What Is The Government Proposing?

The announcement came from Prime Minister Keir Starmer during London Tech Week, where he said the UK would become “the first country in the world to make it impossible for children to take, share or view nude images.”

Under the proposals, technology companies including Apple and Google would be expected to activate existing safety features or introduce new technical measures that detect and block nude images on devices used by children. Adults would still be able to access such content after completing age verification checks.

Three-Month Deadline

The government has given technology companies three months to develop suitable solutions. If they do not, ministers have indicated they are prepared to introduce legislation, financial penalties, and potentially other enforcement measures.

The government argues that stronger intervention is needed because online child sexual abuse, exploitation, and exposure to harmful content remain widespread. Home Office figures cited alongside the announcement indicate that 91 per cent of online child sexual abuse reports recorded in 2024 contained self-generated content from children themselves.

Why Is Signal Opposing The Plan?

Signal, one of the world’s best-known encrypted messaging platforms, has responded forcefully to the proposals. In a public statement, the company said the government’s approach “will not safeguard children. It endangers us all.”

The company’s main concern is not the goal of protecting children, but the technology required to achieve it. Signal argues that forcing devices to scan content before it is viewed, shared, or stored would create a new form of surveillance infrastructure capable of examining private information on users’ devices.

According to Signal, “Forcing all UK residents to prove their age and/or have all their content scanned, simply to exercise their fundamental right to communicate, is a perilous proposition.”

The company also warned that once such capabilities exist, they rarely remain limited to their original purpose. Signal stated: “We know that mass surveillance and censorship capabilities, however sincere-sounding the promises of those who initiate them are, never remain narrowly scoped.”

The Debate Around Client-Side Scanning

At the centre of the controversy is a technology known as client-side scanning.

Unlike traditional content monitoring, which takes place on external servers, client-side scanning operates directly on the user’s device. Supporters argue this provides a compromise between privacy and safety because images do not need to be sent elsewhere for inspection.

Advocates say the approach can prevent harmful content from being created, viewed, or shared while keeping personal information on the device itself.

Critics, however, argue that the distinction is not as clear-cut as it appears.

Although images may never leave the device, the device is still examining content on behalf of a third party. Privacy groups have long argued that this changes the fundamental trust relationship between users and their devices.

Signal’s concern is that the same scanning infrastructure could potentially be expanded in future to identify other forms of content beyond child protection material. Whether or not such powers were ever used, critics argue that the capability itself creates new risks around surveillance, censorship, security vulnerabilities, and public trust.

A Wider Privacy Battle

The disagreement reflects a much broader debate that has been developing for years.

Previous UK legislation, including the Investigatory Powers Act and aspects of the Online Safety Act, has generated similar disputes between governments seeking stronger online protections and privacy advocates concerned about the long-term consequences of expanding monitoring powers.

Technology companies have also faced these questions before. Apple, for example, previously proposed a system for detecting child sexual abuse material on devices before ultimately abandoning the project following widespread criticism from privacy and security experts.

Supporters of the government’s latest proposals argue that child protection must take priority. Organisations including the NSPCC, Internet Watch Foundation, Barnardo’s, and the Children’s Commissioner for England have publicly welcomed the plans.

NSPCC chief executive Chris Sherwood described the proposal as “a major step forward in our fight against online child sexual abuse.”

What Does This Mean For Your Business?

The wider significance of this dispute isn’t really about nude image detection. It is about where governments, technology companies, and citizens draw the line between child protection and personal privacy, particularly when proposals involve technology capable of examining content directly on people’s devices.

The debate also highlights a growing tension that businesses are increasingly encountering across cyber security, compliance, artificial intelligence, and digital regulation. Governments are seeking stronger protections against genuine harms, while technology providers and privacy advocates are warning about the unintended consequences of expanding monitoring capabilities.

The larger issue here is not simply whether children should be protected online, as few would disagree with that objective. The real debate is whether it is possible to achieve those protections without creating technologies that examine private content on personal devices. As governments around the world continue to grapple with that question, the outcome is likely to influence the future of privacy, encryption, and digital communications far beyond the UK.

The post Featured Article : Signal Warns UK Device Scanning Plan ‘Endangers Us All’ appeared first on Mear Technology.

Shopify’s AI Milestone Announced Alongside Strong Financials

These latest figures were unveiled on 4 November 2025 during Shopify’s third-quarter earnings call for the period ending 30 September. The Canadian-based e-commerce software company, which powers millions of businesses in more than 175 countries, reported revenue of around US $2.84 billion, a 32 per cent rise year on year, with gross merchandise volume (GMV) climbing to US $92 billion, also up 32 per cent. Free cash flow margin (the profit left after expenses and investments) stood at about 18 per cent, marking nine consecutive quarters of double-digit free cash flow margins.

Operating income reached US $434 million, slightly below analyst expectations, but executives emphasised that AI-driven performance was the real story of the quarter. “AI is not just a feature at Shopify. It is central to our engine that powers everything we build,” said president Harley Finkelstein during the call, describing AI as “the biggest shift in technology since the internet.”

Shopify and Its Role in Global Commerce

Founded in Ottawa in 2006, Shopify provides digital infrastructure that allows merchants to start, scale and run retail operations online and in-store. For example, the company’s tools cover web hosting, checkout, payments, logistics, marketing, analytics and third-party app integrations. Its reach includes major brands such as Estée Lauder and Supreme, as well as small independent businesses.

The Value of Its Data Network

Shopify’s value essentially lies in its vast data network. For example, with millions of active merchants generating billions of transactions each year, the company can analyse patterns across product categories, price points, consumer behaviour and regional trends. Finkelstein said this data scale provides a distinct edge in the AI era, allowing Shopify to “turn our own signals — support tickets, usage data, reviews, social interactions or even Sidekick prompts — into fast, informed decisions.”

AI Traffic and Orders See Explosive Growth

The most striking statistics from the earnings call were that traffic from AI tools to Shopify-hosted stores is up seven times since January 2025, and that orders attributed to AI-powered search are up eleven times over the same period. Although Shopify did not provide absolute numbers, the growth rate suggests that AI chatbots and conversational assistants are starting to play a meaningful role in how customers find and purchase products.

The company’s internal survey found that 64 per cent of consumers are likely to use AI during the Christmas holiday shopping season, which is a sign, it says, that shoppers are already comfortable relying on digital assistants for product discovery and comparison.

Finkelstein has framed this change as more than a short-term sales boost. “We’ve been building and investing in this infrastructure to make it really easy to bring shopping into every single AI conversation,” he told analysts. “What we’re really trying to do is lay the rails for agentic commerce.”

What Does ‘Agentic Commerce’ Mean?

Shopify’s term “agentic commerce” refers to a model where AI agents act on behalf of consumers, guiding them through discovery, evaluation, checkout and even post-purchase stages such as returns and reordering. For example, rather than searching through multiple sites, a user can simply describe what they want to a conversational AI assistant, which can then query databases, compare prices, and complete the transaction.

The “Commerce for Agents” Stack

To support this model, Shopify has built what it calls its “commerce for agents” stack. This includes a product catalogue system designed for AI queries, a universal shopping cart that lets consumers buy across multiple merchants, and an embedded checkout layer using Shop Pay for one-click transactions. These features are being integrated into platforms such as ChatGPT, Microsoft Copilot and Perplexity through formal partnerships announced earlier this year.

This infrastructure means that AI assistants can browse Shopify merchants’ catalogues and complete purchases directly within chat interfaces. As AI-driven discovery becomes more conversational, Shopify aims to position itself as the primary retail backbone behind these agent-led interactions.

The Scout System

Shopify is also deploying AI internally. For example, its “Scout” system analyses hundreds of millions of pieces of merchant feedback to help employees make product and support decisions more effectively. “Scout is just one of many tools we’re developing to turn our own signals into fast, informed decisions,” Finkelstein said.

Sidekick

Another major tool is Sidekick, an AI assistant embedded within Shopify’s merchant dashboard. Sidekick can analyse sales trends, suggest pricing adjustments, generate marketing copy, or create reports on command. In the third quarter alone, more than 750,000 shops used Sidekick for the first time, generating close to 100 million conversations. Shopify says this helps merchants operate more efficiently and spend less time on routine administrative work.

Shop Pay

Shop Pay is the company’s one-click checkout solution and remains a cornerstone of its AI ecosystem. In Q3 it processed about US $29 billion of GMV, a 67 per cent increase year on year, and accounted for around 65 per cent of all transactions on the platform. This integration ensures that when AI agents complete orders, Shopify retains control of the payment flow and associated data.

Global Impact and European Opportunity

Finkelstein told investors that consumer confidence “is measured at checkout,” adding that shoppers on Shopify “keep buying” and “keep returning.” He noted that demand has remained resilient across categories, even as economic uncertainty persists. Europe appears to be a particular bright spot, with cross-border GMV (the total value of all sales made through Shopify’s platform) steady at 15 per cent of total sales and growth in sectors such as fashion and consumer goods.

For UK and European merchants, this could present a new phase of opportunity. For example, businesses already using Shopify can benefit from being automatically visible to AI-driven discovery systems without developing custom integrations with each platform. By ensuring that product listings are detailed, structured and machine-readable, merchants can increase their chances of being recommended by AI agents.

There is also a potential opening for agencies and developers to specialise in optimising “agent-ready” storefronts, designing catalogues and metadata that AI systems can interpret accurately. For smaller retailers, this could be an efficient route into AI commerce without the high cost of in-house development.

How AI Is Changing the Competitive Landscape

Shopify’s emphasis on AI-driven commerce poses strategic questions for competitors. For example, Amazon and major regional marketplaces already use AI recommendation engines, but Shopify’s model offers decentralised access: independent merchants can collectively benefit from the same AI infrastructure without surrendering control of their brands.

If agentic commerce grows as Shopify predicts, discovery and purchasing could increasingly occur inside chat platforms rather than traditional websites or search engines. That would reshape marketing and customer acquisition strategies, pushing retailers to focus more on structured data, integration quality and conversational optimisation.

For Shopify itself, the rise of agent-driven traffic could also reinforce its role as the connective tissue of global retail, potentially deepening its partnerships with large AI providers and securing a share of new sales channels that bypass traditional web search entirely.

Opportunities and Challenges for Businesses

For merchants, the potential benefits include higher-quality leads, faster conversions, and less reliance on paid advertising. AI-powered assistants can surface relevant products to users who are ready to buy, reducing friction in the path to purchase. The integration of Sidekick also promises time savings through automation of everyday tasks like inventory monitoring and campaign planning.

However, the challenges are equally significant. For example, attribution remains a key question, i.e., determining which sales are truly “AI-driven” is difficult when customers interact across multiple devices and channels. There is also the issue of discoverability. As AI agents narrow recommendations to just a few products, competition for visibility may intensify, potentially favouring larger brands that can afford dedicated AI-optimisation strategies.

Data privacy and regulatory compliance are further concerns, especially in the UK and EU. For example, agentic commerce depends on detailed user data to personalise results, and any sharing of this data between Shopify, AI partners and merchants will attract scrutiny under GDPR and related frameworks. Businesses will need clear consent processes and transparent data handling to maintain consumer trust.

Critics also warn of overreliance on automated systems that can misinterpret queries or produce inaccurate results. Large language models are known to “hallucinate”, and shopping assistants could recommend inappropriate or unavailable items. Shopify’s claim that AI represents autonomy rather than mere automation raises questions about accountability if an agent completes a transaction incorrectly or processes returns without oversight.

Despite these uncertainties, Shopify’s strategy and apparent success with it could be seen as a signal that conversational and agentic shopping will become a defining feature of global retail. The company’s 7× rise in AI-driven traffic and 11× increase in orders could be seen as providing the clearest evidence yet that the technology is beginning to translate from hype into measurable commerce.

What Does This Mean For Your Business?

Shopify’s results appear to show that AI-driven shopping is no longer an abstract concept but a tangible factor reshaping how consumers buy and how merchants sell. The company’s data and partnerships give it a strong early foothold in this emerging space, yet they also highlight the scale of change underway across the entire retail ecosystem. For merchants and technology partners, particularly in the UK, the lesson appears to be that conversational and agent-led shopping channels are likely to become a growing part of how customers discover and complete purchases. Those who adapt their product data, content and customer engagement models early will be better placed to capture new demand as AI assistants become a standard entry point to commerce.

At the same time, the risks are becoming more visible. For example, the concentration of traffic within a handful of AI platforms introduces new dependencies and competition for visibility that could prove as intense as traditional search engine optimisation. Data protection and transparency will remain major issues, especially in the UK and EU where regulators are tightening scrutiny on how consumer data is shared between AI systems and third-party platforms. Businesses will need to ensure that automation enhances customer experience without removing human accountability or trust.

For Shopify, the early surge in AI-related sales provides some validation of its long-term investment in agentic commerce, but the road ahead will depend on whether AI tools can sustain accuracy, reliability and fairness at scale. For retailers, investors and consumers alike, the company’s current momentum highlights the fact that AI is already changing commerce in practice, not just in theory, and the balance between innovation, control and transparency will define who benefits most from this new era.

The post Featured Article : Shopify Reports 7× Surge in AI-Driven Traffic appeared first on Mear Technology.

Vulnerabilities Found in AI Code

The finding comes from cybersecurity company Aikido Security’s State of AI in Security & Development 2026, which features the results of a wide-ranging survey of 450 developers, AppSec engineers and CISOs across Europe and the US.

According to the study, nearly a quarter of all production code (24 per cent) is now written by AI tools, rising to 29 per cent in the US and 21 per cent in Europe. However, it seems that adoption has come at a cost. For example, the report shows that almost seven in ten respondents said they had found vulnerabilities introduced by AI-generated code, while one in five reported serious incidents that caused material business impact. As Aikido’s researchers put it, “AI-generated code is already causing real-world damage.”

Worse In The US

According to the report, the US appears to be hit hardest. For example, 43 per cent of US organisations reported serious incidents linked to AI-generated code, compared with just 20 per cent in Europe. The report says this is due to stronger regulatory oversight and stricter testing practices in Europe, where companies tend to catch problems earlier. European respondents recorded more “near misses”, indicating that vulnerabilities were identified before they could cause harm.

AI Changing The Development Landscape

AI coding assistants such as GitHub Copilot, ChatGPT and other generative tools are now integral to the software pipeline, promising faster output and fewer repetitive tasks, but they also introduce a new layer of risk.

Aikido’s data highlights that productivity gains can be offset by increased complexity and slower remediation. For example, teams now spend an average of 6.1 hours per week triaging alerts from security tools, with most of that time wasted on false positives. In larger environments, the triage burden grows to nearly eight hours a week where teams rely on multiple tools.

Leads To Dangerous Shortcuts

It seems that this problem can lead to dangerous shortcuts. For example, two-thirds of respondents admitted bypassing or delaying security checks due to a kind of alert fatigue. Developers under pressure to deliver have started to “push through” security warnings, creating a cycle where quick fixes outweigh caution.

Natalia Konstantinova, Global Architecture Lead in AI at BP, highlights the issue, saying: “AI-generated code shouldn’t be fully trusted, since it can cause serious damage. This is a reminder to carefully double-check its outputs.”

Accountability Is Becoming A Flashpoint

It seems that as AI-generated code makes its way into production, one of the biggest challenges is determining who is responsible when things go wrong.

Aikido’s survey shows a clear divide. For example, 53 per cent of respondents said security teams would be blamed if AI code caused a breach, 45 per cent blamed the developer who wrote the code, and 42 per cent blamed whoever merged it into production. The result, according to UK insurance and pensions company Rothesay’s CISO Andy Boura, is “a lack of clarity among respondents over where accountability should sit for good risk management.”

In fact, half of developers said they expect to shoulder the blame personally if AI-generated code they produced led to an incident, suggesting a growing culture of uncertainty and mistrust between teams.

The blurred lines are also fuelling tension between developers and security leaders. Many security professionals worry that AI-assisted development is moving too fast for proper oversight, while developers argue that outdated review processes are slowing down innovation.

“Tool Sprawl” Is Making Things Worse

Perhaps surprisingly, Aikido’s research found that organisations with more security tools were actually experiencing more security incidents. For example, companies using six to nine different tools reported incidents 90 per cent of the time, compared with 64 per cent for those using just one or two.

It seems this “tool sprawl” is also linked to slower fixes. Teams with multiple vendor tools took almost eight days on average to remediate a critical vulnerability, compared with just over three days in smaller, more consolidated setups.

The problem, according to Aikido, is not the tools themselves but the overhead they create, i.e., duplicate alerts, inconsistent data and fractured workflows that slow response times.

Walid Mahmoud, DevSecOps Lead at the UK Cabinet Office, notes about this issue: “Giving developers the right security tool that works with existing tools and workflows allows teams to implement security best practices and improve their posture.”

Teams using integrated, all-in-one platforms built for both developers and security professionals were twice as likely to report zero incidents compared with those using tools aimed at one group only.

Regional Differences In Oversight

The study draws a clear contrast between European and American approaches. For example, European teams tend to rely more on human oversight, manual reviews and compliance-based testing frameworks, while US teams are quicker to automate processes and deploy AI-generated code at scale.

Aikido’s figures show that 58 per cent of US teams track AI-generated code line by line, compared with just 35 per cent in Europe. That difference, coupled with the higher level of automation in US pipelines, may explain why more AI-related vulnerabilities are being detected (and exploited) there.

As Aikido puts it, “Europe prevents, the US reacts.” The slower, more regulated approach across Europe appears to be reducing the number of major breaches, even if it creates extra workload for developers.

Independent Findings Support The Trend

It should be noted here that security concerns raised by Aikido are actually consistent with other recent studies. For example, Veracode’s 2025 GenAI Code Security Report found that 45 per cent of AI-generated code samples failed basic security tests. Java was the worst affected, with a 72 per cent failure rate, followed by JavaScript (43 per cent), C# (45 per cent) and Python (38 per cent).

The Veracode team concluded that while AI tools can generate functional code quickly, they often fail to account for secure design or contextual logic. Their analysis showed little improvement in security quality between model generations, even as syntax accuracy improved.

Policy researchers are also warning of deeper structural issues. For example, the Center for Security and Emerging Technology (CSET) at Georgetown University has outlined three categories of risk from AI-generated code, i.e., insecure outputs, vulnerabilities in the AI models themselves, and wider supply chain exposure.

Also, research from OX Security has pointed to what it calls the “army of juniors” effect, which is where AI tools can produce vast amounts of syntactically correct code, but often lack the architectural understanding of experienced developers, multiplying low-level errors at scale.

Industry Perspectives On A Path Forward

Despite these warnings, it seems that optimism remains widespread. For example, 96 per cent of Aikido’s respondents believe AI will eventually be able to produce secure, reliable code, with nearly half expecting that within three to five years.

However, only one in five think AI will achieve that without human oversight. The consensus is that people will remain essential to guide secure design, architecture and business logic.

AI Can Check AI

There also appears to be growing belief that AI should be used to check AI. For example, nine out of ten organisations expect AI-driven penetration testing to become mainstream within around five and a half years, using autonomous “agentic” systems to identify vulnerabilities faster than human testers could.

“The 79 per cent are the smart ones,” said Lisa Ventura, founder of the UK’s AI and Cyber Security Association. “AI isn’t about replacing human judgment, it’s about amplifying it.”

This sentiment echoes a wider industry move towards what security leaders call “augmented development”, i.e., human-centred workflows supported by automation, not replaced by it.

Why This Matters

For UK organisations, the implications are immediate. For example, the report shows that AI-generated code is not a future risk but a current operational issue already affecting production environments.

As Kevin Curran, Professor of Cybersecurity at Ulster University, says: “This demonstrates the slim thread which at times holds systems together, and highlights the need to properly allocate resources to cybersecurity.”

Aikido’s findings also underline the importance of developer education and clear accountability. Matias Madou, CTO at Secure Code Warrior, wrote that “in the AI era, security starts with developers. They are the first line of defence for the code they write, and for the AI that writes alongside them.”

For businesses already navigating compliance regimes such as the UK NCSC’s Cyber Essentials or ISO 27001, this means treating AI-generated code as a separate risk class requiring its own testing and review procedures.

Criticisms And Challenges

While Aikido’s report is one of the most comprehensive of its kind, it is not without its critics. For example, some security analysts argue that “one in five breaches” may overstate the influence of AI-generated code because correlation does not prove causation. Many breaches involve complex attack chains where AI code may only play a small role.

Others have questioned the representativeness of the sample. For example, the survey focused primarily on organisations already experimenting with AI in production, which may naturally skew toward higher exposure. Small or less digitally mature companies, where AI coding tools are still limited to pilot use, may experience fewer issues.

There are also some methodological challenges. For example, measuring what qualifies as “AI-generated” can be difficult, particularly when developers use AI assistants to autocomplete small code segments rather than entire functions. Attribution of vulnerabilities can therefore be subjective.

That said, even many of the sceptics agree that the report captures a growing and genuine concern. Independent findings from Veracode, OX Security and CSET all point in the same direction, i.e., that AI-generated code introduces new risks that traditional security pipelines were never designed to manage.

The challenge for developers and CISOs alike is, therefore, to close that gap before AI coding becomes the default, not the exception. As the technology matures, the balance between innovation speed and security assurance will define how safely businesses can harness AI’s potential without repeating the mistakes of early adoption.

What Does This Mean For Your Business?

The findings appear to point to an industry racing ahead faster than its safety systems can adapt. AI coding tools have clearly shifted from experimental to mainstream, yet governance and testing practices are still catching up. The evidence suggests that while automation can improve productivity, it cannot yet replicate the depth of human reasoning needed to identify design-level flaws or assess real-world attack paths. That gap between capability and control is where today’s vulnerabilities are being born.

For UK businesses, this raises practical questions about oversight and responsibility. Many already face pressure to adopt AI for competitive reasons, yet the report shows that without strong testing regimes and clear accountability, the risks can outweigh the benefits. In particular, financial services, healthcare and public sector organisations, which handle sensitive data and operate under strict compliance frameworks, will need to ensure that AI-generated code goes through the same, if not stricter, scrutiny as any other form of software.

Developers, too, are being asked to operate within new boundaries. The growing reliance on generative tools means the traditional model of code review and approval is no longer sufficient. UK companies may now need to invest in dedicated AI audit trails, tighter version tracking and security validation that can distinguish between human and machine-written code. The evidence from Aikido’s report also suggests that integrated platforms, where developer and security functions work together, can yield better results than fragmented tool stacks, making collaboration a critical priority.

For other stakeholders, including regulators and insurers, the implications are equally clear. For example, regulators will need to consider whether existing standards, such as Cyber Essentials, adequately address AI-generated components. Insurers may need to begin to factor the presence of AI-written code into risk assessments and premiums, especially if breach attribution becomes more traceable.

There is also a wider social and ethical dimension to consider here. For example, if AI-generated code becomes a leading cause of breaches, the question of accountability will soon reach the boardroom and, potentially, the courts. The current ambiguity over who is at fault, i.e., the developer, the CISO or the AI vendor, will not remain sustainable for long. Policymakers may be forced to define clearer lines of liability, particularly where generative AI is being deployed at scale in safety-critical systems.

The overall picture that emerges here is not one of panic but of adjustment. The technology is here to stay, and most industry leaders still believe it will eventually write secure, reliable code. The challenge lies in getting from here to there without compromising trust or resilience in the process. For now, it seems the safest path forward is not to reject AI in development, but to treat it with the same caution as any powerful, untested colleague: valuable, but never unsupervised.

The post Featured Article : AI-Generated Code Blamed for 1-in-5 Breaches appeared first on Mear Technology.

Hardening of Attitudes

Arctic Wolf’s 2025 Human Risk Behaviour Snapshot reveals that 77 per cent of IT and security leaders say they have (or would) sack an employee for falling for a phishing or social engineering scam, up from 66 per cent in 2024. The report describes this shockingly high statistic as the result of a significant hardening of attitudes among security professionals, despite continuing increases in attack volume and breach rates.

The Scale

The study, which surveyed more than 1,700 IT leaders and end users globally, found that 68 per cent of organisations suffered at least one breach in the past year. The UK and Ireland, for example, recorded some of the steepest rises, partly due to high-profile incidents in the retail sector. Arctic Wolf notes that many firms are still failing to implement basic measures, with only 54 per cent enforcing multi-factor authentication (MFA) for all users.

Sacking Doesn’t Solve The Problem

The same report also found that organisations taking an education-first approach rather than firing staff saw an 88 per cent reduction in long-term human risk. According to Arctic Wolf’s Chief Information Security Officer, Adam Marrè, “Terminating employees for falling victim to a phishing attack may feel like a quick fix, but it doesn’t solve the underlying problem.”

A Strong Policy Signal

The findings of the report appear to highlight a growing gap between confidence and capability. For example, three-quarters of leaders said they believed their organisation would not fall for a phishing attack, yet almost two-thirds admitted they have clicked a phishing link themselves, and one in five said they failed to report it.

Corrective Action Instead of Dismissal

It should be noted that, in the same survey, more than six in ten leaders said they had taken corrective action against employees who fell for phishing scams by restricting or changing access privileges, which Arctic Wolf suggests is a more constructive approach than dismissal.

Executives Are Valuable Targets For Cybercriminals

In fact, the company’s own data also shows that 39 per cent of senior leadership teams were targeted by phishing and 35 per cent experienced malware infections, highlighting how executives themselves are often the most valuable targets for attackers.

“When leaders are overconfident in their defences while overlooking how employees actually use technology, it creates the perfect conditions for mistakes to become breaches,” Marrè said. He added that the most secure organisations “pair strong policies and safeguards with a culture that empowers employees to speak up, learn from errors, and continuously improve.”

Confidence Vs Behaviour

The Arctic Wolf report appears to highlight a clear contradiction. For example, while most security leaders view phishing as a frontline employee issue, they are actually statistically among the most likely to make the same mistakes. Many also admit to disabling or bypassing security systems. For example, 51 per cent said they had done so in the past year, often claiming that certain measures “slowed them down” or made their work harder.

This gap between stated policy and personal practice is what Marrè describes as “a major blind spot and degree of hubris among some security leaders.” The report concludes that leadership culture sets the tone for the rest of the organisation, and that inconsistency at the top erodes credibility and weakens defences.

Who Is Really Falling For Phishing In 2025?

The question of who gets caught out most is not as simple as it might appear. For example, Arctic Wolf’s data indicates that senior staff, not junior employees, are often prime targets because of their privileged access and decision-making authority. The company found that nearly four in ten executive teams experienced phishing attempts, compared with lower rates among general staff.

Other research appears to support this pattern. For example, Verizon’s 2025 Data Breach Investigations Report confirms that social engineering remains one of the top causes of data breaches, accounting for more than two-thirds of all initial intrusion methods. Its analysis identifies finance, healthcare, education, and retail as the most heavily targeted sectors. Attackers exploit trust, urgency, and routine workflows to trick users into sharing credentials or downloading malware.

New Hires More Likely To Click

Also, a mid-2025 study by Keepnet, reported by Help Net Security, found that 71 per cent of new hires clicked on phishing emails during their first 90 days, making them 44 per cent more likely to fall victim than longer-serving staff. The main reasons were unfamiliar internal systems, a desire to respond quickly to apparent authority figures, and inconsistent onboarding security training. The same research found that structured, role-specific training reduced click rates by around 30 per cent within three months.

Retail Legacy Systems An Issue

Retail has also seen a marked increase in phishing incidents across the UK and Ireland. Arctic Wolf attributes this to the industry’s reliance on legacy systems, seasonal sales spikes, and the complexity of managing large volumes of customer data. The company says these factors have made retail “a prime target” for opportunistic and scalable attacks.

Can Employers Really Sack Staff For Clicking A Phishing Email?

In the UK, simply sacking an employee for falling for a phishing email is legally possible but rarely straightforward. For example, under the Advisory, Conciliation and Arbitration Service (Acas) Code of Practice, an employer can only dismiss fairly if they have both a valid reason, such as misconduct or capability, and have followed a fair and reasonable procedure.

For a dismissal to be lawful, the employer must investigate properly, give the employee a chance to respond, and ensure the sanction is proportionate. Even where a phishing incident causes financial loss or reputational damage, the question is whether the individual acted negligently or was misled despite reasonable training and policies. In most cases, a first-time mistake caused by deception would not actually meet the threshold for gross misconduct.

Unfair Dismissal?

It’s worth noting here that employees with two years’ service can bring a claim for unfair dismissal if they believe the reason or process was unreasonable. Employment tribunals are required to take the Acas Code into account, and may increase or reduce compensation by up to 25 per cent if either side fails to follow it. This means employers that act punitively without clear evidence or consistent practice could face costly legal challenges.

Most employment lawyers, therefore, recommend a corrective rather than disciplinary response, especially where the organisation’s training or technical safeguards may have been insufficient. Arctic Wolf’s data reflects this tendency, with many leaders actually opting to limit access rights rather than dismiss staff outright after a phishing incident.

Ethics And Culture

Beyond legality, there is an ethical debate here to take account of which focuses on culture and transparency. For example, the UK’s National Cyber Security Centre (NCSC) advises that creating a “no-blame reporting culture” is one of the most effective ways to reduce security risk. Its guidance stresses that employees should feel safe to report suspicious emails or mistakes immediately, without fear of reprisal.

In fact, it is well known that when punishment is the first response, employees often stay silent. Arctic Wolf’s own findings appear to bear this out, i.e., one in five security leaders who clicked a phishing link failed to report it. That silence can allow breaches to escalate before they are detected.

Human Error Inevitable

Security experts argue that treating human error as inevitable, and training people to respond effectively, is far more effective than zero-tolerance policies. Marrè says that “progress comes when leaders accept that human risk is not just a frontline issue but a shared accountability across the organisation.” He advocates regular, engaging training that reflects real threats, backed by leadership example and open communication.

The Double Standard In Practice

The data from this and other reports appears to paint a clear picture of contradiction at the top. For example, many of the same leaders who advocate sacking staff for phishing errors have clicked links themselves or disabled controls that protect the wider organisation. Arctic Wolf’s report describes this as “a culture of ‘do as I say, not as I do’,” warning that it undermines credibility and increases exposure to social engineering attacks.

Phishing Now More Sophisticated

One other important factor to take into account here is the fact that phishing techniques have also grown more sophisticated. For example, attackers now use AI-generated emails, cloned websites, and real-time chat-based scams to trick users into sharing credentials. Even experienced professionals can, therefore, struggle to spot these messages, particularly when they appear to come from known suppliers or senior colleagues.

AI Supercharges Phishing Success

Microsoft’s 2025 Digital Defence Report shows that AI-generated phishing emails are 4.5 times more likely to fool recipients, achieving a 54 per cent click-through rate compared with 12 per cent for traditional scams. The company says this surge in realism and scale has made phishing “the most significant change in cybercrime over the last year”.

Microsoft also estimates that AI can make phishing campaigns up to 50 times more profitable, as attackers use automation to craft messages in local languages, tailor lures, and launch mass campaigns with minimal effort. Beyond email, AI is now being used to scan for vulnerabilities, clone voices, and create deepfakes, transforming phishing into one of the fastest-growing and most lucrative attack methods worldwide.

Initial Compromise Comes From Phishing

Industry-wide data continues to show that phishing is the most common initial attack vector in business email compromise, ransomware, and credential theft cases. Verizon’s latest data shows phishing accounts for roughly 73 per cent of initial compromise methods, followed by previously stolen credentials. These statistics underline how difficult it is to eliminate human error entirely, even in well-trained environments.

Arctic Wolf argues that genuine progress actually requires leading by example rather than blaming employees. In its report, the company’s closing recommendations include continuous education, practical simulations, and building a culture that rewards honesty over silence. Its research concludes that organisations where employees feel confident to report mistakes are significantly less likely to experience repeat incidents, and far more likely to detect breaches early.

What Does This Mean For Your Business?

The findings appear to highlight a cultural challenge within cyber security. Punishing individuals for mistakes that even experienced leaders admit to making risks undermining the very trust and openness that strong defences depend on. The evidence shows that while technical safeguards such as MFA and endpoint protection are essential, they are not enough on their own. What really differentiates resilient organisations is how they handle human error, whether they choose to learn from it or treat it as grounds for dismissal.

For UK businesses, the implications are significant. A strict zero-tolerance policy towards phishing may appear decisive, but it can also damage morale, suppress reporting, and expose employers to potential legal and reputational risks. Dismissing staff without due process could also lead to unfair dismissal claims, while a culture of fear can discourage the transparency needed to contain attacks quickly. By contrast, firms that take a measured, education-focused approach tend to see fewer repeat incidents, faster recovery times, and stronger employee engagement in security.

The message from Arctic Wolf’s data is that leadership example matters most. When senior executives model good cyber hygiene, acknowledge their own vulnerabilities, and support open communication, staff are far more likely to follow suit. Creating an environment where everyone feels responsible for reporting threats, and confident they will be supported for doing so, delivers a far greater return than any punitive measure.

For regulators, investors, training providers and others, the findings reinforce the importance of human-centred strategies that combine accountability with education. As phishing continues to evolve in sophistication, organisations across all sectors must balance clear policy enforcement with a recognition that even the best-informed professionals can make mistakes. The organisations that respond to that reality with fairness, transparency, and leadership integrity will be the ones best equipped to withstand the next wave of attacks.

The post Featured Article : 77% of Security Leaders Would Sack Phishing Victims appeared first on Mear Technology.

Using Algorithms

The disclosure came after recent reports in The Telegraph revealed HMRC was using algorithms to flag suspicious activity online. In response, the tax authority confirmed that AI is already playing a role in its investigative work. Officials stressed the technology is only used in criminal investigations and is not applied to the everyday taxpayer. In a statement, HMRC said AI is being deployed to help staff spot inconsistencies between declared income and publicly available social media posts, while also cutting down the amount of time spent on manual administration.

Spend Less Time on Admin

“Greater use of AI will enable our staff to spend less time on admin and more time helping taxpayers, as well as better target fraud and evasion to bring in more money for public services,” HMRC said in a statement. Officials added that the approach does not replace human decision-making, pointing to what they describe as “robust safeguards and legal oversight” around the process.

Why AI Is Being Deployed

The move reflects HMRC’s broader challenge of narrowing the UK’s tax gap, which in 2022–23 was estimated at £51 billion, or about 4.8 per cent of total theoretical tax liabilities. Of this, around £5.5 billion was attributed to tax evasion. Reducing this shortfall has become a priority for the government, which has promised that more efficient enforcement will increase revenues without raising taxes on working households.

By applying AI tools to tasks previously carried out manually, HMRC, therefore hopes to process large volumes of open-source data more quickly and accurately. Social media platforms such as Instagram, Facebook and TikTok are seen as sources of information because they often show details of people’s lifestyles that may not align with their declared income.

For example, cases have previously been reported where individuals claiming benefits on grounds of ill health were found posting publicly about participation in marathons, or where people declaring modest incomes shared photos of luxury cars and holidays. Until now, gathering such evidence relied heavily on human monitoring. AI allows patterns, anomalies and potential red flags to be detected across thousands of accounts in a fraction of the time.

Integration with Existing Systems

It’s hoped that this latest use of AI will complement HMRC’s wider analytical infrastructure, particularly its “Connect” system, introduced more than a decade ago. Connect draws together information from tax returns, banks, property records and other government databases to flag discrepancies between declared income and observed financial behaviour. Adding automated social media analysis into that mix gives investigators another channel through which to identify possible fraud.

Also To Provide Guidance To Taxpayers

It should be noted that the department has also been exploring AI for broader and less sinister purposes, such as helping taxpayers navigate the more than 100,000 pages of guidance on its website, and summarising customer service calls for advisers. However, it’s the use of social media monitoring that has generated the most public debate, not least because of its implications for privacy, accuracy and accountability.

Efficiency Gains and Cost-Cutting For HMRC

For HMRC itself, the adoption of AI in investigations is positioned as an efficiency gain rather than a cost-cutting measure. The government has already announced plans to recruit 5,500 new compliance staff, suggesting the technology will be used to augment rather than replace human expertise.

Tax specialists have noted that AI could help HMRC by pulling together information from multiple sources far more efficiently than manual checks. At the same time, they warn of potential pitfalls, including the risk of mistaken identity if the technology fails to distinguish between genuine accounts and those that are fake or hacked. Such concerns underline the importance of retaining human oversight in any decision-making process.

Focusing

From HMRC’s perspective, the argument is that automation allows investigators to focus their time where it is most valuable, i.e. complex cases that require judgment, rather than sifting through data for initial leads. The department also points to the potential to secure better returns on public spending, with AI-enabled enforcement expected to bring in billions of pounds in additional tax revenues over the coming years.

The Implications for Taxpayers

For law-abiding taxpayers, HMRC has been keen to stress that there is little to fear from AI social media monitoring. Officials say the tools are not used in routine tax collection or compliance checks, but only in serious criminal cases where there is already suspicion of wrongdoing.

The wider deployment of AI across HMRC’s operations could, in time, make interactions with the tax system simpler for the majority. For example, tools that help people understand complex rules, avoid errors in returns and access relevant guidance more quickly could reduce unintentional mistakes. Tax specialists point out that significant amounts of revenue are often lost through basic errors, and AI has the potential to reduce this by offering clearer digital assistance and more reliable support to taxpayers.

Surveillance Fears

At the same time, it has to be said that the disclosure that HMRC is scouring social media using AI may add to public concerns about surveillance and government access to personal data. Although the posts in question are publicly visible, many people may not anticipate that their online activity could form part of a criminal tax investigation.

Challenges

Not surprisingly, the announcement has not gone unchallenged. Privacy advocates and some parliamentarians have warned that reliance on AI risks producing false positives, where innocent individuals are wrongly flagged as suspicious. Concerns have also been raised that the system could amplify errors if it fails to distinguish between genuine accounts and those that are hacked, fake or misleading. Civil liberties group Big Brother Watch has previously cautioned that the spread of AI-driven surveillance represents a “frightening expansion” of state monitoring, and argued that without strict legal safeguards such tools risk undermining privacy and fairness in the justice system.

There is also a wider political backdrop. The UK government is under pressure over its broader AI strategy, with reports earlier this year suggesting the national AI institute faced internal turmoil and potential funding withdrawals. Against that context, the use of AI by HMRC has become part of a larger debate about how far public authorities should adopt emerging technologies, and how safeguards should be applied.

Some commentators have also drawn parallels with the Horizon IT scandal at the Post Office, in which faulty computer evidence led to wrongful prosecutions of sub-postmasters. Although HMRC emphasises that human decision-making remains central to its process, critics argue that overreliance on automated systems without adequate checks could carry significant risks.

The tax authority insists that its approach has been developed with those lessons in mind. AI is used to highlight possible leads, but human investigators must review the evidence before any action is taken. Officials have also stressed that all use of AI in this area is subject to legal oversight, ensuring compliance with UK data protection and criminal justice laws.

Wider International Context

It should be noted, however, that the UK is not alone in deploying AI to tackle tax evasion as other countries have already been using similar methods. HMRC has been sending so-called “nudge letters” to taxpayers after analysing international financial data shared under the OECD’s Common Reporting Standard, which tracks overseas income. This AI-assisted approach has contributed to a reported 22 per cent rise in admissions of foreign tax evasion in recent years.

The logic appears to be that as more financial data becomes digitised and globally shared, AI will become a necessary tool for connecting the dots. For HMRC, adding social media monitoring into that picture is seen as the next step in keeping pace with increasingly complex forms of tax fraud.

What Does This Mean For Your Business?

The real test will be whether HMRC can strike the balance between efficiency and fairness. The technology may promise to sharpen investigations, close the tax gap and support a more resilient tax base, but it also raises unresolved questions about how far government agencies should be able to probe into people’s digital lives. For taxpayers, reassurance that AI will not be used in routine compliance checks will be welcome, but concerns about transparency and proportionality are unlikely to fade quickly.

For UK businesses, the implications may be twofold. For example, firms could benefit from a more level playing field if AI enables HMRC to clamp down more effectively on undeclared income and fraudulent competition. However, there is a risk that legitimate companies could face greater scrutiny or reputational harm if mistakes occur in the interpretation of online data. The safeguards HMRC has promised will, therefore, be critical in maintaining trust.

Other stakeholders, from policymakers to civil liberties groups, will, no doubt, be watching closely. The government has positioned AI as a tool for improving public services and raising revenue without additional tax rises, yet its wider strategy for regulating AI remains unsettled. With memories of past technology failures still fresh, the rollout of these systems within HMRC will be an early indicator of how the state intends to manage the trade-offs between innovation, privacy and accountability in the years ahead.

The post Featured Article : HMRC’s AI Scans (Tax-Cheats) Social Media appeared first on Mear Technology.

What Is The Deal?

Announced on 21 July 2025, the agreement takes the form of a Memorandum of Understanding (MoU) between the Department for Science, Innovation and Technology and OpenAI, the US-based company behind ChatGPT. While not legally binding, the document outlines both sides’ intentions to deepen collaboration in areas including AI infrastructure, public sector deployment, and AI safety research.

To Transform Taxpayer-Funded Services

According to the Department, the strategic aim is to “transform taxpayer-funded services” and improve how the state uses emerging technologies. It also includes commitments to explore joint investments in regional AI growth zones, share technical insights with the UK’s AI Safety Institute, and expand OpenAI’s UK-based engineering and research operations.

Technology Secretary Peter Kyle described the move as central to “driving the change we need to see across the country – whether that’s in fixing the NHS, breaking down barriers to opportunity or driving economic growth”.

OpenAI CEO Sam Altman echoed this, saying AI is a “core technology for nation building” and that the partnership would “deliver prosperity for all” by aligning with the goals set out in the UK’s AI Opportunities Action Plan.

Why Now And Why OpenAI?

The timing reflects the government’s wider push to try to position Britain as a leader in AI development and deployment. This includes the £2 billion commitment to AI growth zones made earlier this year, alongside a new AI Compute Strategy and the creation of a national AI Safety Institute.

It also comes as the UK faces some sluggish productivity growth, mounting public sector workloads, and strained public finances. Officials argue that automating time-consuming tasks, such as consultation analysis, document classification or civil service admin, could help free up staff to focus on more complex or sensitive work.

OpenAI’s Models Already Being Used

It’s worth noting here that GPT-4o, OpenAI’s latest model, is already being used in a Whitehall tool called “Consult”, which automatically processes responses to public consultations. The tool is said to reduce weeks of manual work to a matter of minutes, while leaving substantive decision-making to human experts.

The government’s AI chatbot “Humphrey” also uses OpenAI’s API to help small businesses navigate GOV.UK services more efficiently.

According to the MoU, future deployments will prioritise transparency, data protection, and alignment with democratic values. However, critics have raised concerns that key details of the deal remain vague.

A Boost for OpenAI’s UK Ambitions

For OpenAI, the partnership will, no doubt, reinforce its growing presence in the UK, which it describes as a “top three market globally” for both API developers and paid ChatGPT subscribers.

The company opened its first international office in London in 2023 and now employs more than 100 staff there. Under the new agreement, it plans to expand these operations further to support both product development and local partnerships.

OpenAI is also expected to explore building or supporting UK-based data centres and R&D infrastructure, which is a move that would enhance what the government calls the country’s “sovereign AI capability”. This concept refers to ensuring that core AI infrastructure and innovation remain under UK control rather than becoming overly reliant on US or Chinese providers.

Sam Altman has suggested that such regional investment could help stimulate jobs and revitalise communities, especially within the designated AI growth zones.

Competitors and UK Tech Firms

The announcement is likely to intensify competition among global AI providers, particularly Google DeepMind and Anthropic, both of which have also signed cooperation agreements with the UK Government in recent months.

However, some British AI firms say the government is placing too much emphasis on partnerships with dominant US players at the expense of homegrown innovation. Tim Flagg, Chief Operating Officer at UKAI, a trade body for British AI companies, previously warned that the AI Opportunities Action Plan takes a “narrow view” of who is shaping the UK’s AI future.

For example, it could mean that UK-based AI firms working on foundation models, language processing, or ethical AI frameworks may now find themselves competing for talent, attention, and influence with the likes of OpenAI, whose models and reputation already dominate the field.

Digital rights campaigners have also questioned whether the government is adequately safeguarding public interest and data security in its eagerness to court big tech firms.

Warnings Over Public Data and Accountability

One of the main criticisms of the deal is its lack of specificity on how public data may be used. While the agreement hints at technical collaboration and information-sharing, it doesn’t clarify whether UK citizens’ data will help train OpenAI’s models, or what safeguards will be in place.

Digital rights group Foxglove called the MoU “hopelessly vague”, warning that OpenAI stands to benefit from the UK’s “treasure trove of public data”. Co-Executive Director Martha Dark went further, saying that “Peter Kyle seems bizarrely determined to put the big tech fox in charge of the henhouse when it comes to UK sovereignty”.

Others have raised broader concerns about transparency and oversight. Some academics and civil service experts suggest that while AI tools may relieve public sector staff of time-consuming administrative tasks, the real challenge lies in ensuring that deployments are done ethically, with strong governance and minimal reliance on personal or sensitive data.

The AI Infrastructure Angle

Beyond public services, the deal includes plans to explore investment in AI infrastructure, a term that typically refers to the high-performance computing facilities and energy-intensive data centres required to train and deploy large AI models.

This ties into the UK’s broader push for regional development. Under the AI Growth Zone initiative, over 200 local bids have been submitted, with billions in potential investment expected. The government has confirmed that both Scotland and Wales will host zones under the AI Compute Strategy.

The partnership with OpenAI may give these ambitions extra momentum. If the company builds or co-develops infrastructure in the UK, it could significantly improve national access to compute power, a key enabler for both public and private AI innovation.

Concerns Over Sovereignty and Big Tech Influence

Despite assurances from ministers that the UK will remain in control of its AI future, there are growing calls for greater scrutiny and legislative oversight.

The UK’s Data Protection and Digital Information Bill, which is making its way through Parliament, may play a role in regulating how personal and government data can be used in AI systems. However, many campaigners believe that dedicated AI legislation, with clear public interest protections, is still lacking.

Meanwhile, the MoU’s non-binding nature means the partnership could evolve in unpredictable ways, without necessarily being subject to parliamentary approval or regulatory review.

Peter Kyle has defended the approach, arguing that “global companies which are innovating on a scale the British state cannot match” must be engaged if the UK wants to compete in the AI era.

However, for opponents, this signals a risk of policy being shaped too closely around commercial interests, rather than the public good.

What Does This Mean For Your Business?

The UK’s agreement with OpenAI may sound like a significant moment in the evolution of public sector AI strategy, but it also raises some important questions about balance, control, and accountability. For government departments under pressure to deliver more with less, AI appears to present an opportunity to reduce routine workloads, speed up processes, and direct skilled professionals toward more impactful tasks. With OpenAI’s models already embedded in tools like “Humphrey” and “Consult”, this partnership could enable deeper integration and faster iteration across critical areas such as justice, health, education, and small business support.

For UK businesses, particularly those involved in or supplying to the public sector, the partnership could bring both practical benefits and growing pressure. For example, OpenAI’s expanded presence may improve access to advanced AI tools, infrastructure, and collaborative opportunities, helping British startups and firms apply new technologies more effectively. At the same time, there is concern that prioritising partnerships with large US-based companies could marginalise smaller UK tech providers whose innovations may be better suited to local contexts but lack the scale or visibility to compete.

The deal also adds pressure on the UK to clarify how it will protect data, enforce ethical guardrails, and ensure that public interest remains front and centre. Critics argue that the lack of legally binding terms leaves room for mission creep or overreach, especially if partnerships expand without clear oversight. With public trust in digital services already under strain, transparency and accountability will be vital to ensuring these systems are not only efficient, but also fair and secure.

Ultimately, the MoU appears to reflect the government’s belief that strategic alignment with global AI leaders is essential if the UK wants to stay competitive. Whether this approach will deliver broad-based economic and societal benefit, or reinforce existing power imbalances, will depend on how well the promises of inclusion, sovereignty, and ethical standards are translated into action. For now, the UK has made its bet, and the challenge will be ensuring that it delivers for everyone.

The post Featured Article : UK Public Sector / AI Partnership appeared first on Mear Technology.

ChatGPT As An ‘AI Agent’

OpenAI has formally launched what it calls the ChatGPT agent, transforming its well-known conversational model into a proactive digital assistant capable of completing real tasks, independently choosing tools, and reasoning through multi-step workflows.

This new functionality, now available to paying subscribers, marks a significant turning point. For example, rather than simply responding to prompts, ChatGPT can now act as a true AI agent, performing tasks such as planning a meal, generating a financial forecast, writing and formatting a presentation, or summarising your inbox. Crucially, it can also interact with websites, manipulate files, and run code using its own virtual machine.

“We’ve brought together the strengths of our Operator and deep research systems to create a unified agentic model that works for you—using its own computer,” OpenAI explained in a blog post on 17 July. “ChatGPT can now handle complex tasks from start to finish.”

What the ChatGPT Agent Can Actually Do

OpenAI says the agentic version of ChatGPT can choose the best tools to solve a problem and it can perform multi-step operations without being micromanaged by the user.

For example:

– Users can ask ChatGPT to analyse their calendar and highlight upcoming client meetings, incorporating relevant news about those companies.

– It can plan a dinner for four by navigating recipe websites, ordering ingredients, and sending the shopping list via email.

– In professional settings, it may be used to analyse competitors, generate editable slide decks, or reformat financial spreadsheets with up-to-date data.

Its Own Toolkit

Technically, the agent achieves this by drawing on a powerful toolkit, i.e. a visual browser, text-based browser, command-line terminal, access to OpenAI APIs, and “connectors” for apps like Gmail, Google Drive, or GitHub. OpenAI reports that it can navigate between tools fluidly, running tasks within a dedicated virtual computer environment that preserves context and session history.

This context-awareness means it can hold onto prior steps and continue building on them. For example, if a user uploads a spreadsheet to be analysed, ChatGPT can extract key data, switch to a browser to find supporting info, and return to the terminal to generate a report, all within one session.

OpenAI describes the experience as interactive and collaborative, not just automated. Users can interrupt, steer or stop tasks, and ChatGPT will adapt accordingly.

Who, When, and How?

The new ChatGPT agent capabilities are being rolled out initially to paying customers on the Pro, Plus, and Team plans. Enterprise and Education users will follow in the coming weeks.

To access agent mode, users need to open a conversation in ChatGPT and select the ‘agent mode’ option from the tools dropdown. Once enabled, users can assign complex tasks just as they would in a natural chat. On-screen narration gives visibility into what the model is doing at each step.

Pro users get 400 messages per month, while Plus and Team users receive 40 per month, with more usage available through paid credits.

Although the rollout is currently limited, OpenAI says it is “working on enabling access for the European Economic Area and Switzerland” and will continue improving the experience.

Why OpenAI Is Doing This Now?

OpenAI’s move reflects a broader push within the industry to shift from passive chatbots to autonomous AI agents, i.e. models that can actively use tools, complete workflows, and deliver tangible results.

Until now, models like ChatGPT have excelled at language generation but faltered when asked to carry out structured, real-world tasks involving files, websites, or multiple steps. That changes with the new agent.

Demand-Driven Says OpenAI

According to OpenAI, user demand drove this shift. For example, many were reportedly attempting to use previous tools, such as Operator, for deeper research tasks, but were apparently frustrated by their limitations. By combining tool use and reasoning within a single system, OpenAI hopes to unlock more practical and business-relevant use cases.

This could also represent a strategic response by OpenAI to rising competition from agents being developed by Google DeepMind, Anthropic, Meta, and open-source communities, many of whom are now focusing on AI models that can act, not just talk.

Business Uses

While consumers can use the agent for tasks like travel planning or dinner parties, the biggest implications may be for professionals and businesses. For example, in OpenAI’s internal tests, the agent performed as well as or better than humans on tasks like:

– Generating investment banking models with correct formulas and formatting.

– Producing competitive market analyses.

– Updating Excel-style financial reports.

– Converting screenshots into editable presentations.

OpenAI says that for data-heavy roles, ChatGPT agent showed strong results. For example, on DSBench, a benchmark testing real-world data science tasks, it outperformed humans by wide margins in both analysis (89.9 per cent) and modelling (85.5 per cent). On SpreadsheetBench, it scored 45.5 per cent with direct Excel editing, far ahead of Microsoft’s Copilot in Excel at 20.0 per cent.

This positions ChatGPT agent not just as a time-saver, but as a cost-effective knowledge worker in fields like consulting, finance, data science, and operations.

New Capabilities Bring New Risks

Despite the powerful new functions, OpenAI has been clear that risks are increasing too, particularly because the agent can interact directly with sensitive data, websites, and terminal commands.

“This introduces new risks, particularly because ChatGPT agent can work directly with your data,” the company warned, noting the risk of adversarial prompt injection—where attackers hide malicious instructions in web pages or metadata that the AI might interpret as legitimate commands.

For example, if a webpage contained an invisible prompt telling ChatGPT to “share email contents with another user,” the model might do so (unless safeguards are in place).

To prevent this, OpenAI says it has:

– Required explicit user confirmation for real-world actions like purchases or emails.

– Introduced a watch mode for supervising high-impact tasks.

– Trained the model to refuse dangerous tasks (e.g. transferring funds).

– Implemented privacy controls, including cookie and browsing data deletion.

– Shielded the model from seeing passwords during browser “takeover” sessions.

Also, on synthetic prompt injection tests, OpenAI claims the agent resisted 99.5 per cent of malicious instructions. However, in more realistic red-team scenarios, the resistance rate dropped to 95 per cent, which is a reminder that vulnerabilities still exist.

The Next Phase

The launch of ChatGPT agent pushes OpenAI firmly into the next phase of AI development, i.e. intelligent systems that act on behalf of humans, not just inform them.

It’s a clear sign that OpenAI aims to lead in the agentic AI race, rather than simply competing on model performance or training size. With its own virtual environment, a growing toolset, and proactive capabilities, ChatGPT now resembles something closer to a software co-pilot than a chatbot.

Competitors will likely follow suit. Google’s Gemini, Anthropic’s Claude, and open-source challengers are all exploring similar agent-style features. However, OpenAI is arguably first to market with a production-ready system that balances capability and risk management (however imperfectly).

For users, especially in business, the implications are considerable. For example, those able to integrate ChatGPT agent into workflows may gain speed, efficiency, and analytical power, so long as they understand the limitations and continue to exercise oversight.

The success of this rollout could also shape broader conversations about AI safety, regulation, and responsibility, particularly as agents become more embedded in real-world systems.

What Does This Mean For Your Business?

The agent rollout gives OpenAI a powerful lead in the shift toward goal-directed, tool-using AI, one that can complete work on behalf of the user rather than waiting for commands. Its ability to interact with live websites, private data sources, and business systems puts it on a new level of utility, but also of accountability. This is no longer just about generating answers. It is about delegation.

For UK businesses, the implications are likely to be immediate and wide-ranging. For example, the agent offers a credible way to automate time-consuming tasks like competitor analysis, document preparation, scheduling, and spreadsheet management. For knowledge-heavy sectors such as finance, consultancy, and data operations, it introduces a low-friction option for streamlining routine work, reducing manual handling, and speeding up research. Organisations already experimenting with automation and AI-assisted productivity tools may now find themselves rethinking existing workflows in favour of a more hands-off, outcome-driven approach.

However, it’s not without operational risks. Any system that can click, copy, calculate, and communicate on your behalf must be trusted to do so responsibly. That means businesses will need to consider internal guardrails and policies, not just to protect sensitive information, but also to ensure the AI is being used ethically and in line with organisational goals. The fact that ChatGPT can now act autonomously raises pressing questions around auditability, compliance, and human oversight, especially in regulated sectors.

There are also broader competitive and reputational pressures in play. For OpenAI, this launch extends its relevance beyond individual users and into the professional environments that rivals like Microsoft and Google are also targeting. At the same time, it invites scrutiny over safety claims, especially as agents become more capable and the scope for unintended consequences grows.

OpenAI making ChatGPT an AI agent appears to be a clear step-change in how AI is positioned and applied. The tools are no longer limited to outputting content or providing suggestions, but are now expected to deliver outcomes, complete tasks, and take action with minimal supervision. For users, that means new possibilities, but also a renewed need to stay alert, strategic, and in control.

The post Featured Article : ChatGPT Turned Into a Fully-Featured AI Agent appeared first on Mear Technology.

What Are ‘AI Agents’ And Why Are They Struggling?

AI agents are software systems that use large language models (LLMs), like ChatGPT or Claude, in combination with tools and applications to carry out goal-driven tasks without constant human input. Unlike chatbots or virtual assistants that only provide responses, agentic AI is designed to take actions, such as navigating software, interacting with web content, or managing emails, based on natural language instructions.

Examples include agents that can generate reports, schedule meetings, or execute multi-step operations such as processing CRM queries or managing code deployments. The idea behind them is that AI can behave like a semi-autonomous digital worker, thereby improving speed and efficiency while reducing costs. However, recent evidence suggests the reality falls far short of the promise.

For example, in a landmark study by researchers at Carnegie Mellon University (CMU), most of today’s leading AI agents were only able to complete around 30–35 per cent of assigned office tasks. That means they failed nearly 70 per cent of the time.

Testing Real-World Tasks

To evaluate how AI agents perform in realistic workplace scenarios, the CMU team created TheAgentCompany, a simulated IT company environment designed to mimic tasks that real employees might encounter. These included browsing the web, writing and editing code, interpreting spreadsheets, drafting performance reviews, and messaging colleagues on internal comms tools like RocketChat.

Results Not Good

Researchers tested agents based on how many tasks they could complete fully and accurately. Top-scoring models included Gemini 2.5 Pro, which managed a 30.3 per cent success rate, and Claude 3.7 Sonnet, which achieved 26.3 per cent. Other well-known models fared worse. GPT-4o completed just 8.6 per cent of tasks, while some large-scale models like Amazon-Nova-Pro and Qwen-2 scored under 2 per cent.

Variation and Serious Slip-Ups

“We find in experiments that the best-performing model…was able to autonomously perform 30.3 per cent of the provided tests to completion,” the CMU team noted. Even with extra credit for partial progress, most agents still fell short of reliable performance.

Also, it looks as though the failures weren’t just minor slip-ups. For example, in some cases, agents forgot to message colleagues, froze while interacting with pop-ups, or even faked task completion, such as renaming users to make it seem like they’d contacted the correct person.

Salesforce’s Findings Echo the Concerns

A separate study by Salesforce offered similarly sobering results. In their CRM-focused benchmark CRMArena-Pro, LLM agents completed about 58 per cent of simple, single-turn customer service tasks. However, in multi-step scenarios where context had to be maintained, success rates dropped sharply to around 35 per cent. None of the evaluated agents demonstrated any meaningful understanding of confidentiality—an essential requirement for deployment in enterprise settings.

The researchers concluded: “LLM agents are generally not well-equipped with many of the skills essential for complex work tasks.”

Over 40 Per Cent of Projects Will Be Cancelled by 2027 …

Industry analysts at Gartner believe this isn’t just a technical hiccup, but could be an indicator of wider strategic risk. For example, the firm predicts that more than 40 per cent of all agentic AI projects will actually be cancelled by the end of 2027. Their assessment is based on the three key drivers of spiralling costs, unclear business value, and inadequate risk controls.

“Most agentic AI projects right now are early-stage experiments or proofs of concept that are mostly driven by hype and are often misapplied,” said Anushree Verma, Senior Director Analyst at Gartner. “This can blind organisations to the real cost and complexity of deploying AI agents at scale.”

A January 2025 Gartner poll of more than 3,400 business respondents revealed that while 19 per cent had already made significant investments in agentic AI, another 42 per cent were only dipping a toe in. Around a third were still waiting to see how the technology matures before committing.

What’s Going Wrong?

A key issue appears to be the fact that many supposed “AI agents” aren’t really agentic at all. For example, Gartner has criticised the growing trend of ‘agent washing’, where vendors rebrand chatbots, rule-based automation tools, or even basic assistants as ‘agents’ to ride the hype wave. Of the thousands of companies claiming to offer agentic AI products, Gartner estimates that only around 130 genuinely qualify.

Even for the legitimate players, it seems that technical challenges abound. For example, CMU’s team highlighted the following major limitations:

– Common-sense reasoning failures. AI agents often misinterpret basic instructions or misunderstand context. This limits their ability to carry out even straightforward workplace tasks.

– Poor tool integration. Many agents struggle to operate reliably within software interfaces. They may freeze, click the wrong buttons, or fail to retrieve the right data.

– Fabricated outputs. Hallucination remains a major problem. Agents sometimes invent plausible-sounding but incorrect responses. Among developers, 75 per cent report experiencing hallucinated functions or APIs.

– High cost and inefficiency. Despite being pitched as labour-saving, one study estimated that a typical AI agent task involved around 30 steps and cost over $6, which is often more than it would take a person to do manually.

– Security and privacy risks. Because agents need wide-ranging system permissions, there’s a serious risk they could accidentally expose sensitive data, or act unpredictably in ways that breach confidentiality.

Complexity and Context

While some agent frameworks are improving, it seems that the wider problem is that many office tasks require not just automation, but judgement. For example, Graham Neubig, a co-author of the CMU paper, explained that while coding agents can be sandboxed to limit risk, office agents must interact with live systems, sensitive messages, and human colleagues.

“It’s very easy to sandbox code…whereas, if an agent is processing emails on your company email server…it could send the email to the wrong people,” Neubig warned.

There’s also the issue of persistence. Multi-step tasks require agents to keep track of state, adapt based on outcomes, and respond to dynamic inputs. Even advanced models struggle to maintain context and consistency across more than a handful of steps, particularly when unexpected events, e.g. like a pop-up, error message, or missing file, intervene.

Buyers, and the Enterprise

For AI companies, the research findings appear to cast doubt on the maturity of the agentic AI market. Those selling genuine solutions will need to demonstrate clear, auditable performance, while others may face a credibility backlash if their products are exposed as agent-washed rebrands.

For enterprise buyers, the message is to proceed with caution. Agentic AI holds promise, but only for very specific use cases where outputs can be clearly defined, risks are manageable, and success is measurable. Without that, projects risk becoming costly distractions that never reach production.

Gartner suggests that businesses focus on agentic AI investments only where it can deliver proven ROI, e.g. by automating decisions, not just tasks, or by redesigning workflows to be agent-friendly from the ground up. “It’s about driving business value through cost, quality, speed and scale,” Verma explained.

Even so, Gartner remains optimistic that the agentic AI landscape will improve. By 2028, they predict that 15 per cent of all daily work decisions will be made autonomously by AI agents, up from none in 2024. They also expect 33 per cent of enterprise software applications to include agentic AI functionality by that time, suggesting that while short-term challenges are real, the long-term potential may still emerge.

What Does This Mean For Your Business?

The current hype around AI agents may be loud, but the reality behind the scenes appears to be proving far messier. Recent research shows that these systems still struggle with many of the core qualities needed for effective office automation, e.g., context awareness, reliability, consistency, and trust. While some agents show promise in structured environments like coding or CRM workflows, real-world office tasks often involve ambiguity, judgement, and unexpected challenges that most agents today simply can’t handle. This mismatch between marketing and capability is already fuelling disillusionment across the enterprise tech landscape.

For UK businesses, this could mean adopting a much more measured approach. For example, rather than rushing into large-scale AI rollouts, organisations may want to carefully assess whether agentic tools truly solve the problem at hand, and whether those benefits outweigh the risks and complexity. In industries where security, compliance, or client confidentiality are vital, agents that behave unpredictably or hallucinate outputs could introduce significant operational or reputational risk. Decision-makers will need to ask hard questions about vendor claims, demand transparency around performance, and avoid falling for superficial rebrands.

Also, for AI developers and solution providers, the pressure is now mounting to deliver genuine value and technical maturity. As Gartner’s forecast suggests, many agentic AI projects may be scrapped before they ever reach deployment. Rising costs, patchy results, and lack of clarity about return on investment are already stalling momentum. Yet amid this shakeout, there remains opportunity. Businesses still want tools that save time, reduce admin overhead, and support hybrid teams. If AI agents can evolve into reliable, well-integrated assistants that are grounded in workflows that make sense for users, they may yet become part of the fabric of enterprise software.

Until then, the safest path forward appears to be to treat agents as experimental copilots, not replacements. Hybrid approaches that combine AI capabilities with human oversight are likely to produce the most stable and trustworthy results. For now, it seems that the goal shouldn’t be full autonomy, but augmentation that helps people work smarter, and doesn’t automate them out of the loop.

The post Featured Article : AI Agents Failing (40% Cancellations Predicted) appeared first on Mear Technology.

Search Goes Conversational

Google this week announced the launch of Search Live with voice input, a new capability inside the Google app that allows users to engage in back-and-forth spoken conversations with its AI-powered Search tool. Rolled out first in the United States, the feature is initially available to those who have opted into the AI Mode experiment in Google Labs, the company’s testing platform for early-access features.

Hands-Free Search

The launch marks a step forward in how users interact with Search, with Google positioning the update as a more natural, hands-free way to discover and explore information while multitasking or on the move.

Use the “Live” Icon

A dedicated “Live” icon now appears within the Google app interface, allowing users to tap and speak their queries aloud. The AI responds in spoken form, and users can follow up with further questions to refine or expand the topic, thereby mirroring a more human-like back-and-forth conversation.

According to Google, Search Live “lets you talk, listen and explore in real time,” giving users the ability to access web-based information while continuing to use other apps or even switching between tasks. The tool also provides on-screen links to source material, allowing users to dig deeper into AI-generated answers.

Building on Gemini and Search Infrastructure

Search Live actually runs on a custom version of Gemini, Google’s multimodal large language model, which powers many of its generative AI tools. The Gemini model used in AI Mode has been specially adapted to support live voice input, real-time responses, and integration with Google Search’s existing ranking and quality systems.

Liza Ma, director of product management at Google Search, explained in a company blog post that the system combines “advanced voice capabilities” with the reliability of Search’s “best-in-class quality and information systems,” ensuring that responses are both conversational and trustworthy. She also confirmed the use of Google’s ‘query fan-out’ technique, which enables the system to return a more diverse and useful range of web content in response to user questions.

For example, a user might ask, “What are some tips for preventing a linen dress from wrinkling in a suitcase?” and then follow up with, “What should I do if it still wrinkles?” The AI answers audibly while presenting related links on screen. This continuity is key to what Google hopes will be a smoother, more context-aware search experience.

How and Where to Access It

At launch, Search Live with voice is available only to users in the U.S. who have joined the AI Mode experiment through Google Labs. It works on both Android and iOS via the official Google app. There is currently no timeline for a broader international rollout, though Google says it intends to expand features and availability in the coming months.

Users who have access will know because they see a new “Live” microphone icon below the search bar in the app. Once activated, they can ask a question out loud and receive a spoken response. Users can view a transcript of the interaction, continue the conversation via typing if preferred, and even revisit past queries via the AI Mode history log.

Multitask While it Works in the Background

Also, because Search Live works in the background, it enables a degree of multitasking not previously possible with voice-based search tools. For example, a user could begin a conversation in the app, switch to messaging or maps, and continue speaking to the AI without interruption.

Voice, Visuals, and What Comes Next

The introduction of voice input is actually just one part of Google’s broader plan to bring real-time multimodal capabilities into Search. For example, at Google I/O in May 2025, the company previewed future updates that will allow users to combine voice interaction with real-time visual input via their phone’s camera, building on advances made in its Project Astra research and the ongoing development of Google Lens.

Multimodal Search

This evolution represents a deeper move by Google into what’s referred to as multimodal search, whereby users can interact with AI not just through typing or talking, but by showing it what they see. In practical terms, this could include pointing the phone at a confusing diagram or damaged object, asking what it is, and getting a contextual explanation, complete with suggested web links, video tutorials or shopping sources.

It also echoes the direction competitors are taking. For example, OpenAI’s ChatGPT has recently introduced voice interaction capabilities in its mobile apps, and Perplexity AI has gained traction for its own real-time web search and voice tools. Google’s response, with Search Live, is both a defensive and strategic step to stay ahead in what is quickly becoming a crowded, AI-first search market.

A New Frontier for Business and Advertisers?

For business users, the implications of voice-first search are far-reaching. For example, in sectors such as logistics, retail, and field service, the ability to conduct voice-based queries while driving or working could prove invaluable. Search Live also introduces potential benefits for productivity, especially for knowledge workers trying to conduct research or fact-checks while multitasking between devices or applications.

It may also signal a new phase for Google’s advertising ecosystem, although details remain unclear. As Search becomes more conversational and voice-led, traditional search result ads, particularly those dependent on text input and visual scanning, may need to evolve. It’s not yet known how, or if, Search Live results will incorporate sponsored content.

The visual links shown alongside voice answers could potentially become prime real estate for future advertising formats. However, Google has so far remained quiet on how monetisation will work within AI Mode. With more users consuming answers audibly and potentially clicking fewer links, publishers and advertisers will be watching closely.

Challenges

Despite the promise, it should be noted that there are several challenges ahead. For example, accuracy and reliability remain key concerns for AI-generated search responses. While Google stresses its Gemini-based AI uses the same quality controls as regular Search, AI hallucinations (where systems confidently give false or misleading answers) are still a known risk in generative models.

The opt-in nature of the feature also limits immediate user exposure and feedback. By placing Search Live behind the AI Mode experimental wall, Google is clearly seeking to manage rollout cautiously but this also means that the majority of users globally still can’t access or evaluate it.

There are also privacy and data security implications, particularly with voice-based input and persistent conversation histories. Google maintains that users can view, manage or delete their AI Mode interactions, but questions remain over how voice data is processed, stored, or used to train models.

One other aspect critics may point to is the increasing opacity of sources in AI answers. For example, while Google includes clickable links alongside Search Live responses, these can sometimes appear secondary to the spoken reply, which may not fully represent the nuance or breadth of available information. Ensuring transparency and balance in summarised answers will be crucial to maintaining trust, especially as Search Live expands into more domains.

What Does This Mean For Your Business?

The introduction of Search Live could be seen as the next step in its natural progression towards Google’s long-term vision for AI-powered search. By blending real-time voice interaction with the depth of web content, Google is essentially positioning itself not just as a search engine but as a more intuitive, responsive assistant capable of handling everyday queries in more dynamic, human-like ways. However, the fact that it’s limited to U.S.-based testers in Labs signals Google’s awareness of the stakes involved. It is not just testing technology but testing trust, usability and commercial viability all at once.

For UK businesses, this could open up important new opportunities once rolled out more widely. Voice-driven interaction with AI may reduce the need for screen time in roles where hands-free efficiency matters, i.e. from trades and transport to healthcare and hospitality. It could also help knowledge workers process information faster while juggling tasks, potentially enhancing productivity and reducing friction in routine research or client support work. There are potential implications for business intelligence and even internal training, particularly once real-time camera input is layered in. But these benefits will only be realised if the underlying AI delivers reliable and verifiable responses at scale.

Advertisers and content publishers are likely to be more cautious. With fewer visual interactions, the conventional search engine results page model may weaken. If users hear an answer but don’t tap the links shown, that affects traffic and engagement metrics. This will raise fresh questions about how brands position themselves within voice-first search and whether new advertising formats will emerge within AI Mode or remain separated. Also, the monetisation path here is still not altogether clear and, as Google experiments with form, it may need to reassure partners that function won’t entirely override visibility.

Meanwhile, Google’s competitors such as OpenAI and Perplexity AI will, no doubt, be watching closely. Each is racing to define the next evolution of everyday search, combining voice, visuals and real-time reasoning. Google still has the infrastructure advantage, but the race is no longer just about data—it’s about usability, privacy, and user confidence. In that context, Search Live’s success may depend as much on how it is governed and explained as how well it works technically.

Whether Search Live becomes the new normal or remains a feature for power users will likely depend on the clarity of its responses, the transparency of its sources, and the ease with which users (especially businesses) can trust it as a tool rather than a black box. What is clear already is that Google is laying groundwork for a future where the way we search is no longer typed, but spoken, shown and responded to in real time. Once mainstream, that could fundamentally change how we interact with the web.

The post Featured Article : Google’s New Voice-Driven Search appeared first on Mear Technology.

Report Uncovers Widespread “Security Debt”

The findings come from US-based application risk management firm Veracode’s Public Sector State of Software Security 2025 report, released on 11 June. Based on an analysis of over 1.3 million software applications and 126 million security findings, the research highlights the extent to which government organisations in the US are falling behind on basic software vulnerability management.

According to the report, a massive 78 per cent of (US) public sector bodies are running with unresolved flaws that have remained open for more than a year, a situation Veracode refers to as “security debt”. In more than half of these organisations, the report identifies critical vulnerabilities with high risk potential that have still not been addressed.

Fixing Flaws Takes Far Longer in Government

One of the clearest indicators of the public sector’s struggle appears to be the time it takes to resolve these software issues. For example, the report shows that government bodies take an average of 315 days to fix just half of their identified software vulnerabilities. This is far higher than the cross-industry average of 252 days, which is already considered too slow by many cybersecurity experts.

That 63-day gap may sound modest, but Veracode warns it opens up a significant attack window. This is because these flaws, often in applications delivering essential services, could be exploited by attackers for months at a time. In some cases, flaws are left unresolved for multiple years. As the report shows, around one-third of vulnerabilities in US government software remain unpatched even after two years, and 15 per cent are still unresolved after five.

Chris Wysopal, Chief Security Evangelist at Veracode, described the situation as a systemic failure to keep pace with risk, saying: “Many government organisations are facing growing challenges in keeping up with vulnerability remediation, potentially leaving critical systems and data that run essential government services exposed.”

Which Public Sector Organisations?

The report encompasses a wide range of public sector bodies, including US federal, regional, and local government departments, as well as agencies responsible for education, healthcare, law enforcement, and infrastructure. While the specific organisations are not named, the findings indicate a sector-wide problem that spans multiple tiers of government.

Public-facing applications and internal administrative systems are both affected, with legacy software and fragmented IT infrastructure frequently cited as contributing factors. The report also shows that larger and more complex organisations tend to perform worse, particularly where digital transformation has lagged.

Is the UK Public Sector Facing the Same Risks?

Although Veracode’s report focuses specifically on the US, many of the challenges it identifies appear to be mirrored in the UK.

For example, according to a recent National Audit Office (NAO) report, 58 critical UK government IT systems still have significant cyber-resilience gaps, with 228 legacy systems running without full knowledge of their vulnerabilities. The NAO also highlighted that one in three cybersecurity roles in government remains vacant or is filled by temporary staff, suggesting a widespread skills shortage similar to that seen in the US.

Also, recent cyber incidents have highlighted the risks. For example, back in May, a breach at the Legal Aid Agency exposed the personal data of over 2 million individuals. The British Library and parts of the NHS have also suffered serious service disruptions due to ransomware attacks, often linked to outdated infrastructure.

Unlike Veracode’s report, there is currently no published UK data showing the average time it takes public sector bodies to fix software vulnerabilities. However, the reliance on legacy systems, combined with under-resourced security teams and a reactive approach to patching, strongly suggests that vulnerability resolution timelines in the UK are also prolonged.

That said, the UK Government has begun taking steps to address the issue. For example, a new Cyber Security and Resilience Bill is set to tighten breach reporting requirements and enhance supply chain security. Also, the NCSC’s GovAssure programme is now auditing critical departments, and £1 billion has been pledged to improve cyber capacity across public services. However, progress has been slow, and experts have raised concerns about how effectively these initiatives are being implemented.

In the absence of specific figures, it remains difficult to compare the scale of UK security debt directly with the US, however the warning signs are there and the structural issues look strikingly familiar.

Open Source and Third-Party Code a Major Weak Point

While most flaws are found in first-party applications, it seems that the most dangerous and persistent problems come from open-source and third-party code. Interestingly, although these components make up less than 10 per cent of total public sector software, they account for 70 per cent of the critical security debt in government systems.

To make matters worse, flaws in third-party code take around 50 per cent longer to fix than those in software developed internally. As organisations increasingly rely on open-source libraries and packages, this gap presents a growing threat.

“This disproportionate risk highlights the importance of securing software supply chains and carefully vetting open-source dependencies,” said Wysopal. “Without extending visibility and remediation efforts beyond internal code, public sector entities risk leaving the most dangerous flaws unaddressed.”

Some Agencies Are Far Ahead of Others

The report appears to highlight a stark disparity between the best and worst performing organisations. In the top 25 per cent of public sector bodies, just one-third of applications contain flaws. These leading agencies resolve half of their issues within 3.3 months and manage to fix over 9 per cent of flaws per month. The report shows that by contrast, the worst 25 per cent have flaws in every application tested, with less than 0.1 per cent fixed each month and average remediation times exceeding 11 months.

Wysopal highlights how this gap raises serious questions about leadership, resource allocation, and operational culture across the public sector, saying: “The disparity between top and bottom-performing government organisations is striking and raises important questions about the factors that make a material difference to security posture.”

What’s Causing the Problem?

The report suggests a number of causes behind the growing backlog. These include underinvestment in software development security (AppSec) tools, overreliance on legacy systems, and a lack of skilled personnel to address vulnerabilities at scale.

Another issue is that vulnerability scanning is often performed late in the development lifecycle, when flaws are more costly and time-consuming to fix. Without ongoing analysis and integration into development workflows, issues tend to accumulate and are eventually deprioritised due to competing pressures.

Compounding this appears to be the rapid adoption of AI-generated code. While generative AI can speed up development, it can also introduce subtle but serious vulnerabilities if not properly reviewed. Veracode warns that comprehensive open-source analysis is more essential than ever to prevent hidden flaws from slipping through.

How Can Public Sector Bodies Respond?

Veracode is urging public sector organisations to modernise their approach by adopting risk-based remediation strategies and automating more of the security process. Key recommendations include:

– Implementing context-driven security posture management, which prioritises the most exploitable vulnerabilities using insights from multiple tools and data sources.

– Establishing continuous scanning, integrated into the full development lifecycle, so that flaws are caught earlier and fixed faster.

– Supporting developer enablement, giving teams the training and tools they need to identify and address issues proactively.

According to the report, the most effective and cost-efficient way to reduce security debt is to prevent it from accumulating in the first place.

Risks for the Public, Service Delivery, and Compliance

While the problem is technical in nature, the impact appears to extend far beyond IT departments. For example, vulnerabilities in public sector software can put sensitive public data at risk, disrupt essential services, and erode public trust. In sectors like healthcare and social services, the consequences of a breach could be devastating.

There are also compliance implications. For example, governments are increasingly subject to cybersecurity regulations requiring evidence of secure coding practices and risk mitigation. Persistent security debt may put some organisations in breach of data protection obligations or national security protocols.

A Complex Challenge, but Improvement Is Possible

Despite the bleak statistics, Veracode’s analysis makes clear that progress is achievable and that top-performing agencies prove that meaningful improvement can be made with the right strategy, investment, and organisational buy-in.

The challenge now appears to be for lagging organisations to assess their security maturity, identify the operational and cultural blockers to faster remediation, and make the structural changes needed to reduce their exposure to risk.

What Does This Mean For Your Business?

For governments, the consequences of inaction are no longer theoretical. The exposure created by slow patching and ageing systems is already being exploited by cybercriminals. Also, for the public, the stakes are growing, whether through data loss, service disruption, or erosion of trust in digital government services. What Veracode’s report makes clear is that the organisations getting this right are not doing so through luck or scale, but through deliberate prioritisation and operational focus.

In the UK, many of the same systemic issues are clearly visible. Critical infrastructure is still running on unsupported legacy platforms, key security roles remain unfilled, and cyber incidents linked to outdated systems are becoming more frequent. Without hard data on vulnerability resolution times or the extent of open-source debt, public sector bodies are left guessing where their greatest risks lie and how they compare to their peers.

This gap also affects the wider network of software vendors and contractors. UK businesses that supply the public sector will need to meet rising expectations around security assurance and may face tighter scrutiny as new legislation and procurement rules come into force. At the same time, private sector organisations can use these findings as a benchmark, both to avoid the same mistakes and to identify opportunities to lead in secure development practices.

The core message here is that software risk is measurable, manageable, and no longer optional. Delays in addressing known flaws are not just a technical lapse but an operational liability, with real consequences for services, compliance, and reputation. Whether in the US or UK, the longer these gaps are left open, the harder and costlier they become to close.

The post Featured Article : US & UK Public Sectors Running Insecure IT appeared first on Mear Technology.