AI Intelligence Brief

Wed 27 May 2026

Daily Brief — Curated and contextualised by Best Practice AI

101Articles
Editor's pickEditor's Highlights

ECB Warns on AI Credit, Microsoft Finds Humans Cheaper, and Chile Faces Drought Costs

TL;DR The ECB has raised concerns about the financial risks posed by AI-driven private credit markets. Microsoft and Uber have found AI deployment more costly than human labor, challenging the narrative of AI-driven productivity gains. Alphabet-backed OpenRouter raised $113 million to support AI model exchanges. Meanwhile, Chile's datacenter expansion is exacerbating its mega-drought, highlighting the environmental costs of AI infrastructure.

Editor's highlights

The stories that matter most

Selected and contextualised by the Best Practice AI team

6 of 101 articles

Economics & Markets

23 articles
AI Investment & Valuations10 articles
Editor's pickTechnology
Globaldatacenterhub· Today

In AI Infrastructure, the Offtake Agreement Is the Asset

Committed Demand as the Primary Credit Variable, Counterparty Quality Over Real Estate, Compute Factory Underwriting from First Principles, What CoreWeave's Microsoft Contract Actually Is

Editor's pickFinancial Services
NewsX· Yesterday

India vs Taiwan: How Taiwan Overtook India As World’s Fifth Largest Stock Market

That’s a sign of a broader market ... money at AI infrastructure, semiconductors and tech supply chains at breakneck speed. India still has deeper domestic growth drivers, a much larger economy and a wider investor base. But right now, global capital is making one point clear — by 2026, artificial intelligence will be shaping market leadership as much as economic growth. Also Read: Wall Street Today: Futures Jump After Holiday Break; Tech Strength, Calm Geopolitics, Falling Oil ...

Editor's pickFinancial Services
Viestories· Yesterday

Nandan Nilekani's Fundamentum launches F2A with Rs 3,000 Cr corpus

F2A has also brought in Debraj Banerjee, a former SIDBI Venture Capital executive, as a general partner to help lead its AI and deeptech investment strategy. Before joining F2A, he was a senior fund manager and investment committee member at SIDBI Venture Capital. He has invested in startups like ...

Editor's pickTransportation & Logistics
Daily Brew· Today

TMV's $200M Fund Targets Maritime Innovation to Tackle Global Shipping Challenges

TMV has unveiled a $200 million venture fund dedicated to advancing maritime infrastructure and logistics technologies to modernize global supply chains.

Editor's pickTechnology
GlobeNewswire· Yesterday

On-Device AI Market Size to Hit USD 185.23 Billion by 2035 | Research by SNS Insider

The US On-device Artificial Intelligence Market reached USD 4.88 billion in 2025 and is expected to grow at a CAGR of 26.32% up to USD 50.43 billion during...

Labor, Society & Culture

21 articles
AI & Employment14 articles
Editor's pickTechnology
Reuters· Yesterday

OpenAI's Altman says AI unlikely to lead to 'jobs apocalypse' | Reuters

SYDNEY, May 26 (Reuters) - Open AI CEO Sam Altman said on Tuesday the rapid development ‌and adoption of AI would not lead to a global "jobs apocalypse" and the technology had not claimed as many white-collar jobs as he had feared.

Editor's pickPAYWALLProfessional Services
FT· Yesterday

AI tools lead to ‘clear racial disparities’ in job hiring

New Stanford-led study finds candidates that fail AI-hiring tests face ‘systemic rejection’ across companies

Editor's pickFinancial Services
Reuters· Yesterday

Reuters AI News | Latest Headlines and Developments | Reuters

Fears are growing among workers as banks offer more frank assessments about how AI could replace their jobs.

Editor's pick
MIT Technology Review· Yesterday

The Download: puncturing the AI jobs panic

This is today’s edition of The Download, our weekday newsletter that provides a daily dose of what’s going on in the world of technology. A reality check on the AI jobs hysteria Despite the growing hysteria over AI’s threat to white-collar jobs, there’s still scant evidence that the technology has had a large-scale impact on…

Editor's pick
HR Dive· Yesterday

AI is ‘going to break down millions of careers,’ Gartner analyst says | HR Dive

Organizations need to rethink how employees gain expertise, or they will find themselves without talent for the jobs artificial intelligence helps create, the analyst said.

Editor's pick
UPI· Yesterday

Southeast Asia’s AI boom leaves 40 million gig workers exposed - UPI.com

Southeast Asia is emerging as a major beneficiary of the global AI race led by the U.S. and China, but analysts warn that gig economy workers exposed

Editor's pickEducation
AJC· Yesterday

AI job losses are increasing. Are training programs the answer?

From Atlanta Technical College to statewide data, Georgia faces AI-driven job losses even as training expands. Experts question if skills equal jobs.

Editor's pick
Forbes· Today

How Leaders Are Automating Away Their Own Future Talent

Leaders cutting entry-level roles for short-term AI efficiency are building a talent gap that will hollow out their senior bench within a decade.

Editor's pick
Khan· Today

‘2045 Strategy’ to address youth employment·polarization in the AI era···Securing funding is key - 경향신문

The government has begun formulating a national development strategy that sets out a future vision ahead of the 100th anniversary of Liberation in 2045. Youth employment challenges arising from the...

Editor's pick
Lexington Herald Leader· Yesterday

The new rules for getting hired in an AI-driven job market | Lexington Herald Leader

Toptal reports that AI is reshaping the job market, especially impacting entry-level positions.

Editor's pickTechnology
Fortune· Yesterday

$7.2 billion AI CEO gets thousands of job applications a day but still can’t find candidates with a strong work ethic

Millions of Gen Z grads can't find jobs. This AI boss can't find candidates. And the one skill he's looking for has nothing to do with your degree.

Editor's pick
Stl· Yesterday

The Deep Shift: A Comprehensive Roadmap of AI Capabilities and Labor Market Realignment (2026–2036)

The Deep Shift: A Comprehensive ... and Labor Market Realignment (2026–2036) ... (STL.News) The arrival of generative artificial intelligence sparked a global rush toward digital transformation. However, looking out toward the next decade reveals a fundamental shift. We are transitioning from a period of assisted productivity—where humans ...

Editor's pick
NBC· Today

Nbcpalmsprings

Artificial intelligence is rapidly transforming workplaces across industries, raising concerns about what it could mean for jobs — especially for recent graduates entering an already challenging labor market. Business leaders have increasingly warned that AI could lead to cuts in entry-level ...

Editor's pick
Reading Eagle· Yesterday

FROM THE GRCA: Looking at some workforce trends for 2026

Organizations that embrace innovation, invest in their employees and remain adaptable will be better positioned for long-term success in an increasingly competitive labor market.

Technology & Infrastructure

28 articles
AI Infrastructure & Compute11 articles
Editor's pickPAYWALLEnergy & Utilities
FT· Yesterday

AI and the brave new world of deals

Global M&A is now dominated by the race to control the world’s energy, fibre networks and compute

Editor's pickManufacturing & Industrials
DIGITIMES· Today

AI infrastructure spending lifts Taiwan electronics sector outlook

Cloud providers' large-scale investments in AI infrastructure have strengthened demand for Taiwan's electronics supply chain, boosting optimism among local manufacturers, according to a Taiwan Institute of Economic Research (TIER) survey. The survey noted that nearly 40% of Taiwan's electronics ...

Editor's pickTechnology
Eciks· Yesterday

SMCI stock rallies 6% after strong AI server demand drives 100% sales surge - ECIKS.org

The broader sector faces the question: can SMCI maintain its specialization advantage as AI server market competition intensifies? Emerging rivals include Chinese custom server vendors and OEM in-house teams at Amazon and Google. Over the next 24-36 months, industry consolidation is likely, ...

Editor's pickTechnology
SiliconANGLE· Yesterday

Air-cooled AI infrastructure in demand in agentic era - SiliconANGLE

AMD and Dell say rising agentic AI workloads are increasing demand for CPUs and accelerating enterprise adoption of air-cooled AI infrastructure.

Editor's pickTechnology
Theregister· Today

Cisco making SONiC available to all customers – not just hyperscalers

Hardened version of open-source NOS coming to Nexus 9000s

Editor's pickTechnology
StartupHub.ai· Yesterday

AI Infrastructure Boom: Demand Surges as Costs Collapse | StartupHub.ai

ARK Investment Management's "Big Ideas 2026" report details the AI infrastructure boom, with demand surging and costs collapsing, driving massive investment.

Editor's pickDefense & National Security
Executive Gov· Today

Pentagon Seeks Nearly $30B for AI Supercomputing Modernization

The Pentagon has requested $29.5 billion in FY 2027 funding to build secure AI data centers and deploy advanced GPUs and AI supercomputers.

Editor's pickTechnology
Check Point· Yesterday

2026 Cloud Security Report: Why Traditional Network, Cloud, and Security Architecture Are Lagging Behind the AI Transformation - Check Point Blog

As AI rapidly reshapes industries, the role of the cloud has become even more critical. From automated customer experiences to intelligent cyber security

Editor's pickEnergy & Utilities
Business Insider· Today

Cerebras CEO says AI 'as an industry' has done a terrible job of selling data centers: 'We ought to pay our own way

"There's no reason why we can't add these to communities and have the community benefit from it," Cerebras CEO Andrew Feldman said.

Editor's pickEnergy & Utilities
Bebeez· Yesterday

Equinix opens MD5 data center in Madrid, Spain

Equinix has officially opened MD5, its new data center located in the Alcobendas area of Madrid, Spain. The colo firm this week held an official ceremony attended by the President of the Community of Madrid, Isabel Díaz Ayuso; the Regional Minister for Digitalization, Miguel López-Valverde; the Regional Minister for the Economy, Rocío Albert; and the […]

Editor's pickTechnology
Blogs· Yesterday

Why AI Infrastructure Downtime Is No Longer the Biggest Risk in 2026 | Blogs

Organizations reevaluating long-term ... Infrastructure Correctly in 2026, and Why AI Inference Performance Degrades Over Time because organizations increasingly recognize that infrastructure quality involves much more than maximum theoretical compute performance....

AI Security & Cybersecurity10 articles
Editor's pickProfessional Services
Global Risk Community· Yesterday

Why Is Digital Risk Protection Becoming a Business Priority in the AI Era? - Market Research - Global Risk Community

Organizations today operate in an environment where cyber threats extend far beyond traditional networks. Brand impersonation, phishing campaigns, data leaks, exposed credentials, and malicious activity on the dark web can damage business operations and customer trust within hours.

Editor's pickFinancial Services
VentureBeat· Yesterday

The attack dominating financial services doesn't steal passwords. It resets MFA and steals the token.

The attacker who hit the most financial services organizations over the past 12 months never phished a password. They called an IT support line, convinced an employee to reset their MFA, and registered their own device on the network. CrowdStrike’s 2026 Financial Services Threat Landscape Report, released this month and covering activity from April 2025 through March 2026, identified Mutant Spider as the single most active threat to the financial services sector. The group’s primary technique was voice phishing over Microsoft Teams. Operators impersonated internal IT support, convinced employees to reset their credentials and multifactor authentication, then registered their own devices on corporate networks. The security control worked exactly as designed — and that was the problem. Within days, the FBI published a public service announcement warning about Kali365, a phishing-as-a-service platform sold on Telegram for as little as $250 a month. Kali365 captures Microsoft 365 OAuth tokens through the legitimate device code authentication flow. MFA fires on the victim’s device, not the attacker’s. The token grants persistent access to Outlook, Teams, and OneDrive without triggering another MFA prompt. The Verizon 2026 Data Breach Investigations Report, also released in May, confirmed that credential theft dropped to 13% of breach initial access vectors. Vulnerability exploitation took the top position at 31%, displacing what Verizon called the longtime leading initial-access category. That's three independent sources, same structural finding. MFA protects password-based authentication, but the attacks dominating financial services increasingly bypass password theft through resets, token grants, and exploitation. The MFA Bypass Exposure Audit Grid at the end of this article maps all five confirmed attack surfaces from the CrowdStrike, FBI, and Verizon reports, what MFA misses on each one, and the specific fix for Monday morning. The CrowdStrike numbers paint a sector under sustained pressure Financial services ranked as the fourth most targeted sector by Q1 2026, accounting for 12% of all observed adversary activity, according to the CrowdStrike report. Globally, financial institutions faced 43% more hands-on-keyboard intrusions in 2025 compared to two years earlier. In North America, that figure was 48%. The e-crime side of the problem grew faster than most defenders expected. Big game hunting operators named 423 financial services entities on dedicated leak sites during the reporting period. That is a 27% increase from the 334 entities named in the prior 12 months. REVENANT SPIDER, which operates the Qilin ransomware-as-a-service program, posted the most financial services victims of any e-crime adversary on its dedicated leak site. The group’s financial services victim count jumped from 14 to 97 over the reporting period. “Who needs a zero day if all you have to do is call the help desk and say, 'I forgot my password'?” Adam Meyers, senior vice president of counter adversary operations at CrowdStrike, told VentureBeat. That one sentence captures the structural shift his team documented across twelve months of financial services intrusions. The interactive intrusion breakdown tells the story of who is actually getting inside these networks. E-crime actors drove 75% of hands-on-keyboard intrusions against financial services. State-sponsored adversaries accounted for the remaining 25%. That ratio has not moved since 2023. What changed is the total volume and the sophistication of the access techniques. Mutant Spider’s vishing campaigns over Microsoft Teams represent a structural shift in initial access. The group impersonates IT support, manipulates employees into resetting MFA, then deploys custom post-access tools including PrionFlaire, SocksLoader, and SleepyMutagen. CrowdStrike believes the group sells that access to ransomware operators. The Teams call is step one. The ransom note is step five. “Who needs a zero day if all you have to do is call the help desk and say, 'I forgot my password'?” Scattered Spider returned to aggressive ransomware operations against insurance companies from April through July 2025, following a significant operational pause that began in December 2024. The group ran the same playbook it has used since 2022: help desk social engineering; credential and MFA reset requests; then lateral movement through integrated SaaS applications to locate data for extortion. In September 2025, the U.K.’s National Crime Agency arrested and charged two members for allegedly targeting Transport for London. The U.S. Department of Justice separately charged one of them in connection with multiple cyberattacks against U.S. critical infrastructure. State-sponsored groups added scale and speed The report’s state-sponsored findings reinforce the identity problem from a different direction. DPRK-nexus adversaries stole $2.02 billion in digital assets in 2025, a 51% increase from the prior year. In February 2025, Pressure Chollima executed the largest single theft ever reported, stealing $1.46 billion in cryptocurrency by compromising Safe{Wallet}, a digital asset management platform supporting the Bybit exchange, after a developer’s machine was infected through a trojanized Python project. China-nexus groups conducted sustained campaigns against financial institutions across multiple continents. Hollow Panda exploited Check Point VPN appliances to target banks in the Philippines, Indonesia, and Brazil. Vault Panda gained initial access through compromised VPN and firewall appliances across four continents. Every state-sponsored campaign CrowdStrike documented shared a common thread. The adversary’s first move targeted an identity, a credential, or a trusted access path. Elia Zaitsev, CrowdStrike’s CTO, told VentureBeat in April that the speed of these operations is outpacing traditional defense models. “Traditional approaches are just not designed for this sort of behavior,” Zaitsev said. Kali365 turns token theft into a subscription service The FBI’s May 21 public service announcement on Kali365 confirmed the second attack path that makes this a compound problem. The platform exploits Microsoft’s OAuth 2.0 device authorization grant flow, a mechanism designed for devices like smart TVs and conference room systems that cannot support interactive login. Kali365 sends phishing emails impersonating trusted services like Adobe Acrobat Sign, DocuSign, and SharePoint. The email contains a device code and instructions to visit a legitimate Microsoft verification page. The victim authenticates normally. MFA fires. The token goes to the attacker. Arctic Wolf, which published a technical deep dive on Kali365 in April, documented a three-tier commercial structure. An admin tier for the developers, an agent tier for resellers, and a client tier for paying affiliates. Subscription pricing runs from $250 for 30 days to $2,000 for a year. The platform supports 14 languages and includes AI-generated phishing lures, automated campaign templates, and a real-time tracking dashboard. The device code flow is not a vulnerability. It is a feature. Microsoft designed it for devices that cannot support interactive login. The problem is that default Entra ID configurations do not restrict its use, and most organizations have never audited whether any legitimate workflow actually requires it. Kali365 exploits that gap between design intent and deployment reality. The Verizon DBIR reinforced that assessment from a different angle. The 2026 edition analyzed more than 22,000 confirmed breaches across 145 countries. Vulnerability exploitation at 31% now leads credential abuse at 13%. The median time for full patching increased to 43 days, up from 32. Organizations patched only 26% of critical flaws in CISA’s Known Exploited Vulnerabilities catalog, down from 38% the prior year. That data creates a clear picture. The industry has spent two decades building defenses against credential theft. The attacks that are actually working in financial services either remove MFA through social engineering or capture tokens through legitimate authentication flows where MFA does not protect the attacker’s session. MFA Bypass Exposure Audit Grid Security directors need to run this audit against their environment this week. Each row represents a confirmed attack path from the three reports above. Attack Surface Confirmed Event What MFA Misses Action Teams vishing/help desk MFA reset Most active FS attacker called employees on Teams, got MFA reset, registered own device (CrowdStrike) Help desk verifies caller identity without out-of-band confirmation. Social engineering removes MFA entirely. Out-of-band verification for all MFA resets. FIDO2 hardware keys. Callback on a separate channel. OAuth device code flow $250/mo tool captures M365 tokens via devicelogin page. MFA does not fire on attacker’s device. (FBI) Not restricted in default Entra ID configurations. Authentication channel separates user’s MFA challenge from attacker’s token grant. Restrict device code flow in Entra ID conditional access. Block unmanaged devices. Token persistence Both paths end here. Valid tokens can grant weeks or months of silent access depending on token lifetime configuration. (CrowdStrike + FBI) Traditional credential-theft monitoring does not flag token-based access. Tokens are credential-equivalent bearer artifacts, but most detection tools do not classify them that way. Monitor OAuth refresh token usage from unfamiliar devices. Token lifetime policies. Post-access SaaS movement After reset, attackers pivoted to SaaS apps for credentials and docs. (CrowdStrike, insurance sector) DLP monitors file downloads, not post-reset session activity or token-based API calls from authorized sessions. Audit Graph API access. Flag bulk ops from reset or device-code sessions. Budget misalignment Credential theft at 13%. Vuln exploitation at 31%. (Verizon DBIR) Patch reverse-engineering within 72 hours. (Ivanti) Legacy, login-only MFA investment addresses the threat that just dropped to third. Token capture and social engineering sit outside that investment. Rebalance toward token monitoring, session validation, identity verification for resets. Mike Riemer, SVP and field CISO at Ivanti, told VentureBeat in an exclusive interview that the speed problem compounds the budget misalignment. “Threat actors are reverse engineering patches, and the speed at which they’re doing it has been enhanced greatly by AI,” Riemer said. “They’re able to reverse engineer a patch within 72 hours. If I release a patch and a customer doesn’t patch within 72 hours of that release, they’re open to exploit.” The structural problem is clear “People are forgetting about runtime security,” Zaitsev said. “We’ve done this before, with endpoint and virtualization and cloud. People really focused on, hey, let’s patch all the vulnerabilities. Impossible. Let’s make sure we lo ck down all the permissions. Somehow always seem to miss something.” The attackers who matter most in financial services right now are not stealing passwords. They are calling help desks. They are exploiting legitimate authentication flows. They are capturing tokens that persist for months. The defenses that consumed the largest share of security budgets for the past decade are pointed at a threat that just dropped to third place. The fix is not adding another layer of MFA — Zaitsev and Riemer both said as much. It's rethinking what MFA actually protects, what it doesn't, and where the budget needs to go next.

Editor's pickTechnology
Top Daily Headlines: EU's digital sovereignty boo-boo may be the best thing to ever happen to the project· Today

Microsoft wants safer C# without turning it into Rust

Unsafe bits get a warning label in planned low-level coding shake-up.

Editor's pickTransportation & Logistics
The Manila Times· Yesterday

Ransomware Attacks on Automotive and Smart Mobility More Than Doubled in 2025, According to New Research by Upstream Security | The Manila Times

Upstream's report finds that the rapid adoption of Physical AI, with autonomous vehicles among the first production-ready systems in real-world operation, is expanding attack surfaces and accelerating attacker capabilities, creating large-scale cyber risks with massive impact potential.

Editor's pickDefense & National Security
The Hacker News· Yesterday

CERT-In Recommends 12-Hour Patching for Internet-Facing Flaws Amid AI-Assisted Attacks

SANSFIRE 2026 in D.C. brings 50+ courses, AI-focused sessions, and NetWars. July 13–18. Save $500. ... AI collapsed human response window and turned remote access into fastest path to breach. ... Lead the future of cybersecurity risk management with an online Master’s from Georgetown.

Editor's pickTechnology
Stock Titan· Yesterday

Study of 34 AI models finds biggest risks in privacy and fraud

TELUS (NYSE:TU) released its April 2026 GenAI Safety Model Benchmark, based on over 620,000 adversarial tests across 34 AI models from 10 global providers. Vulnerability rates ranged from 1.3% to 93%, underscoring that no model is fully immune. The study finds reasoning models are hardest to exploit, smaller models most vulnerable, and privacy, fraud and cybersecurity ...

Editor's pickTechnology
PYMNTS· Today

Gambit Says Speed of AI-Powered Cyberattacks Drives Need for Cyber Resilience | PYMNTS.com

Recent cyberattacks by a persona linked to Iran reportedly demonstrate the speed with which AI-enhanced attacks can be carried out.

Editor's pickTechnology
SME Street· Yesterday

AI Attacks Are No Longer Experimental: Key Findings from the March-April 2026 AI Threat Landscape

Check Point report reveals rise in AI-powered cyberattacks, exposing risks to government agencies, enterprises, AI tools, and cloud security systems. Technology For SMEs | Cybersecurity

Editor's pickTelecommunications
WebWire· Yesterday

e& Cyber Security Council and Open Innovation AI Collaboration | WebWire

The UAE Cyber Security Council (CSC), e& UAE, and Open Innovation AI (OI) launched the UAE Sovereign AI Platform for national-scale infrastructure, an initiative delivering secure AI capabilities across national security, mission-critical operations, critical infrastructure, and classified ...

Editor's pickTechnology
Hipther· Today

Cybersecurity Roundup: Partnerships, Funding, and Emerging Threats — May 26, 2026 | CISA, Securonix, GRAMAX Cybertech, TELUS Digital, Upstream Security, and Autonomous Patching

Home » Blog » Cybersecurity Roundup: Partnerships, Funding, and Emerging Threats — May 26, 2026 | CISA, Securonix, GRAMAX Cybertech, TELUS Digital, Upstream Security, and Autonomous Patching ... The latest headlines point in one direction: AI is speeding up both attacks and defenses, critical-infrastructure operators are relying more on managed cyber defense partnerships, enterprise buyers are demanding clearer AI safety ...

Adoption, Deployment & Impact

14 articles
AI Adoption Barriers & Enablers9 articles

Geopolitics, Policy & Governance

15 articles
AI National Strategy5 articles
AI Policy & Regulation8 articles
Best Practice AI© 2026 Best Practice AI Ltd. All rights reserved.

Get the full executive brief

Receive curated insights with practical implications for strategy, operations, and governance.

AI Daily Brief — leaders actually read it.

Free email — not hiring or booking. Optional BPAI updates for company news. Unsubscribe anytime.

Include

No spam. Unsubscribe anytime. Privacy policy.