks for subscribing. Check out more VB newsletters here. An error occured.

If you own a printer from China-based Procolored, watch out: The company’s driver files are full of malware, including a Windows-based backdoor.Karsten Hahn, a researcher at cybersecurity vendor G Data, reported the findings on Thursday. "A printer company provided infected printer software for half a year," he said.Hahn began investigating after YouTuber Cameron Coward at Serial Hobbyism received a printer from Procolored, a provider of direct-to-film printers, which can be used for creating custom T-shirts. While testing the printer for a review, the built-in antivirus Windows Defender and Google's Chrome browser alerted him of malware threats on his PC. His computer had been hit with Floxif, a powerful malware that can change Windows executables and install other malicious code. It can also spread itself through connected USB drives. Coward’s PC received the malware alert after installing software from a ZIP folder on the “USB thumb drive Procolored supplied with the printer.”Although Procolored, a Shenzhen-based company, claimed the malware alerts were false-positives, Coward posted a call on Reddit for a third-party security researcher to double-check. Hahn at G Data began investigating and traced the threat to the printer driver files hosted on Procolored's website. (Credit: Mega.nz/Procolored)Surprisingly, Procolored continues to host the printer driver files for six products on a third-party Mega.nz file sharing account. Hahn’s antivirus scan found that 39 of the files triggered two malware detections: One for a cryptocurrency wallet stealer, the other a backdoor for Windows PCs dubbed XRed.  Recommended by Our EditorsHahn estimates the malicious driver files were circulating for half a year because the Mega.nz directory shows many of the files were last updated about six months ago. His investigation also uncovered evidence that driver files had been originally tampered with on a system that had been “infected several times” with different kinds of malware, which might explain why Hahn’s PC encountered the Floxif infection. Procolored didn’t immediately respond to a request for comment. But the company told Hahn that it suspects the drivers files were tampered with through an infected USB drive. "The software hosted on our website was initially transferred via USB drives. It is possible that a virus was introduced during this process,” Procolored said. "As a precaution, all software has been temporarily removed from the Procolored official website,” the company added. “We are conducting a comprehensive malware scan of every file. Only after passing stringent virus and security checks will the software be re-uploaded. This is a top priority for us, and we are taking it very seriously."The statement also notes that Procolored plans on disclosing the incident to customers and updating its site “once all software has been thoroughly reviewed and confirmed safe.” Hahn says he’s received copies of the new driver files and reports they appear to be clean. Some might speculate that Procolored deliberately planted the malware. But in his blog post, Hahn wrote, “a far more plausible explanation points to the absence or failure of antivirus scanning on the systems used to compile and distribute the software packages.” That's because the command-and-control server for the backdoor malware XRed appears to have been offline since February 2024, reducing the threat's severity. In the meantime, Hahn recommends affected users consider reinstalling the Windows OS to fully wipe out the threat. "It is possible that some users have dismissed antivirus warnings, assuming the files were safe. This could have allowed the malware to remain undetected," he said.

AMETEK, provider of industrial technology solutions, and FARO Technologies, a specialist in 3D measurement and imaging solutions, have entered into a definitive agreement under which AMETEK will acquire all outstanding shares of FARO for $44 per share in cash. The purchase price reflects a 40% premium over FARO’s closing share price on May 5, 2025, and values the company at approximately $920 million. The boards of directors for both companies have unanimously approved the transaction. “FARO is an outstanding acquisition for AMETEK and an excellent strategic fit with our Ultra Precision Technologies division,” comments David A. Zapico, AMETEK Chairman and Chief Executive Officer. “FARO’s differentiated 3D metrology and imaging solutions expand our presence in attractive growth markets. Its strong brand, global customer base, employees and technology capabilities complement our existing Creaform business and provide compelling opportunities for growth and margin expansion.” AMETEK is listed on the New York Stock Exchange. Photo via AMETEK. The transaction is subject to customary closing conditions, including regulatory approvals and the approval of FARO shareholders. Completion is expected in the second half of 2025. About FARO Technologies Founded in 1981 and headquartered in Lake Mary, Florida, FARO Technologies provides a broad range of 3D measurement and imaging technologies. Its product portfolio includes portable measurement arms, laser scanners, trackers, specialized software, and comprehensive service offerings. Serving a diverse set of industries such as aerospace and defense, FARO generates approximately $340 million in annual revenue. “We are excited to join AMETEK and become part of its portfolio of industry-leading technology businesses,” said Peter Lau, President, CEO, and Director of FARO Technologies. “AMETEK’s global scale, operational excellence, and dedication to innovation will help us accelerate our growth and continue to deliver cutting-edge solutions to customers worldwide.” FARO Blink Imaging Laser Scanner. Image via FARO Technologies. 3D Printing Mergers and Acquisitions  AMETEK and FARO Technologies are not the only companies executing mergers and acquisitions in additive manufacturing.  This month Sodick, a Japanese EDM manufacturer, has finalized the acquisition of  a metal 3D printer manufacturer Prima Additive, reinforcing its position in the metal additive manufacturing sector. With the majority stake secured, Prima Additive has officially exited the Prima Industrie Group and is now a wholly owned subsidiary of Sodick. Going forward, the company will operate under the name “Prima Additive by Sodick.” The existing management team will remain in place, with CEO Paolo Calefati continuing to lead the company. Plans are already underway to open a new production facility and expand R&D operations in Turin, Italy. In April, Nano Dimension completed its acquisition of U.S. FDM 3D printer manufacturer Markforged Holding Corporation.Nano Dimension’s deal for Markforged was first announced in September 2024. Valued at $116 million, or $5.00 per share, the transaction has been sealed following the completion of regulatory approvals and satisfaction of customary closing conditions. As part of the agreement, Markforged’s Chief Financial Officer, Assaf Zipori, has become Nano Dimension’s new CFO.  droive Elsewhere, United Performance Metals (UPM), a US-based specialty metals solutions provider and affiliate of O’Neal Industries, acquired Fabrisonic LLC, an Ohio-based 3D metal printing manufacturing company. The acquisition is intended to enhance UPM’s manufacturing capabilities and expand its range of solutions. Take the 3DPI Reader Survey — shape the future of AM reporting in under 5 minutes. Subscribe to the 3D Printing Industry newsletter to keep up with the latest 3D printing news. You can also follow us on LinkedIn, and subscribe to the 3D Printing Industry Youtube channel to access more exclusive content. Featured imageshows FARO Blink Imaging Laser Scanner. Image via FARO Technologies.

If you want to get your hands on the new McCrispy Strips, you might have to show your photo ID.A McDonald’s in Virginia has just implemented an age restriction for customers.The fast food location in Franconia, Va., has banned any customer under the age of 21 from entering the establishment.According to NBC Washington, the new rule was made to protect its workers after multiple fights among teens from the nearby Thomas Edison High School broke out in the dining area.READ MORE: How to Find Super Rare McDonald’s With Red Arches Instead of YellowA new sign on the location's door now reads:Safety Notice Effective ImmediatelyDue to repeated incidents of student violence, this McDonald’s location is temporarily closed for dine-in service to anyone under 21 years of age. This decision was made to protect our staff, our guests, and our community.Adults — we are still here to serve you! Please ring the doorbell and a team member will assist you...The fast food restaurant also thanked customers for their “understanding” while they work to keep the location “safe and welcoming.”READ MORE: 15 Discontinued Fast Food Sauces That You’ll (Probably) Never Get AgainA manager told NBC that adults who dine in may now be asked to verify their age by showing their ID.The Virginia location’s new rule comes as a new report shows McDonald’s customers are spending way less money than ever before.In the U.S., store location sales dipped 3.6 percent in the first quarter of 2025—the biggest decline for McDonald's since Covid-19 hit in 2020, which resulted in temporary store closings.Get our free mobile appOnce-Beloved Fast Food Burgers That No Longer ExistThese fast food burgers got a lot of attention when they debuted. It didn’t last forever.

Ali Niknam has built Dutch fintech Bunq into one of Europe’s biggest neobanks. But he fears the Netherlands is now driving entrepreneurs away. The Bunq founder and CEO is alarmed by the country’s business mindset. He believes risk-aversion, growing insularity, and hostility to ambition are pushing talent overseas. “Many of the best entrepreneurs I know have either left or are considering leaving,” Niknam tells TNW. Surveys back him up. A poll last year found that almost one in five Dutch entrepreneurs were considering relocating — up from nearly one in eight in 2023. The 💜 of EU techThe latest rumblings from the EU tech scene, a story from our wise ol' founder Boris, and some questionable AI art. It's free, every week, in your inbox. Sign up now!Another study found that 24% of large companies were contemplating moves abroad — nearly double the share from the year before.  Tech scaleups are also mulling exits. One of the country’s biggest — software unicorn Bird — recently announced plans to shift operations out of the country. The company’s CEO blamed “over-regulation” and a bad climate for tech businesses. Niknam — who’s set to speak at TNW Conference on June 20 in Amsterdam — has his own critiques of the Dutch business landscape. He calls its support for entrepreneurship “among the worst” he’s seen. Yet he still has deep faith in the country’s talent pool.  “There are very few countries I know that have such amazing, creative, smart people as the Dutch,” he says.  Those people have been integral to Bunq’s rapid growth. Building bridges at Bunq Niknam’s idea for Bunq emerged in the wake of the 2008 financial crisis. One of the causes, he believes, was groupthink at incumbent banks. He founded Bunq in 2012 to create an alternative.  To create a new approach to banking, Niknam sought to embrace diverse ideas. He points to the company’s approach to proposals, which can be pitched anonymously — even to Niknam himself. “On the one hand, that’s better for the company — the best ideas win. And on the other hand, it makes it more fair, because all that counts is the quality of your idea, not who you know, where you’re brought up, or what school you attended.” The strategy delivered rapid results. In 2015, Bunq became the first Dutch company in 35 years to obtain a greenfield banking license. It then grew into Europe’s second-largest neobank after Revolut — and one of the few to achieve profitability. The company now boasts over 17 million users with more than €8bn in deposits. Outside Bunq, however, Niknam sees a country that’s becoming more closed. He believes the Netherlands is abandoning its internationalist roots, which is damaging its tech ecosystem and chasing talent away.  “Historically, the Netherlands has been very entrepreneurial, very international… when this country retreats and closes the doors is when things start to get worse.” Even the country’s vast pension funds, he notes, avoid backing Dutch startups. “They know the returns are going to be less,” he says. “Why are the returns less? Because it’s a small country, and it is retreating and starting to focus within its own borders.” He contrasts the mood with developments in the Baltics. The region’s tech ecosystem has attracted admiring glances for its optimism, openness, and rapid growth. Niknam feels that many people in the Netherlands take their rights for granted. “It’s maybe a little bit of an entitlement disease — that we have forgotten that all these wonderful things that we enjoy today, somebody worked for them really, really hard,” he says. Born in Canada to Iranian parents and with homes in the Netherlands and the US, Niknam has diverse cultural experiences. Image: OLSjopera Niknam feels the Netherlands has become too risk-averse and inward-looking. Despite the liberal stereotype, Dutch society can be surprisingly conservative.  That caution, Niknam says, is embedded in the culture — even in local proverbs. One goes: “Steek je kop niet boven het maaiveld uit.” Loosely translated: “Don’t stick your head above the mowing line.” If you do, it might get chopped off. In Niknam’s eyes, that mentality thwarts ambitious entrepreneurs. “Success is not only not celebrated, but you’re almost faulted for being successful,” he says.  The international return The Netherlands is also losing its appeal to international talent. Over nine in ten expats and migrant workers no longer even consider coming to work in the country, according to research from last year. Tech firms have raised major concerns over losing access to global talent. The chip equipment maker ASML — the largest company in the Netherlands — has threatened to move abroad because of the country’s hardening stance on migrants. Peter Wennink, ASML’s former CEO — who will also speak at TNW Conference — recently warned against losing access to skilled workers. “If we cannot get those people here, we will get those people in Eastern Europe or in Asia or in the United States,” he said. Still, Niknam believes the tide can turn. For change to come, he believes the “silent majority” — those who value openness and diversity — must speak up.  Despite its problems, Niknam remains upbeat about the future for tech businesses in the Netherlands. “The people are great. The schooling is great. The infrastructure is great,” he says. “It is simply changing the attitude and mindset — which can happen in a relatively short amount of time — that will make all the difference.” If you want to catch the talks by Niknam and Wennink — or anything else on the agenda for TNW Conference — we have a special offer for you. Use the code TNWXMEDIA2025 at the checkout to get 30% off your ticket. Story by Thomas Macaulay Managing editor Thomas is the managing editor of TNW. He leads our coverage of European tech and oversees our talented team of writers. Away from work, he e (show all) Thomas is the managing editor of TNW. He leads our coverage of European tech and oversees our talented team of writers. Away from work, he enjoys playing chess (badly) and the guitar (even worse). Get the TNW newsletter Get the most important tech news in your inbox each week. Also tagged with

Join our daily and weekly newsletters for the latest updates and exclusive content on industry-leading AI coverage. Learn More Unpatched systems are a ticking time bomb. Fifty-seven percent of cyberattack victims acknowledge that available patches would have prevented breaches, yet nearly one-third admit failing to act, compounding the risk. Ponemon research shows organizations now take an alarming average of 43 days to detect cyberattacks, even after a patch is released, up from 36 days the previous year. According to the Verizon 2024 Data Breach Investigations Report, attackers’ ability to exploit vulnerabilities surged by 180% from 2023 to 2024. Chronic firefighting makes manual or partially automated patching overly burdensome, further pushing patching down teams’ priority lists. Relying on manual or partially automated patching systems is considered too time-consuming, further reducing patching to the bottom of a team’s action item list. This is consistent with an Ivanti study that found that the majority (71%) of IT and security professionals think patching is overly complex, cumbersome and time-consuming. When it comes to patching, complacency kills Attackers aggressively exploit legacy Common Vulnerabilities and Exposures (CVEs), often ten or more years old. A sure sign of how effective attackers’ tradecraft is becoming at targeting legacy CVEs is their success with vulnerabilities in some cases, 10-plus years old. A sure sign that attackers are finding new ways to weaponize old vulnerabilities is reflected in the startling stat that 76% of vulnerabilities leveraged by ransomware were reported between 2010 and 2019. The misalignment between IT and security teams compounds delays, with 27% lacking cohesive patch strategies and nearly a quarter disagreeing on patch schedules. One of the unexpected benefits of automating patch management is breaking the impasse between IT and security when it comes to managing the patch workload.    “Typically, on average, an enterprise may patch 90% of desktops within two to four weeks, 80% of Windows servers within six weeks and only 25% of Oracle Databases within six months from patch release date”, writes Gartner in their recent report, “We’re not patching our way out of vulnerability exposure.” The report states that “the cold, hard reality is that no one is out patching threat actors at scale in any size organization, geography or industry vertical.” Ring deployment: proactive defense at scale Every unpatched endpoint or threat surface invites attackers to exploit it. Enterprises are losing the patching race, which motivates attackers even more. In the meantime, patching has become exponentially more challenging for security and IT teams to manage manually. Approximately a decade ago, ring deployment began to rely on Microsoft-dominated networks. Since then, ring deployments have proliferated across on-premise and cloud-based patch and risk management systems. Ring deployment provides a phased, automated strategy, shrinking attacker windows and breach risks. Ring deployment rolls out patches incrementally through carefully controlled stages or “rings:” Test Ring (1%): Core IT teams quickly validate patch stability. Early Adopter Ring (5–10%): A broader internal group confirms real-world compatibility. Production Ring (80–90%): Enterprise-wide rollout after stability is conclusively proven. Ivanti’s recent release of ring deployment is designed to give security teams greater control over when patches will be deployed, to which systems and how each sequence of updates will be managed. By addressing patching issues early, the goal is to minimize risks and reduce and eliminate disruptions. Gartner’s ring deployment strategy escalates patches from internal IT outward, providing continuous validation and dramatically reducing deployment risk. Source: Gartner, “Modernize Windows and Third-Party Application Patching,” p. 6. Ring deployment crushes MTTP, ends reactive patching chaos Relying on outdated vulnerability ratings to lead patch management strategies only increases the risk of a breach as enterprises race to keep up with growing patch backlogs. That’s often when patching becomes cybersecurity’s endless nightmare, with attackers looking to capitalize on the many legacy CVEs that remain unprotected. Gartner’s take in their recent report “Modernize windows and third-party application patching” makes the point brutally clear, showing how traditional patching methods routinely fail to keep pace. In contrast, enterprises embracing ring deployment are getting measurable results. Their research finds ring deployment achieves a “99% patch success within 24 hours for up to 100,000 PCs,” leaving traditional methods far behind. During an interview with VentureBeat, Tony Miller, Ivanti’s VP of enterprise services, emphasized that “Ivanti Neurons for Patch Management and implementing Ring Deployment is an important part of our Customer Zero journey.” He said the company uses many of its own products, which allows for a quick feedback loop and gives developers insight into customers’ pain points. Miller added: “We’ve tested out Ring Deployment internally with a limited group, and we are in the process of rolling it out organization-wide. In our test group, we have benefited from deploying patches based on real-world risk, and ensuring that updates don’t interrupt employee productivity–a significant challenge for any IT organization.” VentureBeat also spoke with Jesse Miller, SVP and director of IT at Southstar Bank, about leveraging Ivanti’s dynamic Vulnerability Risk Rating (VRR), an AI-driven system continuously recalibrated with real-time threat intelligence, live exploit activity, and current attack data. Miller stated clearly: “This is an important change for us and the entire industry. Judging a patch based on its CVSS now is like working in a vacuum. When judging how impactful something can be, you have to take everything from current events, your industry, your environment and more into the equation. Ultimately, we are just making wiser decisions as we are not disregarding CVSS scoring; we are simply adding to it.” Miller also highlighted his team’s prioritization strategy: “We have been able to focus on prioritizing Zero-Day and Priority patches to get out first, as well as anything being exploited live in the wild. Using patch prioritization helps us eliminate our biggest risk first so that we can reduce our attack surface as quickly as possible.” By combining ring deployment and dynamic VRR technology, Ivanti Neurons provides enterprises with structured visual orchestration of incremental patch rollouts. This approach sharply reduces Mean-Time-to-Patch (MTTP), accelerating patches from targeted testing through full deployment and significantly decreasing the exposure windows that attackers exploit. Caption: The Ivanti Neurons interface visually manages deployment rings, success thresholds, patching progress and streamlining operational clarity. Source: Ivanti Neurons Comparing Ivanti Neurons, Microsoft Autopatch, Tanium and ServiceNow: Key strengths and gaps When selecting enterprise patch management solutions, apparent differences emerge among leading providers, including Microsoft Autopatch, Tanium, ServiceNow and Ivanti Neurons. Microsoft Autopatch relies on ring deployment but is restricted to Windows environments, including Microsoft 365 applications. Ivanti Neurons expands on this concept by covering a broader spectrum, including Windows, macOS, Linux and various third-party applications. This enables enterprise-wide patch management for organizations with large-scale, diverse infrastructure. Tanium stands out for its robust endpoint visibility and detailed reporting features, but its infrastructure requirements typically align better with resource-intensive enterprises. Meanwhile, ServiceNow’s strength lies in workflow automation and IT service management integrations. Executing actual patches often demands significant additional customization or third-party integrations. Ivanti Neurons aims to differentiate by integrating dynamic risk assessments, phased ring deployments and automated workflows within a single platform. It directly addresses common enterprise challenges in patch management, including visibility gaps, operational complexity and uncertainty about vulnerability prioritization with real-time risk assessments and intuitive visual dashboards. Caption: Ivanti Neurons provides real-time patch status, vulnerability assessments, and risk exposure metrics, ensuring continuous visibility. Source: Ivanti Neurons Transforming patch management into a strategic advantage Patching alone cannot eliminate vulnerability exposure. Gartner’s analysts continue to stress the necessity of integrating compensating controls, including endpoint protection platforms (EPP), multifactor authentication, and network segmentation to reinforce security beyond basic patching. Combining ring deployment with integrated compensating controls that are part of a broader zero-trust framework ensures security, allows IT teams to shrink exposure windows, and better manage cyber risks. Ivanti’s approach to ring deployment incorporates real-time risk assessments, automated remediation workflows, and built-in threat management, directly aligning patch management with broader business resilience strategies. The design decision to make it part of Neurons for Patch Management delivers the scale enterprises need to improve risk management’s real-time visibility.   Bottom line: Integrating ring deployment with compensating controls and prioritization tools transforms patch management from a reactive burden to a strategic advantage. Daily insights on business use cases with VB Daily If you want to impress your boss, VB Daily has you covered. We give you the inside scoop on what companies are doing with generative AI, from regulatory shifts to practical deployments, so you can share insights for maximum ROI. Read our Privacy Policy Thanks for subscribing. Check out more VB newsletters here. An error occured.

The Ontario Science Centre was shuttered on June 21, 2024, with the Ontario government claiming that a structural roof issue made it unsafe. New documents suggest that the engineers inspecting the roof didn’t agree. Photo by Canmenwalker via Wikimedia Commons New documents, obtained by Canadian Architect through a freedom of information request, appear to indicate that Rimkus—the structural engineers hired to assess the Ontario Science Centre’s roof before its closure—did not support closing the Centre for public safety reasons. The draft versions of the report instead recommend regular, routine maintenance to the roofs over the course of the coming 20 years. When read in conjunction with correspondence preceding the closure obtained by Global News, it seems likely that the engineers were pressured by the government to produce a report that would support the shuttering of the Ontario Science Centre. However, such a recommendation was not supported by their research and expertise. Canadian Architect obtained draft versions of parts of the Rimkus report from March, April, and May of 2024. The report, whose final version is dated June 18, 2024, was commissioned to assess the condition of the Science Centre’s reinforced autoclaved aerated concrete (RAAC) roof panels, an outdated form of construction that can pose problems over time if not properly maintained. It was based on on-site investigations conducted by Rimkus from December 2023 to March 2024. In a key section on RAAC Panel Recommendations, the March and April versions of the report clearly recommend to proceed with repairs to a set of panels identified as “high risk”—less than 2.5% of the Science Centre’s roofs—over the summer. It reads: “It is Rimkus’ recommendation to address all 2024 RAAC panel repair (amber risk) locations as a single project. As such, it is our opinion that the most cost effective strategy would be a consistent repair approach. Panel replacement rather than reinforcement is feasible at all areas, and presented in Table 7.” The government seems to have pushed the engineers to go further, asking how the RAAC risk could be entirely eliminated. The May version adds the sentences: “It is recommended that RAAC panels should be replaced at the time of the next scheduled roof replacement, to completely eliminate the RAAC panel risk. Recommended timelines for complete roof assembly and RAAC panel (where applicable) replacements, and budgetary costs, by roof area are shown in Table 8.” In the March, April, and May versions of the report, there is no provision for declining to do the repairs—simply because roof repairs are a relatively routine, straightforward undertaking. RAAC panels at the Science Centre had been routinely replaced in the past. At the time of the inspection, a half dozen panels were identified as being in critical condition, and were already being replaced while the report was completed. A building permit was in progress to repair a section of the roof over the rainforest room. The cost of the immediate repairs needed would amount to around $500,000—or just over $7 million, if coupled with replacing, repairing, and maintaining larger sections of the Science Centre’s roofs that year. And yet, the language apparently wasn’t strong enough for the Ontario government, whose communications staffers aimed to justify the closure as a public safety issue. For the final version of the report, government officials seem to have pressed the engineers to answer the question: what if we just don’t do the repairs? Wouldn’t the only totally safe option, in that case, be to close the building? As a result, the final version of the report included the following passage: “Where replacement or reinforcement cannot be completed within the recommended time frame, then one of the following supplemental risk mitigation options is recommended and should be implemented in conjunction with the snow/load monitoring program: Option 1: Restricted access or full closure to prevent any persons from walking in areas where high risk panels are present. Option 2: Installation of temporary shoring (reinforcement) supporting the underside of RAAC panels. Options 3: If shoring is not possible, installation of horizontal hoarding near the underside of hard ceiling levels, or other building interferences (sprinkler mains/process piping etc.) The above three recommended options are listed in order of preference, with option 1 completing [sic] eliminating the risk to public or staff.” As I have written before, while a quick reading of this passage may seem to suggest “full closure” of the Science Centre, a closer look shows that access would only need to be restricted at the areas “where high risk panels are present.” The high-risk panels represent a miniscule portion of the Science Centre’s roof, almost entirely in non-exhibition areas. Texts between Infrastructure Ontario minister Michael Lindsey and a top communications staffer, obtained by Global News, point to the Ministry’s communications with structural engineers Rimkus in the lead-up to the announcement of the Ontario Science Centre’s closure. The texts also show that the Ministry of Infrastructure was in tight communication with the Premier’s Office (PO) about the closure.   Text messages between Infrastructure Ontario CEO Michael Lindsay and the agency’s top communications staffer, from the run-up to the closure announcement, suggest that the agency was working closely with Rimkus and pressing executives to tailor its language before the report was submitted. “The executives at Rimkus look like survivors of the apocalypse. [laugh/cry emoji],” one of the texts reads. The presence of a typo in the report’s added section also suggests a rushed addition. When the final report was sent, a member of Rimkus’s team seems to have also referenced conversations that took place between the two parties. “Please refer to revised final summary report (R2) attached, with updated notes/paragraphs, as discussed,” they wrote on June 18. While some back-and-forth between consultants and public clients is expected, it is unusual that this contact would be with the Ministry’s top brass—particularly for a routine, technical report. Also notable is that while the Rimkus report released to the public by Infrastructure Ontario was signed by the engineers, it was not stamped—an indication that the engineers may not have felt entirely comfortable with how the report landed, and were unwilling to be professionally liable for it. In an email to top Ministry of Infrastructure and Infrastructure Ontario officials after the closure announcement, an Ontario Ministry director of communications shares a few questions that may arise. One is: “Q: Is this [closure] just a convenient excuse to move [the Ontario Science Centre] to Ont Place?” He suggests the reply: “This is a health and safety issue. Full stop.” But for the engineers that actually inspected the roof, closure should never have been on the table: the roof issue could—and should—have been addressed with routine repairs. The post New documents reinforce that Science Centre closure was not supported by engineers appeared first on Canadian Architect.